run402 4.39.0 → 4.40.0

package/sdk/dist/namespaces/gitvault.d.ts

@@ -29,14 +29,17 @@
  * never persisted into an agent-surface result store, and never logged.
  */
 import type { Client } from "../kernel.js";
-import { GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT } from "./gitvault.crypto.js";
-import type { GitvaultCaptureReceipt, GitvaultHeadsListingPage, GitvaultHeadsListingRequest, GitvaultHeadTarget } from "./gitvault.types.js";
+import { GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT, GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT } from "./gitvault.crypto.js";
+import type { GitvaultCaptureReceipt, GitvaultHeadsListingPage, GitvaultHeadsListingRequest, GitvaultHeadTarget, GitvaultRecoveryReceipt } from "./gitvault.types.js";
 import type { GitvaultMaintenanceLease, GitvaultMaintenanceLeaseRequest, GitvaultTransport, GitvaultVaultRecord } from "../node/gitvault-publication.js";
 import type { GitvaultDeployOptions, GitvaultDeployResult } from "../node/gitvault-deploy.js";
-import type { GitvaultPublishResult, GitvaultRefMap, GitvaultVerifiedState } from "../node/gitvault-publication.js";
+import type { GitvaultPublishResult, GitvaultRefMap, GitvaultReconcileEnvelopeRecipientsResult, GitvaultVerifiedState } from "../node/gitvault-publication.js";
 import type { GitvaultCreationResult } from "../node/gitvault-creation-journal.js";
 import type { GitvaultKeystore } from "../node/gitvault-keystore.js";
 import type { GitvaultSnapshot } from "../node/gitvault-snapshot.js";
+import type { GitvaultMirrorConfig, GitvaultMirrorCredential } from "../node/gitvault-mirror-config.js";
+import type { GitvaultMirrorPushResult, GitvaultMirrorSyncSummary } from "../node/gitvault-mirror.js";
+import type { GitvaultRecoverResult, GitvaultVerifyReport } from "../node/gitvault-recover.js";
 /** What `r.gitvault.status()` reports. Never carries key material. */
 export interface GitvaultStatus {
     repo_id: string | null;
@@ -287,7 +290,32 @@ export interface GitvaultHandle {
     /** The full protocol object — every verb below is built on it. */
     vault: import("../node/gitvault-publication.js").GitvaultVault;
 }
+/** {@link Gitvault.push}'s best-effort envelope-recipient reconcile outcome, reported beside (never folded into) the vault result — same non-blocking contract as {@link GitvaultMirrorPushResult}. */
+export interface GitvaultReconcileEnvelopeRecipientsPushResult {
+    attempted: boolean;
+    outcome: "reconciled" | "skipped_error";
+    result?: GitvaultReconcileEnvelopeRecipientsResult;
+    error?: string;
+}
 /** What {@link Gitvault.openOrCreate} did. `created` is `null` exactly when `found` is `true`. */
+/** `run402 gitvault mirror status` — what this machine and the mirror each believe (design D8: both honesty statements ride every response). */
+export interface GitvaultMirrorStatus {
+    repo_id: string;
+    configured: boolean;
+    /** `s3://bucket/prefix` or a directory path — never a credential. */
+    destination: string | null;
+    credential_kind: "profile" | "ambient" | null;
+    /** The newest generation the MIRROR holds and chain-verifies (keyless). `null` when unconfigured, unreachable, or empty. */
+    mirrored_generation: string | null;
+    /** The LIVE vault's newest generation (one vault-record read). `null` when unconfigured or the vault has never captured. */
+    newest_generation: string | null;
+    /** `null` when either side is unknown (never fabricated from a partial read). */
+    is_current: boolean | null;
+    /** Present exactly when `is_current === false`. */
+    closing_command: string | null;
+    validity_not_freshness: typeof GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT;
+    keystore_still_required: typeof GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT;
+}
 export interface GitvaultOpenOrCreateResult {
     handle: GitvaultHandle;
     /** `true` when the vault already existed — nothing was allocated by this call. */
@@ -301,6 +329,28 @@ export interface GitvaultOpenOrCreateResult {
     } | null;
     terminal_loss_statement: typeof GITVAULT_TERMINAL_LOSS_STATEMENT;
 }
+/**
+ * {@link Gitvault.deploy}'s post-push glue: attach the best-effort
+ * mirror/reconcile hooks to a deploy result, gated on whether this deploy
+ * actually landed a new generation in the vault. Extracted as a standalone
+ * function (rather than inlined in `deploy()`) purely so the gating can be
+ * unit-tested with fake thunks — the real hooks (`#tryMirrorPush` /
+ * `#tryReconcileEnvelopeRecipients`) are private class methods that already
+ * catch everything and never reject, so this function does not need its own
+ * try/catch: it only decides WHETHER to call them and how to merge what they
+ * resolve to.
+ *
+ * `DEPLOYED_AND_VAULTED` and `DEPLOY_FAILED_VAULTED` are the only two
+ * outcomes that carry a `generation` — a vault push actually landed. The
+ * other three (`DEPLOY_BLOCKED_PUSH_FAILED`, `DEPLOY_FAILED_UNVAULTED`,
+ * `DEPLOYED_UNVAULTED_OVERRIDE`) published nothing new, so `mirror_push` /
+ * `reconcile_recipients` are OMITTED rather than a faked `skipped_*` value —
+ * there is nothing this deploy did that either hook could report on.
+ */
+export declare function attachGitvaultDeployHooks(result: GitvaultDeployResult, mirror: () => Promise<GitvaultMirrorPushResult>, reconcile: () => Promise<GitvaultReconcileEnvelopeRecipientsPushResult>): Promise<GitvaultDeployResult & {
+    mirror_push?: GitvaultMirrorPushResult;
+    reconcile_recipients?: GitvaultReconcileEnvelopeRecipientsPushResult;
+}>;
 export declare class Gitvault {
     #private;
     constructor(client: Client);
@@ -594,6 +644,8 @@ export declare class Gitvault {
         snapshot: GitvaultSnapshot;
         gitvault_commit: string;
         gitvault_commit_line: string;
+        mirror_push: GitvaultMirrorPushResult;
+        reconcile_recipients: GitvaultReconcileEnvelopeRecipientsPushResult;
     }>;
     /**
      * A REAL preview of what {@link push} would publish (kychee-com/run402#565)
@@ -706,6 +758,25 @@ export declare class Gitvault {
      * from its verified prefix rather than restarting.
      */
     verify(options?: GitvaultVaultHandleOptions): Promise<GitvaultVerifiedState>;
+    /**
+     * Wrap this vault's current epoch key to every org member who has
+     * published an encryption key but has no `key_envelope` on this vault yet
+     * — gitvault-human-envelopes task 4.1's ADD-path workaround. See {@link
+     * import("../node/gitvault-publication.js").GitvaultVault.
+     * reconcileEnvelopeRecipients} for the full design (TOFU pinning, the
+     * gateway `public_key` gap, and why this is a workaround rather than the
+     * eventual epoch-rotation design).
+     *
+     * `run402 gitvault reconcile [--repo <id>]` is the explicit standalone
+     * CLI surface (design D5's "session start" hook). `deploy()` runs this
+     * itself, best-effort, whenever a deploy lands a new generation in the
+     * vault — design D5's "deploy time" hook, "the same 'one command every
+     * agent runs' argument that decided deploy-implies-capture." `push()`
+     * (capture-and-publish outside a deploy) runs the identical hook after
+     * every successful publish, for the vault-only-project cadence. See
+     * `#tryReconcileEnvelopeRecipients` below for both call sites.
+     */
+    reconcileEnvelopeRecipients(options?: GitvaultVaultHandleOptions): Promise<GitvaultReconcileEnvelopeRecipientsResult>;
     /**
      * The push-gated deploy: both lanes under one fresh `capture_id`, resolving
      * to exactly one of five outcomes — `DEPLOYED_AND_VAULTED`,
@@ -715,8 +786,27 @@ export declare class Gitvault {
      * The push is never gated on deploy success, and a build that fails before a
      * canonical apply plan exists still captures (with a null plan digest, so no
      * activation token can be minted from it).
+     *
+     * `run402 deploy` is design D5's PRIMARY envelope-recipient reconcile hook
+     * ("the same 'one command every agent runs' argument that decided
+     * deploy-implies-capture") and design D6's primary dual-push mirror trigger
+     * — both fire HERE, not inside {@link runGitvaultDeploy} itself, mirroring
+     * {@link push}'s exact non-blocking contract: best-effort, NEVER throw,
+     * NEVER alter the deploy outcome already resolved above, reported BESIDE it
+     * on `mirror_push` / `reconcile_recipients`. They fire only when this
+     * deploy actually landed a new generation in the vault
+     * (`DEPLOYED_AND_VAULTED` / `DEPLOY_FAILED_VAULTED` — the outcomes carrying
+     * a `generation`); the other three outcomes published nothing new, so
+     * there is nothing to mirror or reconcile against ({@link
+     * import("../node/gitvault-mirror.js").mirrorPushForGeneration}'s own
+     * contract: "fires after an ordinary vault push/deploy produces a new
+     * generation"). Both fields are therefore OMITTED — never a faked
+     * `skipped_*` outcome — when no generation landed.
      */
-    deploy(options: Omit<GitvaultDeployOptions, "vault"> & GitvaultVaultHandleOptions): Promise<GitvaultDeployResult>;
+    deploy(options: Omit<GitvaultDeployOptions, "vault"> & GitvaultVaultHandleOptions): Promise<GitvaultDeployResult & {
+        mirror_push?: GitvaultMirrorPushResult;
+        reconcile_recipients?: GitvaultReconcileEnvelopeRecipientsPushResult;
+    }>;
     /**
      * Drain every unvaulted-override journal on this machine: push the exact
      * journaled snapshot and present the capture receipt for full-field
@@ -734,6 +824,53 @@ export declare class Gitvault {
         refs: Record<string, string>;
         generation: string;
     }>;
+    /**
+     * Configure (or replace) the customer-owned mirror destination for one
+     * vault. Client-side ONLY — the destination + credential NAME are written
+     * beside the keystore (design D2); run402 never sees or stores a raw
+     * secret value. `s3://<bucket>/<prefix>` needs `credential`; a plain
+     * filesystem path needs none.
+     */
+    mirrorSet(options: GitvaultVaultHandleOptions & {
+        destination_url: string;
+        credential?: GitvaultMirrorCredential;
+        region?: string;
+        endpoint?: string;
+    }): Promise<GitvaultMirrorConfig>;
+    /** Remove the mirror config for one vault. Never touches the mirror's own bytes (design: config removal ≠ data deletion). */
+    mirrorRemove(options?: GitvaultVaultHandleOptions): Promise<{
+        repo_id: string;
+        removed: boolean;
+    }>;
+    /**
+     * What this machine and the mirror each believe: whether a mirror is
+     * configured, the newest generation the MIRROR holds and can chain-verify
+     * (keyless — never touches keys), the LIVE vault's newest generation (one
+     * read of the vault record), and — when they disagree — the closing
+     * command. Both honesty statements (design D8) ride every response.
+     */
+    mirrorStatus(options?: GitvaultVaultHandleOptions): Promise<GitvaultMirrorStatus>;
+    /** List the vault's stored objects, diff against the mirror, fetch + hash-verify + write what's missing, in admission order. Resumable and idempotent. */
+    mirrorSync(options?: GitvaultVaultHandleOptions): Promise<GitvaultMirrorSyncSummary>;
+    /** Keyless integrity probe against the CONFIGURED mirror: discovery + chain verification + closure/absence adjudication, never decryption (`run402 gitvault mirror verify`). */
+    mirrorVerify(options?: GitvaultVaultHandleOptions): Promise<GitvaultVerifyReport>;
+    /**
+     * `r402s-recover` (design D4): rebuild a working git repository straight
+     * from a mirrored `source/<repo_id>/` prefix — NO SERVER INVOLVED. `source`
+     * is `s3://<bucket>[/<prefix>]` or a local directory; when it names more
+     * than one mirrored vault, pass `repo_id` explicitly. Recovery proves
+     * validity, never freshness (both honesty statements ride every result).
+     */
+    recover(options: {
+        source: string;
+        out_dir: string;
+        repo_id?: string;
+        credential?: GitvaultMirrorCredential;
+        region?: string;
+        endpoint?: string;
+        recovery_receipt?: GitvaultRecoveryReceipt;
+        keystore_root?: string;
+    }): Promise<GitvaultRecoverResult>;
 }
 /**
  * The composite escalation trigger (design D7): ANY of these crossing its

package/sdk/dist/namespaces/gitvault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,KAAK,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7I,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAuB,cAAc,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACzI,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAqCrE,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,yFAAyF;QACzF,QAAQ,EAAE,OAAO,CAAC;QAClB,2DAA2D;QAC3D,cAAc,EAAE,OAAO,CAAC;QACxB;;;;;;;WAOG;QACH,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;SACjC,CAAC;KACH,CAAC;IACF;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F;;;;;;;;OAQG;IACH,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACpC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE;QACJ,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC,CAAC;IACF,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;IACjE,oBAAoB,EAAE,OAAO,kCAAkC,CAAC;IAChE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,OAAO,CAAC;IACtB,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iFAAiF;IACjF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+GAA+G;IAC/G,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,2IAA2I;IAC3I,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,0DAA0D;IAC1D,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,+GAA+G;IAC/G,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sEAAsE;IACtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qIAAqI;IACrI,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,0FAA0F;IAC1F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6FAA6F;IAC7F,WAAW,EAAE,OAAO,iCAAiC,EAAE,mCAAmC,GAAG,IAAI,CAAC;IAClG,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E;;;;OAIG;IACH,YAAY,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8CAA8C;AAC9C,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,kEAAkE;IAClE,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,CAAC;CAChE;AAED,kGAAkG;AAClG,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,cAAc,CAAC;IACvB,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE;QACP,iKAAiK;QACjK,YAAY,EAAE,OAAO,CAAC;QACtB,4IAA4I;QAC5I,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAC7D,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IACT,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAID,qBAAa,QAAQ;;gBAGP,MAAM,EAAE,MAAM;IAM1B,qFAAqF;IAC/E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIvD;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIjE;;;;;;;OAOG;IACG,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7F;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMlF;;;;;;;;;OASG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQpG;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAkBjL;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,eAAe,EAAE,UAAU,GAAG,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAQlP;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvN;;;;;;OAMG;IACG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAkB1G;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB7E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,YAAY,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA6B/I;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,OAAO,EAAE,0BAA0B,GAAG;QACpC,OAAO,EAAE,qBAAqB,CAAC;QAC/B,sJAAsJ;QACtJ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,kGAAkG;QAClG,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,6BAA6B,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7I,GACA,OAAO,CAAC,0BAA0B,GAAG;QAAE,UAAU,EAAE,OAAO,6BAA6B,EAAE,yBAAyB,CAAA;KAAE,CAAC;IAwBxH;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uDAAuD;QACvD,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC/B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC;IA6FzK;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA0B,GAAG;QACjD;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;KACX,GAAG,OAAO,CAAC,cAAc,CAAC;IA4LhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CACR,OAAO,EAAE,0BAA0B,GAAG;QACpC;;;;;;;WAOG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;;;;WASG;QACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;QAChC,kHAAkH;QAClH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvG;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BzH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,QAAQ,CACZ,OAAO,EAAE,0BAA0B,GAAG;QACpC,2KAA2K;QAC3K,OAAO,CAAC,EAAE,qBAAqB,CAAC;QAChC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,wBAAwB,CAAC;IA2CpC;;;;;;;;;OASG;IACG,OAAO,CACX,OAAO,GAAE,0BAA0B,GAAG;QACpC,iEAAiE;QACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;WAMG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KACvB,GACL,OAAO,CAAC,qBAAqB,CAAC;IA8CjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CACT,OAAO,GAAE,0BAA0B,GAAG;QACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB;;;;;;WAMG;QACH,qBAAqB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;QACvE;;;;WAIG;QACH,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAClE,gBAAgB,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAC9E,oGAAoG;YACpG,IAAI,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SACpD,CAAC;KACE,GACL,OAAO,CAAC,mBAAmB,CAAC;IAkN/B;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtF;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMvH;;;;OAIG;IACG,cAAc,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IAMzI;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAsC3I;AAWD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;CAInC,CAAC;AAEX,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,GAAG,SAAS,GAAG,qBAAqB,CAAC,EAC7F,GAAG,GAAE,IAAiB,GACrB,uBAAuB,CAUzB;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAUhF;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAIhF;AAED,8FAA8F;AAC9F,MAAM,MAAM,yBAAyB,GAAG,IAAI,GAAG,MAAM,CAAC;AAKtD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,yBAAyB,CAEnG;AAED,qGAAqG;AACrG,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,GAAG,IAAI,CAMtF"}
+{"version":3,"file":"gitvault.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EACL,iDAAiD,EACjD,gDAAgD,EAChD,kCAAkC,EAClC,gCAAgC,EACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACtK,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAuB,cAAc,EAAE,yCAAyC,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACpL,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAA6B,MAAM,mCAAmC,CAAC;AACnI,OAAO,KAAK,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACtG,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAyC/F,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,yFAAyF;QACzF,QAAQ,EAAE,OAAO,CAAC;QAClB,2DAA2D;QAC3D,cAAc,EAAE,OAAO,CAAC;QACxB;;;;;;;WAOG;QACH,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;SACjC,CAAC;KACH,CAAC;IACF;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F;;;;;;;;OAQG;IACH,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACpC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE;QACJ,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC,CAAC;IACF,eAAe,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC;IACrD,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;IACjE,oBAAoB,EAAE,OAAO,kCAAkC,CAAC;IAChE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,OAAO,CAAC;IACtB,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;IAC3B,iFAAiF;IACjF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+GAA+G;IAC/G,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,2IAA2I;IAC3I,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,0DAA0D;IAC1D,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,+GAA+G;IAC/G,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sEAAsE;IACtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qIAAqI;IACrI,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,0FAA0F;IAC1F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6FAA6F;IAC7F,WAAW,EAAE,OAAO,iCAAiC,EAAE,mCAAmC,GAAG,IAAI,CAAC;IAClG,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E;;;;OAIG;IACH,YAAY,EAAE,OAAO,2BAA2B,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8CAA8C;AAC9C,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,kEAAkE;IAClE,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,CAAC;CAChE;AAED,uMAAuM;AACvM,MAAM,WAAW,6CAA6C;IAC5D,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,YAAY,GAAG,eAAe,CAAC;IACxC,MAAM,CAAC,EAAE,yCAAyC,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,gJAAgJ;AAChJ,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9C,4HAA4H;IAC5H,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,4HAA4H;IAC5H,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,mDAAmD;IACnD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sBAAsB,EAAE,OAAO,gDAAgD,CAAC;IAChF,uBAAuB,EAAE,OAAO,iDAAiD,CAAC;CACnF;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,cAAc,CAAC;IACvB,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE;QACP,iKAAiK;QACjK,YAAY,EAAE,OAAO,CAAC;QACtB,4IAA4I;QAC5I,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAC7D,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IACT,uBAAuB,EAAE,OAAO,gCAAgC,CAAC;CAClE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,EAC/C,SAAS,EAAE,MAAM,OAAO,CAAC,6CAA6C,CAAC,GACtE,OAAO,CAAC,oBAAoB,GAAG;IAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAAC,oBAAoB,CAAC,EAAE,6CAA6C,CAAA;CAAE,CAAC,CAQlJ;AAID,qBAAa,QAAQ;;gBAGP,MAAM,EAAE,MAAM;IAM1B,qFAAqF;IAC/E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIvD;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIjE;;;;;;;OAOG;IACG,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7F;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMlF;;;;;;;;;OASG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQpG;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAkBjL;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,eAAe,EAAE,UAAU,GAAG,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAQlP;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvN;;;;;;OAMG;IACG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAkB1G;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB7E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,YAAY,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA6B/I;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,OAAO,EAAE,0BAA0B,GAAG;QACpC,OAAO,EAAE,qBAAqB,CAAC;QAC/B,sJAAsJ;QACtJ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,kGAAkG;QAClG,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,6BAA6B,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7I,GACA,OAAO,CAAC,0BAA0B,GAAG;QAAE,UAAU,EAAE,OAAO,6BAA6B,EAAE,yBAAyB,CAAA;KAAE,CAAC;IAwBxH;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uDAAuD;QACvD,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC/B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC;IA6FzK;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA0B,GAAG;QACjD;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;KACX,GAAG,OAAO,CAAC,cAAc,CAAC;IA4LhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CACR,OAAO,EAAE,0BAA0B,GAAG;QACpC;;;;;;;WAOG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;;;;WASG;QACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;QAChC,kHAAkH;QAClH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvG;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,qBAAqB,GAAG;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,wBAAwB,CAAC;QAAC,oBAAoB,EAAE,6CAA6C,CAAA;KAAE,CAAC;IAyDrO;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,QAAQ,CACZ,OAAO,EAAE,0BAA0B,GAAG;QACpC,2KAA2K;QAC3K,OAAO,CAAC,EAAE,qBAAqB,CAAC;QAChC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACvF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,wBAAwB,CAAC;IA2CpC;;;;;;;;;OASG;IACG,OAAO,CACX,OAAO,GAAE,0BAA0B,GAAG;QACpC,iEAAiE;QACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;WAMG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KACvB,GACL,OAAO,CAAC,qBAAqB,CAAC;IA8CjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CACT,OAAO,GAAE,0BAA0B,GAAG;QACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB;;;;;;WAMG;QACH,qBAAqB,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;QACvE;;;;WAIG;QACH,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAClE,gBAAgB,EAAE,OAAO,2BAA2B,EAAE,uBAAuB,CAAC;YAC9E,oGAAoG;YACpG,IAAI,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SACpD,CAAC;KACE,GACL,OAAO,CAAC,mBAAmB,CAAC;IAkN/B;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtF;;;;;;;;;;;;;;;;;OAiBG;IACG,2BAA2B,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,yCAAyC,CAAC;IAK/H;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,MAAM,CACV,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,0BAA0B,GACzE,OAAO,CAAC,oBAAoB,GAAG;QAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC;QAAC,oBAAoB,CAAC,EAAE,6CAA6C,CAAA;KAAE,CAAC;IAgBnJ;;;;OAIG;IACG,cAAc,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IAMzI;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ1I;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,EAAE,0BAA0B,GAAG;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQ5L,6HAA6H;IACvH,YAAY,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAO5G;;;;;;OAMG;IACG,YAAY,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiC3F,0JAA0J;IACpJ,UAAU,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAO9F,gLAAgL;IAC1K,YAAY,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAY3F;;;;;;OAMG;IACG,OAAO,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA6D7P;AAWD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;CAInC,CAAC;AAEX,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,GAAG,SAAS,GAAG,qBAAqB,CAAC,EAC7F,GAAG,GAAE,IAAiB,GACrB,uBAAuB,CAUzB;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAUhF;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAIhF;AAED,8FAA8F;AAC9F,MAAM,MAAM,yBAAyB,GAAG,IAAI,GAAG,MAAM,CAAC;AAKtD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,yBAAyB,CAEnG;AAED,qGAAqG;AACrG,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,GAAG,IAAI,CAMtF"}

package/sdk/dist/namespaces/gitvault.js

@@ -29,7 +29,7 @@
  * never persisted into an agent-surface result store, and never logged.
  */
 import { LocalError } from "../errors.js";
-import { GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT } from "./gitvault.crypto.js";
+import { GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT, GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT, } from "./gitvault.crypto.js";
 /** A keystore path, or `null` when there is no id to derive it from (or it is malformed). */
 function safePath(derive, repoId) {
     if (!repoId)
@@ -49,6 +49,34 @@ async function nodeOnly(load, verb) {
         throw new LocalError(`\`r.gitvault.${verb}\` needs the Node runtime (keystore + git); import it from a Node process, or use the read-only vault methods in a browser.`, `running gitvault ${verb}`, { code: "GITVAULT_NODE_ONLY", details: { cause: e instanceof Error ? e.message : String(e) } });
     }
 }
+/**
+ * {@link Gitvault.deploy}'s post-push glue: attach the best-effort
+ * mirror/reconcile hooks to a deploy result, gated on whether this deploy
+ * actually landed a new generation in the vault. Extracted as a standalone
+ * function (rather than inlined in `deploy()`) purely so the gating can be
+ * unit-tested with fake thunks — the real hooks (`#tryMirrorPush` /
+ * `#tryReconcileEnvelopeRecipients`) are private class methods that already
+ * catch everything and never reject, so this function does not need its own
+ * try/catch: it only decides WHETHER to call them and how to merge what they
+ * resolve to.
+ *
+ * `DEPLOYED_AND_VAULTED` and `DEPLOY_FAILED_VAULTED` are the only two
+ * outcomes that carry a `generation` — a vault push actually landed. The
+ * other three (`DEPLOY_BLOCKED_PUSH_FAILED`, `DEPLOY_FAILED_UNVAULTED`,
+ * `DEPLOYED_UNVAULTED_OVERRIDE`) published nothing new, so `mirror_push` /
+ * `reconcile_recipients` are OMITTED rather than a faked `skipped_*` value —
+ * there is nothing this deploy did that either hook could report on.
+ */
+export async function attachGitvaultDeployHooks(result, mirror, reconcile) {
+    if (result.outcome !== "DEPLOYED_AND_VAULTED" && result.outcome !== "DEPLOY_FAILED_VAULTED")
+        return result;
+    // Sequential, not Promise.all — same ordering push() uses, so a reconcile
+    // failure can never be misread as a mirror failure in a log line that
+    // assumed ordering.
+    const mirrorPush = await mirror();
+    const reconcileRecipients = await reconcile();
+    return { ...result, mirror_push: mirrorPush, reconcile_recipients: reconcileRecipients };
+}
 // ─── The namespace ───────────────────────────────────────────────────────────
 export class Gitvault {
     #client;
@@ -685,7 +713,38 @@ export class Gitvault {
             ...(options.checkpoint ? { checkpoint: true } : {}),
         };
         const result = await handle.vault.push(push);
-        return { ...result, snapshot, gitvault_commit: snapshot.oid, gitvault_commit_line: line };
+        // Capture-time dual-push hook (design D6/task 2.4): fires only when a
+        // mirror is configured; NEVER throws, NEVER alters the vault outcome
+        // above (already returned/committed) — a mirror failure is a named
+        // pending finding reported BESIDE the vault result, on its own field.
+        const mirrorPush = await this.#tryMirrorPush(handle.repo_id, handle.keystore);
+        // Deploy-time reconcile hook (design D5's "deploy time" cadence,
+        // gitvault-human-envelopes task 4.1): fires on every successful push,
+        // best-effort — a reconcile failure (including a read-only principal
+        // with no signing key) is reported BESIDE the vault result, never a
+        // `push()` throw, same non-blocking contract as the mirror hook above.
+        const reconcileRecipients = await this.#tryReconcileEnvelopeRecipients(handle.vault);
+        return { ...result, snapshot, gitvault_commit: snapshot.oid, gitvault_commit_line: line, mirror_push: mirrorPush, reconcile_recipients: reconcileRecipients };
+    }
+    /** Best-effort dual-push: catches EVERYTHING, including the lazy module import itself, so a mirror problem can never surface as a `push()` throw. */
+    async #tryMirrorPush(repoId, keystore) {
+        try {
+            const { mirrorPushForGeneration } = await this.#mirror();
+            return await mirrorPushForGeneration(this.#client, repoId, { keystore });
+        }
+        catch (e) {
+            return { attempted: false, outcome: "skipped_no_mirror", error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /** Best-effort envelope-recipient reconcile: catches EVERYTHING so a reconcile problem can never surface as a `push()` throw (mirrors {@link #tryMirrorPush}'s contract exactly). */
+    async #tryReconcileEnvelopeRecipients(vault) {
+        try {
+            const result = await vault.reconcileEnvelopeRecipients();
+            return { attempted: true, outcome: "reconciled", result };
+        }
+        catch (e) {
+            return { attempted: false, outcome: "skipped_error", error: e instanceof Error ? e.message : String(e) };
+        }
     }
     /**
      * A REAL preview of what {@link push} would publish (kychee-com/run402#565)
@@ -1018,6 +1077,28 @@ export class Gitvault {
         const handle = await this.open(options);
         return handle.vault.verifyToNewest();
     }
+    /**
+     * Wrap this vault's current epoch key to every org member who has
+     * published an encryption key but has no `key_envelope` on this vault yet
+     * — gitvault-human-envelopes task 4.1's ADD-path workaround. See {@link
+     * import("../node/gitvault-publication.js").GitvaultVault.
+     * reconcileEnvelopeRecipients} for the full design (TOFU pinning, the
+     * gateway `public_key` gap, and why this is a workaround rather than the
+     * eventual epoch-rotation design).
+     *
+     * `run402 gitvault reconcile [--repo <id>]` is the explicit standalone
+     * CLI surface (design D5's "session start" hook). `deploy()` runs this
+     * itself, best-effort, whenever a deploy lands a new generation in the
+     * vault — design D5's "deploy time" hook, "the same 'one command every
+     * agent runs' argument that decided deploy-implies-capture." `push()`
+     * (capture-and-publish outside a deploy) runs the identical hook after
+     * every successful publish, for the vault-only-project cadence. See
+     * `#tryReconcileEnvelopeRecipients` below for both call sites.
+     */
+    async reconcileEnvelopeRecipients(options = {}) {
+        const handle = await this.open(options);
+        return handle.vault.reconcileEnvelopeRecipients();
+    }
     /**
      * The push-gated deploy: both lanes under one fresh `capture_id`, resolving
      * to exactly one of five outcomes — `DEPLOYED_AND_VAULTED`,
@@ -1027,11 +1108,33 @@ export class Gitvault {
      * The push is never gated on deploy success, and a build that fails before a
      * canonical apply plan exists still captures (with a null plan digest, so no
      * activation token can be minted from it).
+     *
+     * `run402 deploy` is design D5's PRIMARY envelope-recipient reconcile hook
+     * ("the same 'one command every agent runs' argument that decided
+     * deploy-implies-capture") and design D6's primary dual-push mirror trigger
+     * — both fire HERE, not inside {@link runGitvaultDeploy} itself, mirroring
+     * {@link push}'s exact non-blocking contract: best-effort, NEVER throw,
+     * NEVER alter the deploy outcome already resolved above, reported BESIDE it
+     * on `mirror_push` / `reconcile_recipients`. They fire only when this
+     * deploy actually landed a new generation in the vault
+     * (`DEPLOYED_AND_VAULTED` / `DEPLOY_FAILED_VAULTED` — the outcomes carrying
+     * a `generation`); the other three outcomes published nothing new, so
+     * there is nothing to mirror or reconcile against ({@link
+     * import("../node/gitvault-mirror.js").mirrorPushForGeneration}'s own
+     * contract: "fires after an ordinary vault push/deploy produces a new
+     * generation"). Both fields are therefore OMITTED — never a faked
+     * `skipped_*` outcome — when no generation landed.
      */
     async deploy(options) {
         const { runGitvaultDeploy } = await this.#deploy();
         const handle = await this.open(options);
-        return runGitvaultDeploy({ ...options, vault: handle.vault, repo_dir: options.repo_dir ?? process.cwd() });
+        const result = await runGitvaultDeploy({ ...options, vault: handle.vault, repo_dir: options.repo_dir ?? process.cwd() });
+        // Same ordering push() uses (mirror, then reconcile) — sequential, not
+        // Promise.all, so a reconcile failure can never be misread as a mirror
+        // failure in a log line that assumed ordering. Extracted to a standalone
+        // function so the outcome-gating is unit-testable with fake thunks,
+        // without standing up a live vault — see gitvault-deploy-hooks.test.ts.
+        return attachGitvaultDeployHooks(result, () => this.#tryMirrorPush(handle.repo_id, handle.keystore), () => this.#tryReconcileEnvelopeRecipients(handle.vault));
     }
     /**
      * Drain every unvaulted-override journal on this machine: push the exact
@@ -1053,6 +1156,114 @@ export class Gitvault {
         const out = await handle.vault.restoreObjectsInto(options.target_dir);
         return { refs: out.refs, generation: out.generation };
     }
+    // ── mirror (gitvault-mirror-and-recover, design D1/D2/D7) ─────────────────
+    /**
+     * Configure (or replace) the customer-owned mirror destination for one
+     * vault. Client-side ONLY — the destination + credential NAME are written
+     * beside the keystore (design D2); run402 never sees or stores a raw
+     * secret value. `s3://<bucket>/<prefix>` needs `credential`; a plain
+     * filesystem path needs none.
+     */
+    async mirrorSet(options) {
+        const [{ GitvaultKeystore }, { parseMirrorDestinationUrl, saveMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
+        const repoId = await this.#resolveRepoId(options);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const destination = parseMirrorDestinationUrl(options.destination_url, { region: options.region, endpoint: options.endpoint });
+        return saveMirrorConfig(keystore, { repo_id: repoId, destination, ...(options.credential ? { credential: options.credential } : {}) });
+    }
+    /** Remove the mirror config for one vault. Never touches the mirror's own bytes (design: config removal ≠ data deletion). */
+    async mirrorRemove(options = {}) {
+        const [{ GitvaultKeystore }, { removeMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
+        const repoId = await this.#resolveRepoId(options);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        return { repo_id: repoId, ...removeMirrorConfig(keystore, repoId) };
+    }
+    /**
+     * What this machine and the mirror each believe: whether a mirror is
+     * configured, the newest generation the MIRROR holds and can chain-verify
+     * (keyless — never touches keys), the LIVE vault's newest generation (one
+     * read of the vault record), and — when they disagree — the closing
+     * command. Both honesty statements (design D8) ride every response.
+     */
+    async mirrorStatus(options = {}) {
+        const [{ GitvaultKeystore }, { readMirrorConfig, formatMirrorDestination }, { openGitvaultMirrorBackend }, { verifyGitvaultMirror }] = await Promise.all([
+            this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
+        ]);
+        const repoId = await this.#resolveRepoId(options);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const config = readMirrorConfig(keystore, repoId);
+        const base = { repo_id: repoId, validity_not_freshness: GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, keystore_still_required: GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT };
+        if (!config) {
+            return { ...base, configured: false, destination: null, credential_kind: null, mirrored_generation: null, newest_generation: null, is_current: null, closing_command: null };
+        }
+        let mirroredGeneration = null;
+        try {
+            const backend = openGitvaultMirrorBackend(config.destination, repoId, config.credential);
+            const report = await verifyGitvaultMirror(backend, { keystore });
+            mirroredGeneration = report.recovered_generation;
+        }
+        catch {
+            // A configured-but-unreachable/empty mirror is still `configured: true` — the honest report is "unknown", not a thrown status call.
+        }
+        let newestGeneration = null;
+        try {
+            newestGeneration = (await this.get(repoId)).newest_generation;
+        }
+        catch {
+            /* the live vault read is best-effort here; the mirror half of status still answers */
+        }
+        const isCurrent = mirroredGeneration !== null && newestGeneration !== null ? mirroredGeneration === newestGeneration : null;
+        return {
+            ...base, configured: true, destination: formatMirrorDestination(config.destination), credential_kind: config.credential?.kind ?? null,
+            mirrored_generation: mirroredGeneration, newest_generation: newestGeneration, is_current: isCurrent,
+            closing_command: isCurrent === false ? "run402 gitvault mirror sync" : null,
+        };
+    }
+    /** List the vault's stored objects, diff against the mirror, fetch + hash-verify + write what's missing, in admission order. Resumable and idempotent. */
+    async mirrorSync(options = {}) {
+        const [{ GitvaultKeystore }, { mirrorSync }] = await Promise.all([this.#keystore(), this.#mirror()]);
+        const repoId = await this.#resolveRepoId(options);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        return mirrorSync(this.#client, repoId, { keystore });
+    }
+    /** Keyless integrity probe against the CONFIGURED mirror: discovery + chain verification + closure/absence adjudication, never decryption (`run402 gitvault mirror verify`). */
+    async mirrorVerify(options = {}) {
+        const [{ GitvaultKeystore }, { readMirrorConfig }, { openGitvaultMirrorBackend }, { verifyGitvaultMirror }] = await Promise.all([
+            this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
+        ]);
+        const repoId = await this.#resolveRepoId(options);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const config = readMirrorConfig(keystore, repoId);
+        if (!config)
+            throw new LocalError(`no mirror is configured for ${repoId}`, "verifying gitvault mirror", { code: "GITVAULT_MIRROR_NOT_CONFIGURED", details: { repo_id: repoId }, next_actions: [{ action: "run402 gitvault mirror set <destination>" }] });
+        const backend = openGitvaultMirrorBackend(config.destination, repoId, config.credential);
+        return verifyGitvaultMirror(backend, { keystore });
+    }
+    /**
+     * `r402s-recover` (design D4): rebuild a working git repository straight
+     * from a mirrored `source/<repo_id>/` prefix — NO SERVER INVOLVED. `source`
+     * is `s3://<bucket>[/<prefix>]` or a local directory; when it names more
+     * than one mirrored vault, pass `repo_id` explicitly. Recovery proves
+     * validity, never freshness (both honesty statements ride every result).
+     */
+    async recover(options) {
+        const [{ GitvaultKeystore }, { parseMirrorDestinationUrl }, { openGitvaultMirrorBackend, discoverMirroredRepoIds }, { recoverGitvaultMirror }] = await Promise.all([
+            this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
+        ]);
+        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const destination = parseMirrorDestinationUrl(options.source, { region: options.region, endpoint: options.endpoint });
+        let repoId = options.repo_id;
+        if (!repoId) {
+            const found = await discoverMirroredRepoIds(destination, options.credential);
+            if (found.length === 0)
+                throw new LocalError(`${options.source} holds no mirrored vault (no source/<repo_id>/ prefix found)`, "recovering gitvault vault", { code: "GITVAULT_MIRROR_EMPTY", details: { source: options.source } });
+            if (found.length > 1)
+                throw new LocalError(`${options.source} holds ${found.length} mirrored vaults; pass repo_id to pick one`, "recovering gitvault vault", { code: "GITVAULT_MIRROR_AMBIGUOUS", details: { source: options.source, repo_ids: found }, next_actions: found.map((id) => ({ action: `recover --repo ${id}` })) });
+            repoId = found[0];
+        }
+        const backend = openGitvaultMirrorBackend(destination, repoId, options.credential);
+        return recoverGitvaultMirror({ backend, out_dir: options.out_dir, keystore, ...(options.recovery_receipt ? { recovery_receipt: options.recovery_receipt } : {}) });
+    }
     // ── internals ─────────────────────────────────────────────────────────────
     async #resolveRepoId(options) {
         if (options.repo_id)
@@ -1085,6 +1296,18 @@ export class Gitvault {
     #address() {
         return nodeOnly(() => import("../node/gitvault-address.js"), "resolveOrCreateAddress");
     }
+    #mirror() {
+        return nodeOnly(() => import("../node/gitvault-mirror.js"), "mirrorSync");
+    }
+    #mirrorConfig() {
+        return nodeOnly(() => import("../node/gitvault-mirror-config.js"), "mirrorSet");
+    }
+    #mirrorBackend() {
+        return nodeOnly(() => import("../node/gitvault-mirror-backend.js"), "mirrorSet");
+    }
+    #recovery() {
+        return nodeOnly(() => import("../node/gitvault-recover.js"), "recover");
+    }
 }
 // ─── D7 — progressive terminal-loss warning (repo-first-onramp task 2.7) ────
 //