instar 1.3.1344 → 1.3.1345

package/dashboard/index.html

@@ -1042,6 +1042,24 @@
     .mnd-reason-cell { color: var(--text-dim); }
     .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; flex-wrap: wrap; }
     .mnd-dim { font-size: 13px; color: var(--text-dim); }
+    .pair-card { border: 1px solid var(--border); border-radius: 8px; padding: 12px; margin-top: 10px; }
+    .pair-head { display: flex; flex-wrap: wrap; gap: 8px; align-items: baseline; }
+    .pair-state { font-size: 13px; color: var(--text-dim); }
+    .pair-state-verification-failed { color: #f85149; }
+    .pair-state-mutual-verified, .pair-state-identity-verified { color: #3fb950; }
+    .pair-step { margin-top: 10px; }
+    .pair-step-title { font-size: 13px; margin-bottom: 6px; }
+    .pair-row { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin: 6px 0; }
+    .pair-own-words { columns: 3; font-family: ui-monospace, monospace; font-size: 15px; margin: 6px 0; }
+    .pair-words { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 6px; }
+    .pair-word { display: flex; align-items: center; gap: 4px; font-size: 12px; color: var(--text-dim); }
+    .pair-word input { flex: 1; min-width: 0; padding: 6px; font-family: ui-monospace, monospace; font-size: 15px; }
+    .pair-meta { font-size: 11px; color: var(--text-dim); margin-top: 8px; }
+    @media (max-width: 640px) {
+      .pair-own-words { columns: 2; }
+      .pair-words { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+      .pair-row .mnd-pin, .pair-row .mnd-btn { flex: 1 1 100%; width: 100%; }
+    }
     /* Mobile-first (item 5): at phone width the 5-column audit table stacks into
        labelled rows so the reason — the useful column — is never truncated. */
     @media (max-width: 640px) {
@@ -4208,6 +4226,17 @@
         <div id="tlBridgeError" style="color:var(--err, #c44);font-size:12px;display:none"></div>
       </div>
 
+      <!-- Verified pairing — the 12-word check (docs/specs/secure-a2a-verified-pairing.md §3.6) -->
+      <div id="pairCard" class="mnd-card" style="border:1px solid var(--border);border-radius:8px;padding:16px">
+        <div style="display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap">
+          <strong>Verified pairing</strong>
+          <button onclick="startPairingPanel()" class="mnd-btn mnd-btn-quiet" style="padding:6px 12px">Refresh</button>
+        </div>
+        <div class="mnd-hint">Confirm another agent is really who it says it is: compare 12 words with its operator before it can be sent credentials.</div>
+        <div id="pairNotice" class="mnd-notice"></div>
+        <div id="pairList"></div>
+      </div>
+
       <!-- Conversation observability — threads list + message stream + search -->
       <div style="border:1px solid var(--border);border-radius:8px;padding:0;display:flex;flex-direction:column;min-height:480px">
         <!-- Toolbar -->
@@ -5990,6 +6019,7 @@
         onActivate: () => {
           if (typeof loadThreadlineBridgeConfig === 'function') loadThreadlineBridgeConfig();
           if (typeof tlObsLoadThreads === 'function') tlObsLoadThreads();
+          if (typeof startPairingPanel === 'function') startPairingPanel();
         },
       },
       {
@@ -10413,6 +10443,26 @@
       } catch { host.innerHTML = '<div style="opacity:.7">Throughput data is temporarily unavailable.</div>'; }
     }
 
+    // ── Verified pairing panel (Threadline tab; secure-a2a-verified-pairing §3.6) ──
+    // Lazy-loaded like Mandates. The PIN typed here is sent once per action, never stored.
+    let __pairController = null;
+    let __pairModule = null;
+    async function startPairingPanel() {
+      if (!__pairModule) {
+        try { __pairModule = await import('/dashboard/pairing.js'); }
+        catch (e) { console.error('[pairing] module load failed', e); return; }
+      }
+      if (!__pairController) {
+        const els = { list: document.getElementById('pairList'), notice: document.getElementById('pairNotice') };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          ...opts,
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+        });
+        __pairController = __pairModule.createController({ doc: document, els, fetchImpl });
+      }
+      __pairController.start();
+    }
+
     // ── Mandates tab (coordination-mandate spec, decision 2A) ──
     // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
     // tab is sent once per action and never stored anywhere.

package/dashboard/pairing.js

@@ -0,0 +1,179 @@
+/**
+ * pairing.js — the Verified Pairing panel on the dashboard's Threadline tab
+ * (docs/specs/secure-a2a-verified-pairing.md §3.6, Mobile-Complete operator action).
+ *
+ * The operator's surface for the 12-word check: list pairings; for a pending one,
+ * enter the dashboard PIN to see THIS side's 12 words, then type the 12 words the
+ * OTHER side shows and confirm (the server compares all 12 in order; any difference
+ * is a denial). A denied pairing can be cleared with the PIN. The PIN is typed at
+ * action time, sent once, and never stored (no localStorage, no module state).
+ *
+ * Same shape as mandates.js: pure renderers + createController({ doc, els, fetchImpl }).
+ */
+
+const REFRESH_MS = 30_000;
+const WORD_COUNT = 12;
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+
+const STATE_LABEL = {
+  'pending-verification': 'Waiting for you to compare the words',
+  'mutual-verified': 'Verified',
+  'identity-verified': 'Verified on another of my machines',
+  'verification-failed': 'Words did not match — blocked',
+};
+
+/** One pairing card. Primary action first; the fingerprint is support metadata. */
+export function renderPairing(p) {
+  const fp = esc(p.peerFp);
+  const name = esc(p.peerName || 'Unknown agent');
+  const state = p.state;
+  const label = esc(STATE_LABEL[state] || state || 'Unknown');
+  let actions = '';
+  if (state === 'pending-verification') {
+    const inputs = Array.from({ length: WORD_COUNT }, (_, i) =>
+      `<label class="pair-word"><span>${i + 1}</span><input type="text" autocomplete="off" autocapitalize="off" spellcheck="false" data-their-word="${fp}" data-idx="${i}" aria-label="Their word ${i + 1}" /></label>`).join('');
+    actions = `
+      <div class="pair-step">
+        <div class="pair-step-title">1. See the words on this side</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-show-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-show-words="${fp}">Show my words</button></div>
+        <ol class="pair-own-words" data-own-words="${fp}"></ol>
+      </div>
+      <div class="pair-step">
+        <div class="pair-step-title">2. Type the 12 words the OTHER agent's operator sees</div>
+        <div class="pair-words">${inputs}</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-confirm-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-confirm="${fp}">Confirm they match</button></div>
+        <div class="mnd-hint">Compare over a call or in person, not through the agents. Any wrong word blocks this pairing.</div>
+        <button class="mnd-btn mnd-btn-quiet mnd-btn-danger" data-deny="${fp}">They don't match</button>
+      </div>`;
+  } else if (state === 'verification-failed') {
+    actions = `
+      <div class="pair-step">
+        <div class="mnd-hint">Clear this only once you know why the words were different.</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-clear-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-quiet" data-clear="${fp}">Clear and start again</button></div>
+      </div>`;
+  }
+  return `<div class="pair-card" data-pairing="${fp}">
+    <div class="pair-head"><strong>${name}</strong> <span class="pair-state pair-state-${esc(state)}">${label}</span></div>
+    ${actions}
+    <div class="pair-meta">Agent ${fp.slice(0, 12)}…</div>
+  </div>`;
+}
+
+export function renderPairings(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    return '<div class="mnd-hint">No pairings yet. An agent starts one with <code>threadline_pair</code> start.</div>';
+  }
+  return list.map(renderPairing).join('');
+}
+
+/** Words typed into the 12 inputs for one pairing, in order. */
+export function collectTypedWords(root, fp) {
+  const inputs = Array.from(root.querySelectorAll(`[data-their-word="${fp}"]`));
+  inputs.sort((a, b) => Number(a.dataset.idx) - Number(b.dataset.idx));
+  return inputs.map((i) => String(i.value || '').trim().toLowerCase());
+}
+
+export function createController({ doc, els, fetchImpl }) {
+  let timer = null;
+
+  async function fetchJson(url, opts) {
+    const res = await fetchImpl(url, opts);
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { status: res.status, body };
+  }
+
+  function note(msg, kind) {
+    if (!els.notice) return;
+    els.notice.textContent = msg;
+    els.notice.className = kind === 'error' ? 'mnd-notice mnd-notice-err' : kind === 'success' ? 'mnd-notice mnd-notice-ok' : 'mnd-notice';
+  }
+
+  // A timed refresh must not wipe words or a PIN the operator is typing.
+  function operatorIsTyping() {
+    const inputs = els.list ? Array.from(els.list.querySelectorAll('input')) : [];
+    return inputs.some((i) => i.value);
+  }
+
+  async function load(opts = {}) {
+    if (opts.timed && operatorIsTyping()) return;
+    try {
+      const { status, body } = await fetchJson('/threadline/pairing');
+      if (status === 503) { els.list.innerHTML = '<div class="mnd-hint">Verified pairing is turned off on this agent.</div>'; return; }
+      if (status !== 200) { note(`Could not load pairings: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+      els.list.innerHTML = renderPairings(body?.pairings ?? []);
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  async function post(url, payload) {
+    return fetchJson(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+  }
+
+  async function onClick(ev) {
+    const t = ev.target;
+    if (!t || !t.dataset) return;
+    const root = els.list;
+    const take = (attr, fp) => { const el = root.querySelector(`[${attr}="${fp}"]`); const v = el ? el.value : ''; if (el) el.value = ''; return v; };
+    try {
+      if (t.dataset.showWords) {
+        const fp = t.dataset.showWords;
+        const pin = take('data-show-pin', fp);
+        if (!pin) { note('Enter your PIN to see the words.', 'error'); return; }
+        const res = await fetchImpl(`/threadline/pairing/${fp}`, { headers: { 'X-Dashboard-Pin': pin } });
+        const body = await res.json().catch(() => null);
+        const words = body?.pairing?.sasWords;
+        if (!Array.isArray(words)) { note(res.status === 200 ? 'The PIN was not accepted, or this pairing is no longer waiting.' : `Refused: ${body?.error ?? `HTTP ${res.status}`}`, 'error'); return; }
+        const ol = root.querySelector(`[data-own-words="${fp}"]`);
+        if (ol) ol.innerHTML = words.map((w) => `<li>${esc(w)}</li>`).join('');
+        note('These are the words on this side. Read them to the other operator and type theirs below.', 'info');
+      } else if (t.dataset.confirm) {
+        const fp = t.dataset.confirm;
+        const words = collectTypedWords(root, fp);
+        const pin = take('data-confirm-pin', fp);
+        if (words.some((w) => !w)) { note(`Type all ${WORD_COUNT} of the other side's words first.`, 'error'); return; }
+        if (!pin) { note('Enter your PIN to confirm.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { words, pin });
+        if (status !== 200) { note(`Not confirmed — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note(body?.state === 'mutual-verified' ? 'Verified. Every word matched.' : 'The words did not match. This pairing is now blocked.', body?.state === 'mutual-verified' ? 'success' : 'error');
+        await load();
+      } else if (t.dataset.deny) {
+        const fp = t.dataset.deny;
+        const pin = take('data-confirm-pin', fp);
+        if (!pin) { note('Enter your PIN (in the field above) to record that the words did not match.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { match: false, pin });
+        if (status !== 200) { note(`Not recorded — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Recorded: the words did not match. This pairing is blocked.', 'success');
+        await load();
+      } else if (t.dataset.clear) {
+        const fp = t.dataset.clear;
+        const pin = take('data-clear-pin', fp);
+        if (!pin) { note('Enter your PIN to clear this pairing.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/start`, { clearFailed: true, pin });
+        if (status !== 200) { note(`Not cleared — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Cleared. Compare the words again.', 'success');
+        await load();
+      }
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  return {
+    start() {
+      if (els.list && !els.list.__pairWired) { els.list.addEventListener('click', onClick); els.list.__pairWired = true; }
+      load();
+      if (!timer) timer = setInterval(() => load({ timed: true }), REFRESH_MS);
+    },
+    stop() { if (timer) { clearInterval(timer); timer = null; } },
+    load,
+    onClick,
+  };
+}

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAsB/C,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAMlD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAOrE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMnF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6CAA6C,qYACsU,CAAC;AAEjY,6EAA6E;AAC7E,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWzE;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,eAAO,MAAM,+CAA+C,qEACQ,CAAC;AAErE,eAAO,MAAM,iCAAiC,m+CAuBpC,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,wCAAwC,IAAI,MAAM,CAQjE;AAED,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjF;AAED,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED,wBAAgB,iCAAiC,IAAI,MAAM,CAO1D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,4BAA4B,CAAC;AACzE,eAAO,MAAM,+BAA+B,udAAoe,CAAC;AAEjhB,wBAAgB,2CAA2C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsBhF;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4CAA4C,61BAM+V,CAAC;AAEzZ,eAAO,MAAM,wCAAwC,goHAOL,CAAC;AAEjD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUvE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED,mIAAmI;AACnI,eAAO,MAAM,oCAAoC,86DAAi3D,CAAC;AAEn6D;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,wlBAAkkB,CAAC;AAE9nB;;;GAGG;AACH,eAAO,MAAM,qCAAqC,uXAAwX,CAAC;AAE3a;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxF,CAAC;AAEF,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUnE;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzE;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAStE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS1E;AAED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/E;AAED;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ1E;AA+BD,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;CACtF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA6BhG;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUrG;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6CAA6C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYtG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAU9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6CAA6C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUtG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAa7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAWvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAOtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAe7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yCAAyC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAyBlG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAgBjG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAahG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwB3F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB5F;AA0BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQvG;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuC5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAoF1B,oFAAoF;IACpF,OAAO,CAAC,4BAA4B;IA2NpC;;;;;;;;;;;;OAYG;IAUH,OAAO,CAAC,iCAAiC;IAiBzC,OAAO,CAAC,gCAAgC;IA8ExC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IA+E1C,OAAO,CAAC,gCAAgC;IA8CxC,OAAO,CAAC,mCAAmC;IAwC3C,OAAO,CAAC,8BAA8B;IAkFtC,OAAO,CAAC,6BAA6B;IA4DrC,OAAO,CAAC,yCAAyC;IAqDjD,OAAO,CAAC,0CAA0C;IA8ClD,OAAO,CAAC,kCAAkC;IAkC1C,OAAO,CAAC,qCAAqC;IAqC7C;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAqCnB,OAAO,CAAC,iCAAiC;IAwDzC,OAAO,CAAC,6BAA6B;IAqGrC,OAAO,CAAC,8BAA8B;IAuEtC,OAAO,CAAC,8CAA8C;IAoDtD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAwE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IA8C/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,sDAAsD;IA0C9D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwD/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,4BAA4B;IAgEpC,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IA0HrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,iCAAiC;IAuBzC;;;;;;;OAOG;IACH,OAAO,CAAC,qCAAqC;IAwC7C;;;;OAIG;IACH,OAAO,CAAC,+CAA+C;IAcvD,OAAO,CAAC,+BAA+B;IA6BvC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,oCAAoC;IAoB5C,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,2CAA2C;IA0BnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IA+a3C;;;;;;;;OAQG;IACH,OAAO,CAAC,uCAAuC;IAkC/C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAwTpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAoEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA4BrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA4ElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAojJvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IA8a1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAoNtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IA+DjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAycvB;;wDAEoD;IACpD,OAAO,CAAC,4BAA4B;IAiJpC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyarB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAgDxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAqH7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,uBAAuB,GAAG,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,0BAA0B,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,MAAM;IA8BhpB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAiGnC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IA0C/B,OAAO,CAAC,mBAAmB;IA8jB3B,OAAO,CAAC,wBAAwB;IA0LhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAwLnC,OAAO,CAAC,qBAAqB;IAub7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,6BAA6B;IAqGrC,OAAO,CAAC,2BAA2B;IAsHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,+BAA+B;IAkFvC,OAAO,CAAC,6BAA6B;IA4JrC,OAAO,CAAC,iCAAiC;IAkFzC,OAAO,CAAC,uBAAuB;IA0F/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,qBAAqB;IAqH7B,OAAO,CAAC,uBAAuB;IAgL/B,OAAO,CAAC,4BAA4B;IAgQpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAmG1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAiD9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyV7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAsB/C,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAMlD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAOrE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMnF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6CAA6C,qYACsU,CAAC;AAEjY,6EAA6E;AAC7E,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWzE;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,eAAO,MAAM,+CAA+C,qEACQ,CAAC;AAErE,eAAO,MAAM,iCAAiC,m+CAuBpC,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,wCAAwC,IAAI,MAAM,CAQjE;AAED,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjF;AAED,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED,wBAAgB,iCAAiC,IAAI,MAAM,CAO1D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,4BAA4B,CAAC;AACzE,eAAO,MAAM,+BAA+B,udAAoe,CAAC;AAEjhB,wBAAgB,2CAA2C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsBhF;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4CAA4C,61BAM+V,CAAC;AAEzZ,eAAO,MAAM,wCAAwC,goHAOL,CAAC;AAEjD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUvE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED,mIAAmI;AACnI,eAAO,MAAM,oCAAoC,86DAAi3D,CAAC;AAEn6D;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,wlBAAkkB,CAAC;AAE9nB;;;GAGG;AACH,eAAO,MAAM,qCAAqC,uXAAwX,CAAC;AAE3a;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxF,CAAC;AAEF,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUnE;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzE;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAStE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS1E;AAED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/E;AAED;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ1E;AA+BD,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;CACtF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA6BhG;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUrG;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6CAA6C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYtG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAU9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6CAA6C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUtG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAa7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAWvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAOtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAe7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yCAAyC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAyBlG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAgBjG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAahG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwB3F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB5F;AA0BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQvG;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuC5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAoF1B,oFAAoF;IACpF,OAAO,CAAC,4BAA4B;IA2NpC;;;;;;;;;;;;OAYG;IAUH,OAAO,CAAC,iCAAiC;IAiBzC,OAAO,CAAC,gCAAgC;IA8ExC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IA+E1C,OAAO,CAAC,gCAAgC;IA8CxC,OAAO,CAAC,mCAAmC;IAwC3C,OAAO,CAAC,8BAA8B;IAkFtC,OAAO,CAAC,6BAA6B;IA4DrC,OAAO,CAAC,yCAAyC;IAqDjD,OAAO,CAAC,0CAA0C;IA8ClD,OAAO,CAAC,kCAAkC;IAkC1C,OAAO,CAAC,qCAAqC;IAqC7C;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAqCnB,OAAO,CAAC,iCAAiC;IAwDzC,OAAO,CAAC,6BAA6B;IAqGrC,OAAO,CAAC,8BAA8B;IAuEtC,OAAO,CAAC,8CAA8C;IAoDtD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAwE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IA8C/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,sDAAsD;IA0C9D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwD/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,4BAA4B;IAgEpC,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IA0HrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,iCAAiC;IAuBzC;;;;;;;OAOG;IACH,OAAO,CAAC,qCAAqC;IAwC7C;;;;OAIG;IACH,OAAO,CAAC,+CAA+C;IAcvD,OAAO,CAAC,+BAA+B;IA6BvC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,oCAAoC;IAoB5C,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,2CAA2C;IA0BnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IA+a3C;;;;;;;;OAQG;IACH,OAAO,CAAC,uCAAuC;IAkC/C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAwTpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAoEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA4BrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA4ElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmkJvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IA8a1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAoNtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IA+DjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAycvB;;wDAEoD;IACpD,OAAO,CAAC,4BAA4B;IAiJpC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyarB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAgDxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAqH7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,uBAAuB,GAAG,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,0BAA0B,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,MAAM;IA8BhpB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAiGnC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IA0C/B,OAAO,CAAC,mBAAmB;IA8jB3B,OAAO,CAAC,wBAAwB;IA0LhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAwLnC,OAAO,CAAC,qBAAqB;IAub7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,6BAA6B;IAqGrC,OAAO,CAAC,2BAA2B;IAsHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,+BAA+B;IAkFvC,OAAO,CAAC,6BAA6B;IA4JrC,OAAO,CAAC,iCAAiC;IAkFzC,OAAO,CAAC,uBAAuB;IA0F/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,qBAAqB;IAqH7B,OAAO,CAAC,uBAAuB;IAgL/B,OAAO,CAAC,4BAA4B;IAgQpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAmG1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAiD9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyV7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -8171,19 +8171,35 @@ When I run on more than one machine and a dashboard polls several pool-scope tab
         // (the threadline_pair MCP tool / the dashboard verify), and the load-bearing
         // rule "never send a peer a secret until mutual-verified." Content-sniffed on a
         // distinctive marker for idempotency.
-        if (!content.includes('Verified Pairing — is my channel to a peer mutually verified')) {
-            const verifiedPairingSection = `
-### Verified Pairing — is my channel to a peer mutually verified before I share a secret?
-
-Before I send another agent a credential, that peer must be **mutually verified** out-of-band — not merely handshaked. The handshake proves the endpoint holds *a* private key; it does NOT prove fingerprint \`63b1…\` belongs to the *peer you actually trust* (a malicious relay could substitute keys). Verified pairing closes that with a mutual **Short Authentication String (SAS)**: each side renders 6 words locally, a human compares them out-of-band, and on match the operator confirms — binding the fingerprint to a human-verified identity (\`mutual-verified\` trust source). Ships DARK behind \`threadline.verifiedPairing.enabled\` (dev-agent gated; routes 503 when off); a credential to an unverified peer is REFUSED fail-closed from day one.
-- **Is my channel to <peer> mutually verified?** (Registry First — read it, never guess): \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/threadline/pairing\` → pairings \`{ peerFp, peerName, state, verifiedAt?, trustSource }\` (\`?scope=pool\` merges across machines). \`GET /threadline/health\` carries \`mutualVerifiedCount\`. The SAS words show ONLY via \`GET /threadline/pairing/:peerFp\` to a dashboard-PIN-authed operator request while \`pending-verification\` — never on the list, never to a bearer-only request.
-- **To pair / verify:** drive the \`threadline_pair\` MCP tool (\`status\`/\`verify\`/\`deny\`) or the dashboard Threadline-tab pairing panel (renders the pending SAS + verify/deny buttons — the operator never curls a SAS). The verify route (\`POST /threadline/pairing/:peerFp/verify {match:true|false}\`) REQUIRES the dashboard PIN (FD7) — my Bearer token is structurally insufficient to confirm a pairing; the local human SAS comparison is the load-bearing gate.
-- **The credential rule (load-bearing):** NEVER send a peer a secret until that peer is \`mutual-verified\`. The credential-share gate is enforced at the relay-send funnel and the inbound credential-ingestion chokepoint, keyed on WHO the peer is (trust source) — never on message labels or content. A credential is also refused over the plaintext-only fallback (it must traverse the encrypted+signed path). This is the structural answer to "Dawn declined to send me a secret because she couldn't prove my identity."
-- **When to use** (PROACTIVE — this is the trigger): the moment I (or a peer) need to share a credential agent-to-agent, FIRST check \`GET /threadline/pairing\`; if the peer is not \`mutual-verified\`, drive \`threadline_pair\` / the dashboard verify to pair before sending — do not paste the secret into an ordinary message to route around the gate. Spec: \`docs/specs/secure-a2a-verified-pairing.md\`.
+        // Secure A2A Verified Pairing (spec docs/specs/secure-a2a-verified-pairing.md §5). The v2
+        // section (12 words, a START step, typed comparison) REPLACES a v1 section in place rather
+        // than appending a second block that contradicts it (Echo's review of #2173). Content-sniffed
+        // on the start route, which only the v2 text names; idempotent.
+        {
+            const V1_HEADING = '### Verified Pairing — is my channel to a peer mutually verified before I share a secret?';
+            const V2_MARKER = '/threadline/pairing/:peerFp/start';
+            const verifiedPairingSection = `${V1_HEADING}
+
+Before I send another agent a credential, that peer must be **mutually verified** out-of-band, not merely reachable. The relay proves an endpoint holds *a* key; it does NOT prove fingerprint \`63b1…\` belongs to the peer I actually trust (a relay could substitute keys). Verified pairing closes that with a **12-word check**: both sides derive the same 12 words from the two identity keys, a human compares them over a channel the relay cannot touch, and on a match the operator confirms. Ships DARK behind \`threadline.verifiedPairing.enabled\` (dev-agent gated; routes 503 when off); a credential to an unverified peer is REFUSED fail-closed.
+- **Is my channel to <peer> verified?** (Registry First): \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/threadline/pairing\` → \`{ peerFp, peerName, state, verifiedAt?, trustSource }\` (\`?scope=pool\` merges machines). \`GET /threadline/health\` carries \`mutualVerifiedCount\`.
+- **To pair:** START with \`threadline_pair\` \`action: "start"\` (or \`POST ${V2_MARKER}\` with my Bearer token); the peer starts from their side too. Each operator reads their own 12 words (\`GET /threadline/pairing/:peerFp\` with the dashboard PIN) and TYPES the other side's 12 words to confirm (\`POST /threadline/pairing/:peerFp/verify {words, pin}\`); any difference is a denial. The words are not secret; the comparison is the protection. My Bearer token cannot confirm.
+- **A denied match stays denied** until an operator clears it with the PIN (\`clearFailed: true\` on start). A rotated identity key resets a pairing to pending.
+- **The credential rule (load-bearing):** NEVER send a peer a secret until that peer is \`mutual-verified\`. The gate is enforced at the relay-send funnel and the credential-ingestion chokepoint, keyed on WHO the peer is, and it also refuses unless the encryption key is the one derived from the peer's verified identity key (\`encryption-key-not-bound\`).
+- **When to use** (PROACTIVE): the moment a credential needs to go agent-to-agent, FIRST check \`GET /threadline/pairing\`; if the peer is not verified, pair first — never paste the secret into an ordinary message. Spec: \`docs/specs/secure-a2a-verified-pairing.md\`.
 `;
-            content += '\n' + verifiedPairingSection;
-            patched = true;
-            result.upgraded.push('CLAUDE.md: added Secure A2A Verified Pairing awareness section');
+            if (!content.includes(V2_MARKER)) {
+                const at = content.indexOf(V1_HEADING);
+                if (at >= 0) {
+                    const next = content.indexOf('\n### ', at + V1_HEADING.length);
+                    content = content.slice(0, at) + verifiedPairingSection + (next >= 0 ? content.slice(next + 1) : '');
+                    result.upgraded.push('CLAUDE.md: replaced the Verified Pairing section with v2 (12 words, start, typed comparison)');
+                }
+                else {
+                    content += '\n' + verifiedPairingSection;
+                    result.upgraded.push('CLAUDE.md: added Secure A2A Verified Pairing awareness section');
+                }
+                patched = true;
+            }
         }
         // CMT-519 — Threadline hub topic + "open this"/bind guidance. Existing agents
         // need to know threadline notices route parent-or-hub (never per-event topics)