devchain-cli 0.23.4 → 0.24.0

package/dist/server/modules/remotes/host/provider-baseline.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-baseline.service.js","sourceRoot":"","sources":["../../../../src/modules/remotes/host/provider-baseline.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AA2BA,4CASC;AASD,sCAoBC;AAjED,2CAAyE;AACzE,0CAA8C;AAC9C,qCAAkC;AAClC,yCAA0C;AAC1C,gFAGkD;AAClD,2DAA8D;AAC9D,sEAAmG;AACnG,+DAA0D;AAE1D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,yBAAyB,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC5D,CAAC;AAKD,SAAgB,gBAAgB,CAC9B,OAAgC,EAChC,QAAwB;IAExB,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CACtD,cAAc,CAAC,MAAM,CAAC;QACpB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAC5B,CAAC;AACJ,CAAC;AASD,SAAgB,aAAa,CAC3B,OAAgC,EAChC,QAAwB,EACxB,IAAI,GAAG,EAAE;IAET,MAAM,KAAK,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAA7B,YAA6B,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;IAAG,CAAC;IAE9D,KAAK,CAAC,sBAAsB;QAC1B,IAAI,aAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,6DAA6D,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAsB,EAAC,wCAAoB,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EACpD,4CAA4C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAEvF,IAAI,OAAO,GAAmC,IAAI,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,YAAY,EAAE,EACtB,yDAAyD,CAC1D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,YAAY,EAAE,EACtB,0DAA0D,CAC3D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,4CAAwB,CAAC;YAAE,OAAO;QAE3E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EAAE,4CAAwB,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACvC,mBAAmB,MAAM,CAAC,GAAG,sCAAsC,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAA,qCAAqB,EACzB,YAAY,EACZ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC5C,kBAAkB,CACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7EY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAE8B,uCAAiB;GAD/C,uBAAuB,CA6EnC"}

package/dist/server/modules/remotes/host-api-key.d.ts

@@ -0,0 +1,7 @@
+export declare const HOST_API_KEY_REJECTED = "HOST_API_KEY_REJECTED";
+export declare const HOST_API_KEY_REJECTED_MESSAGE = "The VM rejected this PC's API key. Use Enter API key in Remote VMs.";
+export declare const HOST_API_KEY_PATTERN: RegExp;
+export declare function generateHostApiKey(): string;
+export declare function hashHostApiKey(key: string): string;
+export declare function isHostApiKeyRejection(response: Pick<Response, 'status' | 'json'>): Promise<boolean>;
+export declare function isClaimedHost(etcDir: string): boolean;

package/dist/server/modules/remotes/host-api-key.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOST_API_KEY_PATTERN = exports.HOST_API_KEY_REJECTED_MESSAGE = exports.HOST_API_KEY_REJECTED = void 0;
+exports.generateHostApiKey = generateHostApiKey;
+exports.hashHostApiKey = hashHostApiKey;
+exports.isHostApiKeyRejection = isHostApiKeyRejection;
+exports.isClaimedHost = isClaimedHost;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.HOST_API_KEY_REJECTED = 'HOST_API_KEY_REJECTED';
+exports.HOST_API_KEY_REJECTED_MESSAGE = "The VM rejected this PC's API key. Use Enter API key in Remote VMs.";
+exports.HOST_API_KEY_PATTERN = /^dck_[A-Za-z0-9_-]{43}$/;
+function generateHostApiKey() {
+    return `dck_${(0, node_crypto_1.randomBytes)(32).toString('base64url')}`;
+}
+function hashHostApiKey(key) {
+    return (0, node_crypto_1.createHash)('sha256').update(key).digest('hex');
+}
+async function isHostApiKeyRejection(response) {
+    if (response.status !== 401)
+        return false;
+    const body = await response.json().catch(() => null);
+    return (typeof body === 'object' &&
+        body !== null &&
+        'code' in body &&
+        body.code === exports.HOST_API_KEY_REJECTED);
+}
+function isClaimedHost(etcDir) {
+    try {
+        (0, node_fs_1.statSync)((0, node_path_1.join)(etcDir, 'claim.json'));
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ENOENT';
+    }
+}
+//# sourceMappingURL=host-api-key.js.map

package/dist/server/modules/remotes/host-api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-api-key.js","sourceRoot":"","sources":["../../../src/modules/remotes/host-api-key.ts"],"names":[],"mappings":";;;AAcA,gDAEC;AAGD,wCAEC;AAGD,sDAWC;AAOD,sCAOC;AAjDD,6CAAsD;AACtD,qCAAmC;AACnC,yCAAiC;AAGpB,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,6BAA6B,GACxC,qEAAqE,CAAC;AAG3D,QAAA,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,SAAgB,kBAAkB;IAChC,OAAO,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxD,CAAC;AAGD,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,QAA2C;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,MAAM,IAAI,IAAI;QACd,IAAI,CAAC,IAAI,KAAK,6BAAqB,CACpC,CAAC;AACJ,CAAC;AAOD,SAAgB,aAAa,CAAC,MAAc;IAC1C,IAAI,CAAC;QACH,IAAA,kBAAQ,EAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/server/modules/remotes/host-image.d.ts

@@ -0,0 +1,3 @@
+export declare const MIN_HOST_IMAGE_VERSION = "1.3.0";
+export declare function isSupportedHostImage(imageVersion: string | null | undefined): boolean;
+export declare function unsupportedHostImageMessage(imageVersion: string | null): string;

package/dist/server/modules/remotes/host-image.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_HOST_IMAGE_VERSION = void 0;
+exports.isSupportedHostImage = isSupportedHostImage;
+exports.unsupportedHostImageMessage = unsupportedHostImageMessage;
+const semver = __importStar(require("semver"));
+exports.MIN_HOST_IMAGE_VERSION = '1.3.0';
+function isSupportedHostImage(imageVersion) {
+    return (Boolean(imageVersion) &&
+        semver.valid(imageVersion) !== null &&
+        semver.gte(imageVersion, `${exports.MIN_HOST_IMAGE_VERSION}-0`));
+}
+function unsupportedHostImageMessage(imageVersion) {
+    return `Host image ${imageVersion ?? 'unknown'} is not supported; ${exports.MIN_HOST_IMAGE_VERSION} or later is needed.`;
+}
+//# sourceMappingURL=host-image.js.map

package/dist/server/modules/remotes/host-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-image.js","sourceRoot":"","sources":["../../../src/modules/remotes/host-image.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,oDAMC;AAGD,kEAEC;AApBD,+CAAiC;AAGpB,QAAA,sBAAsB,GAAG,OAAO,CAAC;AAM9C,SAAgB,oBAAoB,CAAC,YAAuC;IAC1E,OAAO,CACL,OAAO,CAAC,YAAY,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI;QACnC,MAAM,CAAC,GAAG,CAAC,YAAa,EAAE,GAAG,8BAAsB,IAAI,CAAC,CACzD,CAAC;AACJ,CAAC;AAGD,SAAgB,2BAA2B,CAAC,YAA2B;IACrE,OAAO,cAAc,YAAY,IAAI,SAAS,sBAAsB,8BAAsB,sBAAsB,CAAC;AACnH,CAAC"}

package/dist/server/modules/remotes/host-install/host-install-block.d.ts

@@ -0,0 +1,31 @@
+export declare const HOST_INSTALL_BOOTSTRAP_PORT = 3000;
+export declare const HOST_CERTIFICATE_PATH = "/etc/devchain-host/tls/cert.pem";
+export declare const HOST_CERTIFICATE_FINGERPRINT_COMMAND = "openssl x509 -in /etc/devchain-host/tls/cert.pem -noout -fingerprint -sha256";
+export declare const HOST_INSTALL_MIN_MEMORY_MIB = 3584;
+export interface HostInstallPins {
+    nodeVersion: string;
+    syncthingVersion: string;
+    npmRegistry: string;
+    bootstrap: {
+        package: string;
+        version: string;
+        sha256: string;
+    };
+    aptPackages: string[];
+}
+export interface HostInstallBlockOptions {
+    pins: HostInstallPins;
+    bootstrapTgzBase64: string;
+    bootstrapUnit: string;
+    sysctlConfig: string;
+    aptPreference: string;
+    minDiskGib: number;
+    homePort: number;
+    imageVersion: string;
+    homeUser: string;
+    homePath: string;
+    devchainVersion: string;
+    checkOnly?: boolean;
+}
+export declare function baseHostInstallAptPackages(pins: HostInstallPins): string[];
+export declare function generateHostInstallBlock(options: HostInstallBlockOptions): string;

package/dist/server/modules/remotes/host-install/host-install-block.js

@@ -0,0 +1,464 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOST_INSTALL_MIN_MEMORY_MIB = exports.HOST_CERTIFICATE_FINGERPRINT_COMMAND = exports.HOST_CERTIFICATE_PATH = exports.HOST_INSTALL_BOOTSTRAP_PORT = void 0;
+exports.baseHostInstallAptPackages = baseHostInstallAptPackages;
+exports.generateHostInstallBlock = generateHostInstallBlock;
+exports.HOST_INSTALL_BOOTSTRAP_PORT = 3000;
+exports.HOST_CERTIFICATE_PATH = '/etc/devchain-host/tls/cert.pem';
+exports.HOST_CERTIFICATE_FINGERPRINT_COMMAND = `openssl x509 -in ${exports.HOST_CERTIFICATE_PATH} -noout -fingerprint -sha256`;
+exports.HOST_INSTALL_MIN_MEMORY_MIB = 3584;
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function assertNonEmpty(name, value) {
+    if (!value || value.includes('\0'))
+        throw new Error(`${name} must be a non-empty string`);
+}
+function baseHostInstallAptPackages(pins) {
+    return pins.aptPackages.filter((name) => name !== 'qemu-guest-agent');
+}
+function generateHostInstallBlock(options) {
+    const { pins } = options;
+    for (const [name, value] of [
+        ['nodeVersion', pins.nodeVersion],
+        ['syncthingVersion', pins.syncthingVersion],
+        ['npmRegistry', pins.npmRegistry],
+        ['bootstrap.package', pins.bootstrap.package],
+        ['bootstrap.version', pins.bootstrap.version],
+        ['bootstrapTgzBase64', options.bootstrapTgzBase64],
+        ['bootstrapUnit', options.bootstrapUnit],
+        ['sysctlConfig', options.sysctlConfig],
+        ['aptPreference', options.aptPreference],
+        ['imageVersion', options.imageVersion],
+        ['homeUser', options.homeUser],
+        ['homePath', options.homePath],
+        ['devchainVersion', options.devchainVersion],
+    ]) {
+        assertNonEmpty(name, value);
+    }
+    if (!/^[a-f0-9]{64}$/.test(pins.bootstrap.sha256)) {
+        throw new Error('bootstrap.sha256 must be a lowercase SHA-256 digest');
+    }
+    if (!Number.isSafeInteger(options.minDiskGib) || options.minDiskGib < 1) {
+        throw new Error('minDiskGib must be a positive integer');
+    }
+    if (!Number.isSafeInteger(options.homePort) || options.homePort < 1 || options.homePort > 65535) {
+        throw new Error('homePort must be an integer between 1 and 65535');
+    }
+    const aptPackages = baseHostInstallAptPackages(pins);
+    if (aptPackages.length === 0 ||
+        aptPackages.some((name) => !/^[a-z0-9][a-z0-9+.-]*$/.test(name))) {
+        throw new Error('aptPackages must contain valid Debian package names');
+    }
+    const quotedAptPackages = aptPackages.map(shellQuote).join(' ');
+    const invocation = options.checkOnly ? 'devchain_host_install --check' : 'devchain_host_install';
+    return `# DevChain host installer. Run only on a dedicated LAN or VPN VM.
+DEVCHAIN_NODE_VERSION=${shellQuote(pins.nodeVersion)}
+DEVCHAIN_SYNCTHING_VERSION=${shellQuote(pins.syncthingVersion)}
+DEVCHAIN_NPM_REGISTRY=${shellQuote(pins.npmRegistry)}
+DEVCHAIN_BOOTSTRAP_PACKAGE=${shellQuote(pins.bootstrap.package)}
+DEVCHAIN_BOOTSTRAP_VERSION=${shellQuote(pins.bootstrap.version)}
+DEVCHAIN_BOOTSTRAP_SHA256=${shellQuote(pins.bootstrap.sha256)}
+DEVCHAIN_BOOTSTRAP_TGZ_BASE64=${shellQuote(options.bootstrapTgzBase64)}
+DEVCHAIN_BOOTSTRAP_UNIT=${shellQuote(options.bootstrapUnit)}
+DEVCHAIN_SYSCTL_CONFIG=${shellQuote(options.sysctlConfig)}
+DEVCHAIN_APT_PREFERENCE=${shellQuote(options.aptPreference)}
+DEVCHAIN_MIN_DISK_GIB=${options.minDiskGib}
+DEVCHAIN_HOME_PORT=${options.homePort}
+DEVCHAIN_IMAGE_VERSION=${shellQuote(options.imageVersion)}
+DEVCHAIN_HOME_USER=${shellQuote(options.homeUser)}
+DEVCHAIN_HOME_PATH=${shellQuote(options.homePath)}
+DEVCHAIN_VERSION=${shellQuote(options.devchainVersion)}
+DEVCHAIN_BOOTSTRAP_PORT=${exports.HOST_INSTALL_BOOTSTRAP_PORT}
+DEVCHAIN_CERT_PATH=${shellQuote(exports.HOST_CERTIFICATE_PATH)}
+DEVCHAIN_FINGERPRINT_COMMAND=${shellQuote(exports.HOST_CERTIFICATE_FINGERPRINT_COMMAND)}
+DEVCHAIN_BASE_APT_PACKAGES=(${quotedAptPackages})
+
+devchain_host_install() {
+  (
+  set -Eeuo pipefail
+  local root="\${DEVCHAIN_HOST_INSTALL_ROOT:-}" check=0 arg
+  root="\${root%/}"
+  if [[ -n "$root" ]]; then
+    export PATH="\${DEVCHAIN_HOST_INSTALL_PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}"
+  else
+    export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  fi
+  export HOME="\${HOME:-/root}"
+  for arg in "$@"; do
+    case "$arg" in
+      --check) check=1 ;;
+      *) printf 'Usage: devchain_host_install [--check]\\n' >&2; return 2 ;;
+    esac
+  done
+
+  devchain_path() { printf '%s%s' "$root" "$1"; }
+  local failures=0
+  devchain_fail() { printf 'ERROR: %s\\n' "$*" >&2; failures=$((failures + 1)); return 0; }
+  devchain_warn() { printf 'WARNING: %s\\n' "$*" >&2; }
+
+  local effective_uid="$EUID"
+  if [[ -n "$root" && -n "\${DEVCHAIN_HOST_INSTALL_EUID:-}" ]]; then
+    effective_uid="$DEVCHAIN_HOST_INSTALL_EUID"
+  fi
+  if [[ "$effective_uid" -ne 0 ]]; then
+    devchain_fail 'This installer must run as root; run with sudo.'
+  fi
+
+  local pid1=''
+  if [[ -r "$(devchain_path /proc/1/comm)" ]]; then
+    pid1="$(tr -d '\\n' < "$(devchain_path /proc/1/comm)")"
+  fi
+  if [[ "$pid1" != systemd ]]; then
+    devchain_fail 'systemd must be PID 1.'
+  fi
+
+  local os_file id='' version_id='' major=0 minor=0
+  os_file="$(devchain_path /etc/os-release)"
+  if [[ -r "$os_file" ]]; then
+    id="$(grep -m1 '^ID=' "$os_file" 2>/dev/null | sed 's/^ID=//;s/^"//;s/"$//' || true)"
+    version_id="$(grep -m1 '^VERSION_ID=' "$os_file" 2>/dev/null | sed 's/^VERSION_ID=//;s/^"//;s/"$//' || true)"
+  fi
+  if [[ "$version_id" =~ ^([0-9]+)(\\.([0-9]+))? ]]; then
+    major=$((10#\${BASH_REMATCH[1]}))
+    if [[ -n "\${BASH_REMATCH[3]:-}" ]]; then minor=$((10#\${BASH_REMATCH[3]})); fi
+  fi
+  if [[ "$id" == ubuntu ]]; then
+    if (( major < 22 || (major == 22 && minor < 4) )); then
+      devchain_fail 'Ubuntu 22.04 or newer is required.'
+    fi
+    if (( major % 2 != 0 || minor != 4 )); then
+      devchain_warn "Ubuntu $version_id is not an LTS release; an even-year YY.04 release is recommended."
+    fi
+  elif [[ "$id" == debian ]]; then
+    if (( major < 12 )); then devchain_fail 'Debian 12 or newer is required.'; fi
+  else
+    devchain_fail 'Only Ubuntu 22.04 or newer and Debian 12 or newer are supported.'
+  fi
+
+  if command -v dpkg >/dev/null 2>&1; then
+    local architecture
+    architecture="$(dpkg --print-architecture 2>/dev/null || true)"
+    if [[ "$architecture" != amd64 ]]; then devchain_fail 'The VM architecture must be amd64.'; fi
+  fi
+
+  # measured against the pinned CLI binaries
+  local required_cpu_flags='cx16 pni ssse3 sse4_1 sse4_2 popcnt pclmulqdq'
+  local cpu_file cpu_flags='' missing_flags='' flag processors=0
+  cpu_file="$(devchain_path /proc/cpuinfo)"
+  if [[ -r "$cpu_file" ]]; then
+    cpu_flags="$(awk '/^flags[[:space:]]*:/ { $1=""; $2=""; print; exit }' "$cpu_file")"
+    processors="$(awk '/^processor[[:space:]]*:/ { n++ } END { print n+0 }' "$cpu_file")"
+  fi
+  for flag in $required_cpu_flags; do
+    if [[ " $cpu_flags " != *" $flag "* ]]; then missing_flags+=" $flag"; fi
+  done
+  if [[ -n "$missing_flags" ]]; then
+    devchain_fail "The VM CPU lacks \${missing_flags# }. Claude Code, OpenCode and Antigravity need them. Set the VM CPU type to host (or a CPU model with these flags) in the hypervisor, then shut down and start the VM."
+  fi
+  if (( processors < 2 )); then
+    devchain_warn "The VM has $processors vCPU. 2 or more are recommended for agent sessions."
+  fi
+
+  if [[ -e "$(devchain_path /etc/devchain-host/claim.json)" ]]; then
+    devchain_fail 'This VM is already a claimed DevChain host.'
+  fi
+  local manifest_path
+  manifest_path="$(devchain_path /usr/share/devchain-host/manifest.json)"
+  if [[ -e "$manifest_path" ]] && ! grep -Eq '"install"[[:space:]]*:' "$manifest_path"; then
+    devchain_fail 'This VM was created from a DevChain host image; use a fresh VM.'
+  fi
+
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-enabled --quiet display-manager.service 2>/dev/null; then
+    devchain_fail 'A display manager is enabled; use a dedicated headless VM.'
+  fi
+  if command -v dpkg-query >/dev/null 2>&1; then
+    local desktop_packages
+    desktop_packages="$({ dpkg-query -W -f='\${Package} \${db:Status-Status}\\n' ubuntu-desktop gnome-shell 2>/dev/null || true; } | awk '$2 == "installed" { print $1 }')"
+    if [[ -n "$desktop_packages" ]]; then
+      devchain_fail "Desktop packages are installed ($desktop_packages); use a dedicated headless VM."
+    fi
+  fi
+
+  local mem_kib=0
+  if [[ -r "$(devchain_path /proc/meminfo)" ]]; then
+    mem_kib="$(awk '$1 == "MemTotal:" { print $2 }' "$(devchain_path /proc/meminfo)")"
+  fi
+  if [[ ! "$mem_kib" =~ ^[0-9]+$ ]] || (( mem_kib < ${exports.HOST_INSTALL_MIN_MEMORY_MIB} * 1024 )); then
+    [[ "$mem_kib" =~ ^[0-9]+$ ]] || mem_kib=0
+    devchain_fail "At least 3584 MiB of memory is required; found $((mem_kib / 1024)) MiB."
+  fi
+
+  local free_kib=0
+  free_kib="$(df -Pk "$(devchain_path /)" 2>/dev/null | awk 'NR == 2 { print $4 }' || true)"
+  if [[ ! "$free_kib" =~ ^[0-9]+$ ]] || (( free_kib < DEVCHAIN_MIN_DISK_GIB * 1024 * 1024 )); then
+    [[ "$free_kib" =~ ^[0-9]+$ ]] || free_kib=0
+    local disk_error root_source lv_path='' vg_name='' vg_free='' vg_number=''
+    disk_error="At least $DEVCHAIN_MIN_DISK_GIB GiB of free space is required on /; found $((free_kib / 1024 / 1024)) GiB free."
+    root_source="$(findmnt -no SOURCE / 2>/dev/null || true)"
+    if [[ -n "$root_source" ]]; then
+      read -r lv_path vg_name vg_free <<< "$(lvs --noheadings --nosuffix --units g -o lv_path,vg_name,vg_free "$root_source" 2>/dev/null || true)" || true
+      vg_number="\${vg_free#<}"
+      if [[ -n "$lv_path" && -n "$vg_name" && "$vg_number" =~ ^[0-9]+(\\.[0-9]+)?$ ]] &&
+          awk -v free="$vg_number" -v bound="\${vg_free:0:1}" 'BEGIN { exit !(free > 1 || (free == 1 && bound != "<")) }'; then
+        disk_error+=" Volume group $vg_name has $vg_free GiB unused. Run: sudo lvextend -r -l +100%FREE $lv_path"
+      fi
+    fi
+    devchain_fail "$disk_error"
+  fi
+
+  local listeners=''
+  if command -v ss >/dev/null 2>&1; then listeners="$(ss -ltnH 2>/dev/null || true)"; fi
+  local port
+  for port in "$DEVCHAIN_BOOTSTRAP_PORT" "$DEVCHAIN_HOME_PORT"; do
+    if awk -v wanted="$port" '{ address=$4; sub(/^.*:/, "", address); if (address == wanted) found=1 } END { print found ? "busy" : "free" }' <<< "$listeners" | grep -q '^busy$'; then
+      # our own unclaimed bootstrap holds the port after a failed claim or a cancelled install
+      if [[ "$port" == "$DEVCHAIN_BOOTSTRAP_PORT" && ! -e "$(devchain_path /etc/devchain-host/claim.json)" ]] &&
+          [[ -e "$manifest_path" ]] && grep -Eq '"install"[[:space:]]*:' "$manifest_path"; then
+        # an installer from before TLS has no certificate; this block replaces it once it stops
+        if [[ ! -e "$(devchain_path "$DEVCHAIN_CERT_PATH")" ]]; then
+          devchain_fail "An older DevChain installer is running on this VM. Stop it with: sudo systemctl disable --now devchain-bootstrap.service. Then run this install again."
+        else
+          devchain_fail "DevChain is already installed on this VM but not claimed. Choose “Set up a new VM” on the Cloud page and enter this VM's address to claim it. Setup asks for the certificate fingerprint; print it with: $DEVCHAIN_FINGERPRINT_COMMAND"
+        fi
+      else
+        devchain_fail "TCP port $port is already listening."
+      fi
+    fi
+    if [[ "$DEVCHAIN_HOME_PORT" == "$DEVCHAIN_BOOTSTRAP_PORT" ]]; then break; fi
+  done
+
+  local tool
+  for tool in curl apt-get dpkg tar xz systemctl systemd-run ss useradd visudo getent id sudo; do
+    if ! command -v "$tool" >/dev/null 2>&1; then devchain_fail "Required command is missing: $tool"; fi
+  done
+  if [[ ! -d "$(devchain_path /etc/sudoers.d)" ]]; then
+    devchain_fail '/etc/sudoers.d is missing.'
+  fi
+
+  if command -v curl >/dev/null 2>&1; then
+    local url
+    for url in \
+      'https://nodejs.org/' \
+      'https://syncthing.net/' \
+      'https://apt.syncthing.net/' \
+      "$DEVCHAIN_NPM_REGISTRY" \
+      'https://antigravity.google/'; do
+      if ! curl -fsSI --max-time 10 "$url" >/dev/null; then
+        devchain_fail "Cannot reach $url"
+      fi
+    done
+    local version_url status
+    version_url="\${DEVCHAIN_NPM_REGISTRY%/}/devchain-cli/$DEVCHAIN_VERSION"
+    status="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 "$version_url" 2>/dev/null || true)"
+    status="\${status:-000}"
+    case "$status" in
+      200) ;;
+      404) devchain_fail "The npm registry $DEVCHAIN_NPM_REGISTRY has no devchain-cli $DEVCHAIN_VERSION. Publish it there, or start DevChain on this PC with HOST_NPM_REGISTRY set to a registry that has it." ;;
+      *) devchain_fail "Could not verify devchain-cli $DEVCHAIN_VERSION at $DEVCHAIN_NPM_REGISTRY (answered $status)." ;;
+    esac
+  fi
+
+  local embedded_sha=''
+  embedded_sha="$(printf '%s' "$DEVCHAIN_BOOTSTRAP_TGZ_BASE64" | base64 -d 2>/dev/null | sha256sum 2>/dev/null | awk '{ print $1 }' || true)"
+  if [[ "$embedded_sha" != "$DEVCHAIN_BOOTSTRAP_SHA256" ]]; then
+    devchain_fail 'The embedded bootstrap archive is damaged (SHA-256 mismatch).'
+  fi
+
+  local -a headless_packages=()
+  if command -v dpkg-query >/dev/null 2>&1; then
+    while IFS= read -r arg; do [[ -z "$arg" ]] || headless_packages+=("$arg"); done < <(
+      { dpkg-query -W -f='\${Package} \${db:Status-Status}\\n' dbus-user-session dbus-x11 gnome-keyring snapd 2>/dev/null || true; } |
+        awk '$2 == "installed" { print $1 }'
+    )
+  fi
+  local purge_preview='No installed headless packages need removal.'
+  if (( \${#headless_packages[@]} > 0 )) && command -v apt-get >/dev/null 2>&1; then
+    if ! purge_preview="$(apt-get -o DPkg::Lock::Timeout=600 -s purge "\${headless_packages[@]}" 2>&1)"; then
+      devchain_fail 'The headless package removal dry run failed.'
+    fi
+  fi
+  printf '%s\\n' 'Headless package removal dry run:' "$purge_preview"
+  if command -v snap >/dev/null 2>&1; then
+    printf '%s\\n' 'Installed snaps:'
+    snap list 2>&1 || true
+  fi
+  if grep -Eq '^Remv (openssh-server|sudo|systemd|dbus|netplan.io|systemd-networkd|ifupdown)([[:space:]]|$)' <<< "$purge_preview"; then
+    devchain_fail 'The headless purge would remove a critical login, init, D-Bus, or network package.'
+  fi
+
+  if command -v ip >/dev/null 2>&1; then
+    local address first_octet second_octet public_address=0
+    while IFS= read -r address; do
+      address="\${address%/*}"
+      IFS=. read -r first_octet second_octet _ <<< "$address"
+      if [[ "$first_octet" == 10 || "$first_octet" == 127 || "$first_octet" == 169 && "$second_octet" == 254 ||
+            "$first_octet" == 192 && "$second_octet" == 168 ||
+            "$first_octet" == 172 && "$second_octet" =~ ^[0-9]+$ && "$second_octet" -ge 16 && "$second_octet" -le 31 ||
+            "$first_octet" == 100 && "$second_octet" =~ ^[0-9]+$ && "$second_octet" -ge 64 && "$second_octet" -le 127 ]]; then
+        continue
+      fi
+      public_address=1
+      devchain_warn "Interface address $address is public. This host must be reachable only on a trusted LAN or VPN."
+    done < <(ip -o -4 addr show scope global 2>/dev/null | awk '{ print $4 }')
+  fi
+  if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+    devchain_warn "ufw is active; allow TCP ports $DEVCHAIN_BOOTSTRAP_PORT, $DEVCHAIN_HOME_PORT and 22000."
+  fi
+  local account=''
+  if command -v getent >/dev/null 2>&1; then account="$(getent passwd "$DEVCHAIN_HOME_USER" 2>/dev/null || true)"; fi
+  if [[ -n "$account" ]]; then
+    local existing_home
+    existing_home="$(awk -F: '{ print $6 }' <<< "$account")"
+    if [[ "$existing_home" == "$DEVCHAIN_HOME_PATH" ]]; then
+      devchain_warn "Account $DEVCHAIN_HOME_USER already exists with $DEVCHAIN_HOME_PATH; the claim reuses it and grants passwordless sudo."
+    else
+      devchain_warn "Account $DEVCHAIN_HOME_USER already exists with $existing_home; choose another user or home in Set up VM."
+    fi
+  fi
+
+  if (( failures > 0 )); then
+    printf 'Pre-validation found %d problem(s); no changes were made.\\n' "$failures" >&2
+    return 1
+  fi
+  printf '%s\\n' 'Pre-validation passed.'
+  if (( check == 1 )); then return 0; fi
+
+  export DEBIAN_FRONTEND=noninteractive
+  # dpkg has no lock-timeout option, and apt's DPkg::Lock::Timeout does not cover the lists lock
+  # that apt-get update takes, so the wait lives here; the env overrides keep the 10-minute wait
+  # testable in seconds
+  local lock_timeout=600 lock_retry=5
+  if [[ "\${DEVCHAIN_PACKAGE_LOCK_TIMEOUT:-}" =~ ^[0-9]+$ ]]; then lock_timeout="$DEVCHAIN_PACKAGE_LOCK_TIMEOUT"; fi
+  if [[ "\${DEVCHAIN_PACKAGE_LOCK_RETRY_SECONDS:-}" =~ ^[0-9]+$ ]]; then lock_retry="$DEVCHAIN_PACKAGE_LOCK_RETRY_SECONDS"; fi
+  # usage: devchain_when_unlocked <lock name> <command>...; only lock contention is retried
+  devchain_when_unlocked() {
+    local lock_name="$1" deadline=$((SECONDS + lock_timeout)) output='' status=0
+    shift
+    until output="$("$@" 2>&1)"; do
+      status=$?
+      if ! grep -qiE 'lock.*(locked by|held by|another process|temporarily unavailable|resource busy)' <<< "$output"; then
+        printf '%s\\n' "$output" >&2
+        return "$status"
+      fi
+      if (( SECONDS + lock_retry > deadline )); then
+        printf 'The %s lock stayed busy for 10 minutes (probably automatic updates). Wait for them to finish, then press Retry.\\n' "$lock_name" >&2
+        return 1
+      fi
+      sleep "$lock_retry"
+    done
+    if [[ -n "$output" ]]; then printf '%s\\n' "$output"; fi
+  }
+  devchain_when_unlocked dpkg dpkg --configure -a
+
+  local guest_package=''
+  case "$(systemd-detect-virt 2>/dev/null || true)" in
+    kvm|qemu) guest_package=qemu-guest-agent ;;
+    vmware) guest_package=open-vm-tools ;;
+  esac
+  devchain_when_unlocked 'apt lists' apt-get -o DPkg::Lock::Timeout=600 update
+  local -a install_packages=("\${DEVCHAIN_BASE_APT_PACKAGES[@]}")
+  if [[ -n "$guest_package" ]]; then install_packages+=("$guest_package"); fi
+  apt-get -o DPkg::Lock::Timeout=600 install -y --no-install-recommends "\${install_packages[@]}"
+
+  mkdir -p "$(devchain_path /etc/apt/preferences.d)"
+  printf '%s' "$DEVCHAIN_APT_PREFERENCE" > "$(devchain_path /etc/apt/preferences.d/devchain-no-session-bus.pref)"
+  chmod 0644 "$(devchain_path /etc/apt/preferences.d/devchain-no-session-bus.pref)"
+  if (( \${#headless_packages[@]} > 0 )); then
+    apt-get -o DPkg::Lock::Timeout=600 purge -y "\${headless_packages[@]}"
+  fi
+  rm -rf "$(devchain_path /snap)" "$(devchain_path /var/snap)" \
+    "$(devchain_path /var/lib/snapd)" "$(devchain_path /var/cache/snapd)"
+
+  local work node_tarball
+  work="$(mktemp -d)"
+  trap 'rm -rf "$work"' 0
+  node_tarball="node-v\${DEVCHAIN_NODE_VERSION}-linux-x64.tar.xz"
+  curl -fsSLo "$work/$node_tarball" "https://nodejs.org/dist/v$DEVCHAIN_NODE_VERSION/$node_tarball"
+  curl -fsSLo "$work/SHASUMS256.txt" "https://nodejs.org/dist/v$DEVCHAIN_NODE_VERSION/SHASUMS256.txt"
+  (cd "$work" && grep " $node_tarball\\$" SHASUMS256.txt | sha256sum -c -)
+  mkdir -p "$(devchain_path /usr/local)"
+  tar -xJf "$work/$node_tarball" -C "$(devchain_path /usr/local)" --strip-components=1 \
+    --no-same-owner --exclude='*/CHANGELOG.md' --exclude='*/README.md' --exclude='*/LICENSE'
+
+  mkdir -p "$(devchain_path /etc/apt/keyrings)" "$(devchain_path /etc/apt/sources.list.d)"
+  curl -fsSLo "$(devchain_path /etc/apt/keyrings/syncthing-archive-keyring.gpg)" https://syncthing.net/release-key.gpg
+  printf '%s\\n' 'deb [signed-by=/etc/apt/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable-v2' \
+    > "$(devchain_path /etc/apt/sources.list.d/syncthing.list)"
+  devchain_when_unlocked 'apt lists' apt-get -o DPkg::Lock::Timeout=600 update
+  apt-get -o DPkg::Lock::Timeout=600 install -y --no-install-recommends "syncthing=$DEVCHAIN_SYNCTHING_VERSION"
+
+  mkdir -p "$(devchain_path /etc/sysctl.d)"
+  printf '%s' "$DEVCHAIN_SYSCTL_CONFIG" > "$(devchain_path /etc/sysctl.d/60-devchain-inotify.conf)"
+  chmod 0644 "$(devchain_path /etc/sysctl.d/60-devchain-inotify.conf)"
+  sysctl --system
+
+  local bootstrap_tgz="$work/devchain-host-bootstrap.tgz"
+  printf '%s' "$DEVCHAIN_BOOTSTRAP_TGZ_BASE64" | base64 -d > "$bootstrap_tgz"
+  npm install -g --omit=dev --no-fund --no-audit "$bootstrap_tgz"
+
+  local packages_file="$work/packages" package package_version
+  : > "$packages_file"
+  for package in "\${install_packages[@]}" syncthing; do
+    package_version="$(dpkg-query -W -f='\${Version}' "$package")"
+    printf '%s\\t%s\\n' "$package" "$package_version" >> "$packages_file"
+  done
+  export DEVCHAIN_MANIFEST_BASE="$id-$version_id-installed"
+  export DEVCHAIN_NODE_RUNTIME="$(node --version)"
+  export DEVCHAIN_NPM_RUNTIME="$(npm --version)"
+  export DEVCHAIN_SYNCTHING_CLI="$(syncthing --version 2>&1)"
+  export DEVCHAIN_IMAGE_VERSION DEVCHAIN_NPM_REGISTRY DEVCHAIN_BOOTSTRAP_PACKAGE
+  export DEVCHAIN_BOOTSTRAP_VERSION DEVCHAIN_VERSION
+  local manifest_tmp="$work/manifest.json"
+  node - "$packages_file" > "$manifest_tmp" <<'DEVCHAIN_MANIFEST'
+const fs = require('node:fs');
+const e = process.env;
+const packages = Object.fromEntries(
+  fs.readFileSync(process.argv[2], 'utf8').trim().split('\\n').filter(Boolean).map((line) => line.split('\\t')),
+);
+const installedAt = new Date().toISOString();
+const manifest = {
+  schemaVersion: 1,
+  imageVersion: e.DEVCHAIN_IMAGE_VERSION,
+  builtAt: installedAt,
+  arch: 'amd64',
+  base: { name: e.DEVCHAIN_MANIFEST_BASE },
+  npmRegistry: e.DEVCHAIN_NPM_REGISTRY,
+  bootstrap: { package: e.DEVCHAIN_BOOTSTRAP_PACKAGE, version: e.DEVCHAIN_BOOTSTRAP_VERSION },
+  packages,
+  runtimes: { node: e.DEVCHAIN_NODE_RUNTIME.replace(/^v/, ''), npm: e.DEVCHAIN_NPM_RUNTIME },
+  syncthingCli: e.DEVCHAIN_SYNCTHING_CLI.split('\\n')[0],
+  install: { method: 'devchain-host-install', devchainVersion: e.DEVCHAIN_VERSION, installedAt },
+};
+process.stdout.write(JSON.stringify(manifest, null, 2) + '\\n');
+DEVCHAIN_MANIFEST
+  mkdir -p "$(devchain_path /usr/share/devchain-host)"
+  install -m 0644 "$manifest_tmp" "$manifest_path"
+
+  mkdir -p "$(devchain_path /etc/systemd/system)"
+  printf '%s' "$DEVCHAIN_BOOTSTRAP_UNIT" > "$(devchain_path /etc/systemd/system/devchain-bootstrap.service)"
+  chmod 0644 "$(devchain_path /etc/systemd/system/devchain-bootstrap.service)"
+  systemctl daemon-reload
+  systemctl enable devchain-bootstrap.service
+  systemctl start devchain-bootstrap.service
+
+  # The bootstrap creates its certificate before systemctl start returns.
+  local fingerprint
+  if ! fingerprint="$(openssl x509 -in "$(devchain_path "$DEVCHAIN_CERT_PATH")" -noout -fingerprint -sha256)"; then
+    printf 'The bootstrap started without its certificate %s. See journalctl -u devchain-bootstrap.\\n' "$DEVCHAIN_CERT_PATH" >&2
+    return 1
+  fi
+  printf '%s\\n' 'DevChain host bootstrap is ready:'
+  while IFS= read -r address; do
+    address="\${address%/*}"
+    [[ -z "$address" ]] || printf 'https://%s:%s\\n' "$address" "$DEVCHAIN_BOOTSTRAP_PORT"
+  done < <(ip -o -4 addr show scope global | awk '{ print $4 }')
+  printf 'Certificate fingerprint (SHA-256): %s\\n' "\${fingerprint#*=}"
+  printf '%s\\n' 'In Cloud, choose Set up a new VM, enter this address, and paste this fingerprint.'
+  )
+}
+
+${invocation}
+`;
+}
+//# sourceMappingURL=host-install-block.js.map

package/dist/server/modules/remotes/host-install/host-install-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-install-block.js","sourceRoot":"","sources":["../../../../src/modules/remotes/host-install/host-install-block.ts"],"names":[],"mappings":";;;AA0CA,gEAEC;AAED,4DAgcC;AA9eY,QAAA,2BAA2B,GAAG,IAAI,CAAC;AAEnC,QAAA,qBAAqB,GAAG,iCAAiC,CAAC;AAE1D,QAAA,oCAAoC,GAAG,oBAAoB,6BAAqB,8BAA8B,CAAC;AAC/G,QAAA,2BAA2B,GAAG,IAAI,CAAC;AA6BhD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;AAC5F,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAAqB;IAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAAgC;IACvE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC;QAC3C,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,CAAC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,CAAC;QAClD,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QACxC,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;QACtC,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QACxC,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;QACtC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,CAAC,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC;KACpC,EAAE,CAAC;QACX,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACrD,IACE,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAEjG,OAAO;wBACe,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;6BACvB,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;wBACtC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;6BACvB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;6BAClC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;4BACnC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gCAC7B,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC;0BAC5C,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC;yBAClC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC;0BAC/B,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC;wBACnC,OAAO,CAAC,UAAU;qBACrB,OAAO,CAAC,QAAQ;yBACZ,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC;qBACpC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;qBAC5B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;mBAC9B,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;0BAC5B,mCAA2B;qBAChC,UAAU,CAAC,6BAAqB,CAAC;+BACvB,UAAU,CAAC,4CAAoC,CAAC;8BACjD,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAgHO,mCAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkR/E,UAAU;CACX,CAAC;AACF,CAAC"}