run402 4.25.0 → 4.26.0

package/lib/gitvault.mjs

@@ -18,6 +18,7 @@
  */
 import { readFileSync } from "node:fs";
 import { resolveProjectId } from "./config.mjs";
+import { resolveOwningOrgId } from "./org-context.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -36,18 +37,34 @@ const COMMON_VALUE_FLAGS = ["--project", "--repo"];
 export const HELP = `run402 gitvault — your source, encrypted before it leaves the machine
 
 Usage:
-  run402 gitvault status  [--project <id>] [--repo <repo_id>]
+  run402 gitvault init    [--project <id>] [--org <org_id>] [--git-remote] [--no-remote]
+  run402 gitvault status  [--project <id>] [--repo <repo_id>] [--refs]
   run402 gitvault push    [--project <id>] [--repo <repo_id>] [--message <text>] [--checkpoint]
+  run402 gitvault policy  <required|grandfathered> [--project <id>] [--repo <repo_id>]
+                          [--reason <why>]
   run402 gitvault compact [--project <id>] [--repo <repo_id>]
   run402 gitvault prune   [--project <id>] [--repo <repo_id>]
                           [--submit --intent-core <path> --verifier-receipt <path> [--wait]]
   run402 gitvault verify  [--project <id>] [--repo <repo_id>] [--budget <n>]
 
 Subcommands:
+  init      ALLOCATE the project's vault. This is the one step that mints key
+            material on this machine and emits the one-shot recovery receipt,
+            so it is explicit rather than a side effect of \`run402 init\` (which
+            only adds the git remote). Idempotent: an existing vault is
+            reported with \`deduplicated: true\` and nothing is re-minted. Adds
+            the \`run402\` remote too when the current directory is already a
+            repository.
   status    What this machine and the control plane each believe about the
             vault: allocation, policy, whether this keystore can sign, the
-            authenticated and materialized pins, and any pending
-            unvaulted-override journals. Never reports key material.
+            authenticated and materialized pins, any pending
+            unvaulted-override journals, and where the keystore lives. Never
+            reports key material.
+  policy    Set the activation policy — \`required\` (a deploy must present a
+            vaulted capture) or \`grandfathered\` (it need not). Owner + step-up,
+            audited. \`grandfathered\` is the documented way out of a deploy
+            blocked by GITVAULT_CLIENT_UPGRADE_REQUIRED, and leaves a
+            doctor-persistent warning until the project returns to \`required\`.
   push      Capture the working tree and publish it. This is NOT gated on a
             deploy — a vault-only project pushes for months without one.
             Before reporting a push as landed the SDK compares finalization
@@ -64,6 +81,21 @@ Subcommands:
 
 Options:
   --project <id>    Project whose vault to act on (defaults to the active project)
+  --org <org_id>    init: the owning organization (resolved from the project
+                    when omitted)
+  --git-remote      init: 'git init' the current directory when it is not a
+                    repository yet, so the run402 remote can be added there.
+                    Opt-in: creating a repository where you did not ask for one
+                    is a bad surprise, so without it a non-repository directory
+                    allocates the vault and adds no remote.
+  --no-remote       init: allocate the vault only; touch no git configuration
+  --reason <why>    policy: why the policy is changing — recorded in the audit
+                    event. REQUIRED for \`grandfathered\`, which is a deliberate
+                    weakening of the activation guarantee.
+  --refs            status: also materialize and report the vault's ref map and
+                    HEAD target. This is a VERIFICATION (it walks the head
+                    chain and advances the local materialized pin), which is
+                    why plain \`status\` — an observation — does not do it.
   --repo <repo_id>  Address the vault directly by id, skipping project lookup
   --message <text>  push: commit message for the synthetic commit a dirty tree
                     produces (a clean tree pushes HEAD itself, no message used)
@@ -111,8 +143,10 @@ Terminal loss (protocol §0):
   stderr and carries it in its JSON — read it before you rely on this.
 
 Examples:
-  run402 gitvault status
+  run402 gitvault init
+  run402 gitvault status --refs
   run402 gitvault push --message "wip: refactor the parser"
+  run402 gitvault policy grandfathered --reason "migrating CI to a vaulted client"
   run402 gitvault verify --budget 500
   run402 gitvault prune --project prj_1a2b3c
 `;
@@ -143,24 +177,194 @@ function vaultTarget(a) {
  * NORMATIVE COPY, printed verbatim straight from the SDK's own constants and
  * never paraphrased, summarized, or reassembled here. Both lines also ride in
  * the JSON payload on stdout.
+ *
+ * The PATH is printed with it. "Whole-keystore loss is terminal" appeared three
+ * times across this surface while the directory to back up appeared nowhere
+ * (dogfood #1, finding D2) — a warning nobody can act on.
  */
 function printTerminalLoss(status) {
   console.error("");
   console.error(status.terminal_loss_statement);
   console.error(status.terminal_loss_detail);
+  console.error(`Back up this directory: ${status.keystore.root}`);
   console.error("");
 }
 
+/** Where the keystore lives — for verbs whose payload is not a `status`. */
+async function printKeystoreLocation() {
+  try {
+    const { getGitvaultKeystoreRoot } = await import("#sdk/node");
+    console.error(`keystore: ${getGitvaultKeystoreRoot()} — back this up; whole-keystore loss is terminal for vault history`);
+  } catch {
+    // Never let a diagnostic line fail a command that already succeeded.
+  }
+}
+
+/**
+ * `run402 gitvault init` — allocate the project's vault.
+ *
+ * WHY THIS EXISTS AS ITS OWN VERB (dogfood #1, finding A). Until it did, the
+ * only way to allocate was `sdk.gitvault.init()` through the vendored SDK:
+ * `gitvault status` pointed at `run402 init`, which scaffolds the remote and
+ * says so in a comment; `gitvault push` and `git push run402` both 404'd and
+ * handed the user a raw `POST /gitvault/v1/vaults`. A published CLI that can
+ * do everything except start is not a usable product.
+ *
+ * It stays SEPARATE from `run402 init` on purpose: this is the step that mints
+ * key material on this machine and emits a one-shot recovery receipt, and
+ * whole-keystore loss is terminal for vault history. That belongs to a command
+ * the user typed, not to a setup command's side effects.
+ */
+async function init(args) {
+  const a = normalizeArgv(args);
+  const valueFlags = ["--project", "--org"];
+  assertKnownFlags(a, [...valueFlags, "--git-remote", "--no-remote", "--help", "-h"], valueFlags);
+  requirePositionalCount(a, valueFlags, {
+    min: 0, max: 0, command: "run402 gitvault init", missing: "",
+  });
+  if (a.includes("--git-remote") && a.includes("--no-remote")) {
+    fail({
+      code: "BAD_USAGE",
+      message: "--git-remote and --no-remote contradict each other.",
+      hint: "--git-remote creates a repository to add the remote to; --no-remote touches no git configuration at all.",
+    });
+  }
+  const projectId = resolveProjectId(flagValue(a, "--project"));
+  const orgId = flagValue(a, "--org") ?? await resolveOwningOrgId(projectId);
+  if (!orgId) {
+    fail({
+      code: "ORG_UNRESOLVED",
+      message: `Could not resolve the organization that owns ${projectId}.`,
+      hint: "Pass --org <org_id>, or check that this wallet can see the project (`run402 projects list`).",
+      details: { project_id: projectId },
+    });
+  }
+
+  // Whether to touch git at all. Mirrors `run402 init`: adding a remote inside
+  // an EXISTING repository is pure addition and is the default; CREATING a
+  // repository is opt-in, because a vault can be allocated from anywhere and
+  // `git init`-ing whatever directory you happened to be in is a bad surprise.
+  let scaffold = !a.includes("--no-remote");
+  let remoteSkipped = null;
+  if (scaffold && !a.includes("--git-remote")) {
+    const { hardenedGit } = await import("#sdk/node");
+    try {
+      await hardenedGit(process.cwd(), ["rev-parse", "--git-dir"]);
+    } catch {
+      scaffold = false;
+      remoteSkipped = "not a git repository — the vault was allocated; re-run with --git-remote to create one and add the remote";
+    }
+  }
+
+  try {
+    const result = await getSdk().gitvault.init({
+      org_id: orgId,
+      project_id: projectId,
+      ...(scaffold ? { repo_dir: process.cwd() } : { scaffold_git: false }),
+    });
+    console.log(JSON.stringify(remoteSkipped ? { ...result, remote_skipped: remoteSkipped } : result, null, 2));
+    console.error(
+      result.deduplicated
+        ? `vault ${result.repo_id} already existed — nothing was re-allocated and no new key material was minted`
+        : `allocated vault ${result.repo_id} (genesis ${result.genesis_sha256})`,
+    );
+    if (result.remote) console.error(`remote '${result.remote.name}' -> ${result.remote.url}`);
+    if (remoteSkipped) console.error(`remote not added: ${remoteSkipped}`);
+    // The recovery receipt is integrity data, not a secret, and it is worth
+    // exactly as much as the number of copies you keep. It is persisted into
+    // the keystore automatically; say where, because "keep many copies" is
+    // advice nobody can act on without a path.
+    console.error("");
+    console.error(result.terminal_loss_statement);
+    await printKeystoreLocation();
+    console.error("");
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+/**
+ * `run402 gitvault policy <required|grandfathered>` — the activation gate.
+ *
+ * The gateway's own `GITVAULT_CLIENT_UPGRADE_REQUIRED` envelope names
+ * `run402 gitvault policy grandfathered --reason <why>` as the second way out
+ * of a blocked deploy. Until this verb existed, running exactly what the
+ * platform told you to run returned UNKNOWN_SUBCOMMAND, so a user could
+ * allocate themselves into a blocked-deploy state with no way back.
+ */
+async function policy(args) {
+  const a = normalizeArgv(args);
+  const valueFlags = [...COMMON_VALUE_FLAGS, "--reason"];
+  assertKnownFlags(a, [...valueFlags, "--help", "-h"], valueFlags);
+  const [requested] = requirePositionalCount(a, valueFlags, {
+    min: 1, max: 1, command: "run402 gitvault policy <required|grandfathered>",
+    missing: "Missing <policy>. Expected `required` or `grandfathered`.",
+  });
+  if (requested !== "required" && requested !== "grandfathered") {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unknown policy: ${requested}.`,
+      hint: "Expected `required` (a deploy must present a vaulted capture) or `grandfathered` (it need not).",
+      details: { policy: requested, known_policies: ["required", "grandfathered"] },
+    });
+  }
+  const reason = flagValue(a, "--reason");
+  // Required only for the weakening direction. Returning to `required` is
+  // restoring the default and needs no justification; leaving it does.
+  if (requested === "grandfathered" && (reason == null || reason.trim() === "")) {
+    fail({
+      code: "BAD_USAGE",
+      message: "`grandfathered` needs --reason <why>.",
+      hint: "It weakens the activation guarantee for this project and is recorded in the audit event. Say why, e.g. --reason \"migrating CI to a vaulted client\".",
+      details: { policy: requested },
+    });
+  }
+
+  const target = vaultTarget(a);
+  try {
+    const sdk = getSdk();
+    const repoId = target.repo_id ?? (await sdk.gitvault.forProject(target.project_id)).repo_id;
+    const result = await sdk.gitvault.setPolicy(repoId, {
+      gitvault_policy: requested,
+      ...(reason != null ? { reason } : {}),
+    });
+    console.log(JSON.stringify({ repo_id: repoId, ...result }, null, 2));
+    console.error(
+      result.changed
+        ? `gitvault_policy is now ${result.gitvault_policy} (version ${result.gitvault_policy_version})`
+        : `gitvault_policy was already ${result.gitvault_policy} — nothing changed`,
+    );
+    for (const w of result.warnings ?? []) console.error(`warning (${w.kind}): ${w.message}`);
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 async function status(args) {
   const a = normalizeArgv(args);
-  assertKnownFlags(a, [...COMMON_VALUE_FLAGS, "--help", "-h"], COMMON_VALUE_FLAGS);
+  assertKnownFlags(a, [...COMMON_VALUE_FLAGS, "--refs", "--help", "-h"], COMMON_VALUE_FLAGS);
   requirePositionalCount(a, COMMON_VALUE_FLAGS, {
     min: 0, max: 0, command: "run402 gitvault status", missing: "",
   });
+  const target = vaultTarget(a);
+  if (a.includes("--refs")) target.refs = true;
   try {
-    const s = await getSdk().gitvault.status(vaultTarget(a));
+    const s = await getSdk().gitvault.status(target);
     console.log(JSON.stringify(s, null, 2));
     printTerminalLoss(s);
+    // Two facts the user otherwise has to leave the CLI for: which vault this
+    // checkout is wired to, and what the control plane says is in it.
+    if (s.remote) {
+      console.error(`remote '${s.remote.name}': ${s.remote.url}${s.remote.matches ? "" : "  ← points at a DIFFERENT project than this status"}`);
+    }
+    if (s.refs) {
+      const names = Object.keys(s.refs).sort();
+      console.error(names.length === 0 ? "refs: (none yet)" : `refs (${names.length}):`);
+      for (const ref of names) console.error(`  ${s.refs[ref]}  ${ref}`);
+      if (s.head_target) {
+        console.error(s.head_target.kind === "symref" ? `  HEAD -> ${s.head_target.ref}` : `  HEAD ${s.head_target.oid} (detached)`);
+      }
+    }
     // Advisories are echoed EXACTLY as the SDK reported them. Nothing is
     // synthesized here — in particular a project that has never deployed gets
     // no deploy-related warning, because a vault-only project is a first-class
@@ -342,6 +546,14 @@ export async function run(sub, args) {
     process.exit(0);
   }
   switch (sub) {
+    case "init": {
+      await init(argv);
+      break;
+    }
+    case "policy": {
+      await policy(argv);
+      break;
+    }
     case "status": {
       await status(argv);
       break;

package/lib/init.mjs

@@ -1,7 +1,8 @@
-import { readAllowance, saveAllowance, loadKeyStore, configDir, configureApiBase, getActiveProjectId, getProject, updateProject } from "./config.mjs";
+import { readAllowance, saveAllowance, loadKeyStore, configDir, configureApiBase, getActiveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { fail } from "./sdk-errors.mjs";
 import { setTierAction, deployAction } from "./next-actions.mjs";
+import { resolveOwningOrgId } from "./org-context.mjs";
 import { getActiveProfile } from "../core-dist/config.js";
 import { readMeta } from "../core-dist/profiles.js";
 import { mkdirSync } from "fs";
@@ -46,11 +47,18 @@ Options:
 
 Output:
   Stdout is a JSON summary { config_dir, wallet, rail, network, balances,
-  tier, projects_saved, next_step }. Progress lines (Config / Allowance /
-  Balance / Tier / Next) go to stderr so a human re-running interactively
-  sees what's happening while a script piping stdout to jq stays clean.
-  With --git-remote the summary also carries { gitvault } (the scaffolded
-  remote) or { gitvault: null, gitvault_error } when it could not be added.
+  tier, projects_saved, active_project_id, next_step }. Progress lines
+  (Config / Allowance / Balance / Tier / Next) go to stderr so a human
+  re-running interactively sees what's happening while a script piping stdout
+  to jq stays clean. The summary also carries { gitvault } (the scaffolded
+  remote), or { gitvault: null, gitvault_skipped } naming why no remote was
+  added, or { gitvault: null, gitvault_error } when it could not be added.
+  \`projects_saved\` counts projects with LOCAL keys; \`active_project_id\` is the
+  project the gitvault scaffold acted on.
+
+  init scaffolds the git remote only. It does NOT allocate the vault — that is
+  \`run402 gitvault init\`, which mints key material and a recovery receipt and
+  therefore stays an explicit step.
 
 Steps (idempotent when re-run with the same rail; pass --switch-rail to change rails):
   1. Creates config directory (~/.config/run402)
@@ -174,42 +182,28 @@ function errorMessage(err) {
 }
 
 /**
- * The owning org of the locally-active project — from the KEYSTORE first, and
- * only then from the named inventory.
+ * Which project the gitvault scaffold acts on — and why it may act on none.
  *
- * Why the cache exists (task 5.12c): the gitvault scaffold is the one part of
- * `run402 init` the client-surface spec says adds no network dependency to the
- * cold-start path, and resolving the org through `projects.list()` quietly made
- * that untrue. `org_id` is a non-secret routing identifier the control plane
- * already hands back with every listing, so the honest fix is to remember it:
- * the FIRST init on a machine still asks, every RETURNING init reads it locally
- * and the scaffold really is network-free.
+ * The CLI-wide resolution order (`RUN402_PROJECT_ID`, then the active
+ * project), not `getActiveProjectId()` alone. Reading only the active project
+ * meant an agent that had exported `RUN402_PROJECT_ID` — the normal way to
+ * address a project without mutating machine state — got a silent no-op: no
+ * remote, no allocation, and no `gitvault` key in the summary at all, with
+ * nothing anywhere saying `run402 projects use` was a prerequisite
+ * (dogfood #1, finding A). A command that exits 0 having done nothing is worse
+ * than an error, so the no-project case names itself.
  *
- * Best-effort by construction — the caller treats `null` as "do not scaffold" —
- * and an EXACT id match is required: a near-miss must never make init add a
- * remote pointing at somebody else's project. `updateProject` is a no-op for a
- * project this machine holds no credentials for, so such a project asks again
- * next time rather than being silently mis-cached.
+ * Exported so the decision is testable on its own: it is one expression, and
+ * it was wrong in two ways at once.
  */
-async function resolveOwningOrgId(projectId) {
-  const cached = getProject(projectId)?.org_id;
-  if (typeof cached === "string" && cached.length > 0) return cached;
-  try {
-    const listed = await getSdk().projects.list();
-    const rows = Array.isArray(listed?.projects) ? listed.projects : [];
-    const row = rows.find((p) => (p?.id ?? p?.project_id) === projectId);
-    const orgId = row?.org_id;
-    if (typeof orgId !== "string" || orgId.length === 0) return null;
-    try {
-      updateProject(projectId, { org_id: orgId });
-    } catch {
-      // Caching is an optimization; a read-only or contended keystore costs a
-      // round trip next time and must never fail the scaffold.
-    }
-    return orgId;
-  } catch {
-    return null;
-  }
+export function resolveScaffoldProject(env = process.env, activeProjectId = getActiveProjectId()) {
+  const fromEnv = typeof env.RUN402_PROJECT_ID === "string" ? env.RUN402_PROJECT_ID.trim() : "";
+  const projectId = fromEnv || activeProjectId || null;
+  if (projectId) return { projectId, skipped: null };
+  return {
+    projectId: null,
+    skipped: "no project is selected, so there is nothing to point a run402 remote at — run `run402 projects use <project_id>` (or set RUN402_PROJECT_ID), then re-run `run402 init`",
+  };
 }
 
 export async function run(args = []) {
@@ -337,6 +331,8 @@ export async function run(args = []) {
     ...(voucherCode ? { voucher: null } : {}),
     tier: null,
     projects_saved: 0,
+    /** The project init acted on — the input to the gitvault scaffold decision. */
+    active_project_id: null,
     next_actions: [],
     next_step: null,
   };
@@ -547,7 +543,12 @@ export async function run(args = []) {
 
   // 5. Projects — count locally saved project entries. Note: "saved" (not
   // "active") — these are all projects in the keystore, regardless of whether
-  // the server considers them active.
+  // the server considers them active. A project selected with
+  // `run402 projects use` but never provisioned FROM this machine holds no
+  // local keys, so it is legitimately not counted here; `active_project_id`
+  // below is the field that says which project init actually acted on, and
+  // reading `projects_saved: 0` as "init did nothing" is what made the
+  // gitvault skip look silent (dogfood #1, finding A).
   summary.projects_saved = Object.keys(store.projects).length;
   line("Projects", `${summary.projects_saved} saved`);
 
@@ -568,8 +569,13 @@ export async function run(args = []) {
   // NON-FATAL in every branch: a missing git, a directory that is not a
   // repository, an unreachable gateway, or a `run402` remote already pointing
   // somewhere else must warn and let setup finish.
-  const activeProjectId = getActiveProjectId();
-  if (activeProjectId) {
+  const { projectId: activeProjectId, skipped: noProjectSkip } = resolveScaffoldProject();
+  summary.active_project_id = activeProjectId;
+  if (noProjectSkip) {
+    summary.gitvault = null;
+    summary.gitvault_skipped = noProjectSkip;
+    line("Gitvault", "skipped — no project selected (run402 projects use <project_id>)");
+  } else {
     summary.gitvault = null;
     try {
       // Dynamic import: the scaffold is the only thing here that needs the

package/lib/org-context.mjs

@@ -13,7 +13,7 @@
  */
 import { getSdk } from "./sdk.mjs";
 import { flagValue } from "./argparse.mjs";
-import { resolveProjectId } from "./config.mjs";
+import { getProject, resolveProjectId, updateProject } from "./config.mjs";
 
 /** Resolve the addressed organization from normalized argv (one SDK lookup at most). */
 export async function resolveOrgId(a) {
@@ -25,3 +25,46 @@ export async function resolveOrgId(a) {
   const scoped = await getSdk().rooms.forProject(projectId);
   return scoped.orgId;
 }
+
+/**
+ * The organization that OWNS a specific project, or `null`.
+ *
+ * Distinct from {@link resolveOrgId}: that one answers "which org is this
+ * command addressed at" (flag → env → active project); this one answers "who
+ * owns THIS project id", which is what a project-scoped scaffold needs and
+ * where an `--org` override would be a mis-binding, not a convenience.
+ *
+ * WHY IT CACHES (task 5.12c): the gitvault scaffold is the one part of
+ * `run402 init` the client-surface spec says adds no network dependency to the
+ * cold-start path, and resolving the org through `projects.list()` quietly made
+ * that untrue. `org_id` is a non-secret routing identifier the control plane
+ * already hands back with every listing, so the honest fix is to remember it —
+ * the FIRST call on a machine still asks, every returning one reads it locally.
+ *
+ * Cached in the local project entry after the first lookup, and an EXACT id
+ * match is required: a near-miss must never bind a vault or a git remote to
+ * somebody else's project. `updateProject` is a no-op for a project this
+ * machine holds no credentials for, so such a project asks again next time
+ * rather than being silently mis-cached. Returns `null` rather than throwing —
+ * every caller has something better to say than a stack trace.
+ */
+export async function resolveOwningOrgId(projectId) {
+  const cached = getProject(projectId)?.org_id;
+  if (typeof cached === "string" && cached.length > 0) return cached;
+  try {
+    const listed = await getSdk().projects.list();
+    const rows = Array.isArray(listed?.projects) ? listed.projects : [];
+    const row = rows.find((p) => (p?.id ?? p?.project_id) === projectId);
+    const orgId = row?.org_id;
+    if (typeof orgId !== "string" || orgId.length === 0) return null;
+    try {
+      updateProject(projectId, { org_id: orgId });
+    } catch {
+      // Caching is an optimization; a read-only or contended keystore costs a
+      // round trip next time and must never fail the caller.
+    }
+    return orgId;
+  } catch {
+    return null;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.25.0",
+  "version": "4.26.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/gitvault.d.ts

@@ -30,7 +30,7 @@
  */
 import type { Client } from "../kernel.js";
 import { GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT } from "./gitvault.crypto.js";
-import type { GitvaultCaptureReceipt, GitvaultHeadsListingPage, GitvaultHeadsListingRequest } from "./gitvault.types.js";
+import type { GitvaultCaptureReceipt, GitvaultHeadsListingPage, GitvaultHeadsListingRequest, GitvaultHeadTarget } from "./gitvault.types.js";
 import type { GitvaultMaintenanceLease, GitvaultMaintenanceLeaseRequest, GitvaultTransport, GitvaultVaultRecord } from "../node/gitvault-publication.js";
 import type { GitvaultDeployOptions, GitvaultDeployResult } from "../node/gitvault-deploy.js";
 import type { GitvaultPublishResult, GitvaultVerifiedState } from "../node/gitvault-publication.js";
@@ -51,7 +51,45 @@ export interface GitvaultStatus {
         can_sign: boolean;
         /** `true` once this machine holds K_repo for the vault. */
         holds_repo_key: boolean;
+        /**
+         * WHERE the keystore lives, and what is in it.
+         *
+         * Terminal loss is stated three times in this surface; until 5.13 the path
+         * to back up was stated nowhere, which made the warning unactionable. These
+         * are file paths, never contents — nothing here is key material.
+         * `repo` / `recovery_receipt` are `null` until a `repo_id` is known.
+         */
+        root: string;
+        paths: {
+            identity: string;
+            repos: string;
+            receipts: string;
+            journal: string;
+            audit_log: string;
+            repo: string | null;
+            recovery_receipt: string | null;
+        };
     };
+    /**
+     * The `run402` git remote in the local repository, when there is one to read.
+     * `null` when no `repo_dir` was given, the directory is not a repository, or
+     * no such remote is configured. `matches` is false when the remote points at
+     * a DIFFERENT vault than the one this status is about — the case where a
+     * checkout is wired to somebody else's project and nothing says so.
+     */
+    remote: {
+        name: string;
+        url: string;
+        matches: boolean;
+    } | null;
+    /**
+     * The vault's ref map and HEAD target — present only when `refs: true` was
+     * requested. Reading them means MATERIALIZING the chain, which is a
+     * verification and advances the local materialized pin, so plain `status`
+     * (an observation) leaves both `null`.
+     */
+    refs: Record<string, string> | null;
+    head_target: GitvaultHeadTarget | null;
     pins: {
         highest_authenticated: string | null;
         highest_materialized: string | null;
@@ -308,7 +346,17 @@ export declare class Gitvault {
      * deployed raises no deploy-related warning, and the terminal-loss statement
      * is stated verbatim exactly as for any other vault.
      */
-    status(options?: GitvaultVaultHandleOptions): Promise<GitvaultStatus>;
+    status(options?: GitvaultVaultHandleOptions & {
+        /**
+         * Also report the vault's ref map and HEAD target.
+         *
+         * Opt-in because it is not free and not read-only in the local sense:
+         * materializing walks the head chain (a verification) and advances the
+         * keystore's materialized pin. `status` without it stays a pure
+         * observation, which is what makes it safe to run anywhere.
+         */
+        refs?: boolean;
+    }): Promise<GitvaultStatus>;
     /**
      * Capture the working tree and publish it — the push half of a deploy, run on
      * its own. Never gated on a deploy: a vault-only project pushes for months

package/sdk/dist/namespaces/gitvault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,KAAK,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACzH,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAuB,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAyBrE,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,yFAAyF;QACzF,QAAQ,EAAE,OAAO,CAAC;QAClB,2DAA2D;QAC3D,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,IAAI,EAAE;QACJ,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC,CAAC;IACF,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;IACjE,oBAAoB,EAAE,OAAO,kCAAkC,CAAC;IAChE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iFAAiF;IACjF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+GAA+G;IAC/G,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,0FAA0F;IAC1F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6FAA6F;IAC7F,WAAW,EAAE,OAAO,iCAAiC,EAAE,mCAAmC,GAAG,IAAI,CAAC;IAClG,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E;;;;OAIG;IACH,YAAY,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8CAA8C;AAC9C,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,kEAAkE;IAClE,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,CAAC;CAChE;AAID,qBAAa,QAAQ;;gBAGP,MAAM,EAAE,MAAM;IAM1B,qFAAqF;IAC/E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIvD;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIjE;;;;;;;;;OASG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQpG;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAkBjL;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,eAAe,EAAE,UAAU,GAAG,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAQlP;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvN;;;;;;OAMG;IACG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAkB1G;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB7E;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uDAAuD;QACvD,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC/B;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAsB9P;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IA6E/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CACR,OAAO,EAAE,0BAA0B,GAAG;QACpC;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBzH;;;;;;;;;OASG;IACG,OAAO,CACX,OAAO,GAAE,0BAA0B,GAAG;QACpC,iEAAiE;QACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;WAMG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KACvB,GACL,OAAO,CAAC,qBAAqB,CAAC;IA8CjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CACT,OAAO,GAAE,0BAA0B,GAAG;QACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB;;;;;;WAMG;QACH,qBAAqB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;QACvE;;;;WAIG;QACH,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAClE,gBAAgB,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAC9E,oGAAoG;YACpG,IAAI,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SACpD,CAAC;KACE,GACL,OAAO,CAAC,mBAAmB,CAAC;IAkN/B;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtF;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMvH;;;;OAIG;IACG,cAAc,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IAMzI;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAgC3I;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIjG"}
+{"version":3,"file":"gitvault.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,KAAK,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7I,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAuB,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAmCrE,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,yFAAyF;QACzF,QAAQ,EAAE,OAAO,CAAC;QAClB,2DAA2D;QAC3D,cAAc,EAAE,OAAO,CAAC;QACxB;;;;;;;WAOG;QACH,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;SACjC,CAAC;KACH,CAAC;IACF;;;;;;OAMG;IACH,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/D;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACpC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE;QACJ,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC,CAAC;IACF,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;IACjE,oBAAoB,EAAE,OAAO,kCAAkC,CAAC;IAChE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iFAAiF;IACjF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+GAA+G;IAC/G,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,0FAA0F;IAC1F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6FAA6F;IAC7F,WAAW,EAAE,OAAO,iCAAiC,EAAE,mCAAmC,GAAG,IAAI,CAAC;IAClG,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E;;;;OAIG;IACH,YAAY,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8CAA8C;AAC9C,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,kEAAkE;IAClE,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,CAAC;CAChE;AAID,qBAAa,QAAQ;;gBAGP,MAAM,EAAE,MAAM;IAM1B,qFAAqF;IAC/E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIvD;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIjE;;;;;;;;;OASG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQpG;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAkBjL;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,eAAe,EAAE,UAAU,GAAG,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAQlP;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvN;;;;;;OAMG;IACG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAkB1G;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB7E;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uDAAuD;QACvD,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC/B;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAsB9P;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA0B,GAAG;QACjD;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;KACX,GAAG,OAAO,CAAC,cAAc,CAAC;IAwIhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CACR,OAAO,EAAE,0BAA0B,GAAG;QACpC;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBzH;;;;;;;;;OASG;IACG,OAAO,CACX,OAAO,GAAE,0BAA0B,GAAG;QACpC,iEAAiE;QACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;WAMG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KACvB,GACL,OAAO,CAAC,qBAAqB,CAAC;IA8CjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CACT,OAAO,GAAE,0BAA0B,GAAG;QACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB;;;;;;WAMG;QACH,qBAAqB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;QACvE;;;;WAIG;QACH,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAClE,gBAAgB,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAC9E,oGAAoG;YACpG,IAAI,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SACpD,CAAC;KACE,GACL,OAAO,CAAC,mBAAmB,CAAC;IAkN/B;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtF;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMvH;;;;OAIG;IACG,cAAc,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IAMzI;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAgC3I;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIjG"}