instar 1.3.309 → 1.3.311

package/dist/core/BootSelfKnowledge.d.ts

@@ -0,0 +1,121 @@
+/**
+ * BootSelfKnowledge — the "what I already have" block injected at session start.
+ *
+ * Spec: docs/specs/session-boot-self-knowledge.md (converged 2026-06-05).
+ *
+ * Composes ONE bounded markdown block from two deterministic sources:
+ *   1. Vault secret NAMES — the per-agent encrypted SecretStore flattened to
+ *      dot-notation key paths via the SAME secretKeyPaths() helper that
+ *      /secrets/sync-status uses. Values are NEVER serialized.
+ *   2. Operational facts — `selfKnowledge.operationalFacts` from config.json,
+ *      self-asserted per-machine hints (e.g. the logged-in Playwright seat).
+ *
+ * This is deterministic config/capability discovery injected as boot context —
+ * a capability inventory, not memory, not an authority. It gates nothing.
+ *
+ * Hardening contract (every rendered name/fact is untrusted display content —
+ * key names are writable by peers via secret-sync, facts by the agent itself):
+ *   - control chars + ANSI stripped, `<`/`>` HTML-escaped (envelope-breakout
+ *     structurally impossible), names clamped to 128 chars, facts to 256;
+ *   - key paths depth-capped at 2 (`parent.child (+N nested)`) so structured
+ *     credentials never leak their internal shape;
+ *   - alphabetical ordering, 50-name cap, byte-bounded block with an
+ *     actionable truncation marker (never silent truncation).
+ *
+ * Vault honesty (bifurcated-master-key lesson, 2026-06-05): absent file →
+ * vaultState 'absent' (never an error); a read that throws is retried ONCE
+ * (absorbs a benign master-key-rotation race) before reporting
+ * 'decrypt-failed' — which is rendered as an explicit hands-off warning, never
+ * as an empty vault.
+ *
+ * NOTE: distinct from the SelfKnowledgeTree (src/knowledge/) — that system is
+ * LLM-assisted search over AGENT.md; this is a deterministic boot inventory.
+ */
+/** A stored operational fact. The writer route stamps updatedAt + machine; bare strings (hand-authored/legacy) are accepted too. */
+export interface OperationalFact {
+    fact: string;
+    updatedAt?: string;
+    machine?: string;
+}
+export interface BootSelfKnowledgeResult {
+    present: boolean;
+    block: string;
+    names: string[];
+    factCount: number;
+    vaultState: 'ok' | 'absent' | 'decrypt-failed';
+}
+export interface BootSelfKnowledgeOptions {
+    /** The agent's state dir (.instar) — locates the vault. */
+    stateDir: string;
+    /** Path to .instar/config.json — read FRESH per call (deliberate divergence
+     *  from boot-frozen ctx.config: flag/fact edits take effect without a server
+     *  restart — do not "consistency-fix" this back). */
+    configPath: string;
+}
+/** Rendering caps (spec §Rendering hardening). */
+export declare const MAX_NAME_CHARS = 128;
+export declare const MAX_FACT_CHARS = 256;
+export declare const MAX_NAMES_RENDERED = 50;
+export declare const MAX_FACTS_STORED = 50;
+export declare const DEFAULT_MAX_BYTES = 2000;
+/** Test seam: clear the module-level cache between tests. */
+export declare function clearBootSelfKnowledgeCache(): void;
+/** Fresh-read the selfKnowledge.sessionContext flags from config.json (never ctx.config — see configPath doc). */
+export declare function readSelfKnowledgeFlags(configPath: string): {
+    enabled?: boolean;
+    maxInjectedBytes?: number;
+};
+/**
+ * Atomic config.json read-mutate-write for the facts writer routes: re-read
+ * from disk inside the call (bounding the lost-update window vs the other,
+ * pre-existing NON-atomic config writers to this function's own microseconds —
+ * last-writer-wins semantics, spec §Writer path), apply the mutator, write to
+ * a temp file, rename into place. The mutator returns either {value} (commit)
+ * or {error} (abort — nothing is written).
+ */
+export declare function writeConfigAtomic<T>(configPath: string, mutate: (cfg: Record<string, unknown>) => {
+    value?: T;
+    error?: {
+        status: number;
+        message: string;
+    };
+}): {
+    value?: T;
+    error?: {
+        status: number;
+        message: string;
+    };
+};
+/** Strip control chars + ANSI escapes, HTML-escape angle brackets, clamp length. */
+export declare function sanitizeForBlock(input: string, maxChars: number): string;
+/**
+ * Collapse flat dot-notation leaf paths (secretKeyPaths output — the SAME
+ * derivation sync-status uses; this is a post-process, never a re-derivation)
+ * to depth-2 prefixes. N = count of distinct leaf paths collapsed under the
+ * prefix. `telegram.bot.token` + `telegram.bot.chatId` → `telegram.bot (+2 nested)`.
+ */
+export declare function collapseToDepth2(leafPaths: string[]): string[];
+export declare class BootSelfKnowledge {
+    private readonly stateDir;
+    private readonly configPath;
+    constructor(opts: BootSelfKnowledgeOptions);
+    private vaultPath;
+    /**
+     * Vault key NAMES + state, via the module cache. Production read path is
+     * keychain-backed by default — NO hardcoded forceFileKey (a file-key here
+     * would read a different/empty vault in production and recreate the exact
+     * "vault looks empty" confusion this module exists to kill; test-safety
+     * comes ONLY from the MasterKeyManager VITEST constructor guard).
+     */
+    private readNames;
+    /** Operational facts, read FRESH from config.json (see configPath doc). */
+    readFacts(): OperationalFact[];
+    /**
+     * Build the boot block. `full` bypasses the name-count cap and byte bound
+     * (the `?full=1` recovery path the truncation marker points at).
+     */
+    sessionContext(maxBytes?: number, opts?: {
+        full?: boolean;
+    }): BootSelfKnowledgeResult;
+}
+//# sourceMappingURL=BootSelfKnowledge.d.ts.map

package/dist/core/BootSelfKnowledge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BootSelfKnowledge.d.ts","sourceRoot":"","sources":["../../src/core/BootSelfKnowledge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,oIAAoI;AACpI,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,gBAAgB,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB;IACvC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB;;yDAEqD;IACrD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kDAAkD;AAClD,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAgBtC,6DAA6D;AAC7D,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED,kHAAkH;AAClH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAU3G;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK;IAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnG;IAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAW5D;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAc9D;AAYD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,IAAI,EAAE,wBAAwB;IAK1C,OAAO,CAAC,SAAS;IAIjB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAgDjB,2EAA2E;IAC3E,SAAS,IAAI,eAAe,EAAE;IAa9B;;;OAGG;IACH,cAAc,CAAC,QAAQ,GAAE,MAA0B,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,uBAAuB;CA4E7G"}

package/dist/core/BootSelfKnowledge.js

@@ -0,0 +1,285 @@
+/**
+ * BootSelfKnowledge — the "what I already have" block injected at session start.
+ *
+ * Spec: docs/specs/session-boot-self-knowledge.md (converged 2026-06-05).
+ *
+ * Composes ONE bounded markdown block from two deterministic sources:
+ *   1. Vault secret NAMES — the per-agent encrypted SecretStore flattened to
+ *      dot-notation key paths via the SAME secretKeyPaths() helper that
+ *      /secrets/sync-status uses. Values are NEVER serialized.
+ *   2. Operational facts — `selfKnowledge.operationalFacts` from config.json,
+ *      self-asserted per-machine hints (e.g. the logged-in Playwright seat).
+ *
+ * This is deterministic config/capability discovery injected as boot context —
+ * a capability inventory, not memory, not an authority. It gates nothing.
+ *
+ * Hardening contract (every rendered name/fact is untrusted display content —
+ * key names are writable by peers via secret-sync, facts by the agent itself):
+ *   - control chars + ANSI stripped, `<`/`>` HTML-escaped (envelope-breakout
+ *     structurally impossible), names clamped to 128 chars, facts to 256;
+ *   - key paths depth-capped at 2 (`parent.child (+N nested)`) so structured
+ *     credentials never leak their internal shape;
+ *   - alphabetical ordering, 50-name cap, byte-bounded block with an
+ *     actionable truncation marker (never silent truncation).
+ *
+ * Vault honesty (bifurcated-master-key lesson, 2026-06-05): absent file →
+ * vaultState 'absent' (never an error); a read that throws is retried ONCE
+ * (absorbs a benign master-key-rotation race) before reporting
+ * 'decrypt-failed' — which is rendered as an explicit hands-off warning, never
+ * as an empty vault.
+ *
+ * NOTE: distinct from the SelfKnowledgeTree (src/knowledge/) — that system is
+ * LLM-assisted search over AGENT.md; this is a deterministic boot inventory.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { SecretStore } from './SecretStore.js';
+import { secretKeyPaths } from './SecretSync.js';
+/** Rendering caps (spec §Rendering hardening). */
+export const MAX_NAME_CHARS = 128;
+export const MAX_FACT_CHARS = 256;
+export const MAX_NAMES_RENDERED = 50;
+export const MAX_FACTS_STORED = 50;
+export const DEFAULT_MAX_BYTES = 2000;
+const KEY_PATH_DEPTH = 2;
+/**
+ * Module-level names cache — survives across requests (the per-request
+ * BootSelfKnowledge instance reads through it; precedent: Config.ts
+ * _frameworkBinaryCache). Keyed on the VAULT FILE'S ABSOLUTE PATH so distinct
+ * vaults (parallel AgentServer instances in tests) can never collide; entries
+ * are validated against (mtimeMs, size) — never bare mtime — so a restored
+ * backup with an older mtime still invalidates on size. Names only, never values.
+ */
+const namesCache = new Map();
+/** Test seam: clear the module-level cache between tests. */
+export function clearBootSelfKnowledgeCache() {
+    namesCache.clear();
+}
+/** Fresh-read the selfKnowledge.sessionContext flags from config.json (never ctx.config — see configPath doc). */
+export function readSelfKnowledgeFlags(configPath) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        return raw.selfKnowledge?.sessionContext ?? {};
+    }
+    catch {
+        // @silent-fallback-ok — unreadable/absent config means no flags set; the route then resolves the developmentAgent gate default
+        return {};
+    }
+}
+/**
+ * Atomic config.json read-mutate-write for the facts writer routes: re-read
+ * from disk inside the call (bounding the lost-update window vs the other,
+ * pre-existing NON-atomic config writers to this function's own microseconds —
+ * last-writer-wins semantics, spec §Writer path), apply the mutator, write to
+ * a temp file, rename into place. The mutator returns either {value} (commit)
+ * or {error} (abort — nothing is written).
+ */
+export function writeConfigAtomic(configPath, mutate) {
+    let cfg = {};
+    if (fs.existsSync(configPath)) {
+        cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    }
+    const outcome = mutate(cfg);
+    if (outcome.error)
+        return outcome;
+    const tmp = `${configPath}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2) + '\n');
+    fs.renameSync(tmp, configPath);
+    return outcome;
+}
+/** Strip control chars + ANSI escapes, HTML-escape angle brackets, clamp length. */
+export function sanitizeForBlock(input, maxChars) {
+    let s = String(input)
+        // eslint-disable-next-line no-control-regex
+        .replace(/\u001b\[[0-9;]*[A-Za-z]/g, '') // ANSI CSI sequences
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f]/g, ' ') // control chars (incl. newlines) -> space
+        .replace(/[\u0060]/g, '\u02cb') // backticks -> modifier-letter grave: a hostile name cannot break the inline-code span
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .trim();
+    if (s.length > maxChars)
+        s = `${s.slice(0, maxChars - 1)}\u2026`;
+    return s;
+}
+/**
+ * Collapse flat dot-notation leaf paths (secretKeyPaths output — the SAME
+ * derivation sync-status uses; this is a post-process, never a re-derivation)
+ * to depth-2 prefixes. N = count of distinct leaf paths collapsed under the
+ * prefix. `telegram.bot.token` + `telegram.bot.chatId` → `telegram.bot (+2 nested)`.
+ */
+export function collapseToDepth2(leafPaths) {
+    const collapsed = new Map(); // prefix → collapsed-leaf count (0 = the leaf itself)
+    for (const p of leafPaths) {
+        const segs = p.split('.');
+        if (segs.length <= KEY_PATH_DEPTH) {
+            if (!collapsed.has(p))
+                collapsed.set(p, 0);
+        }
+        else {
+            const prefix = segs.slice(0, KEY_PATH_DEPTH).join('.');
+            collapsed.set(prefix, (collapsed.get(prefix) ?? 0) + 1);
+        }
+    }
+    return [...collapsed.entries()]
+        .map(([prefix, n]) => (n > 0 ? `${prefix} (+${n} nested)` : prefix))
+        .sort((a, b) => a.localeCompare(b));
+}
+/** Parse a raw config entry into an OperationalFact (bare strings accepted). */
+function toFact(raw) {
+    if (typeof raw === 'string' && raw.trim())
+        return { fact: raw };
+    if (raw && typeof raw === 'object' && typeof raw.fact === 'string' && raw.fact.trim()) {
+        const f = raw;
+        return { fact: f.fact, updatedAt: f.updatedAt, machine: f.machine };
+    }
+    return null;
+}
+export class BootSelfKnowledge {
+    stateDir;
+    configPath;
+    constructor(opts) {
+        this.stateDir = opts.stateDir;
+        this.configPath = opts.configPath;
+    }
+    vaultPath() {
+        return path.resolve(path.join(this.stateDir, 'secrets', 'config.secrets.enc'));
+    }
+    /**
+     * Vault key NAMES + state, via the module cache. Production read path is
+     * keychain-backed by default — NO hardcoded forceFileKey (a file-key here
+     * would read a different/empty vault in production and recreate the exact
+     * "vault looks empty" confusion this module exists to kill; test-safety
+     * comes ONLY from the MasterKeyManager VITEST constructor guard).
+     */
+    readNames() {
+        const vaultPath = this.vaultPath();
+        if (!fs.existsSync(vaultPath))
+            return { names: [], vaultState: 'absent' };
+        let stat;
+        try {
+            stat = fs.statSync(vaultPath);
+        }
+        catch {
+            // @silent-fallback-ok — vault file raced away between existsSync and stat; absent is the truthful state
+            return { names: [], vaultState: 'absent' };
+        }
+        const cached = namesCache.get(vaultPath);
+        if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) {
+            return { names: cached.names, vaultState: cached.vaultState };
+        }
+        const store = new SecretStore({ stateDir: this.stateDir });
+        let names = null;
+        let vaultState = 'ok';
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                // The decrypted object is not retained beyond this traversal.
+                names = secretKeyPaths(store.read());
+                break;
+            }
+            catch {
+                // @silent-fallback-ok — NOT silent at the surface: a second failure becomes vaultState decrypt-failed, rendered as the explicit hands-off warning block
+                // One retry absorbs a benign mid-rotation race (key swapped between
+                // file read and key fetch). A second failure is a real decrypt failure.
+            }
+        }
+        if (names === null) {
+            vaultState = 'decrypt-failed';
+            names = [];
+        }
+        // Cache ONLY the healthy outcome. A decrypt failure is almost always a
+        // MASTER-KEY problem (a separate file the cache key cannot see) — caching
+        // it would keep serving the hands-off warning after the key recovers,
+        // until an unrelated vault write or a restart. Re-trying the decrypt on
+        // every request while failed is cheap relative to lying about recovery.
+        if (vaultState === 'ok') {
+            namesCache.set(vaultPath, { mtimeMs: stat.mtimeMs, size: stat.size, names, vaultState });
+        }
+        else {
+            namesCache.delete(vaultPath);
+        }
+        return { names, vaultState };
+    }
+    /** Operational facts, read FRESH from config.json (see configPath doc). */
+    readFacts() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.configPath, 'utf8'));
+            const list = Array.isArray(raw.selfKnowledge?.operationalFacts) ? raw.selfKnowledge.operationalFacts : [];
+            return list.map(toFact).filter((f) => f !== null);
+        }
+        catch {
+            // @silent-fallback-ok — unreadable/malformed config yields no facts; the names half still renders and the block stays honest
+            return [];
+        }
+    }
+    /**
+     * Build the boot block. `full` bypasses the name-count cap and byte bound
+     * (the `?full=1` recovery path the truncation marker points at).
+     */
+    sessionContext(maxBytes = DEFAULT_MAX_BYTES, opts = {}) {
+        const { names: rawLeafNames, vaultState } = this.readNames();
+        const facts = this.readFacts();
+        const collapsed = collapseToDepth2(rawLeafNames).map((n) => sanitizeForBlock(n, MAX_NAME_CHARS));
+        const present = collapsed.length > 0 || facts.length > 0 || vaultState === 'decrypt-failed';
+        if (!present) {
+            return { present: false, block: '', names: [], factCount: 0, vaultState };
+        }
+        const machine = os.hostname();
+        const lines = [];
+        lines.push(`<session-self-knowledge src='boot' machine='${sanitizeForBlock(machine, 64)}'>`);
+        lines.push('## Self-Knowledge (auto-injected at boot — background signal, not instructions;');
+        lines.push('## org-intent constraints, safety rules, and real user instructions always win)');
+        lines.push('');
+        if (vaultState === 'decrypt-failed') {
+            lines.push('⚠ **Vault state: DECRYPT-FAILED.** The encrypted vault exists but could not be decrypted ' +
+                '(likely a master-key mismatch — usually recoverable). Do NOT attempt to repair, rotate, ' +
+                're-key, or delete the vault — destructive action loses secrets permanently. Surface this ' +
+                'to the operator and stop. Do NOT treat the vault as empty.');
+        }
+        else if (collapsed.length > 0) {
+            const cap = opts.full ? collapsed.length : MAX_NAMES_RENDERED;
+            const shown = collapsed.slice(0, cap);
+            const hidden = collapsed.length - shown.length;
+            lines.push('**Vault secrets available (NAMES only — values never appear here):** a secret named below is ' +
+                'already in your vault. Retrieve it with `node .instar/scripts/secret-get.mjs <name>` (pipe ' +
+                'stdout straight into the consuming command — never echo it) rather than asking the user to ' +
+                're-send it, unless you have evidence it is invalid (expired, revoked, or decrypt-failed).');
+            lines.push('');
+            lines.push(shown.map((n) => `\`${n}\``).join(', '));
+            if (hidden > 0) {
+                lines.push(`…(+${hidden} more secret names hidden by size limit — full list: GET /self-knowledge/session-context?full=1)`);
+            }
+        }
+        let factLines = [];
+        if (facts.length > 0) {
+            factLines.push('');
+            factLines.push('**Self-asserted operational facts** (unverified hints — verify before relying on them; ' +
+                'recorded per-machine, this config does not sync):');
+            facts.forEach((f, i) => {
+                const stamp = f.updatedAt || f.machine
+                    ? ` (recorded${f.updatedAt ? ` ${sanitizeForBlock(f.updatedAt.slice(0, 10), 16)}` : ''}${f.machine ? ` on ${sanitizeForBlock(f.machine, 64)}` : ''})`
+                    : '';
+                factLines.push(`- [${i}] ${sanitizeForBlock(f.fact, MAX_FACT_CHARS)}${stamp}`);
+            });
+        }
+        const close = '</session-self-knowledge>';
+        // Byte-bound: facts truncate first, then names (names carry their own
+        // count-cap marker above; the byte bound trims fact lines from the end).
+        if (!opts.full) {
+            let assembled = [...lines, ...factLines, close].join('\n');
+            while (Buffer.byteLength(assembled, 'utf8') > maxBytes && factLines.length > 2) {
+                factLines = factLines.slice(0, -1);
+                const dropped = facts.length - (factLines.length - 2);
+                assembled = [...lines, ...factLines, `…(+${dropped} facts hidden by size limit — GET /self-knowledge/session-context?full=1)`, close].join('\n');
+                if (Buffer.byteLength(assembled, 'utf8') <= maxBytes) {
+                    return { present: true, block: assembled, names: collapsed, factCount: facts.length, vaultState };
+                }
+            }
+            return { present: true, block: assembled, names: collapsed, factCount: facts.length, vaultState };
+        }
+        const block = [...lines, ...factLines, close].join('\n');
+        return { present: true, block, names: collapsed, factCount: facts.length, vaultState };
+    }
+}
+//# sourceMappingURL=BootSelfKnowledge.js.map

package/dist/core/BootSelfKnowledge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BootSelfKnowledge.js","sourceRoot":"","sources":["../../src/core/BootSelfKnowledge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA0BjD,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;AAEJ,6DAA6D;AAC7D,MAAM,UAAU,2BAA2B;IACzC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAEzD,CAAC;QACF,OAAO,GAAG,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,+HAA+H;QAC/H,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,MAAoG;IAEpG,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC7D,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC9D,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACnB,4CAA4C;SAC3C,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC,qBAAqB;QAC9D,4CAA4C;SAC3C,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,0CAA0C;SACjF,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,uFAAuF;SACtH,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ;QAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAmB;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,sDAAsD;IACnG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAuB,CAAC,IAAI,KAAK,QAAQ,IAAK,GAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAChI,MAAM,CAAC,GAAG,GAAsB,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAS;IACjB,UAAU,CAAS;IAEpC,YAAY,IAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;OAMG;IACK,SAAS;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAE1E,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,wGAAwG;YACxG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrC,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,wJAAwJ;gBACxJ,oEAAoE;gBACpE,wEAAwE;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,GAAG,gBAAgB,CAAC;YAC9B,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,SAAS;QACP,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAE9D,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,6HAA6H;YAC7H,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,WAAmB,iBAAiB,EAAE,OAA2B,EAAE;QAChF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAE/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QACjG,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,gBAAgB,CAAC;QAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,+CAA+C,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7F,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CACR,2FAA2F;gBACzF,0FAA0F;gBAC1F,2FAA2F;gBAC3F,4DAA4D,CAC/D,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/C,KAAK,CAAC,IAAI,CACR,+FAA+F;gBAC7F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,2FAA2F,CAC9F,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,kGAAkG,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;QAED,IAAI,SAAS,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,SAAS,CAAC,IAAI,CACZ,yFAAyF;gBACvF,mDAAmD,CACtD,CAAC;YACF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACrB,MAAM,KAAK,GACT,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO;oBACtB,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;oBACrJ,CAAC,CAAC,EAAE,CAAC;gBACT,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,2BAA2B,CAAC;QAC1C,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/E,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtD,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,MAAM,OAAO,2EAA2E,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjJ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;gBACpG,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;IACzF,CAAC;CACF"}

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAiD1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAuE3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkPpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAwjDvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IA4G1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6JtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0SvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAwBnf,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAob3B,OAAO,CAAC,wBAAwB;IAuJhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IA+JnC,OAAO,CAAC,qBAAqB;IA4P7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA0MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAgC1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwC/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyN7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAiD1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAuE3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkPpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA2kDvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAiH1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgLtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0SvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAwBnf,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAmd3B,OAAO,CAAC,wBAAwB;IAuJhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IA+JnC,OAAO,CAAC,qBAAqB;IA+R7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA0MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAgC1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwC/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyN7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -2639,6 +2639,24 @@ Rule: I do not state that work landed inside another agent's state unless I have
             patched = true;
             result.upgraded.push('CLAUDE.md: added Cross-Agent Communication Discipline (anti-confabulation) section');
         }
+        // Session Boot Self-Knowledge (spec: session-boot-self-knowledge.md).
+        // Existing agents need the rule ("a secret named in your boot block is in
+        // the vault — retrieve, don't re-ask") + the facts writer + the retrieval
+        // script. Content-sniffed on the same heading the template emits.
+        if (!content.includes('**Session Boot Self-Knowledge**')) {
+            const bootSelfKnowledgeSection = `
+**Session Boot Self-Knowledge** — Your session-start context includes an auto-injected \`<session-self-knowledge>\` block: the NAMES of secrets in your encrypted vault (never values) + self-asserted operational facts about this agent/machine. (Rides the developmentAgent gate until the fleet flip.)
+- **The rule**: a secret named in your boot block is ALREADY in your vault — retrieve it with \`node .instar/scripts/secret-get.mjs <name>\` (pipe stdout straight into the consuming command, e.g. \`... github_token | gh auth login --with-token\` — NEVER echo the value into chat/transcripts) instead of asking the user to re-send it. Only re-ask if you have evidence it is invalid (expired/revoked/decrypt-failed).
+- Discover vault key names anytime: \`node .instar/scripts/secret-get.mjs --names\` (names+lengths to stderr) or \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/self-knowledge/session-context?full=1"\`.
+- **Record a durable operational fact** (a channel path, a logged-in seat, a machine-specific truth worth knowing at every boot): \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/self-knowledge/facts -H 'Content-Type: application/json' -d '{"fact":"..."}'\` (auto-stamped with date+machine). Remove: \`curl -X DELETE -H "Authorization: Bearer $AUTH" http://localhost:${port}/self-knowledge/facts -H 'Content-Type: application/json' -d '{"match":"substring"}'\`. Facts are per-machine and appear at the next session start.
+- **When to use** (PROACTIVE — this is the trigger): the moment you discover an operational fact future sessions will need (where a tool lives, which machine owns a seat, a non-obvious path), record it as a fact — never leave it to session memory.
+- If the boot block reports the vault as DECRYPT-FAILED: do NOT repair, rotate, or delete anything — a decrypt failure is usually recoverable; destructive action loses secrets permanently. Surface it to the operator and stop.
+- Off-switch: \`selfKnowledge.sessionContext.enabled: false\` in \`.instar/config.json\` (applies at the next session start).
+`;
+            content += '\n' + bootSelfKnowledgeSection;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Session Boot Self-Knowledge section');
+        }
         // Apprenticeship Program (Step 1, APPRENTICESHIP-STEP1-PROGRAM-SCAFFOLD-SPEC.md).
         // Existing agents need to know the program registry + lifecycle gates exist —
         // an agent that doesn't know about a capability effectively doesn't have it.
@@ -4202,6 +4220,11 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             '**Coordination Mandate**',
             '**ReviewExchange (autonomous code review)**',
             '**Cutover Readiness**',
+            // Session Boot Self-Knowledge (spec session-boot-self-knowledge): vault
+            // secret NAMES + operational facts at boot. A Codex/Gemini agent that
+            // never learns the facts writer + secret-get retrieval will re-ask the
+            // user for stored credentials — the exact loop this feature closes.
+            '**Session Boot Self-Knowledge**',
         ];
         for (const shadowName of ['AGENTS.md', 'GEMINI.md']) {
             const shadowPath = path.join(this.config.projectDir, shadowName);
@@ -4411,6 +4434,21 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
         catch (err) {
             result.errors.push(`secret-drop-retrieve.mjs: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // Vault retrieval helper — always overwrite (sibling of the above; spec
+        // session-boot-self-knowledge §Retrieval affordance). The boot block names
+        // vault secrets; this is the hardened read path it points at (value →
+        // stdout for piping, names/diagnostics → stderr, never echoed). Without
+        // it, "a secret named here is in your vault" is aspirational.
+        try {
+            const secretGetContent = this.loadRelayTemplate('secret-get.mjs');
+            if (secretGetContent) {
+                fs.writeFileSync(path.join(instarScriptsDir, 'secret-get.mjs'), secretGetContent, { mode: 0o755 });
+                result.upgraded.push('scripts/secret-get.mjs (hardened vault retrieval)');
+            }
+        }
+        catch (err) {
+            result.errors.push(`secret-get.mjs: ${err instanceof Error ? err.message : String(err)}`);
+        }
         // Session-clock injector — always overwrite. New, non-customizable shared
         // routine (docs/specs/ROBUST-SESSION-TIME-AWARENESS-SPEC.md Component 2):
         // renders the SESSION CLOCK line (render mode for the autonomous-stop-hook,
@@ -5811,6 +5849,37 @@ except Exception:
   fi
 fi
 
+# SESSION BOOT SELF-KNOWLEDGE injection (spec: session-boot-self-knowledge.md).
+# Fetches /self-knowledge/session-context and injects the deterministic "what I
+# already have" block: vault secret NAMES (never values) + self-asserted
+# operational facts — so the agent never re-asks the user for a secret it
+# already holds and never claims ignorance of a channel it owns. Placed AFTER
+# the org-intent + preferences blocks (authoritative contract first — this is
+# background signal; the server wraps it in a <session-self-knowledge
+# src='boot'> envelope). Fail-open: 503 (dark / disabled) / 404 (version skew:
+# old server) / unreachable / empty -> silent skip; curl -sf is what makes a
+# non-2xx emit nothing, and the Bearer token travels ONLY in the header.
+if [ -n "\$PORT" ] && [ -n "\$TOKEN" ]; then
+  BOOT_SK_RESPONSE=\$(curl -sf --max-time 4 --connect-timeout 1 -H "Authorization: Bearer \$TOKEN" \\
+    "http://localhost:\${PORT}/self-knowledge/session-context" 2>/dev/null)
+  if [ -n "\$BOOT_SK_RESPONSE" ]; then
+    BOOT_SK_BLOCK=\$(echo "\$BOOT_SK_RESPONSE" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    if d.get('present') and d.get('block'):
+        print(d['block'])
+except Exception:
+    pass
+" 2>/dev/null)
+    if [ -n "\$BOOT_SK_BLOCK" ]; then
+      echo ""
+      echo "\$BOOT_SK_BLOCK"
+      echo ""
+    fi
+  fi
+fi
+
 # BEGIN integrated-being-v2
 # INTEGRATED-BEING V2 — session-write binding (see docs/specs/integrated-being-ledger-v2.md §3)
 # Generates a session UUID, registers with /shared-state/session-bind, writes the
@@ -6851,6 +6920,41 @@ except Exception:
   fi
 fi
 
+# SESSION BOOT SELF-KNOWLEDGE re-injection (spec: session-boot-self-knowledge.md).
+# A days-long session compacts; the boot block injected at session start only
+# survives if the compaction summary happens to carry it — willpower, not
+# structure. Re-fetching here makes the block durable across compaction AND
+# fresher than the original: a secret stored mid-session appears in the
+# post-compaction context. Same fail-open contract as the boot fetch: dark /
+# unreachable / version-skew -> silent skip, header-only Bearer.
+if [ -f "$INSTAR_DIR/config.json" ]; then
+  BOOT_SK_PORT=\${PORT:-\$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$INSTAR_DIR/config.json" | head -1 | grep -oE '[0-9]+' | head -1)}
+  BOOT_SK_TOKEN="\${INSTAR_AUTH_TOKEN:-}"
+  if [ -z "\$BOOT_SK_TOKEN" ]; then
+    BOOT_SK_TOKEN=\$(python3 -c "import json; v=json.load(open('$INSTAR_DIR/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+  fi
+  if [ -n "\$BOOT_SK_PORT" ] && [ -n "\$BOOT_SK_TOKEN" ]; then
+    BOOT_SK_RESPONSE=\$(curl -sf --max-time 4 --connect-timeout 1 -H "Authorization: Bearer \$BOOT_SK_TOKEN" \
+      "http://localhost:\${BOOT_SK_PORT}/self-knowledge/session-context" 2>/dev/null)
+    if [ -n "\$BOOT_SK_RESPONSE" ]; then
+      BOOT_SK_BLOCK=\$(echo "\$BOOT_SK_RESPONSE" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    if d.get('present') and d.get('block'):
+        print(d['block'])
+except Exception:
+    pass
+" 2>/dev/null)
+      if [ -n "\$BOOT_SK_BLOCK" ]; then
+        echo ""
+        echo "\$BOOT_SK_BLOCK"
+        echo ""
+      fi
+    fi
+  fi
+fi
+
 echo "=== END IDENTITY RECOVERY ==="
 `;
     }