@run402/sdk 4.39.1 → 4.41.0

package/dist/node/gitvault-publication.d.ts

@@ -388,6 +388,61 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         repo_id: string;
         prune_intent_object_id: string;
     }): Promise<GitvaultPruneIntentRecord | null>;
+    /**
+     * The org's directory of envelope-capable principals (gitvault-human-
+     * envelopes design D7, `GET /orgs/v1/:org_id/encryption-keys`) — every
+     * active human member who has published an encryption key. Read by
+     * {@link GitvaultVault.reconcileEnvelopeRecipients} to diff against a
+     * vault's current recipient set.
+     */
+    listOrgEncryptionKeys(request: {
+        org_id: string;
+    }): Promise<GitvaultOrgEncryptionKeyDirectory>;
+    /**
+     * The `ek_` fingerprints already covering this vault, at any epoch
+     * (`GET /gitvault/v1/vaults/:vault_id/envelope-recipients`, task 2.2) —
+     * fingerprints only, never envelope bytes; the recipient-only rule on
+     * envelope BYTES elsewhere is unaffected.
+     */
+    listEnvelopeRecipients(request: {
+        repo_id: string;
+    }): Promise<GitvaultEnvelopeRecipientsResponse>;
+}
+/**
+ * One row of the org's envelope-capable-principal directory
+ * ({@link GitvaultTransport.listOrgEncryptionKeys}).
+ *
+ * `public_key` is OPTIONAL because the shipped gateway route
+ * (`GET /orgs/v1/:org_id/encryption-keys`, `routes/org.ts` in
+ * run402-private) does not return it yet: `services/
+ * principal-encryption-keys.ts:listOrgEncryptionKeyDirectory`'s SELECT
+ * omits `pk.public_key` and the route's response `.map()` doesn't forward
+ * it — a three-line fix (the SELECT list, the `EncryptionKeyDirectoryEntry`
+ * type, and the route's map) that has not shipped as of 2026-08-26. Until
+ * it does, {@link GitvaultVault.reconcileEnvelopeRecipients} reports every
+ * directory entry as `skipped` with reason `missing_public_key` — this type
+ * and the reconcile method are written against the INTENDED response shape
+ * and need no further change once the gateway ships the field.
+ */
+export interface GitvaultOrgEncryptionKeyEntry {
+    principal_id: string;
+    display_name: string | null;
+    ek_fingerprint: string;
+    suite: string;
+    created_at: string;
+    /** Raw base64url X25519 public key — absent on gateways that haven't shipped the fix noted above. */
+    public_key?: string;
+    [key: string]: unknown;
+}
+/** `GET /orgs/v1/:org_id/encryption-keys` — {@link GitvaultTransport.listOrgEncryptionKeys}'s result. */
+export interface GitvaultOrgEncryptionKeyDirectory {
+    org_id: string;
+    keys: GitvaultOrgEncryptionKeyEntry[];
+}
+/** `GET /gitvault/v1/vaults/:vault_id/envelope-recipients` — {@link GitvaultTransport.listEnvelopeRecipients}'s result. */
+export interface GitvaultEnvelopeRecipientsResponse {
+    vault_id: string;
+    recipient_fingerprints: string[];
 }
 /** `GET /gitvault/v1/vaults/:vault_id` — the shape `reads.ts:getVaultRecord` returns. */
 export interface GitvaultVaultRecord {
@@ -454,6 +509,8 @@ export declare const gitvaultPaths: {
     readonly cutoffTicket: (id: string) => string;
     /** `verifier-receipts/<vr>.json` — plaintext-structured, uploaded before a prune intent may reference it (§7.3). */
     readonly verifierReceipt: (id: string) => string;
+    /** `envelopes/<epoch>/<recipient_fingerprint>` — mirrors `gitvault-creation-journal.ts`'s private `envelopePath` (the genesis creator's envelope); this is the same addressing for every OTHER recipient's `key_envelope`. */
+    readonly envelope: (epoch: string, recipientFingerprint: string) => string;
 };
 export interface GitvaultVaultOptions {
     keystore: GitvaultKeystore;
@@ -492,6 +549,33 @@ export interface GitvaultMaterializedState extends GitvaultVerifiedState {
     roots: GitvaultRetentionRoot[];
     head_target: GitvaultHeadTarget;
 }
+/** One directory entry {@link GitvaultVault.reconcileEnvelopeRecipients} wrapped a fresh `key_envelope` for. */
+export interface GitvaultReconcileEnvelopeRecipientsWrapped {
+    principal_id: string;
+    ek_fingerprint: string;
+}
+/** Why {@link GitvaultVault.reconcileEnvelopeRecipients} did NOT wrap a directory entry it otherwise would have. */
+export type GitvaultReconcileEnvelopeRecipientsSkipReason = "missing_public_key" | "invalid_public_key" | "pinned_key_mismatch";
+export interface GitvaultReconcileEnvelopeRecipientsSkipped {
+    principal_id: string;
+    ek_fingerprint: string;
+    reason: GitvaultReconcileEnvelopeRecipientsSkipReason;
+    /** `pinned_key_mismatch`: `{pinned_fingerprint, directory_fingerprint}`. `invalid_public_key` (derivation mismatch): `{derived_fingerprint}`. Absent for `missing_public_key` and a bad-encoding `invalid_public_key`. */
+    details?: Record<string, unknown>;
+}
+/** {@link GitvaultVault.reconcileEnvelopeRecipients}'s full per-recipient breakdown. */
+export interface GitvaultReconcileEnvelopeRecipientsResult {
+    repo_id: string;
+    org_id: string;
+    /** The epoch every wrap in this call used (V0: always {@link GITVAULT_GENESIS_EPOCH}). */
+    epoch: string;
+    /** Directory entries this call itself wrapped a NEW `key_envelope` for. */
+    wrapped: GitvaultReconcileEnvelopeRecipientsWrapped[];
+    /** `ek_` fingerprints already covering the vault before (or, for a raced wrap, as of) this call — no action taken. */
+    already_covered: string[];
+    /** Directory entries this call could not (or, for `pinned_key_mismatch`, would not) wrap. */
+    skipped: GitvaultReconcileEnvelopeRecipientsSkipped[];
+}
 export interface GitvaultPushOptions {
     transaction: GitvaultRefTransaction;
     /** New `HEAD` target for the published ref_state; carried forward when omitted. */
@@ -604,13 +688,77 @@ export declare class GitvaultVault {
      * List from the authenticated pin and verify every link upward. Persists
      * the verified prefix after each page, so a `VERIFICATION_BUDGET_EXCEEDED`
      * continues rather than restarts. Returns the newest verified state.
+     *
+     * `options.persist` (default `true`, repo-surface-consolidation task 3.3 —
+     * `repos fsck --no-write`'s audit mode): when `false`, the chain is walked
+     * and verified exactly the same way, but every `keystore.updateRepo(...)`
+     * write below is skipped — no local trust pin advances. A
+     * `VERIFICATION_BUDGET_EXCEEDED` pause in this mode persists nothing, so a
+     * retry restarts from the ORIGINAL pin rather than resuming — the honest
+     * consequence of asking for a no-write audit and then walking off the end
+     * of one call's budget.
      */
-    verifyToNewest(): Promise<GitvaultVerifiedState>;
+    verifyToNewest(options?: {
+        persist?: boolean;
+    }): Promise<GitvaultVerifiedState>;
     private readHead;
     /** Decrypt one encrypted carrier object by its receipt; any failure is `CHAIN_UNUSABLE`. */
     private openCarrier;
-    /** Verify to newest, then decrypt + apply its carriers — advancing the materialized pin. */
-    materialize(): Promise<GitvaultMaterializedState>;
+    /**
+     * Verify to newest, then decrypt + apply its carriers — advancing the
+     * materialized pin. `options.persist` (default `true`) is forwarded to
+     * {@link verifyToNewest} and gates this method's OWN `materialized_pin`
+     * write the same way — `repos fsck --no-write` computes and returns the
+     * real ref map and generation without moving either local pin.
+     */
+    materialize(options?: {
+        persist?: boolean;
+    }): Promise<GitvaultMaterializedState>;
+    /**
+     * Wrap the vault's CURRENT epoch key to every org member the directory
+     * lists but the vault does not yet have a `key_envelope` for.
+     *
+     * **This is task 1.1's residual WORKAROUND, not the design D5 ideal.** D5
+     * describes a recipient-set change as an epoch rotation — "history epochs
+     * stay wrapped as they were; a new member reads from their first covered
+     * epoch forward" — which needs a protocol revision (task 1, BLOCKED as of
+     * 2026-08-26: V0 pins `epoch` to the single constant
+     * `GITVAULT_GENESIS_EPOCH` on every head, so there is no "forward" to
+     * speak of yet). What this method actually does, legally, without any
+     * protocol change: `key_envelope` objects are never head-referenced (not
+     * even genesis's own envelope is), so uploading an ADDITIONAL one at
+     * `envelopes/<current epoch>/<recipient fingerprint>` for a missing
+     * recipient is accepted by the existing generic create-only upload route
+     * as-is. The honest consequence: a newly-wrapped member gets the SAME
+     * single epoch every existing member already has, which in V0 means the
+     * vault's ENTIRE history — not "from here forward." True forward-only
+     * semantics wait on task 1's protocol revision; this method does not
+     * pretend otherwise.
+     *
+     * **TOFU pinning (design D4 point 3).** The first time this repo wraps a
+     * given `principal_id`, its CURRENT `ek_fingerprint` is pinned in the
+     * keystore repo file (`envelope_recipient_pins`). On a later call, a
+     * directory entry whose fingerprint no longer matches its pin is a
+     * REFUSAL for that recipient ONLY — reported under `skipped` with reason
+     * `pinned_key_mismatch` and both fingerprints in `details`, never wrapped
+     * under the new key, and never a thrown error that would abort the whole
+     * call (other recipients still get processed). Whether that mismatch is a
+     * legitimate key rotation or a substitution is a product/human decision
+     * this SDK does not make unattended.
+     *
+     * **The gateway directory route does not carry `public_key` yet**
+     * (`GET /orgs/v1/:org_id/encryption-keys` — see the doc comment on
+     * {@link GitvaultOrgEncryptionKeyEntry}). Until it does, every directory
+     * entry is reported under `skipped` with reason `missing_public_key`;
+     * this method needs no further change once the gateway ships the field.
+     *
+     * Best-effort by design at the call site, not here: this method itself
+     * either completes (returning a full per-recipient breakdown) or throws
+     * (e.g. `GITVAULT_READ_ONLY` when this principal holds no signing key).
+     * Callers that want "never block on this" (the deploy hook) wrap the call
+     * themselves — see `Gitvault.push`'s `#tryReconcileEnvelopeRecipients`.
+     */
+    reconcileEnvelopeRecipients(): Promise<GitvaultReconcileEnvelopeRecipientsResult>;
     private seal;
     /**
      * The owner signing seed, or `GITVAULT_READ_ONLY`.
@@ -623,6 +771,8 @@ export declare class GitvaultVault {
      */
     signer(): Uint8Array;
     private writerKeyId;
+    /** The owner's full signing keypair, or `GITVAULT_READ_ONLY` — same refusal path as {@link signer}, which returns only the seed; {@link sealKeyEnvelope} needs both halves. */
+    private signingKeypair;
     private buildRefState;
     private buildRetentionRoots;
     /** Plaintext, independently non-thin packs covering `reachable(tips) ∖ reachable(base)`, split at the multi-object target. */

package/dist/node/gitvault-publication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault-publication.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-publication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAyB3C,OAAO,KAAK,EACV,uBAAuB,EAEvB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAG1B,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAE7B,oBAAoB,EAErB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAIV,yBAAyB,EAG1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAwB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAIvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAKrE,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,wCAAwC,OAAQ,CAAC;AAC9D,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAC1D,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AACnD,eAAO,MAAM,0CAA0C,gBAAmB,CAAC;AAC3E,eAAO,MAAM,uCAAuC,YAAc,CAAC;AACnE,eAAO,MAAM,mCAAmC,WAAa,CAAC;AAC9D,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AACzD,eAAO,MAAM,kCAAkC,SAAU,CAAC;AAC1D,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,uHAAuH;AACvH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAahD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAID,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD,kHAAkH;AAClH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qCAAqC;IACpD,2EAA2E;IAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACjF,4HAA4H;IAC5H,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,uBAAuB,GAAG,kBAAkB,GAAG,eAAe,GAAG,8BAA8B,GAAG,MAAM,CAAC;IACjH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiDpM;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIlE;AAED,8GAA8G;AAC9G,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAGjG;AAID,iHAAiH;AACjH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,GAAG,MAAM,CAE9F;AAED,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,sBAAsB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,SAA8B,GAAG,OAAO,CAGlJ;AAED,MAAM,WAAW,0BAA0B;IACzC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAChH;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAIvF;AAED,+HAA+H;AAC/H,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,0BAA0B,GAAG,qBAAqB,EAAE,CAepI;AAID,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAItF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,uBAAuB,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,uBAAuB,CA0BhM;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,GAAG,2BAA2B,GAAG,IAAI,CAI3I;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAUxG;AAID,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAEjG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAOpK;AAID,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6HAA6H;AAC7H,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAelE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAK3D;AAID,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAExD,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAM3E;AAED,gGAAgG;AAChG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,yBAAyB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAWhK;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAExE;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,GACxG;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,8BAA8B,CAAC;CACzC;AAED;;;;GAIG;AACH,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,kFAAkF;AAClF,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B,EAAE,MAAM,CAAC;IACnC,iGAAiG;IACjG,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,iBAAkB,SAAQ,yBAAyB;IAClE,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzG,uGAAuG;IACvG,aAAa,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC3J,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/E,sBAAsB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACvH,uBAAuB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvJ,wBAAwB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrJ,4FAA4F;IAC5F,cAAc,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClF;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrG,yBAAyB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAClL,uBAAuB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrK;;;;;;;;OAQG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpI,uFAAuF;IACvF,cAAc,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACzH;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,uBAAuB,EAAE,MAAM,CAAC;IAChC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,2BAA2B,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACxG,WAAW,EAAE;QACX,KAAK,EAAE;YAAE,oBAAoB,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAC;YAAC,sBAAsB,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACrK,UAAU,EAAE;YAAE,oBAAoB,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QAC1G,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1C,CAAC;IACF,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,oJAAoJ;IACpJ,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAgBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,4BAAiC,GAAG,iBAAiB,CAoPzH;AAID,eAAO,MAAM,aAAa;gCACL,MAAM;qCACD,MAAM;uBACpB,MAAM;4BACD,MAAM;kCACA,MAAM;sCACF,MAAM;kCACV,MAAM;4BACZ,MAAM;gCACF,MAAM;IACzB,oHAAoH;mCAC9F,MAAM;CACpB,CAAC;AAIX,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mJAAmJ;IACnJ,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;CAC1C;AAED,wGAAwG;AACxG,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACtE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,sBAAsB,CAAC;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACnC,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iHAAiH;IACjH,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,sBAAsB,GAAG,CAAC,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC3H;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,eAAe,EAAE,MAAM,CAAC;IACxB,iIAAiI;IACjI,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iHAAiH;IACjH,8BAA8B,EAAE,MAAM,CAAC;IACvC,kIAAkI;IAClI,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,+FAA+F;IAC/F,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,kBAAkB,CAAC;IAChC,uJAAuJ;IACvJ,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,eAAe,EAAE,MAAM,CAAC;IACxB,uIAAuI;IACvI,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mGAAmG;IACnG,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,2GAA2G;IAC3G,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wBAAwB,EAAE,MAAM,CAAC;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uBAAuB,EAAE,OAAO,CAAC;IACjC,gHAAgH;IAChH,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,SAAS,EAAE,0BAA0B,CAAC;IACtC,iBAAiB,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,gEAAgE;IAChE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,yFAAyF;AACzF,qBAAa,aAAa;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,YAAY,CAAkE;gBAE1E,OAAO,EAAE,oBAAoB;IAWzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;IAMzD,QAAQ,IAAI,gBAAgB;IA0B5B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,KAAK;IAEb,OAAO,CAAC,GAAG;IAKX,6DAA6D;IACvD,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAc3E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,qBAAqB,CAAC;YA4CxC,QAAQ;IAatB,4FAA4F;YAC9E,WAAW;IAgBzB,4FAA4F;IACtF,WAAW,IAAI,OAAO,CAAC,yBAAyB,CAAC;IAgBvD,OAAO,CAAC,IAAI;IAKZ;;;;;;;;OAQG;IACH,MAAM,IAAI,UAAU;IAOpB,OAAO,CAAC,WAAW;IAEnB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,mBAAmB;IAQ3B,8HAA8H;IACxH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAiBvE,kFAAkF;IAC5E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD;;;;;;;OAOG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOjE;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKnG,OAAO,CAAC,MAAM;IAId;;;;;;;;;OASG;IACH,WAAW,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM;IAIjE,yFAAyF;IACzF,cAAc,CAAC,CAAC,SAAS;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC;IAI3E,OAAO,CAAC,gBAAgB;IAKxB,wIAAwI;IACxI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE;IAOnH;;;;;OAKG;IACG,eAAe,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA4C5J,yJAAyJ;IACnJ,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhI;;;;;;;;;;OAUG;IACG,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mCAAmC,CAAC;IAsDlH;;;;;;;;;OASG;IACG,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;YA+BjH,SAAS;IAWvB;;;;;OAKG;YACW,iBAAiB;IAyF/B,yJAAyJ;IACnJ,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsBxE;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2BvE;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;KAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAoBjH,uHAAuH;YACzG,oBAAoB;IAalC,OAAO,CAAC,QAAQ;IAIhB,qGAAqG;YACvF,KAAK;IAgBnB;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyD5H,6GAA6G;YAC/F,SAAS;IAoBvB;;;;OAIG;IACG,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,kBAAkB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CxI;AAED,6JAA6J;AAC7J,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,QAAQ,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAYjJ;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,sBAAsB,CAGjI;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"gitvault-publication.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-publication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA4B3C,OAAO,KAAK,EACV,uBAAuB,EAEvB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAG1B,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAG7B,oBAAoB,EAErB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAIV,yBAAyB,EAG1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAwB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAIvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAKrE,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,wCAAwC,OAAQ,CAAC;AAC9D,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAC1D,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AACnD,eAAO,MAAM,0CAA0C,gBAAmB,CAAC;AAC3E,eAAO,MAAM,uCAAuC,YAAc,CAAC;AACnE,eAAO,MAAM,mCAAmC,WAAa,CAAC;AAC9D,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AACzD,eAAO,MAAM,kCAAkC,SAAU,CAAC;AAC1D,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,uHAAuH;AACvH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAahD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAID,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD,kHAAkH;AAClH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qCAAqC;IACpD,2EAA2E;IAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACjF,4HAA4H;IAC5H,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,uBAAuB,GAAG,kBAAkB,GAAG,eAAe,GAAG,8BAA8B,GAAG,MAAM,CAAC;IACjH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiDpM;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIlE;AAED,8GAA8G;AAC9G,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAGjG;AAID,iHAAiH;AACjH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,GAAG,MAAM,CAE9F;AAED,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,sBAAsB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,SAA8B,GAAG,OAAO,CAGlJ;AAED,MAAM,WAAW,0BAA0B;IACzC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAChH;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAIvF;AAED,+HAA+H;AAC/H,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,0BAA0B,GAAG,qBAAqB,EAAE,CAepI;AAID,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAItF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,uBAAuB,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,uBAAuB,CA0BhM;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,GAAG,2BAA2B,GAAG,IAAI,CAI3I;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAUxG;AAID,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAEjG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAOpK;AAID,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6HAA6H;AAC7H,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAelE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAK3D;AAID,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAExD,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAM3E;AAED,gGAAgG;AAChG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,yBAAyB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAWhK;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAExE;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,GACxG;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,8BAA8B,CAAC;CACzC;AAED;;;;GAIG;AACH,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,kFAAkF;AAClF,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B,EAAE,MAAM,CAAC;IACnC,iGAAiG;IACjG,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,iBAAkB,SAAQ,yBAAyB;IAClE,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzG,uGAAuG;IACvG,aAAa,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC3J,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/E,sBAAsB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACvH,uBAAuB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvJ,wBAAwB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrJ,4FAA4F;IAC5F,cAAc,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClF;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrG,yBAAyB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAClL,uBAAuB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrK;;;;;;;;OAQG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpI,uFAAuF;IACvF,cAAc,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACxH;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC/F;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC;CACnG;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yGAAyG;AACzG,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,6BAA6B,EAAE,CAAC;CACvC;AAED,2HAA2H;AAC3H,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,uBAAuB,EAAE,MAAM,CAAC;IAChC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,2BAA2B,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACxG,WAAW,EAAE;QACX,KAAK,EAAE;YAAE,oBAAoB,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAC;YAAC,sBAAsB,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACrK,UAAU,EAAE;YAAE,oBAAoB,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QAC1G,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1C,CAAC;IACF,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,oJAAoJ;IACpJ,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAgBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,4BAAiC,GAAG,iBAAiB,CAsPzH;AAID,eAAO,MAAM,aAAa;gCACL,MAAM;qCACD,MAAM;uBACpB,MAAM;4BACD,MAAM;kCACA,MAAM;sCACF,MAAM;kCACV,MAAM;4BACZ,MAAM;gCACF,MAAM;IACzB,oHAAoH;mCAC9F,MAAM;IAC5B,8NAA8N;+BAC5M,MAAM,wBAAwB,MAAM;CAC9C,CAAC;AAIX,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mJAAmJ;IACnJ,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;CAC1C;AAED,wGAAwG;AACxG,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACtE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED,gHAAgH;AAChH,MAAM,WAAW,0CAA0C;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,oHAAoH;AACpH,MAAM,MAAM,6CAA6C,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAEhI,MAAM,WAAW,0CAA0C;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,6CAA6C,CAAC;IACtD,0NAA0N;IAC1N,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wFAAwF;AACxF,MAAM,WAAW,yCAAyC;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACtD,sHAAsH;IACtH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,6FAA6F;IAC7F,OAAO,EAAE,0CAA0C,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,sBAAsB,CAAC;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACnC,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iHAAiH;IACjH,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,sBAAsB,GAAG,CAAC,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC3H;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,eAAe,EAAE,MAAM,CAAC;IACxB,iIAAiI;IACjI,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iHAAiH;IACjH,8BAA8B,EAAE,MAAM,CAAC;IACvC,kIAAkI;IAClI,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,+FAA+F;IAC/F,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,kBAAkB,CAAC;IAChC,uJAAuJ;IACvJ,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,eAAe,EAAE,MAAM,CAAC;IACxB,uIAAuI;IACvI,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mGAAmG;IACnG,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,2GAA2G;IAC3G,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wBAAwB,EAAE,MAAM,CAAC;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uBAAuB,EAAE,OAAO,CAAC;IACjC,gHAAgH;IAChH,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,SAAS,EAAE,0BAA0B,CAAC;IACtC,iBAAiB,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,gEAAgE;IAChE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,yFAAyF;AACzF,qBAAa,aAAa;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,YAAY,CAAkE;gBAE1E,OAAO,EAAE,oBAAoB;IAWzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;IAMzD,QAAQ,IAAI,gBAAgB;IA0B5B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,KAAK;IAEb,OAAO,CAAC,GAAG;IAKX,6DAA6D;IACvD,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAc3E;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAqD3E,QAAQ;IAatB,4FAA4F;YAC9E,WAAW;IAgBzB;;;;;;OAMG;IACG,WAAW,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAiB1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,2BAA2B,IAAI,OAAO,CAAC,yCAAyC,CAAC;IAwFvF,OAAO,CAAC,IAAI;IAKZ;;;;;;;;OAQG;IACH,MAAM,IAAI,UAAU;IAOpB,OAAO,CAAC,WAAW;IAEnB,+KAA+K;IAC/K,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,mBAAmB;IAQ3B,8HAA8H;IACxH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAiBvE,kFAAkF;IAC5E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD;;;;;;;OAOG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOjE;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKnG,OAAO,CAAC,MAAM;IAId;;;;;;;;;OASG;IACH,WAAW,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM;IAIjE,yFAAyF;IACzF,cAAc,CAAC,CAAC,SAAS;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC;IAI3E,OAAO,CAAC,gBAAgB;IAKxB,wIAAwI;IACxI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE;IAOnH;;;;;OAKG;IACG,eAAe,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA4C5J,yJAAyJ;IACnJ,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhI;;;;;;;;;;OAUG;IACG,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mCAAmC,CAAC;IAsDlH;;;;;;;;;OASG;IACG,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;YA+BjH,SAAS;IAWvB;;;;;OAKG;YACW,iBAAiB;IAyF/B,yJAAyJ;IACnJ,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsBxE;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2BvE;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;KAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAoBjH,uHAAuH;YACzG,oBAAoB;IAalC,OAAO,CAAC,QAAQ;IAIhB,qGAAqG;YACvF,KAAK;IAgBnB;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyD5H,6GAA6G;YAC/F,SAAS;IAoBvB;;;;OAIG;IACG,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,kBAAkB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CxI;AAED,6JAA6J;AAC7J,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,QAAQ,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAYjJ;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,sBAAsB,CAGjI;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/node/gitvault-publication.js

@@ -37,7 +37,7 @@ import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { LocalError, isRun402Error } from "../errors.js";
-import { GITVAULT_FORMAT, GITVAULT_GENESIS_EPOCH, GITVAULT_GENESIS_GENERATION, GITVAULT_HEX16_RE, GITVAULT_OID40_RE, GITVAULT_SUITE, deriveDigestKey, deriveObjectKey, formatGitvaultTimestamp, hexToBytes, jcs, keyedCommitment, newGitvaultId, objectsetContent, openBindingPreimage, openFrame, parseGitvaultStrict, sealFrame, sha256Hex, signGitvaultObject, storedBytes, verifyGitvaultObject, } from "../namespaces/gitvault.crypto.js";
+import { GITVAULT_FORMAT, GITVAULT_GENESIS_EPOCH, GITVAULT_GENESIS_GENERATION, GITVAULT_HEX16_RE, GITVAULT_OID40_RE, GITVAULT_SUITE, deriveDigestKey, deriveObjectKey, ekFingerprint, formatGitvaultTimestamp, fromBase64url, hexToBytes, jcs, keyedCommitment, newGitvaultId, objectsetContent, openBindingPreimage, openFrame, parseGitvaultStrict, sealFrame, sealKeyEnvelope, sha256Hex, signGitvaultObject, storedBytes, verifyGitvaultObject, } from "../namespaces/gitvault.crypto.js";
 import { crossProfileGitvaultHint } from "./gitvault-profile-scan.js";
 import { GITVAULT_DEPLOY_REF, hardenedGit, hasObject, isAncestor } from "./gitvault-snapshot.js";
 // ─── Constants (constants.json) ──────────────────────────────────────────────
@@ -588,6 +588,8 @@ export function createGitvaultHttpTransport(client, options = {}) {
         getVaultRecord: ({ repo_id }) => client.request(base(repo_id), { context: "reading the gitvault record" }),
         findVaultByProject: ({ project_id }) => client.request(`/gitvault/v1/vaults?project_id=${encodeURIComponent(project_id)}`, { context: "resolving the project's gitvault" }),
         findVaultByRepo: ({ org_slug, repo_name }) => client.request(`/gitvault/v1/vaults?repo=${encodeURIComponent(`${org_slug}/${repo_name}`)}`, { context: "resolving the gitvault by repo address" }),
+        listOrgEncryptionKeys: ({ org_id }) => client.request(`/orgs/v1/${encodeURIComponent(org_id)}/encryption-keys`, { context: "reading the org encryption-key directory" }),
+        listEnvelopeRecipients: ({ repo_id }) => client.request(`${base(repo_id)}/envelope-recipients`, { context: "reading the gitvault envelope recipients" }),
         acquireMaintenanceLease: ({ repo_id, base_head_sha256, current_checkpoint_hash, r1_size_bytes, r2_cap_size_bytes, p_before_c1_size_bytes, p_before_c2_size_bytes }) => client.request(`${base(repo_id)}/maintenance-leases`, {
             method: "POST",
             body: {
@@ -658,6 +660,8 @@ export const gitvaultPaths = {
     cutoffTicket: (id) => `retention/${id}.ticket.json`,
     /** `verifier-receipts/<vr>.json` — plaintext-structured, uploaded before a prune intent may reference it (§7.3). */
     verifierReceipt: (id) => `verifier-receipts/${id}.json`,
+    /** `envelopes/<epoch>/<recipient_fingerprint>` — mirrors `gitvault-creation-journal.ts`'s private `envelopePath` (the genesis creator's envelope); this is the same addressing for every OTHER recipient's `key_envelope`. */
+    envelope: (epoch, recipientFingerprint) => `envelopes/${epoch}/${recipientFingerprint}`,
 };
 /** A transport-agnostic view of git ops the publication needs (the local repository). */
 export class GitvaultVault {
@@ -731,8 +735,18 @@ export class GitvaultVault {
      * List from the authenticated pin and verify every link upward. Persists
      * the verified prefix after each page, so a `VERIFICATION_BUDGET_EXCEEDED`
      * continues rather than restarts. Returns the newest verified state.
+     *
+     * `options.persist` (default `true`, repo-surface-consolidation task 3.3 —
+     * `repos fsck --no-write`'s audit mode): when `false`, the chain is walked
+     * and verified exactly the same way, but every `keystore.updateRepo(...)`
+     * write below is skipped — no local trust pin advances. A
+     * `VERIFICATION_BUDGET_EXCEEDED` pause in this mode persists nothing, so a
+     * retry restarts from the ORIGINAL pin rather than resuming — the honest
+     * consequence of asking for a no-write audit and then walking off the end
+     * of one call's budget.
      */
-    async verifyToNewest() {
+    async verifyToNewest(options = {}) {
+        const persist = options.persist ?? true;
         const { genesis, sha256: genesisSha } = await this.genesis();
         const writerKey = genesis.creator_signing_pubkey;
         const writerKeyId = genesis.writer_key_id;
@@ -748,8 +762,11 @@ export class GitvaultVault {
             progress = verifyHeadsListingPage(page, request, progress, this.repoId);
             for (const entry of page.heads) {
                 if (verified >= this.budget) {
-                    this.keystore.updateRepo(this.repoId, { verified_prefix: pin });
-                    fail("VERIFICATION_BUDGET_EXCEEDED", `${verified} heads verified this call; the verified prefix (generation ${pin.generation}) is persisted — call again to continue`, "verifying gitvault chain", { verified_through: pin.generation }, [{ action: "resume verification from the persisted verified prefix" }]);
+                    if (persist)
+                        this.keystore.updateRepo(this.repoId, { verified_prefix: pin });
+                    fail("VERIFICATION_BUDGET_EXCEEDED", persist
+                        ? `${verified} heads verified this call; the verified prefix (generation ${pin.generation}) is persisted — call again to continue`
+                        : `${verified} heads verified this call in no-write mode; nothing was persisted — a retry restarts from the original pin, not generation ${pin.generation}`, "verifying gitvault chain", { verified_through: pin.generation, persisted: persist }, [{ action: persist ? "resume verification from the persisted verified prefix" : "re-run without --no-write to persist and resume incrementally, or re-run this same audit call again from the start" }]);
                 }
                 const bytes = await this.transport.getObject({ repo_id: this.repoId, path: gitvaultPaths.head(entry.generation) });
                 if (!bytes)
@@ -761,21 +778,24 @@ export class GitvaultVault {
                 }
                 catch (e) {
                     // fail closed: pin stays BELOW the transition head; the verified prefix is cleared (this is the final state, not a budget pause)
-                    this.keystore.updateRepo(this.repoId, { head_pin: pin, verified_prefix: null });
+                    if (persist)
+                        this.keystore.updateRepo(this.repoId, { head_pin: pin, verified_prefix: null });
                     throw e;
                 }
                 pin = { generation: head.generation, head_sha256: entry.stored_bytes_sha256, pinned_at: formatGitvaultTimestamp(this.now()) };
                 lastHead = head;
                 verified += 1;
             }
-            // verified prefix persists per page (resumable)
-            this.keystore.updateRepo(this.repoId, { verified_prefix: pin });
+            // verified prefix persists per page (resumable) — skipped entirely in no-write mode
+            if (persist)
+                this.keystore.updateRepo(this.repoId, { verified_prefix: pin });
             const next = nextListingRequest(request, page);
             if (!next)
                 break;
             request = next;
         }
-        this.keystore.updateRepo(this.repoId, { head_pin: pin, verified_prefix: null });
+        if (persist)
+            this.keystore.updateRepo(this.repoId, { head_pin: pin, verified_prefix: null });
         return { generation: pin.generation, head_sha256: pin.head_sha256, head: lastHead, genesis };
     }
     async readHead(generation, expectedSha256) {
@@ -809,21 +829,162 @@ export class GitvaultVault {
         }
         return object;
     }
-    /** Verify to newest, then decrypt + apply its carriers — advancing the materialized pin. */
-    async materialize() {
-        const state = await this.verifyToNewest();
+    /**
+     * Verify to newest, then decrypt + apply its carriers — advancing the
+     * materialized pin. `options.persist` (default `true`) is forwarded to
+     * {@link verifyToNewest} and gates this method's OWN `materialized_pin`
+     * write the same way — `repos fsck --no-write` computes and returns the
+     * real ref map and generation without moving either local pin.
+     */
+    async materialize(options = {}) {
+        const persist = options.persist ?? true;
+        const state = await this.verifyToNewest({ persist });
         const writerKey = state.genesis.creator_signing_pubkey;
         if (!state.head) {
-            this.keystore.updateRepo(this.repoId, { materialized_pin: { generation: state.generation, head_sha256: state.head_sha256, pinned_at: formatGitvaultTimestamp(this.now()) } });
+            if (persist)
+                this.keystore.updateRepo(this.repoId, { materialized_pin: { generation: state.generation, head_sha256: state.head_sha256, pinned_at: formatGitvaultTimestamp(this.now()) } });
             return { ...state, ref_state: null, retention_roots: null, refs: {}, roots: [], head_target: { kind: "symref", ref: "refs/heads/main" } };
         }
         const refState = await this.openCarrier("ref_state", state.head.ref_state, gitvaultPaths.refState(state.head.ref_state.object_id), writerKey);
         const roots = await this.openCarrier("retention_roots", state.head.retention_roots, gitvaultPaths.retentionRoots(state.head.retention_roots.object_id), writerKey);
         if (refState.generation !== state.generation || roots.generation !== state.generation)
             fail("CHAIN_UNUSABLE", "carrier generation does not match the head", "materializing gitvault head");
-        this.keystore.updateRepo(this.repoId, { materialized_pin: { generation: state.generation, head_sha256: state.head_sha256, pinned_at: formatGitvaultTimestamp(this.now()) } });
+        if (persist)
+            this.keystore.updateRepo(this.repoId, { materialized_pin: { generation: state.generation, head_sha256: state.head_sha256, pinned_at: formatGitvaultTimestamp(this.now()) } });
         return { ...state, ref_state: refState, retention_roots: roots, refs: { ...refState.refs }, roots: roots.roots.map((r) => ({ ...r })), head_target: refState.head_target };
     }
+    // ── envelope recipients (gitvault-human-envelopes task 4.1, the ADD-path workaround) ──
+    /**
+     * Wrap the vault's CURRENT epoch key to every org member the directory
+     * lists but the vault does not yet have a `key_envelope` for.
+     *
+     * **This is task 1.1's residual WORKAROUND, not the design D5 ideal.** D5
+     * describes a recipient-set change as an epoch rotation — "history epochs
+     * stay wrapped as they were; a new member reads from their first covered
+     * epoch forward" — which needs a protocol revision (task 1, BLOCKED as of
+     * 2026-08-26: V0 pins `epoch` to the single constant
+     * `GITVAULT_GENESIS_EPOCH` on every head, so there is no "forward" to
+     * speak of yet). What this method actually does, legally, without any
+     * protocol change: `key_envelope` objects are never head-referenced (not
+     * even genesis's own envelope is), so uploading an ADDITIONAL one at
+     * `envelopes/<current epoch>/<recipient fingerprint>` for a missing
+     * recipient is accepted by the existing generic create-only upload route
+     * as-is. The honest consequence: a newly-wrapped member gets the SAME
+     * single epoch every existing member already has, which in V0 means the
+     * vault's ENTIRE history — not "from here forward." True forward-only
+     * semantics wait on task 1's protocol revision; this method does not
+     * pretend otherwise.
+     *
+     * **TOFU pinning (design D4 point 3).** The first time this repo wraps a
+     * given `principal_id`, its CURRENT `ek_fingerprint` is pinned in the
+     * keystore repo file (`envelope_recipient_pins`). On a later call, a
+     * directory entry whose fingerprint no longer matches its pin is a
+     * REFUSAL for that recipient ONLY — reported under `skipped` with reason
+     * `pinned_key_mismatch` and both fingerprints in `details`, never wrapped
+     * under the new key, and never a thrown error that would abort the whole
+     * call (other recipients still get processed). Whether that mismatch is a
+     * legitimate key rotation or a substitution is a product/human decision
+     * this SDK does not make unattended.
+     *
+     * **The gateway directory route does not carry `public_key` yet**
+     * (`GET /orgs/v1/:org_id/encryption-keys` — see the doc comment on
+     * {@link GitvaultOrgEncryptionKeyEntry}). Until it does, every directory
+     * entry is reported under `skipped` with reason `missing_public_key`;
+     * this method needs no further change once the gateway ships the field.
+     *
+     * Best-effort by design at the call site, not here: this method itself
+     * either completes (returning a full per-recipient breakdown) or throws
+     * (e.g. `GITVAULT_READ_ONLY` when this principal holds no signing key).
+     * Callers that want "never block on this" (the deploy hook) wrap the call
+     * themselves — see `Gitvault.push`'s `#tryReconcileEnvelopeRecipients`.
+     */
+    async reconcileEnvelopeRecipients() {
+        const repo = this.repoFile();
+        const epoch = this.epoch();
+        const signer = this.signingKeypair();
+        const [directory, coverage] = await Promise.all([
+            this.transport.listOrgEncryptionKeys({ org_id: repo.org_id }),
+            this.transport.listEnvelopeRecipients({ repo_id: this.repoId }),
+        ]);
+        const covered = new Set(coverage.recipient_fingerprints);
+        const pins = { ...(repo.envelope_recipient_pins ?? {}) };
+        const wrapped = [];
+        const alreadyCovered = [];
+        const skipped = [];
+        let pinsChanged = false;
+        for (const entry of directory.keys) {
+            if (covered.has(entry.ek_fingerprint)) {
+                alreadyCovered.push(entry.ek_fingerprint);
+                continue;
+            }
+            const pinned = pins[entry.principal_id];
+            if (pinned !== undefined && pinned !== entry.ek_fingerprint) {
+                skipped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint, reason: "pinned_key_mismatch", details: { pinned_fingerprint: pinned, directory_fingerprint: entry.ek_fingerprint } });
+                continue;
+            }
+            if (typeof entry.public_key !== "string" || entry.public_key.length === 0) {
+                skipped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint, reason: "missing_public_key" });
+                continue;
+            }
+            let recipientPublicKey;
+            try {
+                recipientPublicKey = fromBase64url(entry.public_key, "public_key");
+            }
+            catch {
+                skipped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint, reason: "invalid_public_key" });
+                continue;
+            }
+            // Defense in depth: a directory row whose printed fingerprint does not
+            // derive from its own public_key is corrupt data, not a valid
+            // recipient — fail loud here rather than let `sealKeyEnvelope` (which
+            // derives the fingerprint itself and never trusts a caller-supplied
+            // one) silently seal under a fingerprint that disagrees with the one
+            // the directory printed.
+            const derived = ekFingerprint(recipientPublicKey);
+            if (derived !== entry.ek_fingerprint) {
+                skipped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint, reason: "invalid_public_key", details: { derived_fingerprint: derived } });
+                continue;
+            }
+            const sealed = await sealKeyEnvelope({
+                k_repo: this.kRepo(),
+                repo_id: this.repoId,
+                epoch,
+                recipient_public_key: recipientPublicKey,
+                signer,
+                created_at: formatGitvaultTimestamp(this.now()),
+            });
+            try {
+                await this.transport.putObject({
+                    repo_id: this.repoId,
+                    path: gitvaultPaths.envelope(epoch, sealed.receipt.recipient_fingerprint),
+                    bytes: sealed.stored_bytes,
+                    expected_sha256: sealed.stored_bytes_sha256,
+                    expected_size_bytes: sealed.size_bytes,
+                });
+                wrapped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint });
+            }
+            catch (e) {
+                // A concurrent reconcile (another machine/session) may have wrapped
+                // the SAME recipient first — HPKE seal is randomized, so two valid
+                // wraps of the same K_repo to the same recipient produce DIFFERENT
+                // ciphertext bytes, and the create-only path's read-and-compare
+                // reports that as `GITVAULT_OBJECT_EXISTS_DIFFERENT` even though the
+                // recipient is now genuinely covered. Treat exactly that code as a
+                // benign race, not a failure; anything else propagates.
+                if (isRun402Error(e) && e.code === "GITVAULT_OBJECT_EXISTS_DIFFERENT") {
+                    alreadyCovered.push(entry.ek_fingerprint);
+                }
+                else {
+                    throw e;
+                }
+            }
+            pins[entry.principal_id] = entry.ek_fingerprint;
+            pinsChanged = true;
+        }
+        if (pinsChanged)
+            this.keystore.updateRepo(this.repoId, { envelope_recipient_pins: pins });
+        return { repo_id: this.repoId, org_id: repo.org_id, epoch, wrapped, already_covered: alreadyCovered, skipped };
+    }
     // ── object building ──
     seal(kind, objectId, plaintext, path) {
         const sealed = sealFrame({ k_obj: deriveObjectKey(this.kRepo(), this.repoId, this.epoch(), kind, objectId), repo_id: this.repoId, object_kind: kind, object_id: objectId, epoch: this.epoch(), plaintext });
@@ -846,6 +1007,14 @@ export class GitvaultVault {
         return kp.seed;
     }
     writerKeyId() { return this.keystore.ensureIdentity().signing_fingerprint; }
+    /** The owner's full signing keypair, or `GITVAULT_READ_ONLY` — same refusal path as {@link signer}, which returns only the seed; {@link sealKeyEnvelope} needs both halves. */
+    signingKeypair() {
+        const identity = this.keystore.ensureIdentity();
+        const kp = this.keystore.signingKeypair(identity);
+        if (!kp)
+            fail("GITVAULT_READ_ONLY", "the signing key is missing from identity.json; this principal is read-only", "signing gitvault object", undefined, [{ action: "stay read-only at the materialized pin" }]);
+        return kp;
+    }
     buildRefState(generation, refs, headTarget) {
         if (headTarget.kind === "symref" && !BRANCH_REF_RE.test(headTarget.ref))
             fail("REFNAME_UNSUPPORTED", `head_target symref must name a refs/heads/* branch: ${headTarget.ref}`, "building ref_state");