@run402/sdk 4.94.0 → 4.96.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +44 -44
- package/core-dist/keystore.d.ts +1 -1
- package/core-dist/keystore.js +1 -1
- package/dist/actions.d.ts +3 -3
- package/dist/actions.d.ts.map +1 -1
- package/dist/app-up.d.ts +2 -2
- package/dist/app-up.d.ts.map +1 -1
- package/dist/config.d.ts +1 -2
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js.map +1 -1
- package/dist/credentials.d.ts +1 -1
- package/dist/errors.d.ts +6 -6
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +1 -1
- package/dist/errors.js.map +1 -1
- package/dist/index.d.ts +9 -9
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +9 -9
- package/dist/index.js.map +1 -1
- package/dist/namespaces/admin.d.ts +1 -1
- package/dist/namespaces/admin.d.ts.map +1 -1
- package/dist/namespaces/ai.d.ts +1 -1
- package/dist/namespaces/ai.js +2 -2
- package/dist/namespaces/ai.js.map +1 -1
- package/dist/namespaces/assets.js +1 -1
- package/dist/namespaces/assets.js.map +1 -1
- package/dist/namespaces/ci.js +3 -3
- package/dist/namespaces/ci.js.map +1 -1
- package/dist/namespaces/deploy.d.ts +5 -5
- package/dist/namespaces/deploy.d.ts.map +1 -1
- package/dist/namespaces/deploy.js +45 -46
- package/dist/namespaces/deploy.js.map +1 -1
- package/dist/namespaces/deploy.types.d.ts +19 -19
- package/dist/namespaces/deploy.types.d.ts.map +1 -1
- package/dist/namespaces/domains.d.ts +10 -2
- package/dist/namespaces/domains.d.ts.map +1 -1
- package/dist/namespaces/domains.js +10 -5
- package/dist/namespaces/domains.js.map +1 -1
- package/dist/namespaces/errors.js +1 -1
- package/dist/namespaces/functions.js +1 -1
- package/dist/namespaces/functions.js.map +1 -1
- package/dist/namespaces/org.d.ts +2 -2
- package/dist/namespaces/org.js +2 -2
- package/dist/namespaces/org.types.d.ts +3 -3
- package/dist/namespaces/pay.js +1 -1
- package/dist/namespaces/{gitvault.d.ts → repos.d.ts} +438 -451
- package/dist/namespaces/repos.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.js → repos.js} +454 -462
- package/dist/namespaces/repos.js.map +1 -0
- package/dist/namespaces/rooms.js +2 -2
- package/dist/namespaces/rooms.js.map +1 -1
- package/dist/namespaces/session.d.ts +2 -2
- package/dist/namespaces/session.d.ts.map +1 -1
- package/dist/namespaces/session.js +2 -2
- package/dist/namespaces/session.js.map +1 -1
- package/dist/namespaces/tier.d.ts +4 -4
- package/dist/namespaces/tier.d.ts.map +1 -1
- package/dist/namespaces/transfers.d.ts +46 -15
- package/dist/namespaces/transfers.d.ts.map +1 -1
- package/dist/namespaces/transfers.js.map +1 -1
- package/dist/namespaces/{gitvault.crypto.d.ts → vault.crypto.d.ts} +141 -141
- package/dist/namespaces/vault.crypto.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.crypto.js → vault.crypto.js} +173 -173
- package/dist/namespaces/vault.crypto.js.map +1 -0
- package/dist/namespaces/{gitvault.types.d.ts → vault.types.d.ts} +136 -136
- package/dist/namespaces/vault.types.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.types.js → vault.types.js} +4 -4
- package/dist/namespaces/vault.types.js.map +1 -0
- package/dist/node/actions-node.js +8 -8
- package/dist/node/actions-node.js.map +1 -1
- package/dist/node/assets-node.js +6 -6
- package/dist/node/assets-node.js.map +1 -1
- package/dist/node/bearer-redeem-key.d.ts +1 -1
- package/dist/node/bearer-redeem-key.js +5 -5
- package/dist/node/bearer-redeem-key.js.map +1 -1
- package/dist/node/ci.js +1 -1
- package/dist/node/ci.js.map +1 -1
- package/dist/node/credentials.d.ts +1 -1
- package/dist/node/credentials.js +1 -1
- package/dist/node/deploy-manifest.d.ts +3 -5
- package/dist/node/deploy-manifest.d.ts.map +1 -1
- package/dist/node/deploy-manifest.js +3 -12
- package/dist/node/deploy-manifest.js.map +1 -1
- package/dist/node/http-dispatcher.js +5 -5
- package/dist/node/http-dispatcher.js.map +1 -1
- package/dist/node/index.d.ts +29 -29
- package/dist/node/index.d.ts.map +1 -1
- package/dist/node/index.js +39 -39
- package/dist/node/index.js.map +1 -1
- package/dist/node/manifest-export.js +2 -2
- package/dist/node/manifest-export.js.map +1 -1
- package/dist/node/org-adopt.js +1 -1
- package/dist/node/org-adopt.js.map +1 -1
- package/dist/node/sites-node.js +1 -1
- package/dist/node/sites-node.js.map +1 -1
- package/dist/node/{gitvault-address.d.ts → vault-address.d.ts} +42 -42
- package/dist/node/vault-address.d.ts.map +1 -0
- package/dist/node/{gitvault-address.js → vault-address.js} +43 -43
- package/dist/node/vault-address.js.map +1 -0
- package/dist/node/{gitvault-apply.d.ts → vault-apply.d.ts} +27 -27
- package/dist/node/vault-apply.d.ts.map +1 -0
- package/dist/node/{gitvault-apply.js → vault-apply.js} +38 -38
- package/dist/node/vault-apply.js.map +1 -0
- package/dist/node/vault-byo-config.d.ts +29 -0
- package/dist/node/vault-byo-config.d.ts.map +1 -0
- package/dist/node/{gitvault-byo-config.js → vault-byo-config.js} +18 -18
- package/dist/node/vault-byo-config.js.map +1 -0
- package/dist/node/vault-byo-probe.d.ts +20 -0
- package/dist/node/vault-byo-probe.d.ts.map +1 -0
- package/dist/node/vault-byo-probe.js +57 -0
- package/dist/node/vault-byo-probe.js.map +1 -0
- package/dist/node/{gitvault-creation-journal.d.ts → vault-creation-journal.d.ts} +69 -69
- package/dist/node/vault-creation-journal.d.ts.map +1 -0
- package/dist/node/{gitvault-creation-journal.js → vault-creation-journal.js} +54 -54
- package/dist/node/vault-creation-journal.js.map +1 -0
- package/dist/node/{gitvault-degraded-read.d.ts → vault-degraded-read.d.ts} +34 -34
- package/dist/node/vault-degraded-read.d.ts.map +1 -0
- package/dist/node/{gitvault-degraded-read.js → vault-degraded-read.js} +24 -24
- package/dist/node/vault-degraded-read.js.map +1 -0
- package/dist/node/{gitvault-deploy.d.ts → vault-deploy.d.ts} +67 -67
- package/dist/node/vault-deploy.d.ts.map +1 -0
- package/dist/node/{gitvault-deploy.js → vault-deploy.js} +27 -27
- package/dist/node/vault-deploy.js.map +1 -0
- package/dist/node/{gitvault-edge-fetch.d.ts → vault-edge-fetch.d.ts} +9 -9
- package/dist/node/vault-edge-fetch.d.ts.map +1 -0
- package/dist/node/{gitvault-edge-fetch.js → vault-edge-fetch.js} +11 -11
- package/dist/node/vault-edge-fetch.js.map +1 -0
- package/dist/node/{gitvault-handoff.d.ts → vault-handoff.d.ts} +9 -9
- package/dist/node/vault-handoff.d.ts.map +1 -0
- package/dist/node/{gitvault-handoff.js → vault-handoff.js} +24 -24
- package/dist/node/vault-handoff.js.map +1 -0
- package/dist/node/{gitvault-keystore.d.ts → vault-keystore.d.ts} +87 -77
- package/dist/node/vault-keystore.d.ts.map +1 -0
- package/dist/node/{gitvault-keystore.js → vault-keystore.js} +105 -68
- package/dist/node/vault-keystore.js.map +1 -0
- package/dist/node/{gitvault-member-bundle.d.ts → vault-member-bundle.d.ts} +17 -17
- package/dist/node/vault-member-bundle.d.ts.map +1 -0
- package/dist/node/{gitvault-member-bundle.js → vault-member-bundle.js} +11 -11
- package/dist/node/vault-member-bundle.js.map +1 -0
- package/dist/node/{gitvault-mirror-backend.d.ts → vault-mirror-backend.d.ts} +26 -26
- package/dist/node/vault-mirror-backend.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror-backend.js → vault-mirror-backend.js} +25 -25
- package/dist/node/vault-mirror-backend.js.map +1 -0
- package/dist/node/{gitvault-mirror-config.d.ts → vault-mirror-config.d.ts} +23 -23
- package/dist/node/vault-mirror-config.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror-config.js → vault-mirror-config.js} +16 -16
- package/dist/node/vault-mirror-config.js.map +1 -0
- package/dist/node/{gitvault-mirror.d.ts → vault-mirror.d.ts} +36 -36
- package/dist/node/vault-mirror.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror.js → vault-mirror.js} +75 -75
- package/dist/node/vault-mirror.js.map +1 -0
- package/dist/node/{gitvault-native-crypto.d.ts → vault-native-crypto.d.ts} +10 -10
- package/dist/node/vault-native-crypto.d.ts.map +1 -0
- package/dist/node/{gitvault-native-crypto.js → vault-native-crypto.js} +16 -16
- package/dist/node/vault-native-crypto.js.map +1 -0
- package/dist/node/{gitvault-open-or-create.d.ts → vault-open-or-create.d.ts} +16 -16
- package/dist/node/vault-open-or-create.d.ts.map +1 -0
- package/dist/node/{gitvault-open-or-create.js → vault-open-or-create.js} +10 -10
- package/dist/node/vault-open-or-create.js.map +1 -0
- package/dist/node/{gitvault-prewarm.d.ts → vault-prewarm.d.ts} +13 -13
- package/dist/node/vault-prewarm.d.ts.map +1 -0
- package/dist/node/{gitvault-prewarm.js → vault-prewarm.js} +25 -25
- package/dist/node/vault-prewarm.js.map +1 -0
- package/dist/node/{gitvault-profile-scan.d.ts → vault-profile-scan.d.ts} +3 -3
- package/dist/node/vault-profile-scan.d.ts.map +1 -0
- package/dist/node/{gitvault-profile-scan.js → vault-profile-scan.js} +12 -12
- package/dist/node/vault-profile-scan.js.map +1 -0
- package/dist/node/{gitvault-prune.d.ts → vault-prune.d.ts} +61 -61
- package/dist/node/vault-prune.d.ts.map +1 -0
- package/dist/node/{gitvault-prune.js → vault-prune.js} +34 -34
- package/dist/node/vault-prune.js.map +1 -0
- package/dist/node/{gitvault-publication.d.ts → vault-publication.d.ts} +399 -399
- package/dist/node/vault-publication.d.ts.map +1 -0
- package/dist/node/{gitvault-publication.js → vault-publication.js} +584 -584
- package/dist/node/vault-publication.js.map +1 -0
- package/dist/node/{gitvault-push-to-create.d.ts → vault-push-to-create.d.ts} +16 -16
- package/dist/node/vault-push-to-create.d.ts.map +1 -0
- package/dist/node/{gitvault-push-to-create.js → vault-push-to-create.js} +9 -9
- package/dist/node/vault-push-to-create.js.map +1 -0
- package/dist/node/{gitvault-recover.d.ts → vault-recover.d.ts} +50 -50
- package/dist/node/vault-recover.d.ts.map +1 -0
- package/dist/node/{gitvault-recover.js → vault-recover.js} +84 -84
- package/dist/node/vault-recover.js.map +1 -0
- package/dist/node/{gitvault-restore.d.ts → vault-restore.d.ts} +8 -8
- package/dist/node/vault-restore.d.ts.map +1 -0
- package/dist/node/{gitvault-restore.js → vault-restore.js} +11 -11
- package/dist/node/vault-restore.js.map +1 -0
- package/dist/node/{gitvault-snapshot.d.ts → vault-snapshot.d.ts} +48 -48
- package/dist/node/vault-snapshot.d.ts.map +1 -0
- package/dist/node/{gitvault-snapshot.js → vault-snapshot.js} +61 -61
- package/dist/node/vault-snapshot.js.map +1 -0
- package/dist/node/{gitvault-writer-state.d.ts → vault-writer-state.d.ts} +8 -8
- package/dist/node/vault-writer-state.d.ts.map +1 -0
- package/dist/node/{gitvault-writer-state.js → vault-writer-state.js} +15 -15
- package/dist/node/vault-writer-state.js.map +1 -0
- package/dist/node/workflow-output.js +4 -4
- package/dist/node/workflow-output.js.map +1 -1
- package/dist/scoped.d.ts +8 -8
- package/dist/scoped.d.ts.map +1 -1
- package/dist/scoped.js +3 -3
- package/dist/scoped.js.map +1 -1
- package/package.json +1 -1
- package/dist/namespaces/gitvault.crypto.d.ts.map +0 -1
- package/dist/namespaces/gitvault.crypto.js.map +0 -1
- package/dist/namespaces/gitvault.d.ts.map +0 -1
- package/dist/namespaces/gitvault.js.map +0 -1
- package/dist/namespaces/gitvault.types.d.ts.map +0 -1
- package/dist/namespaces/gitvault.types.js.map +0 -1
- package/dist/node/gitvault-address.d.ts.map +0 -1
- package/dist/node/gitvault-address.js.map +0 -1
- package/dist/node/gitvault-apply.d.ts.map +0 -1
- package/dist/node/gitvault-apply.js.map +0 -1
- package/dist/node/gitvault-byo-config.d.ts +0 -29
- package/dist/node/gitvault-byo-config.d.ts.map +0 -1
- package/dist/node/gitvault-byo-config.js.map +0 -1
- package/dist/node/gitvault-byo-probe.d.ts +0 -20
- package/dist/node/gitvault-byo-probe.d.ts.map +0 -1
- package/dist/node/gitvault-byo-probe.js +0 -57
- package/dist/node/gitvault-byo-probe.js.map +0 -1
- package/dist/node/gitvault-creation-journal.d.ts.map +0 -1
- package/dist/node/gitvault-creation-journal.js.map +0 -1
- package/dist/node/gitvault-degraded-read.d.ts.map +0 -1
- package/dist/node/gitvault-degraded-read.js.map +0 -1
- package/dist/node/gitvault-deploy.d.ts.map +0 -1
- package/dist/node/gitvault-deploy.js.map +0 -1
- package/dist/node/gitvault-edge-fetch.d.ts.map +0 -1
- package/dist/node/gitvault-edge-fetch.js.map +0 -1
- package/dist/node/gitvault-handoff.d.ts.map +0 -1
- package/dist/node/gitvault-handoff.js.map +0 -1
- package/dist/node/gitvault-keystore.d.ts.map +0 -1
- package/dist/node/gitvault-keystore.js.map +0 -1
- package/dist/node/gitvault-member-bundle.d.ts.map +0 -1
- package/dist/node/gitvault-member-bundle.js.map +0 -1
- package/dist/node/gitvault-mirror-backend.d.ts.map +0 -1
- package/dist/node/gitvault-mirror-backend.js.map +0 -1
- package/dist/node/gitvault-mirror-config.d.ts.map +0 -1
- package/dist/node/gitvault-mirror-config.js.map +0 -1
- package/dist/node/gitvault-mirror.d.ts.map +0 -1
- package/dist/node/gitvault-mirror.js.map +0 -1
- package/dist/node/gitvault-native-crypto.d.ts.map +0 -1
- package/dist/node/gitvault-native-crypto.js.map +0 -1
- package/dist/node/gitvault-open-or-create.d.ts.map +0 -1
- package/dist/node/gitvault-open-or-create.js.map +0 -1
- package/dist/node/gitvault-prewarm.d.ts.map +0 -1
- package/dist/node/gitvault-prewarm.js.map +0 -1
- package/dist/node/gitvault-profile-scan.d.ts.map +0 -1
- package/dist/node/gitvault-profile-scan.js.map +0 -1
- package/dist/node/gitvault-prune.d.ts.map +0 -1
- package/dist/node/gitvault-prune.js.map +0 -1
- package/dist/node/gitvault-publication.d.ts.map +0 -1
- package/dist/node/gitvault-publication.js.map +0 -1
- package/dist/node/gitvault-push-to-create.d.ts.map +0 -1
- package/dist/node/gitvault-push-to-create.js.map +0 -1
- package/dist/node/gitvault-recover.d.ts.map +0 -1
- package/dist/node/gitvault-recover.js.map +0 -1
- package/dist/node/gitvault-restore.d.ts.map +0 -1
- package/dist/node/gitvault-restore.js.map +0 -1
- package/dist/node/gitvault-snapshot.d.ts.map +0 -1
- package/dist/node/gitvault-snapshot.js.map +0 -1
- package/dist/node/gitvault-writer-state.d.ts.map +0 -1
- package/dist/node/gitvault-writer-state.js.map +0 -1
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* vault-mirror-and-recover — `r402s-recover`, the offline recovery engine
|
|
3
3
|
* (design D4/D5, tasks 3.1–3.5).
|
|
4
4
|
*
|
|
5
|
-
* Turns a mirrored `source/<repo_id>/` prefix (any {@link
|
|
5
|
+
* Turns a mirrored `source/<repo_id>/` prefix (any {@link VaultMirrorBackend}
|
|
6
6
|
* — S3 or a local directory) plus a pin (the keystore's recovery receipt, or
|
|
7
7
|
* one supplied explicitly) into a working git repository, with NO SERVER
|
|
8
|
-
* INVOLVED: everything here reads from the {@link
|
|
8
|
+
* INVOLVED: everything here reads from the {@link VaultMirrorBackend}
|
|
9
9
|
* alone. Only the decrypt/materialize step touches key material (design D5)
|
|
10
10
|
* — discovery, chain verification, and closure/absence adjudication run
|
|
11
11
|
* keylessly and are a first-class outcome on their own (`run402 repos fsck
|
|
@@ -13,18 +13,18 @@
|
|
|
13
13
|
*
|
|
14
14
|
* Reuses the SAME pure protocol functions the live SDK verifies pushes with
|
|
15
15
|
* ({@link checkChainLink}, {@link assertNoTransition}, {@link
|
|
16
|
-
* checkClaimSetEquality}, {@link
|
|
16
|
+
* checkClaimSetEquality}, {@link vaultPaths}) — this file adds no new
|
|
17
17
|
* protocol semantics, exactly per the design doc's "recovery is the keyed
|
|
18
18
|
* offline subset of machinery that already exists."
|
|
19
19
|
*/
|
|
20
20
|
import { createHash } from "node:crypto";
|
|
21
21
|
import { existsSync, mkdirSync } from "node:fs";
|
|
22
22
|
import { LocalError, isRun402Error } from "../errors.js";
|
|
23
|
-
import {
|
|
24
|
-
import { assertNoTransition, checkChainLink, checkClaimSetEquality,
|
|
25
|
-
import {
|
|
26
|
-
import { discoverMemberBundles, parseMemberRecoveryBundle, unwrapMemberRecoveryBundle, } from "./
|
|
27
|
-
import { hardenedGit, hasObject } from "./
|
|
23
|
+
import { VAULT_GENESIS_EPOCH, VAULT_GENESIS_GENERATION, VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT, VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, bytesToHex, checkGenesisKeyBindings, checkRecoveryReceipt, deriveDigestKey, deriveObjectKey, generateEncryptionKeypair, hexToBytes, keyedCommitment, objectsetContent, openEpochRotationForRecipient, openFrame, openKeyEnvelope, parseVaultStrict, parseRotateEpochPayload, verifyVaultObject, } from "../namespaces/vault.crypto.js";
|
|
24
|
+
import { assertNoTransition, checkChainLink, checkClaimSetEquality, vaultPaths, nextGeneration, reconcileRetainedTipRefs } from "./vault-publication.js";
|
|
25
|
+
import { VaultKeystore } from "./vault-keystore.js";
|
|
26
|
+
import { discoverMemberBundles, parseMemberRecoveryBundle, unwrapMemberRecoveryBundle, } from "./vault-member-bundle.js";
|
|
27
|
+
import { hardenedGit, hasObject } from "./vault-snapshot.js";
|
|
28
28
|
function fail(code, message, context, details, nextActions) {
|
|
29
29
|
throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
|
|
30
30
|
}
|
|
@@ -46,14 +46,14 @@ function sha256Hex(bytes) {
|
|
|
46
46
|
*/
|
|
47
47
|
export async function discoverAndVerifyChain(options) {
|
|
48
48
|
const { backend } = options;
|
|
49
|
-
const genesisBytes = await backend.get(
|
|
49
|
+
const genesisBytes = await backend.get(vaultPaths.head(VAULT_GENESIS_GENERATION));
|
|
50
50
|
if (!genesisBytes)
|
|
51
|
-
fail("CHAIN_BROKEN", "the mirror holds no genesis (head/0000000000000000) — nothing to recover", "discovering
|
|
52
|
-
const genesis =
|
|
51
|
+
fail("CHAIN_BROKEN", "the mirror holds no genesis (head/0000000000000000) — nothing to recover", "discovering vault from mirror", { destination: backend.describe() });
|
|
52
|
+
const genesis = parseVaultStrict(new TextDecoder().decode(genesisBytes));
|
|
53
53
|
if (genesis.object_kind !== "vault_genesis")
|
|
54
|
-
fail("CHAIN_BROKEN", "head/0000000000000000 is not a vault_genesis object", "discovering
|
|
55
|
-
if (!
|
|
56
|
-
fail("
|
|
54
|
+
fail("CHAIN_BROKEN", "head/0000000000000000 is not a vault_genesis object", "discovering vault from mirror");
|
|
55
|
+
if (!verifyVaultObject(genesis, genesis.creator_signing_pubkey)) {
|
|
56
|
+
fail("VAULT_SIGNATURE_INVALID", "vault_genesis signature does not verify under its own claimed creator key", "discovering vault from mirror", { repo_id: genesis.repo_id });
|
|
57
57
|
}
|
|
58
58
|
const genesisSha = sha256Hex(genesisBytes);
|
|
59
59
|
const receipt = options.recovery_receipt ?? options.keystore?.readRecoveryReceipt(genesis.repo_id) ?? null;
|
|
@@ -61,24 +61,24 @@ export async function discoverAndVerifyChain(options) {
|
|
|
61
61
|
if (receipt) {
|
|
62
62
|
const problems = checkRecoveryReceipt(receipt, genesis);
|
|
63
63
|
if (problems.length > 0) {
|
|
64
|
-
fail("VAULT_CREATION_CONFLICT", `the recovery receipt does not pin this mirror's genesis (${problems.join(", ")}) — this mirror may hold a SUBSTITUTED vault; refusing to recover from it`, "discovering
|
|
64
|
+
fail("VAULT_CREATION_CONFLICT", `the recovery receipt does not pin this mirror's genesis (${problems.join(", ")}) — this mirror may hold a SUBSTITUTED vault; refusing to recover from it`, "discovering vault from mirror", { repo_id: genesis.repo_id, problems, expected_genesis_sha256: receipt.genesis_sha256, observed_genesis_sha256: genesisSha }, [{ action: "verify the mirror destination and pin are the ones you intend — do not retry with a different receipt to make this pass" }]);
|
|
65
65
|
}
|
|
66
66
|
pinTrust = "receipt";
|
|
67
67
|
}
|
|
68
68
|
const chain = [];
|
|
69
69
|
let prevHash = genesisSha;
|
|
70
|
-
let prevGen =
|
|
71
|
-
let prevEpoch =
|
|
70
|
+
let prevGen = VAULT_GENESIS_GENERATION;
|
|
71
|
+
let prevEpoch = VAULT_GENESIS_EPOCH;
|
|
72
72
|
let chainBreak = null;
|
|
73
73
|
const rotations = [];
|
|
74
74
|
for (;;) {
|
|
75
75
|
const nextGen = nextGeneration(prevGen);
|
|
76
|
-
const bytes = await backend.get(
|
|
76
|
+
const bytes = await backend.get(vaultPaths.head(nextGen));
|
|
77
77
|
if (!bytes)
|
|
78
78
|
break; // natural end — the mirror holds nothing further at this generation
|
|
79
79
|
let head;
|
|
80
80
|
try {
|
|
81
|
-
head =
|
|
81
|
+
head = parseVaultStrict(new TextDecoder().decode(bytes));
|
|
82
82
|
checkChainLink({
|
|
83
83
|
head, stored_bytes: bytes, listed_sha256: sha256Hex(bytes), expected_generation: nextGen, prev_sha256: prevHash,
|
|
84
84
|
repo_id: genesis.repo_id, writer_public_key: genesis.creator_signing_pubkey, writer_key_id: genesis.writer_key_id, prev_epoch: prevEpoch,
|
|
@@ -120,31 +120,31 @@ export async function closureForGeneration(backend, chain, targetGeneration) {
|
|
|
120
120
|
const out = [];
|
|
121
121
|
let gen = targetGeneration;
|
|
122
122
|
for (;;) {
|
|
123
|
-
if (gen ===
|
|
123
|
+
if (gen === VAULT_GENESIS_GENERATION)
|
|
124
124
|
break;
|
|
125
125
|
const entry = byGen.get(gen);
|
|
126
126
|
if (!entry)
|
|
127
|
-
fail("CHAIN_BROKEN", `generation ${gen} is not in the verified chain`, "resolving
|
|
128
|
-
out.push({ key:
|
|
129
|
-
out.push({ key:
|
|
127
|
+
fail("CHAIN_BROKEN", `generation ${gen} is not in the verified chain`, "resolving vault recovery closure", { generation: gen });
|
|
128
|
+
out.push({ key: vaultPaths.refState(entry.head.ref_state.object_id), object_id: entry.head.ref_state.object_id, kind: "ref_state" });
|
|
129
|
+
out.push({ key: vaultPaths.retentionRoots(entry.head.retention_roots.object_id), object_id: entry.head.retention_roots.object_id, kind: "retention_roots" });
|
|
130
130
|
if (entry.head.checkpoint) {
|
|
131
131
|
const claimSetId = entry.head.checkpoint.claim_set.object_id;
|
|
132
|
-
out.push({ key:
|
|
132
|
+
out.push({ key: vaultPaths.claimSet(claimSetId), object_id: claimSetId, kind: "checkpoint_claim_set" });
|
|
133
133
|
// The claim set's OWN content (plaintext-structured — no decryption)
|
|
134
134
|
// enumerates the manifest + every pack. Missing claim-set bytes stop
|
|
135
135
|
// enumeration here; the caller's adjudication loop reports it, and
|
|
136
136
|
// enumeration simply cannot go further without it (honest, not silent).
|
|
137
|
-
const claimBytes = await backend.get(
|
|
137
|
+
const claimBytes = await backend.get(vaultPaths.claimSet(claimSetId));
|
|
138
138
|
if (claimBytes) {
|
|
139
|
-
const claimSet =
|
|
140
|
-
out.push({ key:
|
|
139
|
+
const claimSet = parseVaultStrict(new TextDecoder().decode(claimBytes));
|
|
140
|
+
out.push({ key: vaultPaths.checkpointManifest(claimSet.manifest_receipt.object_id), object_id: claimSet.manifest_receipt.object_id, kind: "checkpoint_manifest" });
|
|
141
141
|
for (const p of claimSet.ordered_pack_receipts)
|
|
142
|
-
out.push({ key:
|
|
142
|
+
out.push({ key: vaultPaths.checkpointPack(p.object_id), object_id: p.object_id, kind: "checkpoint_pack" });
|
|
143
143
|
}
|
|
144
144
|
break; // the checkpoint's recovery bundle is self-contained; no earlier WAL is needed
|
|
145
145
|
}
|
|
146
146
|
for (const w of entry.head.wal_entries)
|
|
147
|
-
out.push({ key:
|
|
147
|
+
out.push({ key: vaultPaths.wal(w.object_id), object_id: w.object_id, kind: "wal_pack" });
|
|
148
148
|
gen = generationMinusOne(gen);
|
|
149
149
|
}
|
|
150
150
|
return out;
|
|
@@ -176,7 +176,7 @@ export async function adjudicateAbsences(backend, required) {
|
|
|
176
176
|
if (!bytes)
|
|
177
177
|
continue;
|
|
178
178
|
try {
|
|
179
|
-
const intent =
|
|
179
|
+
const intent = parseVaultStrict(new TextDecoder().decode(bytes));
|
|
180
180
|
intents.push({ object_id: intent.object_id, delete_set: new Set((intent.core?.delete_set ?? []).map((d) => d.object_id)) });
|
|
181
181
|
}
|
|
182
182
|
catch {
|
|
@@ -199,11 +199,11 @@ export async function adjudicateAbsences(backend, required) {
|
|
|
199
199
|
* materializes. A genuinely keyless integrity probe (design D5) — useful as a
|
|
200
200
|
* CI check that never needs a secret.
|
|
201
201
|
*/
|
|
202
|
-
export async function
|
|
202
|
+
export async function verifyVaultMirror(backend, options = {}) {
|
|
203
203
|
const discovery = await discoverAndVerifyChain({ backend, ...options });
|
|
204
204
|
const { generation, absences } = await resolveWithFallback(backend, discovery, { requireMaterializable: false });
|
|
205
205
|
const inventory = {};
|
|
206
|
-
if (generation !==
|
|
206
|
+
if (generation !== VAULT_GENESIS_GENERATION) {
|
|
207
207
|
const required = await closureForGeneration(backend, discovery.chain, generation);
|
|
208
208
|
for (const r of required)
|
|
209
209
|
inventory[r.kind] = (inventory[r.kind] ?? 0) + 1;
|
|
@@ -218,8 +218,8 @@ export async function verifyGitvaultMirror(backend, options = {}) {
|
|
|
218
218
|
recovered_generation: generation, chain_verified_to_generation: discovery.newest_generation, chain_break: discovery.chain_break,
|
|
219
219
|
epoch_decrypt_failure: null, absences,
|
|
220
220
|
data_loss_detected: absences.some((a) => a.adjudication === "unexplained_absence"),
|
|
221
|
-
validity_not_freshness:
|
|
222
|
-
keystore_still_required:
|
|
221
|
+
validity_not_freshness: VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT,
|
|
222
|
+
keystore_still_required: VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT,
|
|
223
223
|
mode: "keyless_verify", inventory,
|
|
224
224
|
member_recovery_bundles: memberBundles,
|
|
225
225
|
};
|
|
@@ -238,7 +238,7 @@ async function resolveWithFallback(backend, discovery, options) {
|
|
|
238
238
|
const allAbsences = [];
|
|
239
239
|
let gen = options.start_generation ?? discovery.newest_generation;
|
|
240
240
|
for (;;) {
|
|
241
|
-
if (gen ===
|
|
241
|
+
if (gen === VAULT_GENESIS_GENERATION)
|
|
242
242
|
return { generation: gen, absences: allAbsences };
|
|
243
243
|
const required = await closureForGeneration(backend, discovery.chain, gen);
|
|
244
244
|
const absences = await adjudicateAbsences(backend, required);
|
|
@@ -258,13 +258,13 @@ async function resolveWithFallback(backend, discovery, options) {
|
|
|
258
258
|
/** Open the recipient's genesis key envelope and decrypt `K_1` — the FIRST step in this file that touches key material (a genesis's own envelope, `rotation_id` absent — D203). */
|
|
259
259
|
async function resolveGenesisEpochKey(backend, genesis, identity) {
|
|
260
260
|
if (!identity.encryption_private_key_hex) {
|
|
261
|
-
fail("VAULT_UNRECOVERABLE", "no encryption key available — recovery can verify and adjudicate but cannot decrypt or materialize anything", "materializing
|
|
261
|
+
fail("VAULT_UNRECOVERABLE", "no encryption key available — recovery can verify and adjudicate but cannot decrypt or materialize anything", "materializing vault recovery", undefined, [
|
|
262
262
|
{ action: "restore the principal keystore (identity.json) from backup, then re-run recover" },
|
|
263
263
|
{ action: "run `run402 repos fsck --mirror` for the verify-only outcome" },
|
|
264
264
|
]);
|
|
265
265
|
}
|
|
266
266
|
if (genesis.envelopes.length === 0)
|
|
267
|
-
fail("VAULT_CREATION_CONFLICT", "genesis carries no key envelope", "materializing
|
|
267
|
+
fail("VAULT_CREATION_CONFLICT", "genesis carries no key envelope", "materializing vault recovery");
|
|
268
268
|
// A real vault can carry MORE than one key_envelope ledger row — a
|
|
269
269
|
// foreign recipient's envelope is the norm on a multi-recipient vault,
|
|
270
270
|
// never an anomaly. A
|
|
@@ -276,32 +276,32 @@ async function resolveGenesisEpochKey(backend, genesis, identity) {
|
|
|
276
276
|
// can only ever decrypt ITS OWN envelope (the recipient-only read gate
|
|
277
277
|
// means the mirror never even holds anyone else's — see
|
|
278
278
|
// `keyEnvelopeRecipientFingerprintFromKey`/`skipped_foreign_recipient` in
|
|
279
|
-
// `
|
|
279
|
+
// `vault-mirror.ts`), so this function never looks for, and never fails
|
|
280
280
|
// on, a FOREIGN envelope being absent — that is silent-OK. A missing OWN
|
|
281
281
|
// envelope in genesis.envelopes (no entry matches our fingerprint at all)
|
|
282
282
|
// is its own distinct, honest refusal, separate from "the mirror never
|
|
283
283
|
// synced the bytes for an envelope genesis DOES name for us" below.
|
|
284
284
|
const envelopeReceipt = genesis.envelopes.find((e) => e.recipient_fingerprint === identity.encryption_fingerprint);
|
|
285
285
|
if (!envelopeReceipt) {
|
|
286
|
-
fail("
|
|
286
|
+
fail("VAULT_ENVELOPE_NOT_FOR_RECIPIENT", "genesis carries no key envelope for this machine's identity — this keystore is not a recipient of this vault", "materializing vault recovery", { own_fingerprint: identity.encryption_fingerprint });
|
|
287
287
|
}
|
|
288
288
|
// `key-envelopes/<epoch>/<recipient_fingerprint>.env` — the GATEWAY's real
|
|
289
289
|
// §3 wire key (`upload-sessions.ts` `UPLOADABLE_KINDS.key_envelope.key()`,
|
|
290
290
|
// mirrored by `storage-keys.ts` `objectKeyFor`), matching protocol §3
|
|
291
|
-
// exactly. The SDK's OWN `
|
|
291
|
+
// exactly. The SDK's OWN `vault-creation-journal.ts` envelope `path`
|
|
292
292
|
// string (`envelopes/<epoch>/<fp>`) is a DIFFERENT, client-local label used
|
|
293
293
|
// only for the upload manifest ("never rides the wire") — the gateway
|
|
294
294
|
// derives its own key independently and never echoes that string back, so
|
|
295
295
|
// a mirror synced from the real objects listing never contains it.
|
|
296
296
|
const envelopeBytes = await backend.get(`key-envelopes/${envelopeReceipt.epoch}/${envelopeReceipt.recipient_fingerprint}.env`);
|
|
297
297
|
if (!envelopeBytes)
|
|
298
|
-
fail("VAULT_UNRECOVERABLE", "the mirror holds no key envelope for this genesis — cannot derive K_repo", "materializing
|
|
299
|
-
const envelope =
|
|
298
|
+
fail("VAULT_UNRECOVERABLE", "the mirror holds no key envelope for this genesis — cannot derive K_repo", "materializing vault recovery");
|
|
299
|
+
const envelope = parseVaultStrict(new TextDecoder().decode(envelopeBytes));
|
|
300
300
|
const bindingProblems = checkGenesisKeyBindings(genesis, envelope);
|
|
301
301
|
if (bindingProblems.length > 0)
|
|
302
|
-
fail("VAULT_CREATION_CONFLICT", `genesis key bindings do not hold for the stored envelope (${bindingProblems.join(", ")})`, "materializing
|
|
302
|
+
fail("VAULT_CREATION_CONFLICT", `genesis key bindings do not hold for the stored envelope (${bindingProblems.join(", ")})`, "materializing vault recovery", { problems: bindingProblems });
|
|
303
303
|
if (envelope.recipient_fingerprint !== identity.encryption_fingerprint) {
|
|
304
|
-
fail("
|
|
304
|
+
fail("VAULT_ENVELOPE_NOT_FOR_RECIPIENT", "the stored envelope is addressed to another principal — this keystore cannot open it", "materializing vault recovery", { recipient_fingerprint: envelope.recipient_fingerprint });
|
|
305
305
|
}
|
|
306
306
|
const kp = generateEncryptionKeypair(hexToBytes(identity.encryption_private_key_hex));
|
|
307
307
|
return openKeyEnvelope({ envelope, recipient: kp, signer_public_key: genesis.creator_signing_pubkey });
|
|
@@ -315,7 +315,7 @@ async function resolveGenesisEpochKey(backend, genesis, identity) {
|
|
|
315
315
|
* Getting this backwards type-checks fine (it is a positional function
|
|
316
316
|
* type, so TypeScript cannot catch the swap) but silently resolves every
|
|
317
317
|
* rotation envelope to the WRONG mirror key — caught by
|
|
318
|
-
* `
|
|
318
|
+
* `vault-epoch-reader.test.ts`'s own offline-recovery test, which is
|
|
319
319
|
* exactly why the parameter names spell it out here too.
|
|
320
320
|
*/
|
|
321
321
|
function mirrorRotationEnvelopePath(epoch, recipientFingerprint, rotationId) {
|
|
@@ -352,7 +352,7 @@ async function resolveRotationEpochKeys(backend, genesis, rotations, identity) {
|
|
|
352
352
|
epochKeys[rot.epoch] = bytesToHex(kE);
|
|
353
353
|
}
|
|
354
354
|
catch (e) {
|
|
355
|
-
const code = isRun402Error(e) && e.code ? e.code : "
|
|
355
|
+
const code = isRun402Error(e) && e.code ? e.code : "VAULT_EPOCH_NOT_OPENABLE";
|
|
356
356
|
return { epoch_keys_hex: epochKeys, failure: { generation: rot.generation, epoch: rot.epoch, rotation_id: rot.payload.rotation_id, code, message: e instanceof Error ? e.message : String(e) } };
|
|
357
357
|
}
|
|
358
358
|
}
|
|
@@ -364,7 +364,7 @@ async function resolveRotationEpochKeys(backend, genesis, rotations, identity) {
|
|
|
364
364
|
* generation before the first rotation whose epoch is missing from
|
|
365
365
|
* `epochKeysHex`, or `newestGeneration` if every rotation opened. Mirrors
|
|
366
366
|
* the live publication read path's identical boundary computation
|
|
367
|
-
* (`
|
|
367
|
+
* (`Vault.materialize`) so both surfaces report the same concept
|
|
368
368
|
* under the same name.
|
|
369
369
|
*/
|
|
370
370
|
function computeDecryptableBoundaryGeneration(rotations, epochKeysHex, newestGeneration) {
|
|
@@ -374,7 +374,7 @@ function computeDecryptableBoundaryGeneration(rotations, epochKeysHex, newestGen
|
|
|
374
374
|
if (!epochKeysHex[rot.epoch]) {
|
|
375
375
|
return {
|
|
376
376
|
generation: boundary,
|
|
377
|
-
failure: { generation: rot.generation, epoch: rot.epoch, rotation_id: rot.payload.rotation_id, code: "
|
|
377
|
+
failure: { generation: rot.generation, epoch: rot.epoch, rotation_id: rot.payload.rotation_id, code: "VAULT_EPOCH_NOT_OPENABLE", message: `epoch ${rot.epoch} (rotation ${rot.payload.rotation_id}) could not be opened by this keystore — recovery caps at the last generation under the prior, openable epoch` },
|
|
378
378
|
};
|
|
379
379
|
}
|
|
380
380
|
boundary = i + 1 < rotations.length ? generationMinusOne(rotations[i + 1].generation) : newestGeneration;
|
|
@@ -384,9 +384,9 @@ function computeDecryptableBoundaryGeneration(rotations, epochKeysHex, newestGen
|
|
|
384
384
|
async function openCarrier(backend, kRepo, repoId, epoch, kind, objectId, ciphertextSha256, key) {
|
|
385
385
|
const frame = await backend.get(key);
|
|
386
386
|
if (!frame)
|
|
387
|
-
fail("CHAIN_UNUSABLE", `${kind} ${objectId} is absent from the mirror`, "materializing
|
|
387
|
+
fail("CHAIN_UNUSABLE", `${kind} ${objectId} is absent from the mirror`, "materializing vault recovery", { object_id: objectId });
|
|
388
388
|
const plaintext = openFrame({ k_obj: deriveObjectKey(kRepo, repoId, epoch, kind, objectId), repo_id: repoId, object_kind: kind, object_id: objectId, epoch, frame, expected_ciphertext_sha256: ciphertextSha256 });
|
|
389
|
-
return
|
|
389
|
+
return parseVaultStrict(new TextDecoder().decode(plaintext));
|
|
390
390
|
}
|
|
391
391
|
/**
|
|
392
392
|
* Materialize the resolved generation into `out_dir` and run §4.7 restorer
|
|
@@ -395,23 +395,23 @@ async function openCarrier(backend, kRepo, repoId, epoch, kind, objectId, cipher
|
|
|
395
395
|
* checkpoint manifest when one covers this generation. Acceptance failure is
|
|
396
396
|
* a typed non-zero exit (throws) — never a partial, silently-accepted repo.
|
|
397
397
|
*/
|
|
398
|
-
export async function
|
|
398
|
+
export async function recoverVaultMirror(options) {
|
|
399
399
|
// `out_dir` is "where to materialize the recovered repository" — the CLI's own
|
|
400
400
|
// documented example (`--out ./restored`) is a path that naturally does
|
|
401
401
|
// NOT already exist, same expectation as `git clone <url> restored-dir`.
|
|
402
402
|
// Create it FIRST, before any discovery/decrypt work, so a bad `out_dir`
|
|
403
403
|
// fails fast with a truthful, typed error instead of the misleading
|
|
404
404
|
// `GIT_UNAVAILABLE` the first `hardenedGit` call would throw (see that function's own
|
|
405
|
-
// `GIT_CWD_MISSING` disambiguation in `
|
|
405
|
+
// `GIT_CWD_MISSING` disambiguation in `vault-snapshot.ts` — this is the
|
|
406
406
|
// belt; that is the suspenders).
|
|
407
407
|
try {
|
|
408
408
|
mkdirSync(options.out_dir, { recursive: true });
|
|
409
409
|
}
|
|
410
410
|
catch (e) {
|
|
411
|
-
fail("
|
|
411
|
+
fail("VAULT_RECOVER_OUT_DIR_UNWRITABLE", `could not create the recovery output directory: ${options.out_dir}`, "materializing vault recovery", { out_dir: options.out_dir, cause: e instanceof Error ? e.message : String(e) });
|
|
412
412
|
}
|
|
413
413
|
const { backend } = options;
|
|
414
|
-
const keystore = options.keystore ??
|
|
414
|
+
const keystore = options.keystore ?? VaultKeystore.open();
|
|
415
415
|
const discovery = await discoverAndVerifyChain({ backend, ...(options.recovery_receipt ? { recovery_receipt: options.recovery_receipt } : {}), keystore });
|
|
416
416
|
const repoId = discovery.repo_id;
|
|
417
417
|
// ── Request 4 (D193-D203, rev 42): resolve every locally-openable epoch
|
|
@@ -420,7 +420,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
420
420
|
// named cause, never folded into the generic "unexplained_absence"
|
|
421
421
|
// vocabulary `resolveWithFallback` already owns for missing bytes.
|
|
422
422
|
//
|
|
423
|
-
//
|
|
423
|
+
// vault-recovery-custody: the decrypt identity comes from EITHER the
|
|
424
424
|
// keystore (the original path) OR a member recovery bundle opened with the
|
|
425
425
|
// source recovery code (the human-member path, no keystore involved). A
|
|
426
426
|
// code with no bundle — explicit or discovered in the mirror's own
|
|
@@ -430,7 +430,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
430
430
|
let memberRecovery = null;
|
|
431
431
|
if (options.source_recovery_code != null || options.member_bundle != null) {
|
|
432
432
|
if (options.source_recovery_code == null) {
|
|
433
|
-
fail("SOURCE_RECOVERY_CODE_REQUIRED", "a member recovery bundle was supplied without its source recovery code — the bundle is ciphertext; the code is what opens it", "materializing
|
|
433
|
+
fail("SOURCE_RECOVERY_CODE_REQUIRED", "a member recovery bundle was supplied without its source recovery code — the bundle is ciphertext; the code is what opens it", "materializing vault recovery", undefined, [
|
|
434
434
|
{ action: "re-run with the source recovery code (SRC1-…) you saved at enrollment" },
|
|
435
435
|
]);
|
|
436
436
|
}
|
|
@@ -446,7 +446,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
446
446
|
else {
|
|
447
447
|
const discovered = (await discoverMemberBundles(backend)).filter((b) => b.bundle != null);
|
|
448
448
|
if (discovered.length === 0) {
|
|
449
|
-
fail("RECOVERY_BUNDLE_MISSING", "a source recovery code was supplied but no member recovery bundle is available — none was passed and this mirror carries no member-recovery-bundles/ sidecar. The code alone cannot recover anything: export the bundle (console.run402.com/account → Download recovery bundle, or `run402 repos recovery-bundle`) and keep it with the mirror.", "materializing
|
|
449
|
+
fail("RECOVERY_BUNDLE_MISSING", "a source recovery code was supplied but no member recovery bundle is available — none was passed and this mirror carries no member-recovery-bundles/ sidecar. The code alone cannot recover anything: export the bundle (console.run402.com/account → Download recovery bundle, or `run402 repos recovery-bundle`) and keep it with the mirror.", "materializing vault recovery", undefined, [{ action: "re-run with --bundle <exported-bundle.json>" }]);
|
|
450
450
|
}
|
|
451
451
|
// Try each discovered bundle — the AEAD authenticates, so a foreign
|
|
452
452
|
// member's bundle simply fails to open and the loop moves on.
|
|
@@ -464,7 +464,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
464
464
|
}
|
|
465
465
|
}
|
|
466
466
|
if (!opened) {
|
|
467
|
-
fail("WRAPPER_DID_NOT_OPEN", `this mirror carries ${discovered.length} member recovery-bundle sidecar(s) but the supplied code opened none of them — a wrong code, or a bundle belonging to a different member`, "materializing
|
|
467
|
+
fail("WRAPPER_DID_NOT_OPEN", `this mirror carries ${discovered.length} member recovery-bundle sidecar(s) but the supplied code opened none of them — a wrong code, or a bundle belonging to a different member`, "materializing vault recovery", { tried: discovered.map((d) => d.key), cause: lastErr instanceof Error ? lastErr.message : String(lastErr) });
|
|
468
468
|
}
|
|
469
469
|
identity = { encryption_private_key_hex: opened.member.private_key_hex, encryption_fingerprint: opened.member.fingerprint };
|
|
470
470
|
memberRecovery = { bundle_key: opened.bundle_key, wrapper_id: opened.member.wrapper_id, rp_id_used: opened.member.rp_id_used, ek_fingerprint: opened.member.fingerprint };
|
|
@@ -473,7 +473,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
473
473
|
else {
|
|
474
474
|
const stored = keystore.readIdentity();
|
|
475
475
|
if (!stored?.encryption_private_key_hex) {
|
|
476
|
-
fail("VAULT_UNRECOVERABLE", "no encryption key in this keystore — recovery can verify and adjudicate but cannot decrypt or materialize anything", "materializing
|
|
476
|
+
fail("VAULT_UNRECOVERABLE", "no encryption key in this keystore — recovery can verify and adjudicate but cannot decrypt or materialize anything", "materializing vault recovery", undefined, [
|
|
477
477
|
{ action: "restore the principal keystore (identity.json) from backup, then re-run recover" },
|
|
478
478
|
{ action: "a human member under wrapper custody: re-run with --bundle <exported-bundle.json> + the source recovery code" },
|
|
479
479
|
{ action: "run `run402 repos fsck --mirror` for the verify-only outcome" },
|
|
@@ -483,7 +483,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
483
483
|
}
|
|
484
484
|
const k1 = await resolveGenesisEpochKey(backend, discovery.genesis, identity);
|
|
485
485
|
const rotationKeys = await resolveRotationEpochKeys(backend, discovery.genesis, discovery.rotations, identity);
|
|
486
|
-
const epochKeysHex = { [
|
|
486
|
+
const epochKeysHex = { [VAULT_GENESIS_EPOCH]: bytesToHex(k1), ...rotationKeys.epoch_keys_hex };
|
|
487
487
|
const decryptBoundary = computeDecryptableBoundaryGeneration(discovery.rotations, epochKeysHex, discovery.newest_generation);
|
|
488
488
|
// The two possible epoch-decrypt failure sources (an unopenable rotation
|
|
489
489
|
// envelope, or the boundary walk simply never reaching one) agree by
|
|
@@ -493,16 +493,16 @@ export async function recoverGitvaultMirror(options) {
|
|
|
493
493
|
const epochDecryptFailure = decryptBoundary.failure ?? rotationKeys.failure;
|
|
494
494
|
const startGeneration = decryptBoundary.generation < discovery.newest_generation ? decryptBoundary.generation : discovery.newest_generation;
|
|
495
495
|
const { generation, absences } = await resolveWithFallback(backend, discovery, { requireMaterializable: true, start_generation: startGeneration });
|
|
496
|
-
if (generation ===
|
|
497
|
-
fail("CHECKPOINT_INCOMPLETE", epochDecryptFailure && startGeneration ===
|
|
496
|
+
if (generation === VAULT_GENESIS_GENERATION) {
|
|
497
|
+
fail("CHECKPOINT_INCOMPLETE", epochDecryptFailure && startGeneration === VAULT_GENESIS_GENERATION
|
|
498
498
|
? `no generation could be materialized — epoch ${epochDecryptFailure.epoch} (rotation ${epochDecryptFailure.rotation_id}) could not be opened by this keystore and the vault's history begins there`
|
|
499
|
-
: "no generation could be fully materialized — every generation back to genesis has an unexplained missing object", "materializing
|
|
499
|
+
: "no generation could be fully materialized — every generation back to genesis has an unexplained missing object", "materializing vault recovery", { absences, epoch_decrypt_failure: epochDecryptFailure });
|
|
500
500
|
}
|
|
501
501
|
const entry = discovery.chain.find((e) => e.generation === generation);
|
|
502
502
|
const epoch = entry.head.epoch;
|
|
503
503
|
const kRepo = hexToBytes(epochKeysHex[epoch]); // guaranteed present — `generation` never exceeds `decryptBoundary.generation`
|
|
504
|
-
const refState = await openCarrier(backend, kRepo, repoId, epoch, "ref_state", entry.head.ref_state.object_id, entry.head.ref_state.ciphertext_sha256,
|
|
505
|
-
const roots = await openCarrier(backend, kRepo, repoId, epoch, "retention_roots", entry.head.retention_roots.object_id, entry.head.retention_roots.ciphertext_sha256,
|
|
504
|
+
const refState = await openCarrier(backend, kRepo, repoId, epoch, "ref_state", entry.head.ref_state.object_id, entry.head.ref_state.ciphertext_sha256, vaultPaths.refState(entry.head.ref_state.object_id));
|
|
505
|
+
const roots = await openCarrier(backend, kRepo, repoId, epoch, "retention_roots", entry.head.retention_roots.object_id, entry.head.retention_roots.ciphertext_sha256, vaultPaths.retentionRoots(entry.head.retention_roots.object_id));
|
|
506
506
|
// ── restore into scratch: newest checkpoint's packs, then every later WAL pack ──
|
|
507
507
|
const chainUpTo = discovery.chain.filter((e) => e.generation <= generation);
|
|
508
508
|
const heads = [];
|
|
@@ -513,7 +513,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
513
513
|
}
|
|
514
514
|
// A fresh output directory becomes a bare repository. An EXISTING git
|
|
515
515
|
// directory — the degraded read materializes straight into a checkout's
|
|
516
|
-
// own `.git` (
|
|
516
|
+
// own `.git` (vault-byo-primary-bucket design D4), and a re-run lands
|
|
517
517
|
// on a prior recovery — is used as it is: `git init --bare .` on a
|
|
518
518
|
// checkout's git dir would rewrite `core.bare = true` and leave the
|
|
519
519
|
// working tree unusable ("this operation must be run in a work tree").
|
|
@@ -530,29 +530,29 @@ export async function recoverGitvaultMirror(options) {
|
|
|
530
530
|
// fully-resolved epoch key).
|
|
531
531
|
const kRepoForEpoch = (e) => hexToBytes(epochKeysHex[e]);
|
|
532
532
|
if (first.head.checkpoint) {
|
|
533
|
-
const claimBytes = await backend.get(
|
|
533
|
+
const claimBytes = await backend.get(vaultPaths.claimSet(first.head.checkpoint.claim_set.object_id));
|
|
534
534
|
if (!claimBytes)
|
|
535
|
-
fail("CHECKPOINT_INCOMPLETE", "checkpoint claim set absent from the mirror", "materializing
|
|
536
|
-
const claimSet =
|
|
537
|
-
if (!
|
|
538
|
-
fail("CHECKPOINT_INCOMPLETE", "checkpoint claim set signature fails", "materializing
|
|
539
|
-
manifest = await openCarrier(backend, kRepoForEpoch(first.head.epoch), repoId, first.head.epoch, "checkpoint_manifest", claimSet.manifest_receipt.object_id, claimSet.manifest_receipt.ciphertext_sha256,
|
|
535
|
+
fail("CHECKPOINT_INCOMPLETE", "checkpoint claim set absent from the mirror", "materializing vault recovery");
|
|
536
|
+
const claimSet = parseVaultStrict(new TextDecoder().decode(claimBytes));
|
|
537
|
+
if (!verifyVaultObject(claimSet, discovery.genesis.creator_signing_pubkey))
|
|
538
|
+
fail("CHECKPOINT_INCOMPLETE", "checkpoint claim set signature fails", "materializing vault recovery");
|
|
539
|
+
manifest = await openCarrier(backend, kRepoForEpoch(first.head.epoch), repoId, first.head.epoch, "checkpoint_manifest", claimSet.manifest_receipt.object_id, claimSet.manifest_receipt.ciphertext_sha256, vaultPaths.checkpointManifest(claimSet.manifest_receipt.object_id));
|
|
540
540
|
checkClaimSetEquality(claimSet, manifest, first.head.checkpoint.covers_through_generation);
|
|
541
541
|
for (const p of manifest.packs) {
|
|
542
|
-
const frame = await backend.get(
|
|
542
|
+
const frame = await backend.get(vaultPaths.checkpointPack(p.object_id));
|
|
543
543
|
if (!frame)
|
|
544
|
-
fail("CHECKPOINT_INCOMPLETE", `checkpoint pack ${p.object_id} absent`, "materializing
|
|
544
|
+
fail("CHECKPOINT_INCOMPLETE", `checkpoint pack ${p.object_id} absent`, "materializing vault recovery");
|
|
545
545
|
const plain = openFrame({ k_obj: deriveObjectKey(kRepoForEpoch(first.head.epoch), repoId, first.head.epoch, "checkpoint_pack", p.object_id), repo_id: repoId, object_kind: "checkpoint_pack", object_id: p.object_id, epoch: first.head.epoch, frame, expected_ciphertext_sha256: p.ciphertext_sha256 });
|
|
546
546
|
if (sha256Hex(plain) !== p.plaintext_sha256 || String(plain.length) !== p.plaintext_size_bytes)
|
|
547
|
-
fail("CHECKPOINT_INCOMPLETE", `checkpoint pack ${p.object_id} plaintext mismatch`, "materializing
|
|
547
|
+
fail("CHECKPOINT_INCOMPLETE", `checkpoint pack ${p.object_id} plaintext mismatch`, "materializing vault recovery");
|
|
548
548
|
await hardenedGit(options.out_dir, ["index-pack", "--stdin", "--strict"], { input: plain });
|
|
549
549
|
}
|
|
550
550
|
}
|
|
551
551
|
for (const h of heads) {
|
|
552
552
|
for (const w of h.head.wal_entries) {
|
|
553
|
-
const frame = await backend.get(
|
|
553
|
+
const frame = await backend.get(vaultPaths.wal(w.object_id));
|
|
554
554
|
if (!frame)
|
|
555
|
-
fail("CHAIN_UNUSABLE", `WAL pack ${w.object_id} absent`, "materializing
|
|
555
|
+
fail("CHAIN_UNUSABLE", `WAL pack ${w.object_id} absent`, "materializing vault recovery", { object_id: w.object_id });
|
|
556
556
|
const plain = openFrame({ k_obj: deriveObjectKey(kRepoForEpoch(h.head.epoch), repoId, h.head.epoch, "wal_pack", w.object_id), repo_id: repoId, object_kind: "wal_pack", object_id: w.object_id, epoch: h.head.epoch, frame, expected_ciphertext_sha256: w.ciphertext_sha256 });
|
|
557
557
|
await hardenedGit(options.out_dir, ["index-pack", "--stdin", "--strict"], { input: plain });
|
|
558
558
|
}
|
|
@@ -565,7 +565,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
565
565
|
coverageTips.add(refState.head_target.oid);
|
|
566
566
|
for (const tip of coverageTips) {
|
|
567
567
|
if (!(await hasObject(options.out_dir, tip)))
|
|
568
|
-
fail("CHAIN_UNUSABLE", `covered tip ${tip} does not resolve after restore`, "materializing
|
|
568
|
+
fail("CHAIN_UNUSABLE", `covered tip ${tip} does not resolve after restore`, "materializing vault recovery", { oid: tip });
|
|
569
569
|
}
|
|
570
570
|
for (const [ref, oid] of Object.entries(refState.refs)) {
|
|
571
571
|
await hardenedGit(options.out_dir, ["update-ref", ref, oid]);
|
|
@@ -577,7 +577,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
577
577
|
// ── git fsck --no-dangling, full connectivity (task 3.4) ──
|
|
578
578
|
const fsck = await hardenedGit(options.out_dir, ["fsck", "--no-dangling", "--full", "--strict"], { okStatuses: [1, 2] });
|
|
579
579
|
if (fsck.status !== 0)
|
|
580
|
-
fail("CHECKPOINT_INCOMPLETE", `fsck reports missing connectivity after restore: ${fsck.stderr.slice(0, 500)}`, "materializing
|
|
580
|
+
fail("CHECKPOINT_INCOMPLETE", `fsck reports missing connectivity after restore: ${fsck.stderr.slice(0, 500)}`, "materializing vault recovery");
|
|
581
581
|
// clone-installs-retained-refs (D2): every retained tip this recovery just
|
|
582
582
|
// proved connective above is now present in the bare repo — install/
|
|
583
583
|
// reconcile its refs/r402/retain/* ref so a disaster-drill `git fsck`
|
|
@@ -603,7 +603,7 @@ export async function recoverGitvaultMirror(options) {
|
|
|
603
603
|
const restoredOids = sortedTips.length === 0 ? [] : (await hardenedGit(options.out_dir, ["rev-list", "--objects", "--no-object-names", ...sortedTips])).lines().map((l) => l.trim());
|
|
604
604
|
const objectsetOk = keyedCommitment(kDigestObjectset, objectsetContent(restoredOids)) === manifest.object_set_hmac;
|
|
605
605
|
if (!refmapOk || !rootsetOk || !objectsetOk) {
|
|
606
|
-
fail("CHECKPOINT_INCOMPLETE", `restored state does not match the checkpoint's keyed commitments (refmap ${refmapOk ? "ok" : "MISMATCH"}, rootset ${rootsetOk ? "ok" : "MISMATCH"}, objectset ${objectsetOk ? "ok" : "MISMATCH"})`, "materializing
|
|
606
|
+
fail("CHECKPOINT_INCOMPLETE", `restored state does not match the checkpoint's keyed commitments (refmap ${refmapOk ? "ok" : "MISMATCH"}, rootset ${rootsetOk ? "ok" : "MISMATCH"}, objectset ${objectsetOk ? "ok" : "MISMATCH"})`, "materializing vault recovery", { refmapOk, rootsetOk, objectsetOk });
|
|
607
607
|
}
|
|
608
608
|
}
|
|
609
609
|
return {
|
|
@@ -612,8 +612,8 @@ export async function recoverGitvaultMirror(options) {
|
|
|
612
612
|
epoch_decrypt_failure: generation === decryptBoundary.generation ? epochDecryptFailure : null,
|
|
613
613
|
absences,
|
|
614
614
|
data_loss_detected: absences.some((a) => a.adjudication === "unexplained_absence"),
|
|
615
|
-
validity_not_freshness:
|
|
616
|
-
keystore_still_required:
|
|
615
|
+
validity_not_freshness: VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT,
|
|
616
|
+
keystore_still_required: VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT,
|
|
617
617
|
mode: "recovered", out_dir: options.out_dir, refs: refState.refs, head_target: refState.head_target,
|
|
618
618
|
member_recovery: memberRecovery,
|
|
619
619
|
retained_refs,
|
|
@@ -623,4 +623,4 @@ export async function recoverGitvaultMirror(options) {
|
|
|
623
623
|
],
|
|
624
624
|
};
|
|
625
625
|
}
|
|
626
|
-
//# sourceMappingURL=
|
|
626
|
+
//# sourceMappingURL=vault-recover.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-recover.js","sourceRoot":"","sources":["../../src/node/vault-recover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,8CAA8C,EAC9C,6CAA6C,EAC7C,UAAU,EACV,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,eAAe,EAEf,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,6BAA6B,EAC7B,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAYvC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEzJ,OAAO,EAAE,aAAa,EAA0B,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,GAG3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG7D,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AA6CD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAA6B;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,cAAc,EAAE,0EAA0E,EAAE,+BAA+B,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1L,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAiB,CAAC;IACzF,IAAI,OAAO,CAAC,WAAW,KAAK,eAAe;QAAE,IAAI,CAAC,cAAc,EAAE,qDAAqD,EAAE,+BAA+B,CAAC,CAAC;IAC1J,IAAI,CAAC,iBAAiB,CAAC,OAAuC,EAAE,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,yBAAyB,EAAE,2EAA2E,EAAE,+BAA+B,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9K,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC3G,IAAI,QAAQ,GAA0C,yBAAyB,CAAC;IAChF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CACF,yBAAyB,EACzB,4DAA4D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,2EAA2E,EAC1J,+BAA+B,EAC/B,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,OAAO,CAAC,cAAc,EAAE,uBAAuB,EAAE,UAAU,EAAE,EAC5H,CAAC,EAAE,MAAM,EAAE,yHAAyH,EAAE,CAAC,CACxI,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,QAAQ,GAAG,UAAU,CAAC;IAC1B,IAAI,OAAO,GAAW,wBAAwB,CAAC;IAC/C,IAAI,SAAS,GAAW,mBAAmB,CAAC;IAC5C,IAAI,UAAU,GAA2B,IAAI,CAAC;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,oEAAoE;QACvF,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAc,CAAC;YACtE,cAAc,CAAC;gBACb,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ;gBAC/G,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,sBAAsB,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS;aACzI,CAAC,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,8DAA8D;YAC9D,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxE,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM;QACR,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,QAAQ,GAAG,OAAO,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK;QACzF,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS;KAC7F,CAAC;AACJ,CAAC;AAkBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA2B,EAAE,KAAiC,EAAE,gBAAwB;IACjI,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,IAAI,GAAG,GAAG,gBAAgB,CAAC;IAC3B,SAAS,CAAC;QACR,IAAI,GAAG,KAAK,wBAAwB;YAAE,MAAM;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,+BAA+B,EAAE,kCAAkC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrI,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7J,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxG,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YACtE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAA4B,CAAC;gBACnG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACnK,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7J,CAAC;YACD,MAAM,CAAC,+EAA+E;QACxF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjI,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA2B,EAAE,QAAwC;IAC5G,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAgF,CAAC;YAChJ,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9H,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAA4B,EAAE;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;YAClC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;YACvE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI;SACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AA2DD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B,EAAE,UAAiF,EAAE;IACtJ,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,UAAU,KAAK,wBAAwB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,aAAa,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACpG,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS;QACpG,oBAAoB,EAAE,UAAU,EAAE,4BAA4B,EAAE,SAAS,CAAC,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW;QAC/H,qBAAqB,EAAE,IAAI,EAAE,QAAQ;QACrC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,qBAAqB,CAAC;QAClF,sBAAsB,EAAE,6CAA6C;QACrE,uBAAuB,EAAE,8CAA8C;QACvE,IAAI,EAAE,gBAAgB,EAAE,SAAS;QACjC,uBAAuB,EAAE,aAAa;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAA2B,EAAE,SAA+B,EAAE,OAAsE;IACrK,MAAM,WAAW,GAA+B,EAAE,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC,iBAAiB,CAAC;IAClE,SAAS,CAAC;QACR,IAAI,GAAG,KAAK,wBAAwB;YAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,qBAAqB,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;YACnC,uEAAuE;YACvE,mEAAmE;YACnE,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAiED,mLAAmL;AACnL,KAAK,UAAU,sBAAsB,CAAC,OAA2B,EAAE,OAAqB,EAAE,QAA+B;IACvH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,EAAE,6GAA6G,EAAE,8BAA8B,EAAE,SAAS,EAAE;YACpL,EAAE,MAAM,EAAE,iFAAiF,EAAE;YAC7F,EAAE,MAAM,EAAE,8DAA8D,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,EAAE,iCAAiC,EAAE,8BAA8B,CAAC,CAAC;IACvI,mEAAmE;IACnE,uEAAuE;IACvE,sBAAsB;IACtB,2EAA2E;IAC3E,sEAAsE;IACtE,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,wDAAwD;IACxD,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC,kCAAkC,EAAE,8GAA8G,EAAE,8BAA8B,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjP,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,qBAAqB,MAAM,CAAC,CAAC;IAC/H,IAAI,CAAC,aAAa;QAAE,IAAI,CAAC,qBAAqB,EAAE,0EAA0E,EAAE,8BAA8B,CAAC,CAAC;IAC5J,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAqB,CAAC;IAC/F,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,yBAAyB,EAAE,6DAA6D,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3N,IAAI,QAAQ,CAAC,qBAAqB,KAAK,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACvE,IAAI,CAAC,kCAAkC,EAAE,sFAAsF,EAAE,8BAA8B,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC9N,CAAC;IACD,MAAM,EAAE,GAAG,yBAAyB,CAAC,UAAU,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtF,OAAO,eAAe,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,8NAA8N;AAC9N;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CAAC,KAAa,EAAE,oBAA4B,EAAE,UAAkB;IACjG,OAAO,iBAAiB,KAAK,IAAI,UAAU,IAAI,oBAAoB,MAAM,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAA2B,EAC3B,OAAqB,EACrB,SAA8C,EAC9C,QAA+B;IAE/B,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,0BAA0B;QAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC;gBAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,eAAe,EAAE,cAAc;gBAC/B,sBAAsB,EAAE,UAAU;gBAClC,yBAAyB,EAAE,OAAO,CAAC,sBAAsB;gBACzD,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC/C,aAAa,EAAE,0BAA0B;aAC1C,CAAC,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAC9E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACnM,CAAC;IACH,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oCAAoC,CAC3C,SAA8C,EAC9C,YAAoC,EACpC,gBAAwB;IAExB,IAAI,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACtG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,SAAS,GAAG,CAAC,KAAK,cAAc,GAAG,CAAC,OAAO,CAAC,WAAW,+GAA+G,EAAE;aACnT,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,OAA2B,EAAE,KAAiB,EAAE,MAAc,EAAE,KAAa,EAAE,IAA6D,EAAE,QAAgB,EAAE,gBAAwB,EAAE,GAAW;IACjO,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,gBAAgB,EAAE,GAAG,IAAI,IAAI,QAAQ,4BAA4B,EAAE,8BAA8B,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7I,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnN,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,+EAA+E;IAC/E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,sFAAsF;IACtF,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,kCAAkC,EAAE,mDAAmD,OAAO,CAAC,OAAO,EAAE,EAAE,8BAA8B,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClO,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3J,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC;IAEjC,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,mEAAmE;IACnE,EAAE;IACF,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,QAA+B,CAAC;IACpC,IAAI,cAAc,GAA0C,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1E,IAAI,OAAO,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,+BAA+B,EAAE,8HAA8H,EAAE,8BAA8B,EAAE,SAAS,EAAE;gBAC/M,EAAE,MAAM,EAAE,uEAAuE,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC1C,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,cAAc,GAAG,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,0BAA0B,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtJ,QAAQ,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC,eAAe,EAAE,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9G,cAAc,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1I,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YAC1F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,CACF,yBAAyB,EACzB,iVAAiV,EACjV,8BAA8B,EAC9B,SAAS,EACT,CAAC,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,MAAM,GAAyF,IAAI,CAAC;YACxG,IAAI,OAAO,GAAY,IAAI,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,EAAE,MAAM,EAAE,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;oBAC1K,MAAM;gBACR,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,gCAAgC;wBAAE,MAAM,CAAC,CAAC,CAAC,iDAAiD;oBAC/H,OAAO,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,sBAAsB,EAAE,uBAAuB,UAAU,CAAC,MAAM,0IAA0I,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjW,CAAC;YACD,QAAQ,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5H,cAAc,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5K,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACxC,IAAI,CAAC,qBAAqB,EAAE,oHAAoH,EAAE,8BAA8B,EAAE,SAAS,EAAE;gBAC3L,EAAE,MAAM,EAAE,iFAAiF,EAAE;gBAC7F,EAAE,MAAM,EAAE,8GAA8G,EAAE;gBAC1H,EAAE,MAAM,EAAE,8DAA8D,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/G,MAAM,YAAY,GAA2B,EAAE,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IACvH,MAAM,eAAe,GAAG,oCAAoC,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC7H,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,mBAAmB,GAAG,eAAe,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;IAC5E,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC;IAE5I,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC;IACnJ,IAAI,UAAU,KAAK,wBAAwB,EAAE,CAAC;QAC5C,IAAI,CACF,uBAAuB,EACvB,mBAAmB,IAAI,eAAe,KAAK,wBAAwB;YACjE,CAAC,CAAC,+CAA+C,mBAAmB,CAAC,KAAK,cAAc,mBAAmB,CAAC,WAAW,6EAA6E;YACpM,CAAC,CAAC,gHAAgH,EACpH,8BAA8B,EAC9B,EAAE,QAAQ,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAE,CAAC;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,+EAA+E;IAE/H,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAgB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3N,MAAM,KAAK,GAAG,MAAM,WAAW,CAAsB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5P,mFAAmF;IACnF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7B,IAAI,SAAS,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM;IAC3C,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;IAC1G,IAAI,CAAC,eAAe;QAAE,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC;IAChH,IAAI,QAAQ,GAAmC,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxB,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,uBAAuB,EAAE,6CAA6C,EAAE,8BAA8B,CAAC,CAAC;QAC9H,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAA4B,CAAC;QACnG,IAAI,CAAC,iBAAiB,CAAC,QAAwC,EAAE,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAAE,IAAI,CAAC,uBAAuB,EAAE,sCAAsC,EAAE,8BAA8B,CAAC,CAAC;QAClN,QAAQ,GAAG,MAAM,WAAW,CAA0B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACvS,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,SAAS,SAAS,EAAE,8BAA8B,CAAC,CAAC;YACnH,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACzS,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB;gBAAE,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,SAAS,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;YACnN,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,SAAS,SAAS,EAAE,8BAA8B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjI,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC/Q,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;QAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,iCAAiC,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1K,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;;QAC9H,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAExG,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,uBAAuB,EAAE,oDAAoD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAC;IAEtK,2EAA2E;IAC3E,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,2EAA2E;IAC3E,QAAQ;IACR,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAEtJ,mFAAmF;IACnF,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3G,MAAM,cAAc,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACjH,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC;QACxD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC;QAClD,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,KAAK,QAAQ,CAAC,cAAc,CAAC;QAC7F,MAAM,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,QAAQ,CAAC,oBAAoB,CAAC;QAClG,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrL,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC;QACnH,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,uBAAuB,EAAE,4EAA4E,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,aAAa,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,eAAe,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,8BAA8B,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3S,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS;QACzF,oBAAoB,EAAE,UAAU,EAAE,4BAA4B,EAAE,SAAS,CAAC,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW;QAC/H,qBAAqB,EAAE,UAAU,KAAK,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;QAC7F,QAAQ;QACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,qBAAqB,CAAC;QAClF,sBAAsB,EAAE,6CAA6C;QACrE,uBAAuB,EAAE,8CAA8C;QACvE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;QACnG,eAAe,EAAE,cAAc;QAC/B,aAAa;QACb,MAAM,EAAE,MAAM;QACd,YAAY,EAAE;YACZ,EAAE,MAAM,EAAE,sFAAsF,EAAE,OAAO,EAAE,aAAa,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,WAAW,EAAE;SACxK;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* `git clone --no-checkout <remoteUrl> <targetDir>` — protocol-permitting
|
|
3
|
-
* (this is the one
|
|
3
|
+
* (this is the one vault git invocation allowed to touch the network),
|
|
4
4
|
* hooks and terminal prompts still neutralized. `targetDir` must not
|
|
5
5
|
* already exist (git's own clone precondition).
|
|
6
6
|
*/
|
|
7
|
-
export declare function
|
|
8
|
-
export interface
|
|
7
|
+
export declare function cloneVaultRemote(remoteUrl: string, targetDir: string): Promise<void>;
|
|
8
|
+
export interface VaultHandoffRestoreOptions {
|
|
9
9
|
/** The freshly cloned repository. */
|
|
10
10
|
dir: string;
|
|
11
11
|
/** The stash-shaped commit oid (design D1) — must already be reachable in `dir`'s object database (a retention root, materialized by clone). */
|
|
@@ -21,7 +21,7 @@ export interface GitvaultHandoffRestoreOptions {
|
|
|
21
21
|
/** The vault's default branch name (e.g. from the head symref, stripped of `refs/heads/`). Read from the fresh clone's `HEAD` symref when omitted; falls back to `main`. */
|
|
22
22
|
branch_hint?: string | null;
|
|
23
23
|
}
|
|
24
|
-
export interface
|
|
24
|
+
export interface VaultHandoffRestoreResult {
|
|
25
25
|
branch: string;
|
|
26
26
|
base_head_oid: string;
|
|
27
27
|
stash_oid: string;
|
|
@@ -33,11 +33,11 @@ export interface GitvaultHandoffRestoreResult {
|
|
|
33
33
|
* plumbing during design). Every step here is LOCAL — no network — so it
|
|
34
34
|
* runs fully hardened.
|
|
35
35
|
*/
|
|
36
|
-
export declare function applyHandoffCheckpoint(options:
|
|
36
|
+
export declare function applyHandoffCheckpoint(options: VaultHandoffRestoreOptions): Promise<VaultHandoffRestoreResult>;
|
|
37
37
|
/**
|
|
38
38
|
* `--to <dir>` wins; otherwise the vault's address-form name (`org/name` →
|
|
39
39
|
* `name`) when the redeem response carried one, otherwise the vault id.
|
|
40
|
-
* Always absolute — `
|
|
40
|
+
* Always absolute — `cloneVaultRemote` runs in `tmpdir()`, so a
|
|
41
41
|
* relative destination must be resolved against the CALLER's cwd first.
|
|
42
42
|
*/
|
|
43
43
|
export declare function resolveResumeTargetDir(to: string | undefined, address: string | null | undefined, vaultId: string): string;
|
|
@@ -48,7 +48,7 @@ export declare function readGitCommitMessage(dir: string, oid: string): Promise<
|
|
|
48
48
|
* (kygit-invite design D5): the ignore file is part of the captured tree
|
|
49
49
|
* and touching it would break exact-state on the first `git status` after
|
|
50
50
|
* `join`/`resume`. `.git/info/exclude` is local-only, per-clone git state,
|
|
51
|
-
* exactly like the id-pins in `
|
|
51
|
+
* exactly like the id-pins in `vault-address.ts`. Idempotent — a second
|
|
52
52
|
* call on an already-excluding checkout is a no-op. Used by BOTH `join` and
|
|
53
53
|
* `resume` (restore is kind-agnostic, kygit-invite design D5).
|
|
54
54
|
*/
|
|
@@ -62,4 +62,4 @@ export declare function excludeMessagingCacheFromGit(dir: string): Promise<void>
|
|
|
62
62
|
* never throws.
|
|
63
63
|
*/
|
|
64
64
|
export declare function isMessagingCacheExcludedFromGit(dir: string): Promise<boolean>;
|
|
65
|
-
//# sourceMappingURL=
|
|
65
|
+
//# sourceMappingURL=vault-restore.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-restore.d.ts","sourceRoot":"","sources":["../../src/node/vault-restore.ts"],"names":[],"mappings":"AA2CA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpF;AAED,MAAM,WAAW,0BAA0B;IACzC,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,gJAAgJ;IAChJ,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4KAA4K;IAC5K,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4BpH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAI1H;AAED,iHAAiH;AACjH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM3F;AAaD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7E;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUnF"}
|