instar 1.3.151 → 1.3.153

package/dist/core/MachineIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MachineIdentity.d.ts","sourceRoot":"","sources":["../../src/core/MachineIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgC1I;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAMlF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAMrF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,EAAE,CAIxD;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE9F;AAID,qBAAa,sBAAsB;IACjC,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,EAAE,MAAM;IAI7B,8FAA8F;IAC9F,IAAI,OAAO,IAAI,MAAM,CAEpB;IAID,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,WAAW,GAEtB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAID;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;;;;;;OAOG;IACG,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,IAAI,CAAC,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,eAAe,CAAC;IAuC5B;;OAEG;IACH,YAAY,IAAI,eAAe;IAO/B;;OAEG;IACH,cAAc,IAAI,MAAM;IAkBxB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAM3B;;OAEG;IACH,YAAY,IAAI,eAAe;IAkB/B;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAK7C;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,GAAE,WAAuB,GAAG,OAAO;IAWvF;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,GAAE,WAAuB,GAAG,IAAI;IA6B/E;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAqBzD;;;;;;OAMG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAYhD;;;;;;;OAOG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAWzE;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI;IAUtD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IASrC;;OAEG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAUtD;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM/C;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAczE;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAQ3B;;;OAGG;IACH,eAAe,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,GAAG,IAAI;IAU5E;;OAEG;IACH,iBAAiB,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAO9E;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ3C;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IASpD;;;OAGG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAW7D;;;OAGG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAexD;;;OAGG;IACH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiB3D;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,WAAW;CAKpB;AAgBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkBxD"}
+{"version":3,"file":"MachineIdentity.d.ts","sourceRoot":"","sources":["../../src/core/MachineIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmC1I;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAMlF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAMrF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,EAAE,CAIxD;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE9F;AAID,qBAAa,sBAAsB;IACjC,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,EAAE,MAAM;IAI7B,8FAA8F;IAC9F,IAAI,OAAO,IAAI,MAAM,CAEpB;IAID,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,WAAW,GAEtB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAID;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;;;;;;OAOG;IACG,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,IAAI,CAAC,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,eAAe,CAAC;IAuC5B;;OAEG;IACH,YAAY,IAAI,eAAe;IAO/B;;OAEG;IACH,cAAc,IAAI,MAAM;IAkBxB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAoB3B;;OAEG;IACH,YAAY,IAAI,eAAe;IAkB/B;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAK7C;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,GAAE,WAAuB,GAAG,OAAO;IAWvF;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,GAAE,WAAuB,GAAG,IAAI;IA6B/E;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAqBzD;;;;;;OAMG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAYhD;;;;;;;OAOG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAWzE;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI;IAUtD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IASrC;;OAEG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAUtD;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM/C;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAczE;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAQ3B;;;OAGG;IACH,eAAe,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,GAAG,IAAI;IAU5E;;OAEG;IACH,iBAAiB,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAO9E;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ3C;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IASpD;;;OAGG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAW7D;;;OAGG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAexD;;;OAGG;IACH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiB3D;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,WAAW;CAKpB;AAgBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkBxD"}

package/dist/core/MachineIdentity.js

@@ -24,6 +24,9 @@ const SIGNING_KEY_FILE = 'signing-key.pem';
 // falls back to it so a legacy-keyed agent's lease coordinator still attaches.
 const LEGACY_SIGNING_KEY_FILE = 'signing-private.pem';
 const ENCRYPTION_KEY_FILE = 'encryption-key.pem';
+// Pre-canonical-rename name; loadEncryptionKey falls back to it for the same reason
+// loadSigningKey does (the mesh transport loads BOTH keys at lease/transport setup).
+const LEGACY_ENCRYPTION_KEY_FILE = 'encryption-private.pem';
 const REGISTRY_FILE = 'registry.json';
 const KEY_FILE_MODE = 0o600;
 const REGISTRY_VERSION = 1;
@@ -223,7 +226,23 @@ export class MachineIdentityManager {
      * Load this machine's X25519 encryption private key (PEM format).
      */
     loadEncryptionKey() {
-        return fs.readFileSync(this.encryptionKeyPath, 'utf-8');
+        try {
+            return fs.readFileSync(this.encryptionKeyPath, 'utf-8');
+        }
+        catch (err) {
+            // Same legacy fallback as loadSigningKey: identities created before the
+            // canonical rename wrote the encryption key as 'encryption-private.pem'.
+            // The mesh lease/transport setup loads this key too — found live
+            // 2026-05-31: with the signing key resolved, the mini's transport setup
+            // still threw ENOENT on the canonical 'encryption-key.pem', so the
+            // legacy-keyed machine's transport couldn't fully initialize.
+            if (err?.code === 'ENOENT') {
+                const legacy = path.join(this.machineDir, LEGACY_ENCRYPTION_KEY_FILE);
+                if (fs.existsSync(legacy))
+                    return fs.readFileSync(legacy, 'utf-8');
+            }
+            throw err;
+        }
     }
     // ── Registry Management ──────────────────────────────────────────
     /**

package/dist/core/MachineIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"MachineIdentity.js","sourceRoot":"","sources":["../../src/core/MachineIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,wEAAwE;AAExE,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAC3C,qFAAqF;AACrF,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,wEAAwE;AAExE,MAAM,MAAM,GAAG;IACb,aAAa,EAAE,CAAC,MAAc,EAAE,EAAE,CAChC,+CAA+C,MAAM,iDAAiD;IACxG,eAAe,EAAE,iGAAiG;IAClH,kBAAkB,EAAE,sEAAsE;IAC1F,gBAAgB,EAAE,mEAAmE;IACrF,iBAAiB,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,EAAE,yBAAyB;IACzE,uBAAuB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,IAAI,uBAAuB;CAC1E,CAAC;AAEX,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,qDAAqD;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO,IAAI,IAAI,WAAW,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,0DAA0D;IAC1D,+CAA+C;IAC/C,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG;SACP,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAqB,EAAE,aAAqB;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,IAAqB,EAAE,SAAiB,EAAE,YAAoB;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,wEAAwE;AAExE,MAAM,OAAO,sBAAsB;IACzB,SAAS,CAAS;IAE1B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,8FAA8F;IAC9F,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,oEAAoE;IAEpE,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,WAAW;QACT,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAItB;QACC,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QAED,2BAA2B;QAC3B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,gBAAgB;QAChB,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,iBAAiB;QACjB,MAAM,QAAQ,GAAoB;YAChC,SAAS;YACT,gBAAgB,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YAChD,mBAAmB,EAAE,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;YACtD,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,iBAAiB,EAAE;YAC1C,QAAQ,EAAE,cAAc,EAAE;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,kBAAkB,EAAE;SACnC,CAAC;QAEF,iDAAiD;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAEpE,kDAAkD;QAClD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvE,wCAAwC;QACxC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC;QACtC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAErC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,4EAA4E;YAC5E,wEAAwE;YACxE,mEAAmE;YACnE,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;gBACnE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAyB;QACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAyB,EAAE,OAAoB,SAAS;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAExD,OAAO,CAAC,IAAI,CACV,6BAA6B,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,IAAI,yDAAyD,IAAI,IAAI,CACnI,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAyB,EAAE,OAAoB,SAAS;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,6EAA6E;QAC7E,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GACZ,QAAQ,EAAE,QAAQ;YAClB,cAAc,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAElG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG;YACtC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ;YACR,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG;YACnC,QAAQ,EAAE,GAAG;SACd,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAiB,EAAE,QAAgB;QAChD,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,6DAA6D,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,gCAAgC,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;QACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBACxF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,SAAiB,EAAE,QAAyB;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,YAAY;QACnG,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB,EAAE,IAAiB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB,EAAE,GAAW;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;QACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAE5F,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;QACvB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC;IAC/C,CAAC;IAED,mEAAmE;IAEnE;;;OAGG;IACH,mBAAmB,CAAC,QAAyB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,SAAiB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,SAAiB;QACtC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,SAAiB;QACzC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,qBAAqB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACK,eAAe,CAAC,QAAgB,EAAE,OAAe;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,0CAA0C;QAC1C,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,iBAAiB,GAAG;IACxB,kCAAkC;IAClC,iCAAiC;IACjC,oCAAoC;IACpC,kBAAkB;IAClB,kBAAkB;IAClB,wEAAwE;IACxE,aAAa;CACd,CAAC;AAEF,uEAAuE;AAEvE;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;AACvF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACjD,wDAAwD;QACxD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1F,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}
+{"version":3,"file":"MachineIdentity.js","sourceRoot":"","sources":["../../src/core/MachineIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,wEAAwE;AAExE,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAC3C,qFAAqF;AACrF,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,oFAAoF;AACpF,qFAAqF;AACrF,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAC5D,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,wEAAwE;AAExE,MAAM,MAAM,GAAG;IACb,aAAa,EAAE,CAAC,MAAc,EAAE,EAAE,CAChC,+CAA+C,MAAM,iDAAiD;IACxG,eAAe,EAAE,iGAAiG;IAClH,kBAAkB,EAAE,sEAAsE;IAC1F,gBAAgB,EAAE,mEAAmE;IACrF,iBAAiB,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,EAAE,yBAAyB;IACzE,uBAAuB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,IAAI,uBAAuB;CAC1E,CAAC;AAEX,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,qDAAqD;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO,IAAI,IAAI,WAAW,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,0DAA0D;IAC1D,+CAA+C;IAC/C,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG;SACP,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAqB,EAAE,aAAqB;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,IAAqB,EAAE,SAAiB,EAAE,YAAoB;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,wEAAwE;AAExE,MAAM,OAAO,sBAAsB;IACzB,SAAS,CAAS;IAE1B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,8FAA8F;IAC9F,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,oEAAoE;IAEpE,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,WAAW;QACT,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAItB;QACC,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QAED,2BAA2B;QAC3B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,gBAAgB;QAChB,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,iBAAiB;QACjB,MAAM,QAAQ,GAAoB;YAChC,SAAS;YACT,gBAAgB,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YAChD,mBAAmB,EAAE,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;YACtD,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,iBAAiB,EAAE;YAC1C,QAAQ,EAAE,cAAc,EAAE;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,kBAAkB,EAAE;SACnC,CAAC;QAEF,iDAAiD;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAEpE,kDAAkD;QAClD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvE,wCAAwC;QACxC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC;QACtC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAErC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,4EAA4E;YAC5E,wEAAwE;YACxE,mEAAmE;YACnE,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;gBACnE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;YACjE,wEAAwE;YACxE,mEAAmE;YACnE,8DAA8D;YAC9D,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;gBACtE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAyB;QACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAyB,EAAE,OAAoB,SAAS;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAExD,OAAO,CAAC,IAAI,CACV,6BAA6B,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,IAAI,yDAAyD,IAAI,IAAI,CACnI,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAyB,EAAE,OAAoB,SAAS;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,6EAA6E;QAC7E,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GACZ,QAAQ,EAAE,QAAQ;YAClB,cAAc,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAElG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG;YACtC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ;YACR,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG;YACnC,QAAQ,EAAE,GAAG;SACd,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAiB,EAAE,QAAgB;QAChD,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,6DAA6D,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,gCAAgC,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;QACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBACxF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,SAAiB,EAAE,QAAyB;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,YAAY;QACnG,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB,EAAE,IAAiB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB,EAAE,GAAW;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;QACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAE5F,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;QACvB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC;IAC/C,CAAC;IAED,mEAAmE;IAEnE;;;OAGG;IACH,mBAAmB,CAAC,QAAyB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,SAAiB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,SAAiB;QACtC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,SAAiB;QACzC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,qBAAqB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACK,eAAe,CAAC,QAAgB,EAAE,OAAe;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,0CAA0C;QAC1C,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,iBAAiB,GAAG;IACxB,kCAAkC;IAClC,iCAAiC;IACjC,oCAAoC;IACpC,kBAAkB;IAClB,kBAAkB;IAClB,wEAAwE;IACxE,aAAa;CACd,CAAC;AAEF,uEAAuE;AAEvE;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;AACvF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACjD,wDAAwD;QACxD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1F,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.151",
+  "version": "1.3.153",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/assemble-next-md.mjs

@@ -0,0 +1,311 @@
+#!/usr/bin/env node
+/**
+ * assemble-next-md — fold per-PR release-note FRAGMENTS into a single NEXT.md.
+ *
+ * ── Why this exists ───────────────────────────────────────────────────
+ * The release pipeline consumes a single shared `upgrades/NEXT.md` per merge.
+ * With many agents merging concurrently, EVERY PR rewrote that one file, so
+ * every PR collided on it within minutes — the release notes became an
+ * un-landable hot file. The fix is per-PR FRAGMENTS: each PR ships its note as
+ * `upgrades/next/<slug>.md`, touching a distinct file, so two PRs never
+ * collide. This script concatenates the fragments into `upgrades/NEXT.md`
+ * BEFORE the existing publish pipeline runs, leaving everything downstream
+ * unchanged.
+ *
+ * ── What it does ──────────────────────────────────────────────────────
+ *   1. Reads every `upgrades/next/*.md` fragment (deterministic filename sort).
+ *   2. Folds in a legacy `upgrades/NEXT.md` too, if one exists (backward compat).
+ *   3. Merges by section: the result has ONE "## What Changed", ONE
+ *      "## Summary of New Capabilities", ONE "## What to Tell Your User", ONE
+ *      "## Evidence" — each section is the concatenation of that section across
+ *      all inputs (in source order). Any non-canonical H2 section is preserved
+ *      and appended after the canonical ones (also concatenated by title).
+ *   4. The bump directive is the HIGHEST tier among the inputs
+ *      (major > minor > patch), emitted as `<!-- bump: X -->`. This is a
+ *      documentation hint only — the REAL release tier is
+ *      `.instar/release-tier.json`, which this script never touches.
+ *   5. Writes the merged result to `upgrades/NEXT.md`.
+ *
+ * ── No-op / failure semantics ─────────────────────────────────────────
+ *   - NO fragments AND NO legacy NEXT.md → does nothing, exits 0 quietly. The
+ *     existing publish "skip if no NEXT.md" logic then fires unchanged.
+ *   - A real malformation (a fragment with content but no parseable H2 section
+ *     at all) → exits non-zero with a clear message, so the workflow fails
+ *     loudly rather than shipping a broken guide.
+ *   - Idempotent: running twice produces the same NEXT.md. (When a generated
+ *     NEXT.md is the ONLY input — no fragments — it is re-emitted byte-stable.)
+ *
+ * The core `assembleNextMd()` function is pure (string in / string out) and is
+ * exported for unit testing. The CLI wrapper at the bottom handles I/O.
+ *
+ * Usage:
+ *   node scripts/assemble-next-md.mjs            # assemble + write upgrades/NEXT.md
+ *   node scripts/assemble-next-md.mjs --upgrades-dir <path>   # override (tests)
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+// ── Canonical section order ───────────────────────────────────────────
+// These four are the sections check-upgrade-guide.js / upgrade-guide-validator
+// know about. We emit them in this order; any other H2 is appended after.
+export const CANONICAL_SECTIONS = [
+  'What Changed',
+  'What to Tell Your User',
+  'Summary of New Capabilities',
+  'Evidence',
+];
+
+const BUMP_RANK = { patch: 0, minor: 1, major: 2 };
+const RANK_BUMP = ['patch', 'minor', 'major'];
+
+const H1_HEADER = '# Upgrade Guide — vNEXT';
+
+// Stable marker stamped into every machine-assembled NEXT.md. It lets us
+// recognize (and skip re-folding) a NEXT.md that this script generated, which
+// is what keeps the on-disk assemble idempotent: a second run shouldn't fold
+// the previous run's output back in on top of the still-present fragments. A
+// hand-authored legacy NEXT.md (no marker) is still folded for backward compat.
+export const GENERATED_MARKER = '<!-- assembled-by: assemble-next-md -->';
+
+/** True when content was produced by this assembler (carries the marker). */
+export function isAssembledOutput(content) {
+  return String(content).includes(GENERATED_MARKER);
+}
+
+/**
+ * Parse the declared bump type from a fragment's `<!-- bump: TYPE -->` comment.
+ * Returns 'patch' | 'minor' | 'major' | null.
+ */
+export function parseBumpType(content) {
+  const match = /<!--\s*bump:\s*(patch|minor|major)\s*-->/i.exec(content);
+  return match ? match[1].toLowerCase() : null;
+}
+
+/**
+ * Split a fragment body into H2 sections: [{ title, body }] in source order.
+ * `body` excludes the heading line itself and is right-trimmed.
+ * Content before the first H2 (H1 header, bump comment, stray prose) is dropped
+ * from the section map — the assembler synthesizes a fresh H1 + bump comment.
+ */
+export function parseSections(content) {
+  const out = [];
+  const lines = String(content).replace(/\r\n/g, '\n').split('\n');
+  let current = null;
+  for (const line of lines) {
+    const m = /^##\s+(.+?)\s*$/.exec(line);
+    if (m) {
+      if (current) out.push(current);
+      current = { title: m[1].trim(), lines: [] };
+    } else if (current) {
+      current.lines.push(line);
+    }
+  }
+  if (current) out.push(current);
+  return out.map((s) => ({ title: s.title, body: s.lines.join('\n').replace(/\s+$/, '') }));
+}
+
+/**
+ * Is this fragment content "empty" for assembly purposes? True when stripping
+ * HTML comments and whitespace leaves nothing.
+ */
+function isEffectivelyEmpty(content) {
+  return String(content).replace(/<!--[\s\S]*?-->/g, '').trim().length === 0;
+}
+
+/**
+ * Core assembler. Pure: takes named fragment inputs, returns the merged NEXT.md
+ * string (or throws on a real malformation).
+ *
+ * @param {Array<{ name: string, content: string }>} fragments
+ *   Each input fragment, in the order they should be concatenated. `name` is
+ *   used only for error messages.
+ * @returns {string} the assembled NEXT.md content (with trailing newline).
+ * @throws {Error} when a fragment has content but no parseable H2 section.
+ */
+export function assembleNextMd(fragments) {
+  // Idempotency guard: a previously-assembled NEXT.md (carrying GENERATED_MARKER)
+  // is the FOLD of the current fragments — folding it again on top of the same
+  // fragments would duplicate every section. So when at least one non-generated
+  // input is present, drop the generated one(s). When a generated output is the
+  // SOLE input (no fragments), keep it: parse→emit is stable, so it re-emits
+  // identically.
+  const nonGenerated = fragments.filter((f) => !isAssembledOutput(f.content ?? ''));
+  const effective = nonGenerated.length > 0 ? nonGenerated : fragments;
+
+  // Map title -> array of section bodies (in source order).
+  const merged = new Map();
+  // Preserve first-seen order of non-canonical titles.
+  const extraOrder = [];
+  let maxBumpRank = 0;
+  let sawAnyBump = false;
+
+  for (const frag of effective) {
+    const content = frag.content ?? '';
+    const bump = parseBumpType(content);
+    if (bump) {
+      sawAnyBump = true;
+      maxBumpRank = Math.max(maxBumpRank, BUMP_RANK[bump]);
+    }
+
+    const sections = parseSections(content);
+    if (sections.length === 0) {
+      // No H2 sections. An effectively-empty fragment (only comments/whitespace)
+      // is malformed — a fragment file should always carry real notes.
+      // A fragment with real prose but no headings is also malformed: we can't
+      // place its content under a known section.
+      throw new Error(
+        `release-note fragment "${frag.name}" has no recognizable "## " section. ` +
+        `Every fragment must contain at least one section heading ` +
+        `(e.g. "## What Changed"). Fix or remove this fragment.`,
+      );
+    }
+
+    for (const sec of sections) {
+      const body = sec.body.trim();
+      // Skip a section whose body is only whitespace/comments — nothing to fold.
+      if (isEffectivelyEmpty(body)) continue;
+      if (!merged.has(sec.title)) {
+        merged.set(sec.title, []);
+        if (!CANONICAL_SECTIONS.includes(sec.title)) extraOrder.push(sec.title);
+      }
+      merged.get(sec.title).push(body);
+    }
+  }
+
+  // If after folding there is genuinely nothing to say, that's a malformation
+  // for a non-empty input set (every fragment was comments-only).
+  if (merged.size === 0) {
+    throw new Error(
+      'release-note fragments produced no content — every section was empty. ' +
+      'Fill in at least "## What Changed" in one fragment.',
+    );
+  }
+
+  // Emit canonical sections first (only when present), then extras in
+  // first-seen order.
+  const titleOrder = [
+    ...CANONICAL_SECTIONS.filter((t) => merged.has(t)),
+    ...extraOrder,
+  ];
+
+  const bump = sawAnyBump ? RANK_BUMP[maxBumpRank] : 'patch';
+
+  const parts = [];
+  parts.push(H1_HEADER);
+  parts.push('');
+  parts.push(GENERATED_MARKER);
+  parts.push(`<!-- bump: ${bump} -->`);
+  parts.push('');
+  for (const title of titleOrder) {
+    const bodies = merged.get(title);
+    parts.push(`## ${title}`);
+    parts.push('');
+    // Concatenate each fragment's body for this section, separated by a blank
+    // line. Bodies were already trimmed.
+    parts.push(bodies.join('\n\n'));
+    parts.push('');
+  }
+
+  // Single trailing newline, no duplicate blank lines at EOF.
+  return parts.join('\n').replace(/\n+$/, '\n');
+}
+
+// ── CLI entry point ────────────────────────────────────────────────────
+
+/**
+ * Gather fragment inputs from disk in deterministic order: legacy NEXT.md first
+ * (so its content leads), then `next/*.md` sorted by filename.
+ */
+export function gatherFragmentInputs(upgradesDir) {
+  const inputs = [];
+
+  const legacyPath = path.join(upgradesDir, 'NEXT.md');
+  const fragmentsDir = path.join(upgradesDir, 'next');
+
+  let legacyContent = null;
+  if (fs.existsSync(legacyPath)) {
+    legacyContent = fs.readFileSync(legacyPath, 'utf-8');
+  }
+
+  let fragmentFiles = [];
+  if (fs.existsSync(fragmentsDir)) {
+    fragmentFiles = fs
+      .readdirSync(fragmentsDir)
+      .filter((f) => f.endsWith('.md'))
+      .sort((a, b) => a.localeCompare(b, 'en'));
+  }
+
+  // Fold the legacy NEXT.md in first — only when it carries real content
+  // (skip a bare template/empty file so re-runs are idempotent and a fresh
+  // template doesn't masquerade as content).
+  if (legacyContent !== null && !isEffectivelyEmpty(legacyContent)) {
+    inputs.push({ name: 'NEXT.md', content: legacyContent });
+  }
+
+  for (const file of fragmentFiles) {
+    const content = fs.readFileSync(path.join(fragmentsDir, file), 'utf-8');
+    inputs.push({ name: `next/${file}`, content });
+  }
+
+  return { inputs, hadLegacy: legacyContent !== null, fragmentCount: fragmentFiles.length };
+}
+
+function main() {
+  const __dirname = path.dirname(fileURLToPath(import.meta.url));
+  const ROOT = path.resolve(__dirname, '..');
+
+  // Allow tests / callers to point at an alternate upgrades dir.
+  const argIdx = process.argv.indexOf('--upgrades-dir');
+  const upgradesDir =
+    argIdx !== -1 && process.argv[argIdx + 1]
+      ? path.resolve(process.argv[argIdx + 1])
+      : path.join(ROOT, 'upgrades');
+
+  const { inputs, hadLegacy, fragmentCount } = gatherFragmentInputs(upgradesDir);
+
+  if (inputs.length === 0) {
+    // No fragments and no (content-bearing) legacy NEXT.md. Do nothing — the
+    // existing publish skip logic handles the "nothing to publish" case.
+    console.log(
+      `[assemble-next-md] no fragments in ${path.join(upgradesDir, 'next')} ` +
+      `and no content-bearing NEXT.md — nothing to assemble.`,
+    );
+    process.exit(0);
+  }
+
+  let assembled;
+  try {
+    assembled = assembleNextMd(inputs);
+  } catch (err) {
+    console.error(`[assemble-next-md] ERROR: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+
+  const nextPath = path.join(upgradesDir, 'NEXT.md');
+  fs.mkdirSync(upgradesDir, { recursive: true });
+  fs.writeFileSync(nextPath, assembled);
+
+  console.log(
+    `[assemble-next-md] assembled ${fragmentCount} fragment(s)` +
+    `${hadLegacy ? ' + legacy NEXT.md' : ''} → ${path.relative(ROOT, nextPath)}`,
+  );
+  process.exit(0);
+}
+
+// Only run main() when invoked directly (not when imported by tests).
+// Compare resolved file URLs rather than string-concatenating argv[1] — that
+// naive form breaks on relative paths and paths containing spaces.
+function invokedDirectly() {
+  if (!process.argv[1]) return false;
+  try {
+    return import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href;
+  } catch {
+    return import.meta.url === pathToFileURL(process.argv[1]).href;
+  }
+}
+
+if (invokedDirectly()) {
+  main();
+}

package/scripts/pre-push-gate.js

@@ -14,11 +14,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { validateGuideContent } from './upgrade-guide-validator.mjs';
+import { assembleNextMd, gatherFragmentInputs } from './assemble-next-md.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
 const upgradesDir = path.join(ROOT, 'upgrades');
-const nextPath = path.join(ROOT, 'upgrades', 'NEXT.md');
 const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf-8'));
 const version = pkg.version;
 
@@ -34,38 +34,66 @@ const REQUIRED_SECTIONS = [
 let errors = [];
 let warnings = [];
 
-// ── 1. NEXT.md validation ─────────────────────────────────────────────
+// ── 1. Release-note validation (fragment-aware) ───────────────────────
+//
+// Release notes are authored as per-PR FRAGMENTS in upgrades/next/<slug>.md
+// (so concurrent PRs never collide on a single shared NEXT.md). The pre-push
+// gate validates the ASSEMBLED result — fragments folded together with any
+// legacy upgrades/NEXT.md — so a PR that ships only a fragment passes the same
+// section/content checks the publish gate enforces. We assemble in-memory and
+// NEVER write NEXT.md to disk here: the PR keeps its fragment, not a generated
+// guide. publish.yml runs the real assemble step before publishing.
 
 const versionedGuidePath = path.join(upgradesDir, `${version}.md`);
 const versionedGuideExists = fs.existsSync(versionedGuidePath);
-const nextExists = fs.existsSync(nextPath);
-
-// Pick the active guide for this push. NEXT.md wins if present (in-flight
-// release notes); fall back to the versioned guide once NEXT.md has been
-// renamed during a publish.
-const activeGuidePath = nextExists
-  ? nextPath
-  : (versionedGuideExists ? versionedGuidePath : null);
-const activeGuideLabel = nextExists
-  ? 'NEXT.md'
-  : (versionedGuideExists ? `${version}.md` : null);
 
-if (activeGuidePath && activeGuideLabel) {
-  const content = fs.readFileSync(activeGuidePath, 'utf-8');
+// Assemble fragments + legacy NEXT.md in-memory.
+let assembledContent = null;
+let assembleError = null;
+{
+  const { inputs } = gatherFragmentInputs(upgradesDir);
+  if (inputs.length > 0) {
+    try {
+      assembledContent = assembleNextMd(inputs);
+    } catch (err) {
+      assembleError = err instanceof Error ? err.message : String(err);
+    }
+  }
+}
 
+// The active guide for validation: the assembled fragments/NEXT.md (in-flight
+// release notes) win when present; otherwise fall back to the versioned guide
+// (post-release-cut state, when NEXT.md has been renamed and no new fragment is
+// staged yet).
+const activeGuideLabel = assembledContent !== null
+  ? 'assembled release notes (upgrades/next/*.md + NEXT.md)'
+  : (versionedGuideExists ? `${version}.md` : null);
+
+if (assembleError) {
+  // A malformed fragment must fail the push loudly — the same loud failure the
+  // publish workflow would hit.
+  errors.push(`Release-note fragments are malformed: ${assembleError}`);
+} else if (assembledContent !== null) {
   // Run the shared validator (same checks as check-upgrade-guide.js at publish
   // time). This catches the publish-blocker bugs that previously slipped past
   // pre-push: inline code / fenced blocks / camelCase config keys in "What to
   // Tell Your User", and missing "## Evidence" when "What Changed" claims a fix.
   // Before this gate, those defects only surfaced as silently-dropped publish
   // runs on main — agents never received the merged code.
-  const validatorIssues = validateGuideContent(content);
+  const validatorIssues = validateGuideContent(assembledContent);
   for (const issue of validatorIssues) {
     errors.push(`${activeGuideLabel}: ${issue}`);
   }
+} else if (versionedGuideExists) {
+  const content = fs.readFileSync(versionedGuidePath, 'utf-8');
+  const validatorIssues = validateGuideContent(content);
+  for (const issue of validatorIssues) {
+    errors.push(`${version}.md: ${issue}`);
+  }
 } else {
   errors.push(
-    `No upgrade guide found. Create upgrades/NEXT.md with sections: ${REQUIRED_SECTIONS.join(', ')}`
+    `No upgrade guide found. Create a release-note fragment ` +
+    `upgrades/next/<slug>.md (or legacy upgrades/NEXT.md) with sections: ${REQUIRED_SECTIONS.join(', ')}`
   );
 }
 
@@ -221,14 +249,16 @@ if (!process.env.CI) {
     /\bnew\b/i,
   ];
 
-  // When NEXT.md exists, it represents the *next* shipment being prepared in
-  // this push — prefer it over the (frozen) versioned guide, which describes
-  // the already-released version and isn't what this PR is changing. This is
-  // the post-release-cut + new-PR state: both files coexist, but only NEXT.md
-  // is in flight. Falls back to the versioned guide when no NEXT.md is staged.
-  const guidePath = nextExists ? nextPath : (versionedGuideExists ? versionedGuidePath : null);
-  if (guidePath && fs.existsSync(guidePath)) {
-    const guideContent = fs.readFileSync(guidePath, 'utf-8');
+  // The in-flight release notes (assembled fragments + legacy NEXT.md) represent
+  // the *next* shipment being prepared in this push — prefer them over the
+  // (frozen) versioned guide, which describes the already-released version and
+  // isn't what this PR is changing. Falls back to the versioned guide when no
+  // fragment / NEXT.md is staged (post-release-cut state).
+  const inFlight = assembledContent !== null;
+  const guideContent = inFlight
+    ? assembledContent
+    : (versionedGuideExists ? fs.readFileSync(versionedGuidePath, 'utf-8') : null);
+  if (guideContent !== null) {
     // Extract "## What Changed" section
     const whatChangedMatch = guideContent.match(/## What Changed\s*([\s\S]*?)(?=\n##\s|$)/);
     const whatChanged = whatChangedMatch ? whatChangedMatch[1] : '';
@@ -237,10 +267,10 @@ if (!process.env.CI) {
 
     if (qualifies) {
       const sideEffectsDir = path.join(ROOT, 'upgrades', 'side-effects');
-      // If NEXT.md is the active guide, any fresh artifact (last 24h) counts —
-      // the versioned-filename requirement only applies when a versioned guide
-      // is being validated without an in-flight NEXT.md.
-      const artifactName = (!nextExists && versionedGuideExists) ? `${version}.md` : null;
+      // When in-flight notes (fragments/NEXT.md) drive the push, any fresh
+      // artifact (last 24h) counts — the versioned-filename requirement only
+      // applies when a versioned guide is being validated without in-flight notes.
+      const artifactName = (!inFlight && versionedGuideExists) ? `${version}.md` : null;
       let artifactFound = false;
 
       if (fs.existsSync(sideEffectsDir)) {
@@ -248,9 +278,9 @@ if (!process.env.CI) {
         if (artifactName) {
           artifactFound = files.includes(artifactName);
         } else {
-          // For NEXT.md, any fresh artifact from the last 24h counts.
-          // The expectation is that during release cut, NEXT.md -> <version>.md
-          // rename will pair with the artifact rename as well.
+          // For in-flight notes (fragments/NEXT.md), any fresh artifact from the
+          // last 24h counts. The expectation is that during release cut, the
+          // fragment/NEXT.md -> <version>.md rename pairs with an artifact rename.
           const recent = files.filter((f) => {
             const stat = fs.statSync(path.join(sideEffectsDir, f));
             return Date.now() - stat.mtimeMs < 24 * 60 * 60 * 1000;

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-31T08:16:51.978Z",
-  "instarVersion": "1.3.151",
+  "generatedAt": "2026-05-31T09:19:20.889Z",
+  "instarVersion": "1.3.153",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.152.md

@@ -0,0 +1,50 @@
+---
+review-convergence: complete
+approved: true
+approved-by: echo (standing 12h deploy mandate, topic 13481; multi-machine live-transfer cascade)
+---
+
+# Instar Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed — the encryption key now has the same legacy-name fallback the signing key got
+
+A direct follow-up to the previous release. Each machine in a multi-machine setup
+opens an encrypted channel to the others using two key files: a signing key and an
+encryption key. The project renamed these files to canonical names at some point,
+and a machine set up before that rename keeps its keys under the older names.
+
+The previous release taught the signing-key loader to fall back to the older
+filename. Deploying that revealed the identical gap one layer down: the
+encryption-key loader was still looking only for the canonical name, so a
+legacy-named machine got past the signing key and then threw an ENOENT on the
+encryption key, leaving its mesh transport unable to fully initialize. This release
+gives the encryption-key loader the same fallback.
+
+## Summary of New Capabilities
+
+- `MachineIdentity.loadEncryptionKey()` falls back to the legacy
+  `encryption-private.pem` when the canonical `encryption-key.pem` is absent
+  (rethrows if neither exists), mirroring `loadSigningKey()`.
+- A machine whose identity predates the canonical key rename now resolves BOTH
+  keys and completes its lease/transport setup without a hand-placed key file.
+
+## What to Tell Your User
+
+If you run your agent across more than one machine, a machine that was set up a
+while ago will now join the encrypted group channel on its own, without needing
+anyone to copy a key file into place by hand. This closes the second half of a pair
+of identical gaps that were quietly stopping an older machine from fully joining.
+Nothing to configure — it applies on the next update.
+
+## Evidence
+
+- Found live on the Mac mini: after the prior release resolved the signing key, the
+  mini still logged a startup error, no such file encryption-key.pem, at mesh
+  transport setup because it had only the legacy encryption-private.pem.
+- Unit, `tests/unit/machine-identity.test.ts`: loadEncryptionKey falls back to the
+  legacy name and still throws when neither file exists.
+- 68 machine-identity tests pass; tsc --noEmit clean.
+- Spec, `docs/specs/encryption-key-fallback.md` plus the .eli16.md sibling.
+- Side-effects, `upgrades/side-effects/encryption-key-fallback.md`.

package/upgrades/1.3.153.md

@@ -0,0 +1,51 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+Release notes are now authored as per-PR **fragments** instead of a single shared
+`upgrades/NEXT.md`. Each PR drops its release note at `upgrades/next/<slug>.md`,
+touching a distinct file, so two concurrent PRs never collide on the release
+notes — the bottleneck that made many-agent merges un-landable in real time.
+
+A new pure script, `scripts/assemble-next-md.mjs`, folds every fragment (sorted
+deterministically by filename) — plus any legacy `upgrades/NEXT.md`, for backward
+compatibility — into a single `upgrades/NEXT.md`, merging by section: one What
+Changed, one What to Tell Your User, one Summary of New Capabilities, one Evidence,
+each being the concatenation of that section across all inputs. Non-canonical
+sections are preserved and appended. The emitted bump directive is the highest tier
+among the fragments (major beats minor beats patch); it is a documentation hint only
+— the real release tier still comes from `.instar/release-tier.json`, which is
+untouched.
+
+The publish workflow gains ONE new step, "Assemble release-note fragments", placed
+immediately before the existing "Check if NEXT.md has content to publish" step.
+Everything downstream — the tier gate, version resolution, the rename, the upgrade
+guide check, publish, and commit — is unchanged. With no fragments and no legacy
+NEXT.md, the assemble step does nothing and the existing skip logic fires exactly as
+before, so the no-fragments path reproduces current behavior byte-for-byte. After a
+release is cut, consumed fragments are deleted (`rm -f upgrades/next/*.md`) and the
+existing commit step stages the deletions. The pre-push gate is now fragment-aware:
+it validates the assembled result in-memory (never writing NEXT.md to disk during
+pre-push), so a PR that ships only a fragment passes the same section and content
+checks the publish gate enforces, and a malformed fragment fails the push loudly.
+`upgrades/NEXT.md` remains fully supported as a legacy, backward-compatible path.
+
+## What to Tell Your User
+
+Behind the scenes, the way I prepare release notes got a lot more robust. Each
+change now writes its own small note in its own file, instead of every change
+fighting over one shared notes file. That means when several updates are being
+prepared at the same time, they no longer block each other, so improvements reach
+you faster and with less risk of a release getting stuck. Nothing changes about how
+I talk to you — this is purely a smoother release pipeline on my side.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Per-PR release-note fragments | Write `upgrades/next/<slug>.md` (one file per change) |
+| Fragment assembler | `node scripts/assemble-next-md.mjs` (runs automatically in publish) |
+| Legacy NEXT.md | Still supported — folded in for backward compatibility |

package/upgrades/side-effects/encryption-key-fallback.md

@@ -0,0 +1,85 @@
+# Side-Effects Review — loadEncryptionKey legacy-name fallback
+
+**Version / slug:** `encryption-key-fallback`
+**Date:** `2026-05-31`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+`MachineIdentity.loadEncryptionKey()` now mirrors `loadSigningKey()` (shipped in
+#610): read the canonical `encryption-key.pem`; on ENOENT, fall back to the legacy
+`encryption-private.pem` if present, else rethrow. Adds one module constant
+`LEGACY_ENCRYPTION_KEY_FILE`.
+
+## Decision-point inventory
+
+- **loadEncryptionKey catch branch** — canonical read throws ENOENT → legacy file
+  exists? read it : rethrow. Both branches covered by unit tests (falls back; still
+  throws when neither exists).
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject?** Nothing new. It only ADDS a
+second lookup location before the same terminal rethrow. Callers that previously
+succeeded (canonical present) are unaffected; callers that previously threw ENOENT
+with a legacy-only key now succeed.
+
+## 2. Under-block
+
+**What does this still miss?** Only the one known legacy name
+(`encryption-private.pem`) is tried, matching the signing-key fallback's single
+legacy name — not an open-ended search. A machine missing BOTH the canonical and
+the legacy file still throws (correct — there is no key to load).
+
+## 3. Level-of-abstraction fit
+
+**Right layer?** Yes. The fix lives in the single `loadEncryptionKey()` loader that
+every encryption-key consumer already calls, directly beside the `loadSigningKey()`
+fallback it mirrors. One constant beside `LEGACY_SIGNING_KEY_FILE`. No duplication.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+No blocking authority added. A pure read-path widen with an unchanged terminal
+rethrow; gates nothing.
+
+## 5. Interactions
+
+`loadEncryptionKey` feeds the mesh transport's X25519 E2E encryption setup.
+Widening it only makes a previously-throwing legacy-keyed machine succeed — no
+consumer observes a different value, only present-vs-throw. Idempotent. Pairs with
+#610's signing-key fallback so a legacy-keyed machine resolves BOTH keys and its
+lease/transport setup completes.
+
+## 6. External surfaces
+
+None. No HTTP routes, config, notifications, or Telegram. The visible effect is the
+absence of the `Lease/transport setup: ENOENT … encryption-key.pem` boot warning on
+a legacy-keyed machine.
+
+## 7. Rollback cost
+
+Low. Revert the method to canonical-only and drop the constant; a legacy-keyed
+machine then re-trips the ENOENT at transport setup. No schema, no migration, no
+persisted state.
+
+## Conclusion
+
+Minimal additive read-path fallback, both branches unit-tested, no new authority,
+no external surface, cheap revert. Closes the encryption-key half of the legacy-key
+defect pair (#610 closed the signing-key half).
+
+## Second-pass review (if required)
+
+Not required — no new blocking authority, no destructive op, both branches tested,
+reversible; direct mirror of the already-reviewed #610 fallback.
+
+## Evidence pointers
+
+- `tests/unit/machine-identity.test.ts` — loadEncryptionKey legacy fallback + still-throws.
+- 68 machine-identity tests green; `tsc --noEmit` clean.
+- Found live on the mini: `Lease/transport setup: ENOENT … encryption-key.pem`
+  after #610 resolved the signing key.
+- Spec: `docs/specs/encryption-key-fallback.md` (+ `.eli16.md`).

package/upgrades/side-effects/nextmd-release-note-fragments.md

@@ -0,0 +1,151 @@
+# Side-Effects Review — Per-PR release-note fragments
+
+**Version / slug:** `nextmd-release-note-fragments`
+**Date:** `2026-05-31`
+**Author:** `echo`
+**Second-pass reviewer:** `required` (release-pipeline blast radius — see §1, §7)
+
+## Summary of the change
+
+The release pipeline consumed a single shared `upgrades/NEXT.md` per merge. With
+many agents merging concurrently, every PR rewrote NEXT.md, so every PR collided on
+it within minutes — the release notes became an un-landable hot file. This change
+introduces per-PR release-note FRAGMENTS (`upgrades/next/<slug>.md`): two PRs touch
+different fragment files and never collide.
+
+The mechanism is an ASSEMBLE PRE-STEP. A new pure script
+(`scripts/assemble-next-md.mjs`) folds every fragment (deterministic filename sort)
+plus any legacy `upgrades/NEXT.md` into a single `upgrades/NEXT.md`, merging by
+section. The publish workflow runs it immediately BEFORE the existing
+"Check if NEXT.md has content to publish" step; everything downstream is unchanged.
+The pre-push gate validates the assembled result in-memory (never writing NEXT.md).
+
+## Decision-point inventory
+
+1. **No-fragments / no-legacy-NEXT.md → no-op (exit 0 quietly).** The existing skip
+   logic then fires. This is the load-bearing backward-compat boundary.
+2. **Malformed fragment (content but no parseable `## ` section, or only
+   comments/whitespace) → loud non-zero exit.** Fails the workflow rather than
+   shipping a broken guide.
+3. **Idempotency guard:** an input carrying `GENERATED_MARKER` is dropped when any
+   non-generated input is present; folded straight through (stable re-emit) when it
+   is the sole input. Decides "is this a fresh fragment set or a re-run on prior
+   output?"
+4. **Bump tier = MAX(fragments).** A hint only; the real tier is
+   `.instar/release-tier.json` (untouched).
+5. **pre-push gate active-guide selection:** assembled in-flight notes win; else fall
+   back to the versioned guide; else "no guide" error.
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject?** A fragment with real prose but no
+`## ` heading is rejected — intentional, because the assembler can't place headless
+prose under a known section. An effectively-empty fragment (comments/whitespace only)
+is rejected — intentional, an empty fragment file is a mistake. A hand-authored legacy
+`upgrades/NEXT.md` is NOT rejected: it is folded in (backward compat). The
+no-fragments-and-no-NEXT.md case is NOT an error — it is a clean exit-0 no-op, so the
+existing "nothing to publish" skip is preserved exactly. **No legitimate current input
+is newly rejected:** today's flow ships a NEXT.md, which still validates and publishes
+unchanged.
+
+## 2. Under-block
+
+**What does this still miss?** The assembler does not deep-validate each fragment's
+section CONTENT (camelCase keys, inline code, missing Evidence) — that remains the job
+of `validateGuideContent`, which runs against the ASSEMBLED result in both the pre-push
+gate and (post-rename) `check-upgrade-guide.js`. So a defect in a fragment is caught at
+the assembled layer, not per-fragment; this is acceptable because the assembled doc is
+exactly what publishes. It does not detect two fragments making contradictory claims —
+out of scope (humans review notes). It does not garbage-collect stale fragments that
+were never released; the publish path deletes only the fragments it just consumed.
+
+## 3. Level-of-abstraction fit
+
+**Right layer?** Yes. The assembler is a pure string→string function with a thin CLI
+wrapper (same shape as `resolve-release-tier.mjs` / `resolve-publish-version.mjs`),
+unit-tested in isolation. The workflow change is one additive step plus one `rm` in the
+existing consumption path — it does not touch the tier gate, version resolution, rename,
+guide check, publish, or commit logic. The pre-push gate reuses the SAME assemble
+function (single source of truth), so pre-push and publish can never diverge on how
+fragments fold.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+No new blocking AUTHORITY over releases is added. The assembler is a transform, not a
+gate: its only failure mode is a malformation (exit non-zero), which is the same loud
+behavior the publish workflow already wants. The real publish AUTHORITY is unchanged —
+`.instar/release-tier.json` (Layer 2) and `validateGuideContent` (the section/content
+gate) still decide what ships. The emitted bump comment is explicitly a documentation
+SIGNAL, not authority (the code comment and the artifact both say so).
+
+## 5. Interactions
+
+- **UpgradeGuideProcessor**: scans `upgrades/` for files matching
+  `^(\d+\.\d+\.\d+)\.md$`. `readdirSync` returns the subdir name `next` (no `.md`
+  suffix) → not matched → ignored. Verified by reading `getAvailableGuides`. The
+  `upgrades/next/` directory is invisible to guide delivery.
+- **check-upgrade-guide.js**: iterates `upgrades/*.md` files (skips `NEXT.md`); the
+  `next/` subdir is not a `.md` file → skipped. By publish time fragments are already
+  deleted and NEXT.md renamed, so it validates the assembled+renamed guide. Verified
+  end-to-end in a scratch dir (assemble → rename → check → exit 0).
+- **pre-push-gate.js**: now imports the assembler; assembles in-memory; the side-effects
+  artifact check (§5 of the gate) reads the assembled "What Changed" instead of raw
+  NEXT.md. No NEXT.md is written during pre-push.
+- **Idempotency / re-runs**: the `GENERATED_MARKER` guard prevents a re-run from
+  double-folding prior output back over still-present fragments.
+- No interaction with SessionReaper, sentinels, recovery, or any runtime path — this is
+  build/CI tooling only.
+
+## 6. External surfaces
+
+- New directory `upgrades/next/` and new file convention `upgrades/next/<slug>.md`.
+- New script `scripts/assemble-next-md.mjs` (build-time only; never shipped to agent
+  runtime paths).
+- One new publish workflow step + one `rm` in the existing rename step.
+- New CLAUDE.md / build-skill guidance instructing fragment authoring; a
+  `PostUpdateMigrator` CLAUDE.md backfill for deployed agents.
+- No HTTP routes, no config keys, no Telegram, no agent runtime behavior change.
+
+## 7. Rollback cost
+
+**Low and clean.** Three independent revert points, each safe on its own:
+- Remove the "Assemble release-note fragments" workflow step + the `rm` line → publish
+  reverts to consuming NEXT.md directly (NEXT.md authoring still works).
+- Revert the pre-push gate to validating NEXT.md directly.
+- Delete `scripts/assemble-next-md.mjs` + its test.
+Because the no-fragments path is a byte-for-byte no-op, a half-rollback (e.g. removing
+only the workflow step while authors still write fragments) degrades gracefully: the
+release simply skips (no NEXT.md), which the release-readiness sentinel surfaces — it
+never ships a wrong or partial guide. No state, no schema, no irreversible op, no data
+migration. Fragments are plain markdown files.
+
+## Conclusion
+
+Additive, backward-compatible, pure-function-at-the-core change to build/CI tooling.
+The release-critical invariant — "the no-fragments path reproduces exact current
+behavior" — is enforced by code (clean exit-0 no-op) and covered by tests (CLI exits 0
+and writes nothing; pre-push accepts a fragment-only push and rejects a malformed one).
+Blast radius is contained to the assemble pre-step; the tier gate, version resolution,
+and content validation that actually authorize a release are untouched.
+
+## Second-pass review (if required)
+
+Required (release-pipeline). Reviewer focus: confirm the publish.yml diff is additive
+(the assemble step precedes the unchanged skip-check; the `rm` rides the existing
+`if:` guard and the existing `git add upgrades/`), and that the no-fragments path still
+skips cleanly. Pending.
+
+## Evidence pointers
+
+- `tests/unit/assemble-next-md.test.ts` — 25 tests: section merge, deterministic order,
+  max bump tier, single fragment, legacy fold, no-op/quiet, malformed→loud, idempotent
+  (in-memory + on-disk CLI), WTTYU backtick-free.
+- `tests/unit/pre-push-gate.test.ts` — fragment-aware integration: accepts fragment-only
+  push (writes no NEXT.md), rejects WTTYU inline code via assembled validation, rejects
+  malformed fragment loudly.
+- Manual end-to-end (scratch dir): fragment → `assemble-next-md.mjs` →
+  `mv NEXT.md <version>.md` + `rm next/*.md` → `check-upgrade-guide.js` exit 0.
+- `upgrades/next/release-note-fragments.md` — this PR's own release note (dogfoods the
+  mechanism; the PR does not touch `upgrades/NEXT.md`).