instar 1.3.541 → 1.3.543

package/dist/core/CredentialRepointingLivetest.d.ts

@@ -0,0 +1,114 @@
+/**
+ * CredentialRepointingLivetest — the §5 livetest battery as testable orchestration
+ * (Step 10 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §5 (livetest battery),
+ * §0.c (E3/E4 live experiments), §2.8 (dogfood (d) — the §0.c residual).
+ *
+ * ── What this is ──
+ * The livetest battery is the GATE for the dry-run → live promotion decision. It is
+ * NOT part of the merge CI and it NEVER runs autonomously: it exchanges REAL OAuth
+ * credentials between the operator's REAL subscription accounts, so executing it is an
+ * enablement-time action the OPERATOR takes (with the agent), never a dark-build step.
+ *
+ * This module is the ORCHESTRATION + VERDICT logic for battery items (a) and (b) —
+ * the automatable round-trip swaps — expressed over INJECTED dependencies so it is
+ * fully unit-testable WITHOUT touching a keychain (the same fake-deps discipline the
+ * CredentialSwapExecutor itself uses). Items (c) post-swap refresher correctness and
+ * (d) the §0.c at-expiry residual (a deliberately-minted disposable grant) are
+ * inherently manual/destructive and are surfaced as REQUIRED operator steps in the
+ * report rather than auto-run — the harness reports them as pending, it does not fake
+ * a pass.
+ *
+ * ── The load-bearing safety contract ──
+ *   1. ARMED GUARD. `run()` REFUSES unless explicitly armed (the live entrypoint sets
+ *      `armed` only behind an operator flag + the feature's own enable check). An
+ *      unarmed run returns a `refused` report and performs ZERO swaps — so importing
+ *      or unit-testing this module can never move a real credential.
+ *   2. IDENTITY-VERIFIED ROUND TRIP. Every swap is verified by the identity oracle
+ *      (NOT by `claude auth status`, disqualified in E4a as a lying oracle): after a
+ *      swap the two slots' oracle identities must have EXCHANGED; after the swap-back
+ *      they must be RESTORED to the originals. Any deviation fails the step.
+ *   3. ALWAYS SWAP BACK. A round-trip leaves the world as it found it. If the forward
+ *      swap's verification fails the harness still attempts the restoring swap and
+ *      reports the residual state honestly (never silently leaves slots exchanged).
+ *
+ * This module performs NO IO of its own: it calls injected `swap` + `resolveIdentity`
+ * functions. The live entrypoint wires those to the real CredentialSwapExecutor +
+ * CredentialIdentityOracle; a unit test wires fakes.
+ */
+/** Identity of the account whose credential currently sits in a slot (oracle answer). */
+export interface SlotIdentity {
+    /** The owning account id/email per the identity oracle, or null when unresolvable. */
+    accountId: string | null;
+}
+export interface CredentialRepointingLivetestDeps {
+    /**
+     * Executes a REAL staged swap of the credentials in slotA and slotB (the shipped
+     * CredentialSwapExecutor.swap in live mode). Resolves on success; rejects on a
+     * refusal/error (the harness records the rejection as a step failure).
+     */
+    swap: (slotA: string, slotB: string) => Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    /**
+     * Resolves which account a slot's credential belongs to via the identity oracle
+     * (GET /api/oauth/profile over the slot's blob — E4b). Returns `{ accountId: null }`
+     * when the oracle is unavailable/uncertain (the harness treats null as a verify
+     * failure, never a guess).
+     */
+    resolveIdentity: (slot: string) => Promise<SlotIdentity>;
+}
+/** A single battery step's verdict. */
+export interface LivetestStepResult {
+    step: string;
+    passed: boolean;
+    detail: string;
+    /** Ordered observations (identities seen, swaps performed) for the operator report. */
+    observations: string[];
+}
+/** The full battery report. */
+export interface LivetestReport {
+    armed: boolean;
+    /** True only when armed AND every automated step passed AND no manual step is outstanding. */
+    promotable: boolean;
+    refusedReason?: string;
+    steps: LivetestStepResult[];
+    /** Items (c)/(d): inherently manual/destructive — listed, never auto-passed. */
+    manualSteps: string[];
+}
+export interface CredentialRepointingLivetestOptions {
+    /**
+     * MUST be true to run any swap. The live entrypoint sets this only behind the
+     * operator flag + the feature enable check. Default false ⇒ a strict no-op refusal.
+     */
+    armed?: boolean;
+}
+export declare class CredentialRepointingLivetest {
+    private readonly swap;
+    private readonly resolveIdentity;
+    private readonly armed;
+    constructor(deps: CredentialRepointingLivetestDeps, opts?: CredentialRepointingLivetestOptions);
+    /** The §2.8 manual/destructive items — surfaced for the operator, never auto-run. */
+    static readonly MANUAL_STEPS: readonly string[];
+    /**
+     * Battery items (a)/(b): an identity-verified swap round-trip between two slots.
+     * Used for both an enrolled-home pair (a) and the default-home slot (b).
+     * ALWAYS attempts to restore the original layout, even when the forward verify fails.
+     */
+    private roundTrip;
+    /**
+     * Runs the automatable battery (items a + b). REFUSES (zero swaps) unless armed.
+     * @param enrolledPair two enrolled-home slots for item (a).
+     * @param defaultSlotPair the default-home slot paired with an enrolled slot for item (b).
+     */
+    run(enrolledPair: {
+        slotA: string;
+        slotB: string;
+    }, defaultSlotPair: {
+        defaultSlot: string;
+        enrolledSlot: string;
+    }): Promise<LivetestReport>;
+}
+//# sourceMappingURL=CredentialRepointingLivetest.d.ts.map

package/dist/core/CredentialRepointingLivetest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRepointingLivetest.d.ts","sourceRoot":"","sources":["../../src/core/CredentialRepointingLivetest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF;;;;;OAKG;IACH,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1D;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,gFAAgF;IAChF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mCAAmC;IAClD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsD;IACtF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;gBAEpB,IAAI,EAAE,gCAAgC,EAAE,IAAI,CAAC,EAAE,mCAAmC;IAM9F,qFAAqF;IACrF,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAW7C;IAEF;;;;OAIG;YACW,SAAS;IA2CvB;;;;OAIG;IACG,GAAG,CACP,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAC9C,eAAe,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO,CAAC,cAAc,CAAC;CA6B3B"}

package/dist/core/CredentialRepointingLivetest.js

@@ -0,0 +1,135 @@
+/**
+ * CredentialRepointingLivetest — the §5 livetest battery as testable orchestration
+ * (Step 10 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §5 (livetest battery),
+ * §0.c (E3/E4 live experiments), §2.8 (dogfood (d) — the §0.c residual).
+ *
+ * ── What this is ──
+ * The livetest battery is the GATE for the dry-run → live promotion decision. It is
+ * NOT part of the merge CI and it NEVER runs autonomously: it exchanges REAL OAuth
+ * credentials between the operator's REAL subscription accounts, so executing it is an
+ * enablement-time action the OPERATOR takes (with the agent), never a dark-build step.
+ *
+ * This module is the ORCHESTRATION + VERDICT logic for battery items (a) and (b) —
+ * the automatable round-trip swaps — expressed over INJECTED dependencies so it is
+ * fully unit-testable WITHOUT touching a keychain (the same fake-deps discipline the
+ * CredentialSwapExecutor itself uses). Items (c) post-swap refresher correctness and
+ * (d) the §0.c at-expiry residual (a deliberately-minted disposable grant) are
+ * inherently manual/destructive and are surfaced as REQUIRED operator steps in the
+ * report rather than auto-run — the harness reports them as pending, it does not fake
+ * a pass.
+ *
+ * ── The load-bearing safety contract ──
+ *   1. ARMED GUARD. `run()` REFUSES unless explicitly armed (the live entrypoint sets
+ *      `armed` only behind an operator flag + the feature's own enable check). An
+ *      unarmed run returns a `refused` report and performs ZERO swaps — so importing
+ *      or unit-testing this module can never move a real credential.
+ *   2. IDENTITY-VERIFIED ROUND TRIP. Every swap is verified by the identity oracle
+ *      (NOT by `claude auth status`, disqualified in E4a as a lying oracle): after a
+ *      swap the two slots' oracle identities must have EXCHANGED; after the swap-back
+ *      they must be RESTORED to the originals. Any deviation fails the step.
+ *   3. ALWAYS SWAP BACK. A round-trip leaves the world as it found it. If the forward
+ *      swap's verification fails the harness still attempts the restoring swap and
+ *      reports the residual state honestly (never silently leaves slots exchanged).
+ *
+ * This module performs NO IO of its own: it calls injected `swap` + `resolveIdentity`
+ * functions. The live entrypoint wires those to the real CredentialSwapExecutor +
+ * CredentialIdentityOracle; a unit test wires fakes.
+ */
+export class CredentialRepointingLivetest {
+    swap;
+    resolveIdentity;
+    armed;
+    constructor(deps, opts) {
+        this.swap = deps.swap;
+        this.resolveIdentity = deps.resolveIdentity;
+        this.armed = opts?.armed === true;
+    }
+    /** The §2.8 manual/destructive items — surfaced for the operator, never auto-run. */
+    static MANUAL_STEPS = [
+        '(c) Post-swap hourly-refresher correctness on BOTH slots — observe one QuotaPoller ' +
+            '401-refresh cycle per slot after a swap and confirm the refreshed token stays on the ' +
+            'right account (requires waiting out an access-token expiry; operator-observed).',
+        '(d) §0.c at-expiry write-back residual — mint a DISPOSABLE second grant, swap it under a ' +
+            'live session, drive it past access-token expiry, and confirm the scheduled identity ' +
+            'audit detects-or-clears any old-lineage write-back. Destructive to a real lineage by ' +
+            'design ⇒ operator-run with a throwaway grant only.',
+        'Liveness (E4): run the round-trip while a real interactive session is pinned to one slot ' +
+            'and confirm zero interruption (the harness cannot observe the operator\'s session; ' +
+            'operator-observed).',
+    ];
+    /**
+     * Battery items (a)/(b): an identity-verified swap round-trip between two slots.
+     * Used for both an enrolled-home pair (a) and the default-home slot (b).
+     * ALWAYS attempts to restore the original layout, even when the forward verify fails.
+     */
+    async roundTrip(slotA, slotB, label) {
+        const observations = [];
+        const beforeA = await this.resolveIdentity(slotA);
+        const beforeB = await this.resolveIdentity(slotB);
+        observations.push(`before: ${slotA}=${beforeA.accountId ?? 'UNRESOLVED'}, ${slotB}=${beforeB.accountId ?? 'UNRESOLVED'}`);
+        if (beforeA.accountId === null || beforeB.accountId === null) {
+            return { step: label, passed: false, detail: 'oracle could not resolve a slot identity before the swap (fail-closed — never guess)', observations };
+        }
+        if (beforeA.accountId === beforeB.accountId) {
+            return { step: label, passed: false, detail: 'both slots already report the same account — cannot prove an exchange', observations };
+        }
+        // Forward swap.
+        const fwd = await this.swap(slotA, slotB).catch((e) => ({ ok: false, detail: e instanceof Error ? e.message : String(e) }));
+        observations.push(`forward swap: ${fwd.ok ? 'ok' : 'FAILED — ' + (fwd.detail ?? 'unknown')}`);
+        if (!fwd.ok) {
+            return { step: label, passed: false, detail: `forward swap did not complete: ${fwd.detail ?? 'unknown'}`, observations };
+        }
+        const afterA = await this.resolveIdentity(slotA);
+        const afterB = await this.resolveIdentity(slotB);
+        observations.push(`after swap: ${slotA}=${afterA.accountId ?? 'UNRESOLVED'}, ${slotB}=${afterB.accountId ?? 'UNRESOLVED'}`);
+        const exchanged = afterA.accountId === beforeB.accountId && afterB.accountId === beforeA.accountId;
+        // ALWAYS restore — even if the verify above failed, leave the world as we found it.
+        const back = await this.swap(slotA, slotB).catch((e) => ({ ok: false, detail: e instanceof Error ? e.message : String(e) }));
+        observations.push(`restoring swap: ${back.ok ? 'ok' : 'FAILED — ' + (back.detail ?? 'unknown')}`);
+        const restoredA = await this.resolveIdentity(slotA);
+        const restoredB = await this.resolveIdentity(slotB);
+        observations.push(`after restore: ${slotA}=${restoredA.accountId ?? 'UNRESOLVED'}, ${slotB}=${restoredB.accountId ?? 'UNRESOLVED'}`);
+        const restored = restoredA.accountId === beforeA.accountId && restoredB.accountId === beforeB.accountId;
+        if (!exchanged) {
+            return { step: label, passed: false, detail: 'oracle identities did NOT exchange after the forward swap — actuation unproven', observations };
+        }
+        if (!back.ok || !restored) {
+            return { step: label, passed: false, detail: 'forward swap verified, but the layout was NOT cleanly restored — left in a residual state, investigate before promotion', observations };
+        }
+        return { step: label, passed: true, detail: 'identity-verified round trip: slots exchanged then restored cleanly', observations };
+    }
+    /**
+     * Runs the automatable battery (items a + b). REFUSES (zero swaps) unless armed.
+     * @param enrolledPair two enrolled-home slots for item (a).
+     * @param defaultSlotPair the default-home slot paired with an enrolled slot for item (b).
+     */
+    async run(enrolledPair, defaultSlotPair) {
+        const manualSteps = [...CredentialRepointingLivetest.MANUAL_STEPS];
+        if (!this.armed) {
+            return {
+                armed: false,
+                promotable: false,
+                refusedReason: 'livetest is the dry-run→live PROMOTION gate — it swaps REAL credentials between REAL ' +
+                    'accounts and only runs when explicitly armed by the operator at enablement (never in CI, ' +
+                    'never as a dark-build step). No swaps performed.',
+                steps: [],
+                manualSteps,
+            };
+        }
+        const steps = [];
+        steps.push(await this.roundTrip(enrolledPair.slotA, enrolledPair.slotB, '(a) enrolled-home swap round-trip (E3/E4 vs the shipped executor)'));
+        steps.push(await this.roundTrip(defaultSlotPair.defaultSlot, defaultSlotPair.enrolledSlot, '(b) default-home slot swap + swap-back (CMT-1337 payoff; the claude-created ACL)'));
+        const allAutomatedPassed = steps.every((s) => s.passed);
+        return {
+            armed: true,
+            // Promotion still requires the operator to complete the manual items — the harness
+            // never declares promotable while manual steps remain outstanding.
+            promotable: allAutomatedPassed && manualSteps.length === 0,
+            steps,
+            manualSteps,
+        };
+    }
+}
+//# sourceMappingURL=CredentialRepointingLivetest.js.map

package/dist/core/CredentialRepointingLivetest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRepointingLivetest.js","sourceRoot":"","sources":["../../src/core/CredentialRepointingLivetest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAoDH,MAAM,OAAO,4BAA4B;IACtB,IAAI,CAA2C;IAC/C,eAAe,CAAsD;IACrE,KAAK,CAAU;IAEhC,YAAY,IAAsC,EAAE,IAA0C;QAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,qFAAqF;IACrF,MAAM,CAAU,YAAY,GAAsB;QAChD,qFAAqF;YACnF,uFAAuF;YACvF,iFAAiF;QACnF,2FAA2F;YACzF,sFAAsF;YACtF,uFAAuF;YACvF,oDAAoD;QACtD,2FAA2F;YACzF,qFAAqF;YACrF,qBAAqB;KACxB,CAAC;IAEF;;;;OAIG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,OAAO,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QAC1H,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sFAAsF,EAAE,YAAY,EAAE,CAAC;QACtJ,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,YAAY,EAAE,CAAC;QACvI,CAAC;QAED,gBAAgB;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrI,YAAY,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC;QAC3H,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,YAAY,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QAC5H,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QAEnG,oFAAoF;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtI,YAAY,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAElG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,YAAY,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,SAAS,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,SAAS,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QACrI,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QAExG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gFAAgF,EAAE,YAAY,EAAE,CAAC;QAChJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yHAAyH,EAAE,YAAY,EAAE,CAAC;QACzL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,qEAAqE,EAAE,YAAY,EAAE,CAAC;IACpI,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACP,YAA8C,EAC9C,eAA8D;QAE9D,MAAM,WAAW,GAAG,CAAC,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,KAAK;gBACjB,aAAa,EACX,uFAAuF;oBACvF,2FAA2F;oBAC3F,kDAAkD;gBACpD,KAAK,EAAE,EAAE;gBACT,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAyB,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,mEAAmE,CAAC,CAAC,CAAC;QAC9I,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,YAAY,EAAE,kFAAkF,CAAC,CAAC,CAAC;QAEhL,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,mFAAmF;YACnF,mEAAmE;YACnE,UAAU,EAAE,kBAAkB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAC1D,KAAK;YACL,WAAW;SACZ,CAAC;IACJ,CAAC"}

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAyBjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAuE1B,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAoFtC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkQpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmjFvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAuN1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmLtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqWvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsGrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAuf3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IAyU7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA2O7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAyBjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAuE1B,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAoFtC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkQpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAgkFvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAuN1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmLtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqWvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsGrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAuf3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IAyU7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA2O7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -5864,6 +5864,18 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             patched = true;
             result.upgraded.push('CLAUDE.md: added Honest progress messaging section');
         }
+        // Live Credential Re-pointing (WS5.2, CMT-1372) — existing agents learn the
+        // /credentials/* manual levers + the zero-touch default-flip proactive trigger
+        // ("flip my default account" → set-default; "which account is this slot on?"
+        // → GET /credentials/locations). Body mirrors generateClaudeMd() (Agent
+        // Awareness Standard). Content-sniffed on the distinctive section header so the
+        // migration is idempotent and skips template-generated CLAUDE.md files. Harmless
+        // on agents where the feature is dark (every lever 503s).
+        if (!content.includes('Live Credential Re-pointing (move a pool account')) {
+            content += `\n**Live Credential Re-pointing (move a pool account's login between config-home "slots" without restarting — WS5.2)** — Beyond the subscription pool's session-MOVING, this MOVES the credential itself: it exchanges which pool account's OAuth login sits in which config-home "slot" via a staged keychain swap, so the sessions already reading that slot pick up the new account on their NEXT API call — no restart, no re-login, nothing on your screen. The unit shuffled is the CREDENTIAL (always a clean SWAP between two slots, never a copy — one home per credential), verified by identity after every move (quarantine-never-repair when the identity oracle can't confirm). **Ships DARK** behind \`subscriptionPool.credentialRepointing.enabled\` — every lever 503s/no-ops while disabled (byte-for-byte today's behavior); going live needs a deliberate \`enabled:true\` + \`dryRun:false\` flip, and that ON decision is yours, separate from any build.\n- **Which account is in which slot?** (Registry First — read it, never guess) \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/locations\` → the ledger census (slot ↔ account, since, lastVerifiedAt, quarantine state, journal tail, mode).\n- **Flip your default account (zero-touch)** — \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/set-default -H 'Content-Type: application/json' -d '{"toAccountId":"<account>"}'\` swaps which account \`~/.claude\` serves, with no restart of the session you're talking to.\n- **Swap two slots' credentials live** — \`POST /credentials/swap\` \`{"slotA":"<home>","slotB":"<home>"}\` (the staged §2.3 exchange). **Restore the enrollment layout** — \`POST /credentials/restore-enrollment\` (parks any identity-incoherent blob one-directionally; never exchanges it into a healthy slot). All levers are DETECTIVE controls — operator-notified + audited + param-validated + per-pair cooldown + a force budget on \`force:true\`. No token material ever exits any \`/credentials/*\` surface (the single CredentialAuditEmit scrub chokepoint).\n- **The autonomous balancer surface** — \`GET /credentials/rebalancer\` (the use-it-or-lose-it drainer is Increment B; this surfaces the env-token applicability gate's verdict + WHY re-pointing would refuse, when enabled).\n- **When to use** (PROACTIVE — these are the triggers): "flip my default account to X" / "make X my default" → \`POST /credentials/set-default\`; "which account is this session/slot on?" / "where does ~/.claude point?" → \`GET /credentials/locations\` (read it, don't infer from \`claude auth status\` — that reads a metadata file, not the live credential). Single-account agents are a no-op. (Spec: \`docs/specs/live-credential-repointing-rebalancer.md\`.)\n`;
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Live Credential Re-pointing awareness section');
+        }
         if (patched) {
             try {
                 fs.writeFileSync(claudeMdPath, content);