@run402/sdk 4.95.0 → 4.96.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +24 -24
- package/core-dist/keystore.d.ts +1 -1
- package/core-dist/keystore.js +1 -1
- package/dist/errors.d.ts +4 -4
- package/dist/errors.d.ts.map +1 -1
- package/dist/index.d.ts +9 -9
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +8 -8
- package/dist/index.js.map +1 -1
- package/dist/namespaces/deploy.d.ts +5 -5
- package/dist/namespaces/deploy.d.ts.map +1 -1
- package/dist/namespaces/deploy.js +20 -20
- package/dist/namespaces/deploy.js.map +1 -1
- package/dist/namespaces/deploy.types.d.ts +17 -17
- package/dist/namespaces/deploy.types.d.ts.map +1 -1
- package/dist/namespaces/org.d.ts +2 -2
- package/dist/namespaces/org.js +2 -2
- package/dist/namespaces/org.types.d.ts +3 -3
- package/dist/namespaces/pay.js +1 -1
- package/dist/namespaces/{gitvault.d.ts → repos.d.ts} +436 -449
- package/dist/namespaces/repos.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.js → repos.js} +451 -459
- package/dist/namespaces/repos.js.map +1 -0
- package/dist/namespaces/rooms.js +2 -2
- package/dist/namespaces/rooms.js.map +1 -1
- package/dist/namespaces/session.d.ts +2 -2
- package/dist/namespaces/session.d.ts.map +1 -1
- package/dist/namespaces/session.js +2 -2
- package/dist/namespaces/session.js.map +1 -1
- package/dist/namespaces/tier.d.ts +3 -3
- package/dist/namespaces/tier.d.ts.map +1 -1
- package/dist/namespaces/{gitvault.crypto.d.ts → vault.crypto.d.ts} +141 -141
- package/dist/namespaces/vault.crypto.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.crypto.js → vault.crypto.js} +173 -173
- package/dist/namespaces/vault.crypto.js.map +1 -0
- package/dist/namespaces/{gitvault.types.d.ts → vault.types.d.ts} +136 -136
- package/dist/namespaces/vault.types.d.ts.map +1 -0
- package/dist/namespaces/{gitvault.types.js → vault.types.js} +4 -4
- package/dist/namespaces/vault.types.js.map +1 -0
- package/dist/node/bearer-redeem-key.d.ts +1 -1
- package/dist/node/bearer-redeem-key.js +5 -5
- package/dist/node/bearer-redeem-key.js.map +1 -1
- package/dist/node/http-dispatcher.js +5 -5
- package/dist/node/http-dispatcher.js.map +1 -1
- package/dist/node/index.d.ts +29 -29
- package/dist/node/index.d.ts.map +1 -1
- package/dist/node/index.js +39 -39
- package/dist/node/index.js.map +1 -1
- package/dist/node/{gitvault-address.d.ts → vault-address.d.ts} +42 -42
- package/dist/node/vault-address.d.ts.map +1 -0
- package/dist/node/{gitvault-address.js → vault-address.js} +43 -43
- package/dist/node/vault-address.js.map +1 -0
- package/dist/node/{gitvault-apply.d.ts → vault-apply.d.ts} +27 -27
- package/dist/node/vault-apply.d.ts.map +1 -0
- package/dist/node/{gitvault-apply.js → vault-apply.js} +38 -38
- package/dist/node/vault-apply.js.map +1 -0
- package/dist/node/vault-byo-config.d.ts +29 -0
- package/dist/node/vault-byo-config.d.ts.map +1 -0
- package/dist/node/{gitvault-byo-config.js → vault-byo-config.js} +18 -18
- package/dist/node/vault-byo-config.js.map +1 -0
- package/dist/node/vault-byo-probe.d.ts +20 -0
- package/dist/node/vault-byo-probe.d.ts.map +1 -0
- package/dist/node/vault-byo-probe.js +57 -0
- package/dist/node/vault-byo-probe.js.map +1 -0
- package/dist/node/{gitvault-creation-journal.d.ts → vault-creation-journal.d.ts} +69 -69
- package/dist/node/vault-creation-journal.d.ts.map +1 -0
- package/dist/node/{gitvault-creation-journal.js → vault-creation-journal.js} +54 -54
- package/dist/node/vault-creation-journal.js.map +1 -0
- package/dist/node/{gitvault-degraded-read.d.ts → vault-degraded-read.d.ts} +34 -34
- package/dist/node/vault-degraded-read.d.ts.map +1 -0
- package/dist/node/{gitvault-degraded-read.js → vault-degraded-read.js} +24 -24
- package/dist/node/vault-degraded-read.js.map +1 -0
- package/dist/node/{gitvault-deploy.d.ts → vault-deploy.d.ts} +67 -67
- package/dist/node/vault-deploy.d.ts.map +1 -0
- package/dist/node/{gitvault-deploy.js → vault-deploy.js} +27 -27
- package/dist/node/vault-deploy.js.map +1 -0
- package/dist/node/{gitvault-edge-fetch.d.ts → vault-edge-fetch.d.ts} +9 -9
- package/dist/node/vault-edge-fetch.d.ts.map +1 -0
- package/dist/node/{gitvault-edge-fetch.js → vault-edge-fetch.js} +11 -11
- package/dist/node/vault-edge-fetch.js.map +1 -0
- package/dist/node/{gitvault-handoff.d.ts → vault-handoff.d.ts} +9 -9
- package/dist/node/vault-handoff.d.ts.map +1 -0
- package/dist/node/{gitvault-handoff.js → vault-handoff.js} +24 -24
- package/dist/node/vault-handoff.js.map +1 -0
- package/dist/node/{gitvault-keystore.d.ts → vault-keystore.d.ts} +87 -77
- package/dist/node/vault-keystore.d.ts.map +1 -0
- package/dist/node/{gitvault-keystore.js → vault-keystore.js} +105 -68
- package/dist/node/vault-keystore.js.map +1 -0
- package/dist/node/{gitvault-member-bundle.d.ts → vault-member-bundle.d.ts} +17 -17
- package/dist/node/vault-member-bundle.d.ts.map +1 -0
- package/dist/node/{gitvault-member-bundle.js → vault-member-bundle.js} +11 -11
- package/dist/node/vault-member-bundle.js.map +1 -0
- package/dist/node/{gitvault-mirror-backend.d.ts → vault-mirror-backend.d.ts} +26 -26
- package/dist/node/vault-mirror-backend.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror-backend.js → vault-mirror-backend.js} +25 -25
- package/dist/node/vault-mirror-backend.js.map +1 -0
- package/dist/node/{gitvault-mirror-config.d.ts → vault-mirror-config.d.ts} +23 -23
- package/dist/node/vault-mirror-config.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror-config.js → vault-mirror-config.js} +16 -16
- package/dist/node/vault-mirror-config.js.map +1 -0
- package/dist/node/{gitvault-mirror.d.ts → vault-mirror.d.ts} +36 -36
- package/dist/node/vault-mirror.d.ts.map +1 -0
- package/dist/node/{gitvault-mirror.js → vault-mirror.js} +75 -75
- package/dist/node/vault-mirror.js.map +1 -0
- package/dist/node/{gitvault-native-crypto.d.ts → vault-native-crypto.d.ts} +10 -10
- package/dist/node/vault-native-crypto.d.ts.map +1 -0
- package/dist/node/{gitvault-native-crypto.js → vault-native-crypto.js} +16 -16
- package/dist/node/vault-native-crypto.js.map +1 -0
- package/dist/node/{gitvault-open-or-create.d.ts → vault-open-or-create.d.ts} +16 -16
- package/dist/node/vault-open-or-create.d.ts.map +1 -0
- package/dist/node/{gitvault-open-or-create.js → vault-open-or-create.js} +10 -10
- package/dist/node/vault-open-or-create.js.map +1 -0
- package/dist/node/{gitvault-prewarm.d.ts → vault-prewarm.d.ts} +13 -13
- package/dist/node/vault-prewarm.d.ts.map +1 -0
- package/dist/node/{gitvault-prewarm.js → vault-prewarm.js} +25 -25
- package/dist/node/vault-prewarm.js.map +1 -0
- package/dist/node/{gitvault-profile-scan.d.ts → vault-profile-scan.d.ts} +3 -3
- package/dist/node/vault-profile-scan.d.ts.map +1 -0
- package/dist/node/{gitvault-profile-scan.js → vault-profile-scan.js} +12 -12
- package/dist/node/vault-profile-scan.js.map +1 -0
- package/dist/node/{gitvault-prune.d.ts → vault-prune.d.ts} +61 -61
- package/dist/node/vault-prune.d.ts.map +1 -0
- package/dist/node/{gitvault-prune.js → vault-prune.js} +34 -34
- package/dist/node/vault-prune.js.map +1 -0
- package/dist/node/{gitvault-publication.d.ts → vault-publication.d.ts} +399 -399
- package/dist/node/vault-publication.d.ts.map +1 -0
- package/dist/node/{gitvault-publication.js → vault-publication.js} +584 -584
- package/dist/node/vault-publication.js.map +1 -0
- package/dist/node/{gitvault-push-to-create.d.ts → vault-push-to-create.d.ts} +16 -16
- package/dist/node/vault-push-to-create.d.ts.map +1 -0
- package/dist/node/{gitvault-push-to-create.js → vault-push-to-create.js} +9 -9
- package/dist/node/vault-push-to-create.js.map +1 -0
- package/dist/node/{gitvault-recover.d.ts → vault-recover.d.ts} +50 -50
- package/dist/node/vault-recover.d.ts.map +1 -0
- package/dist/node/{gitvault-recover.js → vault-recover.js} +84 -84
- package/dist/node/vault-recover.js.map +1 -0
- package/dist/node/{gitvault-restore.d.ts → vault-restore.d.ts} +8 -8
- package/dist/node/vault-restore.d.ts.map +1 -0
- package/dist/node/{gitvault-restore.js → vault-restore.js} +11 -11
- package/dist/node/vault-restore.js.map +1 -0
- package/dist/node/{gitvault-snapshot.d.ts → vault-snapshot.d.ts} +48 -48
- package/dist/node/vault-snapshot.d.ts.map +1 -0
- package/dist/node/{gitvault-snapshot.js → vault-snapshot.js} +61 -61
- package/dist/node/vault-snapshot.js.map +1 -0
- package/dist/node/{gitvault-writer-state.d.ts → vault-writer-state.d.ts} +8 -8
- package/dist/node/vault-writer-state.d.ts.map +1 -0
- package/dist/node/{gitvault-writer-state.js → vault-writer-state.js} +15 -15
- package/dist/node/vault-writer-state.js.map +1 -0
- package/dist/node/workflow-output.js +4 -4
- package/dist/node/workflow-output.js.map +1 -1
- package/package.json +1 -1
- package/dist/namespaces/gitvault.crypto.d.ts.map +0 -1
- package/dist/namespaces/gitvault.crypto.js.map +0 -1
- package/dist/namespaces/gitvault.d.ts.map +0 -1
- package/dist/namespaces/gitvault.js.map +0 -1
- package/dist/namespaces/gitvault.types.d.ts.map +0 -1
- package/dist/namespaces/gitvault.types.js.map +0 -1
- package/dist/node/gitvault-address.d.ts.map +0 -1
- package/dist/node/gitvault-address.js.map +0 -1
- package/dist/node/gitvault-apply.d.ts.map +0 -1
- package/dist/node/gitvault-apply.js.map +0 -1
- package/dist/node/gitvault-byo-config.d.ts +0 -29
- package/dist/node/gitvault-byo-config.d.ts.map +0 -1
- package/dist/node/gitvault-byo-config.js.map +0 -1
- package/dist/node/gitvault-byo-probe.d.ts +0 -20
- package/dist/node/gitvault-byo-probe.d.ts.map +0 -1
- package/dist/node/gitvault-byo-probe.js +0 -57
- package/dist/node/gitvault-byo-probe.js.map +0 -1
- package/dist/node/gitvault-creation-journal.d.ts.map +0 -1
- package/dist/node/gitvault-creation-journal.js.map +0 -1
- package/dist/node/gitvault-degraded-read.d.ts.map +0 -1
- package/dist/node/gitvault-degraded-read.js.map +0 -1
- package/dist/node/gitvault-deploy.d.ts.map +0 -1
- package/dist/node/gitvault-deploy.js.map +0 -1
- package/dist/node/gitvault-edge-fetch.d.ts.map +0 -1
- package/dist/node/gitvault-edge-fetch.js.map +0 -1
- package/dist/node/gitvault-handoff.d.ts.map +0 -1
- package/dist/node/gitvault-handoff.js.map +0 -1
- package/dist/node/gitvault-keystore.d.ts.map +0 -1
- package/dist/node/gitvault-keystore.js.map +0 -1
- package/dist/node/gitvault-member-bundle.d.ts.map +0 -1
- package/dist/node/gitvault-member-bundle.js.map +0 -1
- package/dist/node/gitvault-mirror-backend.d.ts.map +0 -1
- package/dist/node/gitvault-mirror-backend.js.map +0 -1
- package/dist/node/gitvault-mirror-config.d.ts.map +0 -1
- package/dist/node/gitvault-mirror-config.js.map +0 -1
- package/dist/node/gitvault-mirror.d.ts.map +0 -1
- package/dist/node/gitvault-mirror.js.map +0 -1
- package/dist/node/gitvault-native-crypto.d.ts.map +0 -1
- package/dist/node/gitvault-native-crypto.js.map +0 -1
- package/dist/node/gitvault-open-or-create.d.ts.map +0 -1
- package/dist/node/gitvault-open-or-create.js.map +0 -1
- package/dist/node/gitvault-prewarm.d.ts.map +0 -1
- package/dist/node/gitvault-prewarm.js.map +0 -1
- package/dist/node/gitvault-profile-scan.d.ts.map +0 -1
- package/dist/node/gitvault-profile-scan.js.map +0 -1
- package/dist/node/gitvault-prune.d.ts.map +0 -1
- package/dist/node/gitvault-prune.js.map +0 -1
- package/dist/node/gitvault-publication.d.ts.map +0 -1
- package/dist/node/gitvault-publication.js.map +0 -1
- package/dist/node/gitvault-push-to-create.d.ts.map +0 -1
- package/dist/node/gitvault-push-to-create.js.map +0 -1
- package/dist/node/gitvault-recover.d.ts.map +0 -1
- package/dist/node/gitvault-recover.js.map +0 -1
- package/dist/node/gitvault-restore.d.ts.map +0 -1
- package/dist/node/gitvault-restore.js.map +0 -1
- package/dist/node/gitvault-snapshot.d.ts.map +0 -1
- package/dist/node/gitvault-snapshot.js.map +0 -1
- package/dist/node/gitvault-writer-state.d.ts.map +0 -1
- package/dist/node/gitvault-writer-state.js.map +0 -1
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* vault — the six-stage crash-safe creation journal (protocol rev 41 §5.2;
|
|
3
3
|
* task 5.3).
|
|
4
4
|
*
|
|
5
5
|
* LOCAL_KEYS_PREPARED identity + client_creation_id (no ciphertext yet —
|
|
@@ -29,17 +29,17 @@
|
|
|
29
29
|
* does not publish.
|
|
30
30
|
* - anything the journal cannot explain → refuse the destructive retry.
|
|
31
31
|
*
|
|
32
|
-
* The control-plane calls ride an injectable {@link
|
|
32
|
+
* The control-plane calls ride an injectable {@link VaultCreationTransport}
|
|
33
33
|
* — task 5.4 wires the HTTP one; tests supply an in-memory bucket.
|
|
34
34
|
*/
|
|
35
35
|
import { existsSync, readdirSync } from "node:fs";
|
|
36
36
|
import { join } from "node:path";
|
|
37
37
|
import { LocalError } from "../errors.js";
|
|
38
|
-
import {
|
|
39
|
-
import { readFileNoFollow, writeFileAtomic0600 } from "./
|
|
40
|
-
import {
|
|
38
|
+
import { VAULT_GENESIS_EPOCH, VAULT_TERMINAL_LOSS_DOCTOR_TEXT, VAULT_TERMINAL_LOSS_STATEMENT, buildRecoveryReceipt, buildVaultGenesis, bytesToHex, checkAllocation, checkGenesisKeyBindings, formatVaultTimestamp, newHex32, parseVaultStrict, randomBytes, sealKeyEnvelope, sha256Hex, storedBytes, } from "../namespaces/vault.crypto.js";
|
|
39
|
+
import { readFileNoFollow, writeFileAtomic0600 } from "./vault-keystore.js";
|
|
40
|
+
import { crossProfileVaultHint } from "./vault-profile-scan.js";
|
|
41
41
|
// ─── Stages + journal shape ──────────────────────────────────────────────────
|
|
42
|
-
export const
|
|
42
|
+
export const VAULT_CREATION_STAGES = [
|
|
43
43
|
"LOCAL_KEYS_PREPARED",
|
|
44
44
|
"ALLOCATED",
|
|
45
45
|
"OBJECTS_PREPARED",
|
|
@@ -54,23 +54,23 @@ function envelopePath(epoch, recipientFingerprint) {
|
|
|
54
54
|
return `envelopes/${epoch}/${recipientFingerprint}`;
|
|
55
55
|
}
|
|
56
56
|
/** Journal file for one creation attempt. */
|
|
57
|
-
export function
|
|
57
|
+
export function vaultJournalPath(keystore, clientCreationId) {
|
|
58
58
|
if (!/^[0-9a-f]{32}$/.test(clientCreationId))
|
|
59
|
-
fail("
|
|
59
|
+
fail("VAULT_BAD_ID", "client_creation_id must be 32 lowercase hex", "resolving vault journal path");
|
|
60
60
|
return join(keystore.journalDir, `${clientCreationId}.json`);
|
|
61
61
|
}
|
|
62
|
-
export function
|
|
63
|
-
const text = readFileNoFollow(
|
|
62
|
+
export function readVaultJournal(keystore, clientCreationId) {
|
|
63
|
+
const text = readFileNoFollow(vaultJournalPath(keystore, clientCreationId));
|
|
64
64
|
if (!text)
|
|
65
65
|
return null;
|
|
66
66
|
const journal = JSON.parse(text);
|
|
67
|
-
if (journal.version !== 1 || !
|
|
68
|
-
fail("
|
|
67
|
+
if (journal.version !== 1 || !VAULT_CREATION_STAGES.includes(journal.stage)) {
|
|
68
|
+
fail("VAULT_JOURNAL_CORRUPT", "creation journal is not a version-1 vault journal", "reading vault creation journal", { client_creation_id: clientCreationId });
|
|
69
69
|
}
|
|
70
70
|
return journal;
|
|
71
71
|
}
|
|
72
72
|
/** Every journal on disk that has not reached ACTIVE (what `doctor` lists as "creation in progress"). */
|
|
73
|
-
export function
|
|
73
|
+
export function listIncompleteVaultJournals(keystore) {
|
|
74
74
|
if (!existsSync(keystore.journalDir))
|
|
75
75
|
return [];
|
|
76
76
|
const out = [];
|
|
@@ -80,7 +80,7 @@ export function listIncompleteGitvaultJournals(keystore) {
|
|
|
80
80
|
const id = entry.slice(0, -5);
|
|
81
81
|
if (!/^[0-9a-f]{32}$/.test(id))
|
|
82
82
|
continue;
|
|
83
|
-
const j =
|
|
83
|
+
const j = readVaultJournal(keystore, id);
|
|
84
84
|
if (j && j.stage !== "ACTIVE")
|
|
85
85
|
out.push(j);
|
|
86
86
|
}
|
|
@@ -100,38 +100,38 @@ export function listIncompleteGitvaultJournals(keystore) {
|
|
|
100
100
|
* drives to ACTIVE.
|
|
101
101
|
*
|
|
102
102
|
* Refused journals (`VAULT_CREATION_CONFLICT` / `ALLOCATION_SUPERSEDED`) are
|
|
103
|
-
* skipped: `
|
|
103
|
+
* skipped: `VaultCreation.run()` refuses to retry a refused journal
|
|
104
104
|
* destructively, so resuming one here would only reproduce the refusal.
|
|
105
105
|
* When more than one live candidate exists (should not happen in practice —
|
|
106
106
|
* this function is what prevents it — but a manually-edited keystore or a
|
|
107
107
|
* pre-D2 stray journal could produce one), the most recently updated one is
|
|
108
108
|
* preferred, on the theory that it is the attempt most likely still moving.
|
|
109
109
|
*/
|
|
110
|
-
export function
|
|
111
|
-
const candidates =
|
|
110
|
+
export function findResumableVaultJournal(keystore, orgId, projectId) {
|
|
111
|
+
const candidates = listIncompleteVaultJournals(keystore).filter((j) => j.push_to_create === null && j.org_id === orgId && j.project_id === projectId && j.refusal === null);
|
|
112
112
|
if (candidates.length === 0)
|
|
113
113
|
return null;
|
|
114
114
|
candidates.sort((a, b) => (a.updated_at < b.updated_at ? 1 : a.updated_at > b.updated_at ? -1 : 0));
|
|
115
115
|
return candidates[0];
|
|
116
116
|
}
|
|
117
117
|
/**
|
|
118
|
-
* The push-to-create sibling of {@link
|
|
118
|
+
* The push-to-create sibling of {@link findResumableVaultJournal} (task
|
|
119
119
|
* 4.5): find an in-progress LOCAL push-to-create attempt for this exact
|
|
120
120
|
* `(org_slug, repo_name)` address, so a retry after a crash resumes it rather
|
|
121
121
|
* than starting a second competing attempt. A journal that already lost the
|
|
122
122
|
* name-claim race (`REPO_CREATION_CONFLICT`) is excluded — resuming it would
|
|
123
|
-
* only reproduce the same refusal; `
|
|
123
|
+
* only reproduce the same refusal; `pushToCreateVault` starts a fresh
|
|
124
124
|
* attempt in that case (and typically does not even reach here, since its
|
|
125
125
|
* own fast-path read resolves the winner's repo directly).
|
|
126
126
|
*/
|
|
127
127
|
export function findResumablePushToCreateJournal(keystore, orgSlug, repoName) {
|
|
128
|
-
const candidates =
|
|
128
|
+
const candidates = listIncompleteVaultJournals(keystore).filter((j) => j.push_to_create !== null && j.push_to_create.org_slug === orgSlug && j.push_to_create.repo_name === repoName && j.refusal === null);
|
|
129
129
|
if (candidates.length === 0)
|
|
130
130
|
return null;
|
|
131
131
|
candidates.sort((a, b) => (a.updated_at < b.updated_at ? 1 : a.updated_at > b.updated_at ? -1 : 0));
|
|
132
132
|
return candidates[0];
|
|
133
133
|
}
|
|
134
|
-
export class
|
|
134
|
+
export class VaultCreation {
|
|
135
135
|
keystore;
|
|
136
136
|
transport;
|
|
137
137
|
now;
|
|
@@ -154,17 +154,17 @@ export class GitvaultCreation {
|
|
|
154
154
|
static open(options) {
|
|
155
155
|
const usingPushToCreate = options.push_to_create !== undefined;
|
|
156
156
|
if (usingPushToCreate === (options.org_id !== undefined || options.project_id !== undefined)) {
|
|
157
|
-
fail("
|
|
157
|
+
fail("VAULT_BAD_ADDRESS", "pass exactly one of {org_id, project_id} or push_to_create, never both or neither", "opening vault creation");
|
|
158
158
|
}
|
|
159
159
|
const ks = options.keystore;
|
|
160
160
|
const identity = ks.ensureIdentity();
|
|
161
161
|
const signing = ks.signingKeypair(identity);
|
|
162
162
|
const encryption = ks.encryptionKeypair(identity);
|
|
163
163
|
if (!signing || !encryption) {
|
|
164
|
-
fail("
|
|
164
|
+
fail("VAULT_READ_ONLY", "this principal cannot create a vault: a private key is missing from identity.json", "opening vault creation", { signing_key_present: Boolean(signing), encryption_key_present: Boolean(encryption) });
|
|
165
165
|
}
|
|
166
166
|
const id = options.client_creation_id ?? newHex32();
|
|
167
|
-
const existing =
|
|
167
|
+
const existing = readVaultJournal(ks, id);
|
|
168
168
|
if (existing) {
|
|
169
169
|
// Addressing-key mismatch refuses a destructive retry — the ordinary
|
|
170
170
|
// (org_id, project_id) form and push-to-create's (org_slug, repo_name)
|
|
@@ -176,7 +176,7 @@ export class GitvaultCreation {
|
|
|
176
176
|
const mismatch = (usingPushToCreate
|
|
177
177
|
? existing.push_to_create === null || existing.push_to_create.org_slug !== options.push_to_create.org_slug || existing.push_to_create.repo_name !== options.push_to_create.repo_name
|
|
178
178
|
: existing.push_to_create !== null || existing.org_id !== options.org_id || existing.project_id !== options.project_id)
|
|
179
|
-
//
|
|
179
|
+
// vault-byo-primary-bucket task 3.1: a resumed journal's own
|
|
180
180
|
// storage_profile/byo_destination are the RESUMABILITY KEY, exactly
|
|
181
181
|
// like push_to_create's address above — a resume that silently
|
|
182
182
|
// changed which bucket it was asking for would be worse than
|
|
@@ -184,14 +184,14 @@ export class GitvaultCreation {
|
|
|
184
184
|
|| existing.storage_profile !== (options.storage_profile ?? null)
|
|
185
185
|
|| existing.byo_destination !== (options.byo_destination ?? null);
|
|
186
186
|
if (mismatch) {
|
|
187
|
-
fail("VAULT_CREATION_CONFLICT", "journal belongs to a different org/project (or addressing form)", "resuming
|
|
187
|
+
fail("VAULT_CREATION_CONFLICT", "journal belongs to a different org/project (or addressing form)", "resuming vault creation", { client_creation_id: id });
|
|
188
188
|
}
|
|
189
189
|
if (existing.creator_signing_fingerprint !== identity.signing_fingerprint || existing.creator_encryption_fingerprint !== identity.encryption_fingerprint) {
|
|
190
|
-
fail("VAULT_CREATION_CONFLICT", "journal was prepared by a different identity; refusing the destructive retry", "resuming
|
|
190
|
+
fail("VAULT_CREATION_CONFLICT", "journal was prepared by a different identity; refusing the destructive retry", "resuming vault creation", { client_creation_id: id });
|
|
191
191
|
}
|
|
192
|
-
return new
|
|
192
|
+
return new VaultCreation(options, existing, true);
|
|
193
193
|
}
|
|
194
|
-
const at =
|
|
194
|
+
const at = formatVaultTimestamp((options.now ?? (() => new Date()))());
|
|
195
195
|
const journal = {
|
|
196
196
|
version: 1,
|
|
197
197
|
stage: "LOCAL_KEYS_PREPARED",
|
|
@@ -213,7 +213,7 @@ export class GitvaultCreation {
|
|
|
213
213
|
recovery_receipt: null,
|
|
214
214
|
refusal: null,
|
|
215
215
|
};
|
|
216
|
-
const c = new
|
|
216
|
+
const c = new VaultCreation(options, journal, false);
|
|
217
217
|
c.persist();
|
|
218
218
|
return c;
|
|
219
219
|
}
|
|
@@ -221,8 +221,8 @@ export class GitvaultCreation {
|
|
|
221
221
|
return this.journal;
|
|
222
222
|
}
|
|
223
223
|
persist() {
|
|
224
|
-
this.journal = { ...this.journal, updated_at:
|
|
225
|
-
writeFileAtomic0600(
|
|
224
|
+
this.journal = { ...this.journal, updated_at: formatVaultTimestamp(this.now()) };
|
|
225
|
+
writeFileAtomic0600(vaultJournalPath(this.keystore, this.journal.client_creation_id), JSON.stringify(this.journal, null, 2));
|
|
226
226
|
this.keystore.audit("journal_stage", this.journal.allocation?.repo_id, { client_creation_id: this.journal.client_creation_id, stage: this.journal.stage });
|
|
227
227
|
}
|
|
228
228
|
async advance(stage, patch) {
|
|
@@ -231,9 +231,9 @@ export class GitvaultCreation {
|
|
|
231
231
|
await this.options.onStage?.(stage, this.journal);
|
|
232
232
|
}
|
|
233
233
|
refuse(code, message, details) {
|
|
234
|
-
this.journal = { ...this.journal, refusal: { code, at:
|
|
234
|
+
this.journal = { ...this.journal, refusal: { code, at: formatVaultTimestamp(this.now()), ...(details ? { details } : {}) } };
|
|
235
235
|
this.persist();
|
|
236
|
-
fail(code, message, "reconciling
|
|
236
|
+
fail(code, message, "reconciling vault creation", { client_creation_id: this.journal.client_creation_id, ...details });
|
|
237
237
|
}
|
|
238
238
|
/**
|
|
239
239
|
* Init idempotence. Reached only from a FRESH
|
|
@@ -288,9 +288,9 @@ export class GitvaultCreation {
|
|
|
288
288
|
// gateway envelope this replaces — the word "foreign" never appears
|
|
289
289
|
// here. The vault belongs to this org; this keystore just does not (or
|
|
290
290
|
// can no longer provably) hold its key.
|
|
291
|
-
fail("VAULT_CREATION_CONFLICT", `a vault already exists for this project (repo_id ${repoId}), and this machine's keystore does not hold (or cannot verify) its key`, "reconciling
|
|
292
|
-
{ action: "restore the
|
|
293
|
-
...
|
|
291
|
+
fail("VAULT_CREATION_CONFLICT", `a vault already exists for this project (repo_id ${repoId}), and this machine's keystore does not hold (or cannot verify) its key`, "reconciling vault creation", { repo_id: repoId, org_id: this.journal.org_id, project_id: this.journal.project_id }, [
|
|
292
|
+
{ action: "restore the vault keystore onto this machine (run402 repos view prints keystore.root; back it up from the machine that holds it)" },
|
|
293
|
+
...crossProfileVaultHint(repoId),
|
|
294
294
|
]);
|
|
295
295
|
}
|
|
296
296
|
/**
|
|
@@ -299,7 +299,7 @@ export class GitvaultCreation {
|
|
|
299
299
|
*/
|
|
300
300
|
async run() {
|
|
301
301
|
if (this.journal.refusal) {
|
|
302
|
-
fail(this.journal.refusal.code, "this creation attempt was refused earlier; start a new attempt (the journal is kept for diagnosis)", "resuming
|
|
302
|
+
fail(this.journal.refusal.code, "this creation attempt was refused earlier; start a new attempt (the journal is kept for diagnosis)", "resuming vault creation", {
|
|
303
303
|
client_creation_id: this.journal.client_creation_id,
|
|
304
304
|
refused_at: this.journal.refusal.at,
|
|
305
305
|
...this.journal.refusal.details,
|
|
@@ -311,8 +311,8 @@ export class GitvaultCreation {
|
|
|
311
311
|
// ── 2. ALLOCATED ──
|
|
312
312
|
if (this.journal.stage === "LOCAL_KEYS_PREPARED") {
|
|
313
313
|
// PUBKEYS on the request; the returned record carries the fingerprints
|
|
314
|
-
// the gateway derives from them. See
|
|
315
|
-
//
|
|
314
|
+
// the gateway derives from them. See VaultAllocateRequest.
|
|
315
|
+
// vault-byo-primary-bucket task 3.1: the journal's own
|
|
316
316
|
// storage_profile/byo_destination are the pinned request — set once
|
|
317
317
|
// at open, resumability-checked above — never re-derived from a
|
|
318
318
|
// fresh call's options (a resume never re-decides what it is asking
|
|
@@ -342,7 +342,7 @@ export class GitvaultCreation {
|
|
|
342
342
|
catch (e) {
|
|
343
343
|
// Push-to-create's race (task 4.4/4.5, design D6): the atomic
|
|
344
344
|
// name-claim was lost to a concurrent pusher. Mark the journal
|
|
345
|
-
// refused with the winner's project_id so `
|
|
345
|
+
// refused with the winner's project_id so `pushToCreateVault` can
|
|
346
346
|
// resolve to it and proceed as an ordinary push — "the loser's work
|
|
347
347
|
// is not lost, it just wasn't the creator." Never retried
|
|
348
348
|
// destructively from here; a fresh push-to-create attempt (if one is
|
|
@@ -379,7 +379,7 @@ export class GitvaultCreation {
|
|
|
379
379
|
}
|
|
380
380
|
const allocation = this.journal.allocation;
|
|
381
381
|
const repoId = allocation.repo_id;
|
|
382
|
-
const epoch =
|
|
382
|
+
const epoch = VAULT_GENESIS_EPOCH;
|
|
383
383
|
// ── 3. OBJECTS_PREPARED — the FIRST point at which ciphertext exists ──
|
|
384
384
|
if (this.journal.stage === "ALLOCATED") {
|
|
385
385
|
const kRepo = randomBytes(32);
|
|
@@ -389,7 +389,7 @@ export class GitvaultCreation {
|
|
|
389
389
|
epoch,
|
|
390
390
|
recipient_public_key: encryption.public_key,
|
|
391
391
|
signer: signing,
|
|
392
|
-
created_at:
|
|
392
|
+
created_at: formatVaultTimestamp(this.now()),
|
|
393
393
|
});
|
|
394
394
|
const object = {
|
|
395
395
|
object_kind: "key_envelope",
|
|
@@ -426,11 +426,11 @@ export class GitvaultCreation {
|
|
|
426
426
|
bytes,
|
|
427
427
|
expected_sha256: object.stored_bytes_sha256,
|
|
428
428
|
expected_size_bytes: object.size_bytes,
|
|
429
|
-
//
|
|
429
|
+
// vault-byo-primary-bucket task 3.1/3.2: the genesis
|
|
430
430
|
// key_envelope is a payload object — for a BYO vault it is
|
|
431
431
|
// written directly to the customer's own destination, never
|
|
432
432
|
// run402's bucket. `byo_write_target` is in-memory-only
|
|
433
|
-
// (`
|
|
433
|
+
// (`VaultCreationOptions`'s own doc comment) — a resume that
|
|
434
434
|
// omits it fails closed downstream in `upload()` rather than
|
|
435
435
|
// silently defaulting to the managed path.
|
|
436
436
|
...(this.journal.storage_profile === "byo" && this.options.byo_write_target ? { byo: this.options.byo_write_target } : {}),
|
|
@@ -457,9 +457,9 @@ export class GitvaultCreation {
|
|
|
457
457
|
creator_signing: signing,
|
|
458
458
|
creator_encryption_public_key: encryption.public_key,
|
|
459
459
|
envelope_receipt: envelopeObject.receipt,
|
|
460
|
-
created_at:
|
|
460
|
+
created_at: formatVaultTimestamp(this.now()),
|
|
461
461
|
});
|
|
462
|
-
const storedEnvelope =
|
|
462
|
+
const storedEnvelope = parseVaultStrict(new TextDecoder().decode(unb64u(envelopeObject.stored_bytes_b64u)));
|
|
463
463
|
const bindings = checkGenesisKeyBindings(genesis, storedEnvelope);
|
|
464
464
|
if (bindings.length > 0)
|
|
465
465
|
this.refuse("VAULT_CREATION_CONFLICT", "prepared genesis fails its own key bindings", { problems: bindings });
|
|
@@ -534,7 +534,7 @@ export class GitvaultCreation {
|
|
|
534
534
|
project_id: this.journal.project_id ?? undefined,
|
|
535
535
|
}, this.options.service_public_key);
|
|
536
536
|
if (problems.length > 0) {
|
|
537
|
-
fail("
|
|
537
|
+
fail("VAULT_ALLOCATION_INVALID", "allocation does not match this creation attempt", "verifying vault allocation", { problems });
|
|
538
538
|
}
|
|
539
539
|
if (allocation.status === "superseded") {
|
|
540
540
|
this.refuse("ALLOCATION_SUPERSEDED", "the allocation was reclaimed by the owner; this client must not resume", { allocation_generation: allocation.allocation_generation });
|
|
@@ -542,13 +542,13 @@ export class GitvaultCreation {
|
|
|
542
542
|
}
|
|
543
543
|
}
|
|
544
544
|
/** Convenience: open + run in one call. */
|
|
545
|
-
export async function
|
|
546
|
-
return
|
|
545
|
+
export async function createVault(options) {
|
|
546
|
+
return VaultCreation.open(options).run();
|
|
547
547
|
}
|
|
548
|
-
export function
|
|
548
|
+
export function vaultDoctorRecoveryText() {
|
|
549
549
|
return {
|
|
550
|
-
statement:
|
|
551
|
-
doctor_text:
|
|
550
|
+
statement: VAULT_TERMINAL_LOSS_STATEMENT,
|
|
551
|
+
doctor_text: VAULT_TERMINAL_LOSS_DOCTOR_TEXT,
|
|
552
552
|
cas_restore_pointer: "The platform custodially holds the plaintext source artifacts of every DEPLOY in its CAS; ask support for a custodial restore of deployed artifacts. Vault HISTORY (commits never deployed) is not recoverable without a surviving principal keystore.",
|
|
553
553
|
};
|
|
554
554
|
}
|
|
@@ -567,4 +567,4 @@ function bytesEqual(a, b) {
|
|
|
567
567
|
diff |= a[i] ^ b[i];
|
|
568
568
|
return diff === 0;
|
|
569
569
|
}
|
|
570
|
-
//# sourceMappingURL=
|
|
570
|
+
//# sourceMappingURL=vault-creation-journal.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-creation-journal.js","sourceRoot":"","sources":["../../src/node/vault-creation-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,6BAA6B,EAC7B,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,+BAA+B,CAAC;AASvC,OAAO,EAAiB,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,gFAAgF;AAEhF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB;IACrB,WAAW;IACX,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,QAAQ;CACA,CAAC;AAgQX,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,oBAA4B;IAC/D,OAAO,aAAa,KAAK,IAAI,oBAAoB,EAAE,CAAC;AACtD,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,QAAuB,EAAE,gBAAwB;IAChF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,cAAc,EAAE,6CAA6C,EAAE,8BAA8B,CAAC,CAAC;IAClJ,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,gBAAgB,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAuB,EAAE,gBAAwB;IAChF,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;IACzD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,uBAAuB,EAAE,mDAAmD,EAAE,gCAAgC,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,2BAA2B,CAAC,QAAuB;IACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACzC,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAuB,EAAE,KAAa,EAAE,SAAiB;IACjG,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAC3G,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC,CAAC,QAAuB,EAAE,OAAe,EAAE,QAAgB;IACzG,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAC3I,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,aAAa;IACP,QAAQ,CAAgB;IACxB,SAAS,CAAyB;IAClC,GAAG,CAAa;IAChB,OAAO,CAAuB;IACvC,OAAO,CAAuB;IAC9B,OAAO,GAAG,KAAK,CAAC;IAExB,YAAoB,OAA6B,EAAE,OAA6B,EAAE,OAAgB;QAChG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAA6B;QACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC;QAC/D,IAAI,iBAAiB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;YAC7F,IAAI,CAAC,mBAAmB,EAAE,mFAAmF,EAAE,wBAAwB,CAAC,CAAC;QAC3I,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,iBAAiB,EAAE,mFAAmF,EAAE,wBAAwB,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACjO,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,IAAI,QAAQ,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,CAAC,iBAAiB;gBACjC,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,KAAK,OAAO,CAAC,cAAe,CAAC,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,cAAe,CAAC,SAAS;gBACtL,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC;gBACvH,6DAA6D;gBAC7D,oEAAoE;gBACpE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,yCAAyC;mBACtC,QAAQ,CAAC,eAAe,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;mBAC9D,QAAQ,CAAC,eAAe,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,yBAAyB,EAAE,iEAAiE,EAAE,yBAAyB,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5J,CAAC;YACD,IAAI,QAAQ,CAAC,2BAA2B,KAAK,QAAQ,CAAC,mBAAmB,IAAI,QAAQ,CAAC,8BAA8B,KAAK,QAAQ,CAAC,sBAAsB,EAAE,CAAC;gBACzJ,IAAI,CAAC,yBAAyB,EAAE,8EAA8E,EAAE,yBAAyB,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YACzK,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAyB;YACpC,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,qBAAqB;YAC5B,kBAAkB,EAAE,EAAE;YACtB,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAO;YAClD,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW;YAC1D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,2BAA2B,EAAE,QAAQ,CAAC,mBAAmB;YACzD,8BAA8B,EAAE,QAAQ,CAAC,sBAAsB;YAC/D,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,IAAI;SACd,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACjF,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7H,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7J,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAyB,EAAE,KAAoC;QACnF,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,IAAoF,EAAE,OAAe,EAAE,OAAiC;QACrJ,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7H,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACzH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,yBAAyB,CAAC,GAAY;QAClD,MAAM,CAAC,GAAG,GAAkE,CAAC;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,+DAA+D;QAEvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,YAAY,GAAsB,IAAI,CAAC;YAC3C,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,GAAG,IAAI,CAAC,CAAC,qGAAqG;YAC5H,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC3E,OAAO;wBACL,OAAO,EAAE,MAAM;wBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,cAAc,EAAE,WAAW;wBAC3B,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,GAAG,EAAE,YAAY;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,wCAAwC;QACxC,IAAI,CACF,yBAAyB,EACzB,oDAAoD,MAAM,yEAAyE,EACnI,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EACrF;YACE,EAAE,MAAM,EAAE,kIAAkI,EAAE;YAC9I,GAAG,qBAAqB,CAAC,MAAM,CAAC;SACjC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,oGAAoG,EAAE,yBAAyB,EAAE;gBAC/J,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;gBACnD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACnC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAE,CAAC;QAE9D,qBAAqB;QACrB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACjD,uEAAuE;YACvE,2DAA2D;YAC3D,uDAAuD;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,oEAAoE;YACpE,QAAQ;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAc,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpJ,MAAM,OAAO,GAAyB,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC/D,CAAC,CAAC;oBACE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;oBACnD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ;oBAC9C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS;oBAChD,sBAAsB,EAAE,QAAQ,CAAC,cAAc;oBAC/C,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB;oBACrD,GAAG,SAAS;iBACb;gBACH,CAAC,CAAC;oBACE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;oBACnD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAO;oBAC5B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;oBACpC,sBAAsB,EAAE,QAAQ,CAAC,cAAc;oBAC/C,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB;oBACrD,GAAG,SAAS;iBACb,CAAC;YACN,IAAI,UAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,8DAA8D;gBAC9D,+DAA+D;gBAC/D,kEAAkE;gBAClE,oEAAoE;gBACpE,0DAA0D;gBAC1D,qEAAqE;gBACrE,qCAAqC;gBACrC,MAAM,IAAI,GAAI,CAA8B,EAAE,IAAI,CAAC;gBACnD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;oBACrE,MAAM,OAAO,GAAI,CAAkD,EAAE,OAAO,CAAC;oBAC7E,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,gEAAgE,EAAE,OAAO,CAAC,CAAC;gBACnH,CAAC;gBACD,6CAA6C;gBAC7C,iEAAiE;gBACjE,kEAAkE;gBAClE,iEAAiE;gBACjE,kEAAkE;gBAClE,iEAAiE;gBACjE,gEAAgE;gBAChE,oDAAoD;gBACpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACvE,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,iEAAiE;YACjE,4EAA4E;YAC5E,uEAAuE;YACvE,8DAA8D;YAC9D,uDAAuD;YACvD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBAC9B,UAAU;gBACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM;gBAChD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAElC,yEAAyE;QACzE,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,MAAM;gBACf,KAAK;gBACL,oBAAoB,EAAE,UAAU,CAAC,UAAU;gBAC3C,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,MAAM,GAAyB;gBACnC,WAAW,EAAE,cAAc;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;gBAC/D,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC5C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,yFAAyF;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,SAAS;oBAAE,SAAS;gBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAC/C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;oBAClG,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,0FAA0F,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5J,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtF,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC/B,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,4DAA4D,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChK,CAAC;oBACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC7C,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK;oBACL,eAAe,EAAE,MAAM,CAAC,mBAAmB;oBAC3C,mBAAmB,EAAE,MAAM,CAAC,UAAU;oBACtC,qDAAqD;oBACrD,2DAA2D;oBAC3D,4DAA4D;oBAC5D,wDAAwD;oBACxD,6DAA6D;oBAC7D,6DAA6D;oBAC7D,2CAA2C;oBAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3H,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;oBAC3G,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,qEAAqE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChJ,CAAC;gBACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,2FAA2F;QAC3F,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YACrG,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,OAAO,EAAE,MAAM;gBACf,+DAA+D;gBAC/D,+DAA+D;gBAC/D,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAO;gBAC5B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;gBACpC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,eAAe,EAAE,OAAO;gBACxB,6BAA6B,EAAE,UAAU,CAAC,UAAU;gBACpD,gBAAgB,EAAE,cAAc,CAAC,OAAO;gBACxC,UAAU,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAqB,CAAC;YAChI,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,6CAA6C,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvI,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,OAAuC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvI,CAAC;QAED,6EAA6E;QAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAuC,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,2DAA2D,CAAC,CAAC;YAC9I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,+FAA+F,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/K,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;oBAC/C,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,yEAAyE,EAAE,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;gBAC/K,CAAC;gBACD,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,oEAAoE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC5J,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAO;gBAC5B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;gBACpC,cAAc,EAAE,IAAI;gBACpB,eAAe,EAAE,OAAO;gBACxB,6BAA6B,EAAE,UAAU,CAAC,UAAU;aACrD,CAAC,CAAC;YACH,wFAAwF;YACxF,gGAAgG;YAChG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAO;gBAC5B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;gBACpC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;gBACpC,KAAK;gBACL,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,IAAI;gBACd,oBAAoB,EAAE,IAAI;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAO;YAC5B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;YACpC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAe;YAC5C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAiB;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,UAA2B;QAClD,MAAM,QAAQ,GAAG,eAAe,CAC9B,UAAU,EACV;YACE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;YACnD,2BAA2B,EAAE,IAAI,CAAC,OAAO,CAAC,2BAA2B;YACrE,8BAA8B,EAAE,IAAI,CAAC,OAAO,CAAC,8BAA8B;YAC3E,mEAAmE;YACnE,qEAAqE;YACrE,sEAAsE;YACtE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS;YACxC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS;SACjD,EACD,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAChC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,EAAE,iDAAiD,EAAE,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wEAAwE,EAAE,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC9K,CAAC;IACH,CAAC;CACF;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA6B;IAC7D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;AAC3C,CAAC;AAYD,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,SAAS,EAAE,6BAA6B;QACxC,WAAW,EAAE,+BAA+B;QAC5C,mBAAmB,EAAE,wPAAwP;KAC9Q,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,IAAI,CAAC,KAAiB;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import type {
|
|
3
|
-
import type {
|
|
4
|
-
import { type
|
|
5
|
-
import type {
|
|
1
|
+
import { VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT } from "../namespaces/vault.crypto.js";
|
|
2
|
+
import type { VaultHeadTarget } from "../namespaces/vault.types.js";
|
|
3
|
+
import type { VaultKeystore } from "./vault-keystore.js";
|
|
4
|
+
import { type VaultMirrorBackend } from "./vault-mirror-backend.js";
|
|
5
|
+
import type { VaultRetainedRefsReconcileResult } from "./vault-publication.js";
|
|
6
6
|
/**
|
|
7
7
|
* Trigger discipline (design D4): a chain/payload read falls back ONLY on a
|
|
8
8
|
* genuinely network-class failure — the underlying `fetch` threw before a
|
|
@@ -11,49 +11,49 @@ import type { GitvaultRetainedRefsReconcileResult } from "./gitvault-publication
|
|
|
11
11
|
* mirror, so it is excluded even when it happens to arrive with no `.status`
|
|
12
12
|
* (see below).
|
|
13
13
|
*
|
|
14
|
-
* Two wrinkles in how a
|
|
14
|
+
* Two wrinkles in how a vault read actually fails, both handled here:
|
|
15
15
|
*
|
|
16
|
-
* 1. Most
|
|
17
|
-
* `
|
|
16
|
+
* 1. Most vault byte reads (`getGenerationBytes`/`getObjectBytes` in
|
|
17
|
+
* `vault-publication.ts`, and this file's own mirror backend) call the
|
|
18
18
|
* injected `fetch` DIRECTLY rather than the kernel's typed
|
|
19
19
|
* `client.request()` — a raw connection/DNS failure therefore propagates
|
|
20
20
|
* UNBRANDED (a plain `TypeError`, never a `Run402Error`). That is, in
|
|
21
21
|
* practice, the primary shape a real "run402 is unreachable" outage
|
|
22
22
|
* takes, so an unbranded throw is treated as network-class.
|
|
23
23
|
* 2. When those SAME call sites DO get a response but it is not `ok`, they
|
|
24
|
-
* throw via `
|
|
24
|
+
* throw via `vault-publication.ts`'s own local `fail()` helper — a
|
|
25
25
|
* `LocalError` whose real HTTP status rides in `details.status`, never on
|
|
26
26
|
* `e.status` itself (`LocalError` always passes `status: null` to the
|
|
27
27
|
* `Run402Error` constructor). This function reads BOTH places so a 5xx
|
|
28
28
|
* reaching through either path is classified alike, and a 4xx through
|
|
29
29
|
* either path is excluded alike.
|
|
30
30
|
*/
|
|
31
|
-
export declare function
|
|
31
|
+
export declare function isNetworkClassVaultReadError(e: unknown): boolean;
|
|
32
32
|
/** `s3://bucket/prefix` or a directory path — never a credential, same redaction `mirrorStatus` already prints. */
|
|
33
|
-
export interface
|
|
34
|
-
/** `"byo"` when this vault's own primary destination served the fallback (
|
|
33
|
+
export interface VaultDegradedReadSource {
|
|
34
|
+
/** `"byo"` when this vault's own primary destination served the fallback (vault-byo-primary-bucket task 3.4); `"mirror"` for the opt-in customer mirror — see {@link resolveDegradedReadSource}'s precedence. */
|
|
35
35
|
kind: "mirror" | "byo";
|
|
36
36
|
destination: string;
|
|
37
37
|
credential_kind: "profile" | "ambient" | null;
|
|
38
38
|
}
|
|
39
|
-
/** One degraded chain/payload read, served from {@link
|
|
40
|
-
export interface
|
|
39
|
+
/** One degraded chain/payload read, served from {@link VaultDegradedReadSource} via `r402s-recover`. */
|
|
40
|
+
export interface VaultDegradedReadResult {
|
|
41
41
|
degraded: true;
|
|
42
|
-
source:
|
|
42
|
+
source: VaultDegradedReadSource;
|
|
43
43
|
refs: Record<string, string>;
|
|
44
|
-
head_target:
|
|
44
|
+
head_target: VaultHeadTarget;
|
|
45
45
|
generation: string;
|
|
46
|
-
retained_refs:
|
|
47
|
-
validity_not_freshness: typeof
|
|
46
|
+
retained_refs: VaultRetainedRefsReconcileResult;
|
|
47
|
+
validity_not_freshness: typeof VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT;
|
|
48
48
|
}
|
|
49
|
-
interface ResolvedDegradedReadSource extends
|
|
50
|
-
backend:
|
|
49
|
+
interface ResolvedDegradedReadSource extends VaultDegradedReadSource {
|
|
50
|
+
backend: VaultMirrorBackend;
|
|
51
51
|
}
|
|
52
52
|
/**
|
|
53
53
|
* The small seam design D4 calls out: which client-side destination a
|
|
54
54
|
* degraded read should serve from, for one vault.
|
|
55
55
|
*
|
|
56
|
-
* Precedence (
|
|
56
|
+
* Precedence (vault-byo-primary-bucket task 3.4): the opt-in customer
|
|
57
57
|
* MIRROR wins when BOTH a mirror and a BYO write config are configured
|
|
58
58
|
* locally on THIS machine. A BYO vault's own primary destination is
|
|
59
59
|
* ALWAYS a complete `r402s-recover` source on its own (task 3.3's whole
|
|
@@ -66,19 +66,19 @@ interface ResolvedDegradedReadSource extends GitvaultDegradedReadSource {
|
|
|
66
66
|
* local file reads, matching this function's own "never touches the
|
|
67
67
|
* network" contract.
|
|
68
68
|
*/
|
|
69
|
-
export declare function resolveDegradedReadSource(keystore:
|
|
70
|
-
export interface
|
|
69
|
+
export declare function resolveDegradedReadSource(keystore: VaultKeystore, repoId: string): ResolvedDegradedReadSource | null;
|
|
70
|
+
export interface VaultDegradedReadLive {
|
|
71
71
|
refs: Record<string, string>;
|
|
72
|
-
head_target:
|
|
72
|
+
head_target: VaultHeadTarget;
|
|
73
73
|
generation: string;
|
|
74
74
|
}
|
|
75
|
-
export interface
|
|
75
|
+
export interface TryVaultDegradedReadOptions<T extends VaultDegradedReadLive> {
|
|
76
76
|
/** The caller's own live gateway call (e.g. `vault.materialize()` or `vault.restoreObjectsInto(dir)`) — this module has no opinion on which. */
|
|
77
77
|
attemptLive: () => Promise<T>;
|
|
78
|
-
keystore:
|
|
78
|
+
keystore: VaultKeystore;
|
|
79
79
|
repo_id: string;
|
|
80
80
|
/**
|
|
81
|
-
* Where a degraded materialization writes objects (`
|
|
81
|
+
* Where a degraded materialization writes objects (`recoverVaultMirror`'s
|
|
82
82
|
* own `out_dir` — a bare-shaped, git-proven repository, e.g. the resolved
|
|
83
83
|
* `GIT_DIR` from `resolveGitInvocationRepo`; never guessed from `cwd`).
|
|
84
84
|
* `null` disables the fallback entirely — a repo-free read (a bare
|
|
@@ -86,15 +86,15 @@ export interface TryGitvaultDegradedReadOptions<T extends GitvaultDegradedReadLi
|
|
|
86
86
|
* so it surfaces the original gateway error exactly as it always did.
|
|
87
87
|
*/
|
|
88
88
|
out_dir: string | null;
|
|
89
|
-
/** Test/advanced hook: an already-opened backend, bypassing {@link resolveDegradedReadSource}'s config resolution — mirrors `
|
|
90
|
-
backend?:
|
|
89
|
+
/** Test/advanced hook: an already-opened backend, bypassing {@link resolveDegradedReadSource}'s config resolution — mirrors `VaultMirrorSyncOptions`'s own `backend` override. */
|
|
90
|
+
backend?: VaultMirrorBackend;
|
|
91
91
|
}
|
|
92
|
-
export type
|
|
92
|
+
export type VaultDegradedReadOutcome<T extends VaultDegradedReadLive> = {
|
|
93
93
|
degraded: false;
|
|
94
94
|
live: T;
|
|
95
95
|
} | {
|
|
96
96
|
degraded: true;
|
|
97
|
-
result:
|
|
97
|
+
result: VaultDegradedReadResult;
|
|
98
98
|
};
|
|
99
99
|
/**
|
|
100
100
|
* Attempt `options.attemptLive`, with ONE bounded retry on a network-class
|
|
@@ -110,11 +110,11 @@ export type GitvaultDegradedReadOutcome<T extends GitvaultDegradedReadLive> = {
|
|
|
110
110
|
* `code`/`status`/`kind` survive for the caller exactly as they would
|
|
111
111
|
* without this wrapper. Only the caller's own stderr hint may change.
|
|
112
112
|
* With a fallback source, this degrades via the SHIPPED `r402s-recover`
|
|
113
|
-
* engine (`
|
|
113
|
+
* engine (`recoverVaultMirror`) against it, returning
|
|
114
114
|
* `{ degraded: true, result }` — a genuine recovery failure (an incomplete
|
|
115
115
|
* or unreadable mirror) propagates from THAT call as its own honest error,
|
|
116
116
|
* never silently swallowed back into the original gateway failure.
|
|
117
117
|
*/
|
|
118
|
-
export declare function
|
|
118
|
+
export declare function tryVaultDegradedRead<T extends VaultDegradedReadLive>(options: TryVaultDegradedReadOptions<T>): Promise<VaultDegradedReadOutcome<T>>;
|
|
119
119
|
export {};
|
|
120
|
-
//# sourceMappingURL=
|
|
120
|
+
//# sourceMappingURL=vault-degraded-read.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-degraded-read.d.ts","sourceRoot":"","sources":["../../src/node/vault-degraded-read.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,6CAA6C,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE5F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAUhE;AAYD,mHAAmH;AACnH,MAAM,WAAW,uBAAuB;IACtC,iNAAiN;IACjN,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CAC/C;AAED,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,gCAAgC,CAAC;IAChD,sBAAsB,EAAE,OAAO,6CAA6C,CAAC;CAC9E;AAED,UAAU,0BAA2B,SAAQ,uBAAuB;IAClE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAUpH;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,qBAAqB;IAC1E,gJAAgJ;IAChJ,WAAW,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kLAAkL;IAClL,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,qBAAqB,IAChE;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC5B;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,qBAAqB,EACxE,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CA8BtC"}
|