run402 4.68.3 → 4.69.1

package/sdk/dist/node/gitvault-handoff.js

@@ -28,7 +28,7 @@ import { concatBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { base64 } from "@scure/base";
 import { LocalError } from "../errors.js";
-import { _gitvaultAeadBackend, fromBase64url, randomBytes, toBase64url, bytesToHex } from "../namespaces/gitvault.crypto.js";
+import { _gitvaultAeadBackend, fromBase64url, randomBytes, toBase64url, bytesToHex, GITVAULT_FORMAT, GITVAULT_SUITE, GITVAULT_HEX16_RE, GITVAULT_SHA256_RE, signaturePreimage, ed25519Sign, ed25519PublicKey, ed25519VerifyStrict, vkFingerprint, ekFingerprint, } from "../namespaces/gitvault.crypto.js";
 function fail(code, message, context, details) {
     throw new LocalError(message, context, { code, details });
 }
@@ -116,6 +116,141 @@ export function deriveHandoffSecrets(handoffIdBytes, masterSecret) {
     const authHash = sha256(concatBytes(utf8ToBytes(HANDOFF_AUTH_HASH_LABEL), authSecret));
     return { auth_secret: authSecret, wrap_key: wrapKey, auth_hash_hex: bytesToHex(authHash) };
 }
+// ─── Writer-admission grant + acceptance (gitvault-multi-writer D4/§4.17) ───
+//
+// The bearer-completable path for `add_writer_key{authorization.kind:
+// "handoff"}` — an unknown-at-mint, possibly-sender-gone recipient becomes a
+// vault WRITER (not just a K_repo holder) via a sender-signed grant plus the
+// claimant's own two-signature acceptance. Reuses ONLY existing primitives:
+// `signaturePreimage`/`ed25519Sign`/`ed25519VerifyStrict`/`vkFingerprint`/
+// `ekFingerprint` from `gitvault.crypto.ts` — the SAME "r402s/v0/<kind>\n" +
+// JCS(object minus signature) preimage rule every other chain object uses
+// (protocol §1), NOT a bespoke construction. Verified against the gateway's
+// OWN `services/gitvault/claims.ts` (not just the protocol prose, which
+// describes the acceptance statement's preimage as `lp(domain) ‖
+// JCS(statement)` — that text is stale; the shipped gateway code calls its
+// own `signaturePreimage("handoff-writer-accept/v1", acceptance.statement)`,
+// the identical convention used here).
+const HANDOFF_WRITER_ADMISSION_INFO = "kygit/handoff/writer-admission/v1";
+/**
+ * Third HKDF output of the Handoff Key's `master_secret` (design D4,
+ * protocol §4.17): the one-use admission Ed25519 seed. Derived directly
+ * from `master_secret` — deliberately NEVER from `auth_secret` or
+ * `wrap_key` — so the gateway, which receives `auth_secret` at claim, stays
+ * computationally unable to derive this seed and manufacture a different
+ * claimant completion.
+ */
+export function deriveWriterAdmissionSeed(handoffIdBytes, masterSecret) {
+    return hkdf(sha256, masterSecret, handoffIdBytes, utf8ToBytes(HANDOFF_WRITER_ADMISSION_INFO), 32);
+}
+const WRITER_MINTED_ROLES = ["owner", "admin", "developer", "billing", "viewer"];
+/** Mint side (D4): builds + signs `writer_admission_grant`. The gateway's own mint-time validation (grantor active + self-consistent, field equality) is server-side; this function only builds a well-formed, correctly-signed object. */
+export function buildWriterAdmissionGrant(input) {
+    if (!GITVAULT_SHA256_RE.test(input.auth_hash))
+        fail("VALIDATION_FAILED", "auth_hash must be 64 lowercase hex", "building writer_admission_grant", { field: "auth_hash" });
+    if (!GITVAULT_HEX16_RE.test(input.checkpoint_generation))
+        fail("VALIDATION_FAILED", "checkpoint_generation must be 16 lowercase hex", "building writer_admission_grant", { field: "checkpoint_generation" });
+    if (!GITVAULT_SHA256_RE.test(input.checkpoint_head_sha256))
+        fail("VALIDATION_FAILED", "checkpoint_head_sha256 must be 64 lowercase hex", "building writer_admission_grant", { field: "checkpoint_head_sha256" });
+    if (!WRITER_MINTED_ROLES.includes(input.minted_role))
+        fail("VALIDATION_FAILED", "minted_role is not a recognized role", "building writer_admission_grant", { field: "minted_role" });
+    const withoutSignature = {
+        format: GITVAULT_FORMAT,
+        object_kind: "writer_admission_grant",
+        suite: GITVAULT_SUITE,
+        repo_id: input.repo_id,
+        handoff_id: input.handoff_id,
+        auth_hash: input.auth_hash,
+        checkpoint_generation: input.checkpoint_generation,
+        checkpoint_head_sha256: input.checkpoint_head_sha256,
+        grantor_writer_key_id: vkFingerprint(ed25519PublicKey(input.grantor_signing_seed)),
+        handoff_admission_pubkey: toBase64url(input.handoff_admission_pubkey),
+        minted_role: input.minted_role,
+        claim_not_after: input.claim_not_after,
+        created_at: input.created_at ?? new Date().toISOString(),
+    };
+    const signature = toBase64url(ed25519Sign(signaturePreimage("writer_admission_grant", withoutSignature), input.grantor_signing_seed));
+    return { ...withoutSignature, signature };
+}
+/**
+ * Structural + signature verification of a `writer_admission_grant` against
+ * the grantor's writer signing pubkey (raw bytes) — does NOT check chain
+ * state (grantor active in the predecessor writer state, `handoff_id`
+ * unconsumed). That is the caller's job: gateway-side at admission, or a
+ * client-side pre-check before spending a grant it did not itself mint.
+ */
+export function verifyWriterAdmissionGrant(grant, grantorSigningPubkeyRaw) {
+    if (grant.format !== GITVAULT_FORMAT || grant.object_kind !== "writer_admission_grant" || grant.suite !== GITVAULT_SUITE)
+        return false;
+    if (grant.grantor_writer_key_id !== vkFingerprint(grantorSigningPubkeyRaw))
+        return false;
+    const { signature, ...withoutSignature } = grant;
+    let sigBytes;
+    try {
+        sigBytes = fromBase64url(signature, "writer_admission_grant.signature");
+    }
+    catch {
+        return false;
+    }
+    return ed25519VerifyStrict(sigBytes, signaturePreimage("writer_admission_grant", withoutSignature), grantorSigningPubkeyRaw);
+}
+/** The statement `writer_acceptance` signs TWICE (design D225's fold of the consultation's separate `writer_key_proof` into a second signature over this same statement). */
+export const HANDOFF_WRITER_ACCEPT_DOMAIN = "r402s/v0/handoff-writer-accept/v1";
+const HANDOFF_WRITER_ACCEPT_PREIMAGE_DOMAIN = "handoff-writer-accept/v1";
+/**
+ * Claim side (D4): the claimant can construct BOTH signatures before ever
+ * seeing the stored grant, since it already knows `handoff_id`, `auth_hash`
+ * (recomputed exactly as the existing claim flow already does via
+ * {@link deriveHandoffSecrets}), and its own keys.
+ */
+export function buildWriterAcceptance(input) {
+    if (!GITVAULT_SHA256_RE.test(input.auth_hash))
+        fail("VALIDATION_FAILED", "auth_hash must be 64 lowercase hex", "building writer_acceptance", { field: "auth_hash" });
+    const signingPubkeyRaw = ed25519PublicKey(input.claimant_signing_seed);
+    const statement = {
+        domain: HANDOFF_WRITER_ACCEPT_DOMAIN,
+        handoff_id: input.handoff_id,
+        auth_hash: input.auth_hash,
+        writer_key_id: vkFingerprint(signingPubkeyRaw),
+        signing_pubkey: toBase64url(signingPubkeyRaw),
+        encryption_pubkey: toBase64url(input.claimant_encryption_pubkey_raw),
+        encryption_fingerprint: ekFingerprint(input.claimant_encryption_pubkey_raw),
+    };
+    const preimage = signaturePreimage(HANDOFF_WRITER_ACCEPT_PREIMAGE_DOMAIN, statement);
+    return {
+        statement,
+        acceptance_signature: toBase64url(ed25519Sign(preimage, input.admission_seed)),
+        possession_signature: toBase64url(ed25519Sign(preimage, input.claimant_signing_seed)),
+    };
+}
+/**
+ * Verifies BOTH signatures over the SAME statement: `acceptance_signature`
+ * under the grant's `handoff_admission_pubkey` (proves B legitimately
+ * claimed THIS handoff), `possession_signature` under the statement's own
+ * `signing_pubkey` (proves `writer_key_id`/`signing_pubkey` really belong
+ * to whoever is submitting it, not a replayed statement about someone
+ * else's key). Does not check `handoff_id`/`auth_hash` binding to a stored
+ * grant, or single-use — those are the caller's job.
+ */
+export function verifyWriterAcceptance(acceptance, admissionPubkeyRaw) {
+    if (acceptance.statement.domain !== HANDOFF_WRITER_ACCEPT_DOMAIN)
+        return false;
+    let acceptanceSig;
+    let possessionSig;
+    let signingPubkey;
+    try {
+        acceptanceSig = fromBase64url(acceptance.acceptance_signature, "writer_acceptance.acceptance_signature");
+        possessionSig = fromBase64url(acceptance.possession_signature, "writer_acceptance.possession_signature");
+        signingPubkey = fromBase64url(acceptance.statement.signing_pubkey, "writer_acceptance.statement.signing_pubkey");
+    }
+    catch {
+        return false;
+    }
+    if (acceptance.statement.writer_key_id !== vkFingerprint(signingPubkey))
+        return false;
+    const preimage = signaturePreimage(HANDOFF_WRITER_ACCEPT_PREIMAGE_DOMAIN, acceptance.statement);
+    return ed25519VerifyStrict(acceptanceSig, preimage, admissionPubkeyRaw) && ed25519VerifyStrict(possessionSig, preimage, signingPubkey);
+}
 /** Frame tag for this envelope format — DISTINCT from `r402s/v0`'s `"R402S0"` object frame (design D3: never stored as a vault object). */
 export const HANDOFF_ENVELOPE_KIND = "kygit-handoff-envelope-v1";
 const HANDOFF_FRAME_MAGIC = "KGH1";
@@ -148,13 +283,11 @@ function handoffEnvelopeAad(handoffIdBytes, envelopeKind) {
  * `sealed_envelope` on the wire is STANDARD base64 — openapi spells it
  * `format: byte` in both the mint body and the claim response, and the
  * gateway echoes the stored bytes with `Buffer#toString("base64")` (`+`,
- * `/`, `=` padding). Through 4.68.2 the mint sent base64url (which the
- * gateway's lenient decoder accepted) and the claim side decoded with the
- * canonical-base64url-only `fromBase64url`, which refuses every `+`/`/`/`=`
- * — so the first claim that ever verified (2026-09-02, Session B) got a
- * 200 from the gateway and died client-side with HANDOFF_ENVELOPE_INVALID.
- * This decoder reads the documented form and, for tolerance, the base64url
- * form earlier clients minted; padding is optional either way. Anything
+ * `/`, `=` padding). Decoding it with the canonical-base64url-only
+ * `fromBase64url`, which refuses every `+`/`/`/`=`, takes a 200 from the
+ * gateway and dies client-side with HANDOFF_ENVELOPE_INVALID. This decoder
+ * reads the documented form and, for tolerance, the base64url form other
+ * clients mint; padding is optional either way. Anything
  * outside the two alphabets is a refusal (`null` — the caller raises the
  * typed HANDOFF_ENVELOPE_INVALID), never a silent partial decode.
  */
@@ -172,25 +305,40 @@ function decodeSealedEnvelope(value) {
         return null;
     }
 }
-/** Seal the handoff payload under `wrap_key`. Returns the standard-base64 wire form (openapi `format: byte`) + its declared kind tag. */
-export function sealHandoffEnvelope(handoffIdBytes, wrapKey, payload, nonce) {
-    // Plain JSON, NOT the r402s/v0 no-JSON-numbers JCS profile: this envelope
-    // is never a vault object and only this SDK ever encodes/decodes it, so
-    // it needs deterministic round-tripping, not cross-implementation
-    // byte-canonical determinism (design D3's "the frozen protocol is
-    // untouched" — reusing the object-frame profile here would be exactly
-    // the kind of accidental protocol coupling that note warns against).
+// Plain JSON, NOT the r402s/v0 no-JSON-numbers JCS profile: this envelope is
+// never a vault object and only this SDK ever encodes/decodes it, so it
+// needs deterministic round-tripping, not cross-implementation
+// byte-canonical determinism (design D3's "the frozen protocol is
+// untouched" — reusing the object-frame profile here would be exactly the
+// kind of accidental protocol coupling that note warns against). Shared by
+// every envelope kind (v1, v2, …) so the frame byte-layout lives in exactly
+// one place — a v1/v2 divergence here would be invisible to either side
+// until a cross-version open failed.
+function sealHandoffEnvelopeFrame(handoffIdBytes, wrapKey, payload, envelopeKind, nonce) {
     const plaintext = utf8ToBytes(JSON.stringify(payload));
     const n = nonce ?? randomBytes(HANDOFF_NONCE_BYTES);
     if (n.length !== HANDOFF_NONCE_BYTES)
         fail("HANDOFF_ENVELOPE_INVALID", "nonce must be 24 bytes", "sealing handoff envelope");
-    const aad = handoffEnvelopeAad(handoffIdBytes, HANDOFF_ENVELOPE_KIND);
+    const aad = handoffEnvelopeAad(handoffIdBytes, envelopeKind);
     const ct = handoffAeadSeal(wrapKey, n, aad, plaintext);
     const frame = concatBytes(utf8ToBytes(HANDOFF_FRAME_MAGIC), new Uint8Array([HANDOFF_FRAME_VERSION_BYTE]), n, ct);
-    return { sealed_envelope: base64.encode(frame), envelope_kind: HANDOFF_ENVELOPE_KIND };
+    return { sealed_envelope: base64.encode(frame), envelope_kind: envelopeKind };
 }
-/** Open a sealed handoff envelope under `wrap_key` (standard base64 as the claim response carries it, or base64url). Throws `HANDOFF_ENVELOPE_INVALID` on any header mismatch and `HANDOFF_AEAD_AUTH_FAILURE` on a bad key/AAD/ciphertext. */
-export function openHandoffEnvelope(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind = HANDOFF_ENVELOPE_KIND) {
+/** Seal the handoff payload under `wrap_key`. Returns the standard-base64 wire form (openapi `format: byte`) + its declared kind tag. */
+export function sealHandoffEnvelope(handoffIdBytes, wrapKey, payload, nonce) {
+    return sealHandoffEnvelopeFrame(handoffIdBytes, wrapKey, payload, HANDOFF_ENVELOPE_KIND, nonce);
+}
+/**
+ * Decodes, header-checks, AEAD-opens, and JSON-parses a sealed envelope,
+ * returning the RAW parsed payload with no shape validation — shared by
+ * every envelope kind (mirrors {@link sealHandoffEnvelopeFrame} on the seal
+ * side) so the frame byte-layout lives in exactly one place. Each envelope
+ * kind's own `open*` function applies its OWN shape check on the result;
+ * this function deliberately does not, since a shape check IS the version
+ * discriminator (a v1 opener must reject a `v:2` payload, not silently
+ * accept it — that is what makes `v` meaningful at all).
+ */
+function openHandoffEnvelopeFrame(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind) {
     const frame = decodeSealedEnvelope(sealedEnvelope);
     if (frame === null) {
         fail("HANDOFF_ENVELOPE_INVALID", "sealed_envelope is not valid base64", "opening handoff envelope");
@@ -208,19 +356,75 @@ export function openHandoffEnvelope(handoffIdBytes, wrapKey, sealedEnvelope, env
     const opened = handoffAeadOpen(wrapKey, nonce, aad, ct);
     if (opened === null)
         fail("HANDOFF_AEAD_AUTH_FAILURE", "the sealed envelope failed AEAD authentication under this key", "opening handoff envelope");
-    let payload;
     try {
-        payload = JSON.parse(new TextDecoder().decode(opened));
+        return JSON.parse(new TextDecoder().decode(opened));
     }
     catch {
         fail("HANDOFF_ENVELOPE_INVALID", "opened envelope is not valid JSON", "opening handoff envelope");
     }
+}
+/** Open a sealed handoff envelope under `wrap_key` (standard base64 as the claim response carries it, or base64url). Throws `HANDOFF_ENVELOPE_INVALID` on any header mismatch, a `v:2` (or otherwise non-v1) payload shape, and `HANDOFF_AEAD_AUTH_FAILURE` on a bad key/AAD/ciphertext. */
+export function openHandoffEnvelope(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind = HANDOFF_ENVELOPE_KIND) {
+    const payload = openHandoffEnvelopeFrame(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind);
     const p = payload;
     if (p.v !== 1 || p.kind !== "handoff" || typeof p.repo_id !== "string" || typeof p.epoch !== "string" || typeof p.k_e_hex !== "string" || !p.checkpoint || p.note_schema !== "kygit.handoff-note.v1") {
         fail("HANDOFF_ENVELOPE_INVALID", "opened envelope does not match the kygit.handoff-note.v1 payload shape", "opening handoff envelope");
     }
     return p;
 }
+// ─── Envelope v2 (gitvault-multi-writer D4/§4.17) ────────────────────────────
+/**
+ * `kygit-handoff-envelope-v2` adds `writer_admission_grant_sha256` to the
+ * v1 payload — design D4's "no hash cycle: grant first, then seal": the
+ * minter builds + signs {@link WriterAdmissionGrant} FIRST, hashes its
+ * stored bytes SECOND, and only THEN seals this envelope carrying that
+ * hash. The claimant cross-checks it against the grant the gateway
+ * independently returns at claim, an integrity binding entirely
+ * independent of anything the gateway could tamper with (the envelope's
+ * AEAD authenticity comes from `wrap_key`, which the gateway never holds).
+ */
+export const HANDOFF_ENVELOPE_V2_KIND = "kygit-handoff-envelope-v2";
+/** Seal a v2 envelope — identical framing to {@link sealHandoffEnvelope}, tagged `kygit-handoff-envelope-v2` so its AAD (and therefore its ciphertext) is never confusable with a v1 envelope of the same handoff. */
+export function sealHandoffEnvelopeV2(handoffIdBytes, wrapKey, payload, nonce) {
+    if (!GITVAULT_SHA256_RE.test(payload.writer_admission_grant_sha256)) {
+        fail("VALIDATION_FAILED", "writer_admission_grant_sha256 must be 64 lowercase hex", "sealing handoff envelope v2", { field: "writer_admission_grant_sha256" });
+    }
+    return sealHandoffEnvelopeFrame(handoffIdBytes, wrapKey, payload, HANDOFF_ENVELOPE_V2_KIND, nonce);
+}
+/**
+ * Open a v2 envelope for a writer-activation flow. Refuses a v1 (or any
+ * other non-v2) `envelope_kind` LOCALLY with `HANDOFF_ENVELOPE_UNSUPPORTED`
+ * BEFORE attempting to decrypt anything — post-gitvault-multi-writer, a
+ * writer-activation-aware `resume` needs `writer_admission_grant_sha256` to
+ * cross-check the returned grant, and a pre-rev-47 v1 envelope structurally
+ * has none. Shares ONLY the frame/AEAD-opening step with
+ * {@link openHandoffEnvelope} ({@link openHandoffEnvelopeFrame}) — NOT that
+ * function itself, since its `v !== 1` shape check would (correctly) refuse
+ * a v2 payload; this function applies its own `v !== 2` shape check
+ * instead. Callers that only need K_repo/checkpoint delivery, with no
+ * writer activation, keep using {@link openHandoffEnvelope} against a v1
+ * envelope as before — v1 and v2 are NOT interchangeable at the shape
+ * layer, by design.
+ */
+export function openHandoffEnvelopeV2(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind) {
+    if (envelopeKind !== HANDOFF_ENVELOPE_V2_KIND) {
+        fail("HANDOFF_ENVELOPE_UNSUPPORTED", `this handoff's envelope is ${envelopeKind ? `\`${envelopeKind}\`` : "of an unrecognized kind"}, not \`${HANDOFF_ENVELOPE_V2_KIND}\` — writer activation needs the v2 envelope's writer_admission_grant_sha256, which a pre-gitvault-multi-writer handoff never carries`, "opening handoff envelope for writer activation", { received: envelopeKind, required: HANDOFF_ENVELOPE_V2_KIND });
+    }
+    const payload = openHandoffEnvelopeFrame(handoffIdBytes, wrapKey, sealedEnvelope, envelopeKind);
+    const p = payload;
+    if (p.v !== 2 ||
+        p.kind !== "handoff" ||
+        typeof p.repo_id !== "string" ||
+        typeof p.epoch !== "string" ||
+        typeof p.k_e_hex !== "string" ||
+        !p.checkpoint ||
+        p.note_schema !== "kygit.handoff-note.v1" ||
+        typeof p.writer_admission_grant_sha256 !== "string" ||
+        !GITVAULT_SHA256_RE.test(p.writer_admission_grant_sha256)) {
+        fail("HANDOFF_ENVELOPE_INVALID", "opened envelope does not match the v2 kygit.handoff-note.v1 payload shape", "opening handoff envelope for writer activation");
+    }
+    return p;
+}
 export function isKygitHandoffNote(value) {
     if (!value || typeof value !== "object")
         return false;

package/sdk/dist/node/gitvault-handoff.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault-handoff.js","sourceRoot":"","sources":["../../src/node/gitvault-handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE7H,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB;IAC7E,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAUD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,oBAAoB,GAAqC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE7H,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAUtE,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAK,GAAG,YAAY;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oBAAoB,EAAE,GAAG,KAAK,0BAA0B,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,eAA2B,WAAW,CAAC,mBAAmB,CAAC;IAC/G,IAAI,YAAY,CAAC,MAAM,KAAK,mBAAmB;QAAE,IAAI,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,wBAAwB,CAAC,CAAC;IACzI,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,QAAQ,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uEAAuE;QACvE,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,CAAC,qBAAqB,EAAE,4DAA4D,EAAE,qBAAqB,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,KAAK,CAAC,IAAI,sBAAsB,KAAK,CAAC,IAAI,sBAAsB,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,qBAAqB,EAAE,qCAAqC,EAAE,qBAAqB,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC5C,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,KAAK,CAAC,MAAM,oBAAoB,sBAAsB,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACvH,CAAC;AAED,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAS7D,mHAAmH;AACnH,MAAM,UAAU,oBAAoB,CAAC,cAA0B,EAAE,YAAwB;IACvF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,uBAAuB,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAiBD,2IAA2I;AAC3I,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAAoC,CAAC;AAC1E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,0BAA0B,GAAG,yBAAyB,GAAG,CAAC,GAAG,mBAAmB,CAAC;AAEvF,SAAS,eAAe,CAAC,KAAiB,EAAE,OAAmB,EAAE,GAAe,EAAE,SAAqB;IACrG,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,OAAmB,EAAE,GAAe,EAAE,QAAoB;IACpG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,kBAAkB,CAAC,cAA0B,EAAE,YAAoB;IAC1E,OAAO,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,mBAAmB,CAAC,cAA0B,EAAE,OAAmB,EAAE,OAA+B,EAAE,KAAkB;IACtI,0EAA0E;IAC1E,wEAAwE;IACxE,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,KAAK,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;QAAE,IAAI,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IAC7H,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACtE,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,CAAC;AACzF,CAAC;AAED,8OAA8O;AAC9O,MAAM,UAAU,mBAAmB,CAAC,cAA0B,EAAE,OAAmB,EAAE,cAAsB,EAAE,eAAuB,qBAAqB;IACvJ,MAAM,KAAK,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,GAAG,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,0BAA0B,EAAE,mDAAmD,EAAE,0BAA0B,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrF,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,0BAA0B,EAAE,CAAC;QACrG,IAAI,CAAC,0BAA0B,EAAE,+CAA+C,EAAE,0BAA0B,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,yBAAyB,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI;QAAE,IAAI,CAAC,2BAA2B,EAAE,+DAA+D,EAAE,0BAA0B,CAAC,CAAC;IACpJ,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,0BAA0B,EAAE,mCAAmC,EAAE,0BAA0B,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,CAAC,GAAG,OAA0C,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,EAAE,CAAC;QACrM,IAAI,CAAC,0BAA0B,EAAE,wEAAwE,EAAE,0BAA0B,CAAC,CAAC;IACzI,CAAC;IACD,OAAO,CAA2B,CAAC;AACrC,CAAC;AA8BD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,uBAAuB,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9I,CAAC;AAED,+EAA+E;AAE/E,MAAM,4BAA4B,GAAsB;IACtD,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,oCAAoC;IACpC,oCAAoC;IACpC,sBAAsB;CACvB,CAAC;AAEF,6CAA6C;AAC7C,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0HAA0H;AAC1H,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACzC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,iFAAiF;AACjF,QAAQ,CAAC,CAAC,gBAAgB,CAAC,IAAsB;IAC/C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI;QACzB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;QACzB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC;QAC/B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC;KAC/B,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAU,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAsB;IAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,4BAA4B,EAAE,CAAC;YAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;QACpG,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,KAAK,CAAC,MAAM,qCAAqC,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,4BAA4B,CAAC,IAAsB;IACjE,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,8BAA8B,EAAE,wBAAwB,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MAAM,8FAA8F,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnP,CAAC;AACH,CAAC"}
+{"version":3,"file":"gitvault-handoff.js","sourceRoot":"","sources":["../../src/node/gitvault-handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,aAAa,GACd,MAAM,kCAAkC,CAAC;AAE1C,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB;IAC7E,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAUD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,oBAAoB,GAAqC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE7H,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAUtE,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAK,GAAG,YAAY;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oBAAoB,EAAE,GAAG,KAAK,0BAA0B,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,eAA2B,WAAW,CAAC,mBAAmB,CAAC;IAC/G,IAAI,YAAY,CAAC,MAAM,KAAK,mBAAmB;QAAE,IAAI,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,wBAAwB,CAAC,CAAC;IACzI,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,QAAQ,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uEAAuE;QACvE,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,CAAC,qBAAqB,EAAE,4DAA4D,EAAE,qBAAqB,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,KAAK,CAAC,IAAI,sBAAsB,KAAK,CAAC,IAAI,sBAAsB,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,qBAAqB,EAAE,qCAAqC,EAAE,qBAAqB,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC5C,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,KAAK,CAAC,MAAM,oBAAoB,sBAAsB,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACvH,CAAC;AAED,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAS7D,mHAAmH;AACnH,MAAM,UAAU,oBAAoB,CAAC,cAA0B,EAAE,YAAwB;IACvF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,uBAAuB,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,iEAAiE;AACjE,2EAA2E;AAC3E,6EAA6E;AAC7E,uCAAuC;AAEvC,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,cAA0B,EAAE,YAAwB;IAC5F,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,6BAA6B,CAAC,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAGD,MAAM,mBAAmB,GAAwC,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAoCtH,2OAA2O;AAC3O,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1K,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,gDAAgD,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7M,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,iDAAiD,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACjN,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IACrL,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,wBAAiC;QAC9C,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClF,wBAAwB,EAAE,WAAW,CAAC,KAAK,CAAC,wBAAwB,CAAC;QACrE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACzD,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtI,OAAO,EAAE,GAAG,gBAAgB,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA2B,EAAE,uBAAmC;IACzG,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,WAAW,KAAK,wBAAwB,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACvI,IAAI,KAAK,CAAC,qBAAqB,KAAK,aAAa,CAAC,uBAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,CAAC;AAC/H,CAAC;AAED,6KAA6K;AAC7K,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAA4C,CAAC;AACzF,MAAM,qCAAqC,GAAG,0BAA0B,CAAC;AA6BzE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACrK,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACvE,MAAM,SAAS,GAAiC;QAC9C,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,aAAa,CAAC,gBAAgB,CAAC;QAC9C,cAAc,EAAE,WAAW,CAAC,gBAAgB,CAAC;QAC7C,iBAAiB,EAAE,WAAW,CAAC,KAAK,CAAC,8BAA8B,CAAC;QACpE,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,8BAA8B,CAAC;KAC5E,CAAC;IACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,qCAAqC,EAAE,SAA+C,CAAC,CAAC;IAC3H,OAAO;QACL,SAAS;QACT,oBAAoB,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9E,oBAAoB,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;KACtF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA4B,EAAE,kBAA8B;IACjG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,4BAA4B;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,aAAyB,CAAC;IAC9B,IAAI,aAAyB,CAAC;IAC9B,IAAI,aAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;QACzG,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;QACzG,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,4CAA4C,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,qCAAqC,EAAE,UAAU,CAAC,SAA+C,CAAC,CAAC;IACtI,OAAO,mBAAmB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,mBAAmB,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AACzI,CAAC;AAiBD,2IAA2I;AAC3I,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAAoC,CAAC;AAC1E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,0BAA0B,GAAG,yBAAyB,GAAG,CAAC,GAAG,mBAAmB,CAAC;AAEvF,SAAS,eAAe,CAAC,KAAiB,EAAE,OAAmB,EAAE,GAAe,EAAE,SAAqB;IACrG,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,OAAmB,EAAE,GAAe,EAAE,QAAoB;IACpG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,kBAAkB,CAAC,cAA0B,EAAE,YAAoB;IAC1E,OAAO,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,wEAAwE;AACxE,+DAA+D;AAC/D,kEAAkE;AAClE,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,qCAAqC;AACrC,SAAS,wBAAwB,CAAC,cAA0B,EAAE,OAAmB,EAAE,OAAgB,EAAE,YAAoB,EAAE,KAAkB;IAC3I,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,KAAK,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;QAAE,IAAI,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IAC7H,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AAChF,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,mBAAmB,CAAC,cAA0B,EAAE,OAAmB,EAAE,OAA+B,EAAE,KAAkB;IACtI,OAAO,wBAAwB,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAAC,cAA0B,EAAE,OAAmB,EAAE,cAAsB,EAAE,YAAoB;IAC7H,MAAM,KAAK,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,GAAG,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,0BAA0B,EAAE,mDAAmD,EAAE,0BAA0B,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrF,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,0BAA0B,EAAE,CAAC;QACrG,IAAI,CAAC,0BAA0B,EAAE,+CAA+C,EAAE,0BAA0B,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,yBAAyB,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI;QAAE,IAAI,CAAC,2BAA2B,EAAE,+DAA+D,EAAE,0BAA0B,CAAC,CAAC;IACpJ,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,0BAA0B,EAAE,mCAAmC,EAAE,0BAA0B,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,4RAA4R;AAC5R,MAAM,UAAU,mBAAmB,CAAC,cAA0B,EAAE,OAAmB,EAAE,cAAsB,EAAE,eAAuB,qBAAqB;IACvJ,MAAM,OAAO,GAAG,wBAAwB,CAAC,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,OAA0C,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,EAAE,CAAC;QACrM,IAAI,CAAC,0BAA0B,EAAE,wEAAwE,EAAE,0BAA0B,CAAC,CAAC;IACzI,CAAC;IACD,OAAO,CAA2B,CAAC;AACrC,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAAoC,CAAC;AAc7E,sNAAsN;AACtN,MAAM,UAAU,qBAAqB,CAAC,cAA0B,EAAE,OAAmB,EAAE,OAAiC,EAAE,KAAkB;IAC1I,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,mBAAmB,EAAE,wDAAwD,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,OAAO,wBAAwB,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAA0B,EAAE,OAAmB,EAAE,cAAsB,EAAE,YAAoB;IACjI,IAAI,YAAY,KAAK,wBAAwB,EAAE,CAAC;QAC9C,IAAI,CACF,8BAA8B,EAC9B,8BAA8B,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,yBAAyB,WAAW,wBAAwB,uIAAuI,EACxQ,gDAAgD,EAChD,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,OAA4C,CAAC;IACvD,IACE,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,CAAC,CAAC,CAAC,UAAU;QACb,CAAC,CAAC,WAAW,KAAK,uBAAuB;QACzC,OAAO,CAAC,CAAC,6BAA6B,KAAK,QAAQ;QACnD,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,EACzD,CAAC;QACD,IAAI,CAAC,0BAA0B,EAAE,2EAA2E,EAAE,gDAAgD,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,CAA6B,CAAC;AACvC,CAAC;AA8BD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,uBAAuB,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9I,CAAC;AAED,+EAA+E;AAE/E,MAAM,4BAA4B,GAAsB;IACtD,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,oBAAoB;IACpB,oCAAoC;IACpC,oCAAoC;IACpC,sBAAsB;CACvB,CAAC;AAEF,6CAA6C;AAC7C,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0HAA0H;AAC1H,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACzC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,iFAAiF;AACjF,QAAQ,CAAC,CAAC,gBAAgB,CAAC,IAAsB;IAC/C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI;QACzB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;QACzB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC;QAC/B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC;KAC/B,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAU,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAsB;IAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,4BAA4B,EAAE,CAAC;YAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;QACpG,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,KAAK,CAAC,MAAM,qCAAqC,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,4BAA4B,CAAC,IAAsB;IACjE,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,8BAA8B,EAAE,wBAAwB,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MAAM,8FAA8F,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnP,CAAC;AACH,CAAC"}

package/sdk/dist/node/gitvault-keystore.d.ts

@@ -42,6 +42,14 @@ export interface GitvaultIdentityFile {
     encryption_pubkey: string;
     /** `ek_` fingerprint. */
     encryption_fingerprint: string;
+    /**
+     * The control-plane principal this identity ENROLLED as (consult round 2
+     * §9e) — persisted after the first successful authenticated enrollment so a
+     * later run under a DIFFERENT profile fails loudly instead of silently
+     * reusing another principal's custody identity. Absent on identities that
+     * have never enrolled.
+     */
+    enrolled_principal_id?: string;
     created_at: string;
 }
 /** The dual pins (protocol §6.4): the newest authenticated head and its generation. */
@@ -142,6 +150,55 @@ export interface GitvaultRepoFile {
             ek_fingerprint: string;
         }[];
     } | null;
+    /**
+     * gitvault-multi-writer rev 47 (protocol §4.15) — the writer-set analog of
+     * {@link head_pin}: the chain-replayed writer state as of THIS repo's own
+     * `head_pin`/`verified_prefix` generation, persisted so `GitvaultVault.verifyToNewest`
+     * never has to re-walk the writer set from genesis on every call. Advances
+     * in lockstep with `head_pin`/`verified_prefix` — always at the SAME
+     * generation, never ahead or behind. `null` until the first `verifyToNewest`
+     * call on this checkout (equivalent to the genesis-only singleton, which
+     * that call derives for free without needing this field yet).
+     */
+    writer_set_pin?: {
+        version: string;
+        sha256: string;
+        writers: {
+            writer_key_id: string;
+            signing_pubkey: string;
+        }[];
+        pinned_at: string;
+    } | null;
+    /**
+     * gitvault-multi-writer rev 47 — THIS principal's own relationship to the
+     * chain-verified `writer_set_pin` above, as of the last time it was
+     * computed (`repos view`/`doctor`/reconcile — task 5.7). `"pending"`: a
+     * claimed handoff or a directory publish is waiting on the actual
+     * `add_writer_key` push (see `pending_writer_admission` below).
+     * `"active"`: this principal's own signing key IS in `writer_set_pin.writers`.
+     * `"not_admitted"`: an active, eligible org member whose key has never
+     * been added. `"removed"`: a key that WAS a writer and was chain-removed
+     * (permanently — see `writer-state.ts`'s `burnedWriterKeyIds`). `null`
+     * until first computed (e.g. a checkout with no local signing key at all).
+     */
+    writer_status?: "pending" | "active" | "not_admitted" | "removed" | null;
+    /**
+     * gitvault-multi-writer rev 47 (task 5.6) — set by `resume()` the moment a
+     * handoff claim response's `writer_admission_grant` is verified and
+     * persisted, BEFORE the recipient's own `add_writer_key{"handoff"}`
+     * activation push lands on-chain; cleared once that push is admitted
+     * (`writer_status` flips to `"active"` at the same time). Surviving this
+     * field across a crash is exactly what makes the activation push
+     * idempotently resumable (task 5.6's "crash replay") — the grant + the
+     * writer_key_id it names are the only state a retry needs, and both are
+     * already locally held (the grant was echoed verbatim in the claim
+     * response; nothing here is ever re-derived from a network call).
+     */
+    pending_writer_admission?: {
+        handoff_id: string;
+        writer_admission_grant: Record<string, unknown>;
+        claimed_writer_key_id: string;
+    } | null;
     /** The last ref transaction this principal published (5.4 fills it). */
     last_ref_transaction: Record<string, unknown> | null;
     /** How this file came to exist — creation, or a §5.1 restore from the principal's own envelope. */
@@ -155,7 +212,7 @@ export interface GitvaultAuditEntry {
     repo_id?: string;
     details?: Record<string, unknown>;
 }
-export type GitvaultAuditEvent = "keystore_opened" | "identity_created" | "repo_saved" | "repo_restored_from_envelope" | "recovery_receipt_stored" | "permission_finding" | "lock_acquired" | "lock_released" | "lock_stale_reclaimed" | "transition_assessed" | "journal_stage" | "epoch_rotation_recorded";
+export type GitvaultAuditEvent = "keystore_opened" | "identity_created" | "identity_principal_bound" | "repo_saved" | "repo_restored_from_envelope" | "recovery_receipt_stored" | "permission_finding" | "lock_acquired" | "lock_released" | "lock_stale_reclaimed" | "transition_assessed" | "journal_stage" | "epoch_rotation_recorded";
 /** A permission-audit finding (never fatal by default; surfaced to doctor). */
 export interface GitvaultPermissionFinding {
     path: string;
@@ -233,6 +290,12 @@ export declare class GitvaultKeystore {
     readIdentity(): GitvaultIdentityFile | null;
     /** Create the identity if absent; never overwrites an existing one. */
     ensureIdentity(): GitvaultIdentityFile;
+    /**
+     * Record (idempotently) which principal this identity enrolled as. A
+     * DIFFERENT already-recorded principal is refused — a deliberate migration
+     * deletes/replaces the identity, it never silently rebinds.
+     */
+    bindIdentityPrincipal(principalId: string): void;
     /** The signing keypair, or `null` when the signing seed is lost (read-only principal). */
     signingKeypair(identity?: GitvaultIdentityFile): GitvaultSigningKeypair | null;
     /** The encryption keypair, or `null` when the X25519 private key is lost. */
@@ -275,7 +338,7 @@ export declare class GitvaultKeystore {
     /** Save (create or replace) a repo file under the per-repo lock. */
     saveRepo(repo: Omit<GitvaultRepoFile, "version" | "updated_at">): GitvaultRepoFile;
     /** Update the dual pins / last ref transaction without touching key material. */
-    updateRepo(repoId: string, patch: Partial<Pick<GitvaultRepoFile, "head_pin" | "materialized_pin" | "verified_prefix" | "last_ref_transaction" | "epoch" | "envelope_recipient_pins" | "k_repo_hex" | "epoch_keys" | "known_pin_manifest" | "checkpoint_covers_through" | "object_store_origins">>): GitvaultRepoFile;
+    updateRepo(repoId: string, patch: Partial<Pick<GitvaultRepoFile, "head_pin" | "materialized_pin" | "verified_prefix" | "last_ref_transaction" | "epoch" | "envelope_recipient_pins" | "k_repo_hex" | "epoch_keys" | "known_pin_manifest" | "checkpoint_covers_through" | "object_store_origins" | "writer_set_pin" | "writer_status" | "pending_writer_admission">>): GitvaultRepoFile;
     /**
      * gitvault-object-host-predial (design D1/D4, task 1.2): record that
      * `origins` (already-normalized `scheme://host` strings) were observed
@@ -369,9 +432,21 @@ export declare class GitvaultKeystore {
         envelope: GitvaultKeyEnvelope;
         /** A surviving receipt (on disk or supplied) authenticates the genesis; without one the restore is labeled unauthenticated salvage. */
         recovery_receipt?: GitvaultRecoveryReceipt | null;
+        /**
+         * gitvault-agent-envelopes D4: the caller verified genesis's creator
+         * fingerprints against the control plane's SIGNED allocation record. That
+         * is platform-attested consistency, NOT independent authentication — the
+         * platform serves both sides of the comparison — so it labels the restore
+         * `platform_attested`, never `receipt`. `continuity` says whether this
+         * keystore had already pinned this genesis (a later open) or is seeing it
+         * for the first time.
+         */
+        allocation_attested?: boolean;
     }): Promise<{
         repo: GitvaultRepoFile;
-        trust: "receipt" | "unauthenticated_salvage";
+        trust: "receipt" | "platform_attested" | "unauthenticated_salvage";
+        continuity: "first_seen" | "pinned";
+        independently_verified: boolean;
     }>;
     /** Identity fingerprints for display/doctor (never key material). */
     identitySummary(): {

package/sdk/dist/node/gitvault-keystore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault-keystore.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA0BH,OAAO,KAAK,EACV,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EAEvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iCAAiC,CAAC;AAIzC,wGAAwG;AACxG,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,UAAU,EAAE,MAAM,CAAC;IACnB,+KAA+K;IAC/K,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3C,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,mJAAmJ;IACnJ,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,mHAAmH;IACnH,gBAAgB,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,iIAAiI;IACjI,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACpJ,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrD,mGAAmG;IACnG,UAAU,EAAE,SAAS,GAAG,wBAAwB,GAAG,uBAAuB,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,kBAAkB,GAClB,YAAY,GACZ,6BAA6B,GAC7B,yBAAyB,GACzB,oBAAoB,GACpB,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,qBAAqB,GACrB,eAAe,GACf,yBAAyB,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,2BAA2B,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,iCAAiC,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GAClF;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC1E;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,+GAA+G;IAC/G,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAUD,2GAA2G;AAC3G,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,8JAA8J;AAC9J,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAWnD,qEAAqE;AACrE,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBpE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5D;AAsBD,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAEhC,OAAO,GAAE,uBAA4B;IAMjD,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,uBAA4B,GAAG,gBAAgB;IAWpE,IAAI,YAAY,IAAI,MAAM,CAAgD;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAAwC;IAC9D,IAAI,WAAW,IAAI,MAAM,CAA2C;IACpE,IAAI,UAAU,IAAI,MAAM,CAA0C;IAClE,IAAI,YAAY,IAAI,MAAM,CAA4C;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIhC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAO3C,gGAAgG;IAChG,gBAAgB,IAAI,yBAAyB,EAAE;IAyB/C,qEAAqE;IACrE,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAe1F,wCAAwC;IACxC,YAAY,IAAI,kBAAkB,EAAE;IAQpC,YAAY,IAAI,oBAAoB,GAAG,IAAI;IAU3C,uEAAuE;IACvE,cAAc,IAAI,oBAAoB;IAuBtC,0FAA0F;IAC1F,cAAc,CAAC,QAAQ,GAAE,oBAA6C,GAAG,sBAAsB,GAAG,IAAI;IAStG,6EAA6E;IAC7E,iBAAiB,CAAC,QAAQ,GAAE,oBAA6C,GAAG,yBAAyB,GAAG,IAAI;IAS5G,OAAO,CAAC,eAAe;IAQvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAUjD,WAAW,IAAI,MAAM,EAAE;IAKvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAsB7E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG,gBAAgB;IASlF,iFAAiF;IACjF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,OAAO,GAAG,yBAAyB,GAAG,YAAY,GAAG,YAAY,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,sBAAsB,CAAC,CAAC,GAAG,gBAAgB;IAUpT;;;;;;;;;;;;;OAaG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAoC1E,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAE1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,eAAe;IAGvB,OAAO,CAAC,iBAAiB;IASzB,2FAA2F;IAC3F,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAG/E,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAI3E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAGhG,kHAAkH;IAClH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAK5F,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMrH,wHAAwH;IACxH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAKjH;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAsBxB,+MAA+M;IAC/M,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMtC;;;;;;;OAOG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB;IAc3G,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAO3D,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI;IAOnE;;;;OAIG;IACH,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,mBAAwB,GAAG,CAAC;IAqClF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,OAAO,CAAC,gBAAgB;IA0BxB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAyB7E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,uIAAuI;QACvI,gBAAgB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;KACnD,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,yBAAyB,CAAA;KAAE,CAAC;IA0CrF,qEAAqE;IACrE,eAAe,IAAI;QAAE,mBAAmB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAazJ"}
+{"version":3,"file":"gitvault-keystore.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2BH,OAAO,KAAK,EACV,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EAEvB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,iCAAiC,CAAC;AAIzC,wGAAwG;AACxG,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,UAAU,EAAE,MAAM,CAAC;IACnB,+KAA+K;IAC/K,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3C,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,mJAAmJ;IACnJ,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,mHAAmH;IACnH,gBAAgB,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,iIAAiI;IACjI,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACpJ;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7I;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACzE;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzI,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrD,mGAAmG;IACnG,UAAU,EAAE,SAAS,GAAG,wBAAwB,GAAG,uBAAuB,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,kBAAkB,GAClB,0BAA0B,GAC1B,YAAY,GACZ,6BAA6B,GAC7B,yBAAyB,GACzB,oBAAoB,GACpB,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,qBAAqB,GACrB,eAAe,GACf,yBAAyB,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,2BAA2B,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,iCAAiC,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GAClF;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC1E;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,+GAA+G;IAC/G,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAUD,2GAA2G;AAC3G,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,8JAA8J;AAC9J,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAWnD,qEAAqE;AACrE,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBpE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5D;AAsBD,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAEhC,OAAO,GAAE,uBAA4B;IAMjD,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,uBAA4B,GAAG,gBAAgB;IAWpE,IAAI,YAAY,IAAI,MAAM,CAAgD;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAAwC;IAC9D,IAAI,WAAW,IAAI,MAAM,CAA2C;IACpE,IAAI,UAAU,IAAI,MAAM,CAA0C;IAClE,IAAI,YAAY,IAAI,MAAM,CAA4C;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIhC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAO3C,gGAAgG;IAChG,gBAAgB,IAAI,yBAAyB,EAAE;IAyB/C,qEAAqE;IACrE,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAe1F,wCAAwC;IACxC,YAAY,IAAI,kBAAkB,EAAE;IAQpC,YAAY,IAAI,oBAAoB,GAAG,IAAI;IAU3C,uEAAuE;IACvE,cAAc,IAAI,oBAAoB;IAuBtC;;;;OAIG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAUhD,0FAA0F;IAC1F,cAAc,CAAC,QAAQ,GAAE,oBAA6C,GAAG,sBAAsB,GAAG,IAAI;IAStG,6EAA6E;IAC7E,iBAAiB,CAAC,QAAQ,GAAE,oBAA6C,GAAG,yBAAyB,GAAG,IAAI;IAS5G,OAAO,CAAC,eAAe;IAQvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAUjD,WAAW,IAAI,MAAM,EAAE;IAKvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAsB7E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG,gBAAgB;IASlF,iFAAiF;IACjF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,OAAO,GAAG,yBAAyB,GAAG,YAAY,GAAG,YAAY,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,eAAe,GAAG,0BAA0B,CAAC,CAAC,GAAG,gBAAgB;IAUtX;;;;;;;;;;;;;OAaG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAoC1E,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAE1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,eAAe;IAGvB,OAAO,CAAC,iBAAiB;IASzB,2FAA2F;IAC3F,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAG/E,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAI3E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAGhG,kHAAkH;IAClH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAK5F,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMrH,wHAAwH;IACxH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAKjH;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAsBxB,+MAA+M;IAC/M,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMtC;;;;;;;OAOG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB;IAc3G,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAO3D,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI;IAOnE;;;;OAIG;IACH,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,mBAAwB,GAAG,CAAC;IAqClF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,OAAO,CAAC,gBAAgB;IA0BxB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAyB7E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,uIAAuI;QACvI,gBAAgB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;QAClD;;;;;;;;WAQG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,mBAAmB,GAAG,yBAAyB,CAAC;QAAC,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,CAAC;IAiEjL,qEAAqE;IACrE,eAAe,IAAI;QAAE,mBAAmB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAazJ"}

package/sdk/dist/node/gitvault-keystore.js

@@ -30,7 +30,7 @@ import { closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, open
 import { dirname, join } from "node:path";
 import { getConfigDir } from "../../core-dist/config.js";
 import { LocalError } from "../errors.js";
-import { GITVAULT_EK_RE, GITVAULT_SRC_RE, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT, GITVAULT_VK_RE, bytesToHex, checkGenesisKeyBindings, checkRecoveryReceipt, ekFingerprint, formatGitvaultTimestamp, generateEncryptionKeypair, generateSigningKeypair, hexToBytes, openKeyEnvelope, storedBytesSha256, toBase64url, verifyGitvaultObject, vkFingerprint, } from "../namespaces/gitvault.crypto.js";
+import { GITVAULT_EK_RE, GITVAULT_SRC_RE, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT, GITVAULT_VK_RE, bytesToHex, checkGenesisKeyBindings, checkRecoveryReceipt, ekFingerprint, fromBase64url, formatGitvaultTimestamp, generateEncryptionKeypair, generateSigningKeypair, hexToBytes, openKeyEnvelope, storedBytesSha256, toBase64url, verifyGitvaultObject, vkFingerprint, } from "../namespaces/gitvault.crypto.js";
 function fail(code, message, context, details) {
     throw new LocalError(message, context, { code, details });
 }
@@ -257,6 +257,21 @@ export class GitvaultKeystore {
         this.audit("identity_created", undefined, { signing_fingerprint: identity.signing_fingerprint, encryption_fingerprint: identity.encryption_fingerprint });
         return identity;
     }
+    /**
+     * Record (idempotently) which principal this identity enrolled as. A
+     * DIFFERENT already-recorded principal is refused — a deliberate migration
+     * deletes/replaces the identity, it never silently rebinds.
+     */
+    bindIdentityPrincipal(principalId) {
+        const identity = this.requireIdentity();
+        if (identity.enrolled_principal_id === principalId)
+            return;
+        if (identity.enrolled_principal_id) {
+            fail("GITVAULT_IDENTITY_PROFILE_MISMATCH", `this keystore identity enrolled as principal ${identity.enrolled_principal_id}, not ${principalId} — refusing cross-profile reuse`, "binding gitvault identity", { enrolled_principal_id: identity.enrolled_principal_id, principal_id: principalId });
+        }
+        writeFileAtomic0600(this.identityPath, JSON.stringify({ ...identity, enrolled_principal_id: principalId }, null, 2));
+        this.audit("identity_principal_bound", undefined, { principal_id: principalId });
+    }
     /** The signing keypair, or `null` when the signing seed is lost (read-only principal). */
     signingKeypair(identity = this.requireIdentity()) {
         if (!identity.signing_seed_hex)
@@ -696,13 +711,39 @@ export class GitvaultKeystore {
         if (!verifyGitvaultObject(genesis, genesis.creator_signing_pubkey)) {
             fail("GITVAULT_SIGNATURE_INVALID", "vault_genesis signature does not verify", "restoring gitvault repo state", { repo_id: genesis.repo_id });
         }
-        const bindings = checkGenesisKeyBindings(genesis, envelope);
+        // The creator's OWN genesis envelope is bound to genesis byte-for-byte
+        // (hash + size + recipient). Any OTHER recipient's envelope (a member
+        // wrapped post-genesis — gitvault-agent-envelopes D4's cold open) is
+        // not in genesis at all: for it, check genesis's own structural bindings
+        // plus the envelope's addressing (this vault, this epoch, written under
+        // the registered writer key); `openKeyEnvelope` then verifies the
+        // writer's signature over it before anything is opened.
+        const creatorEk = ekFingerprint(fromBase64url(genesis.creator_encryption_pubkey, "creator_encryption_pubkey"));
+        const isCreatorEnvelope = envelope.recipient_fingerprint === creatorEk;
+        const bindings = isCreatorEnvelope ? checkGenesisKeyBindings(genesis, envelope) : checkGenesisKeyBindings(genesis);
+        if (!isCreatorEnvelope) {
+            if (envelope.repo_id !== genesis.repo_id)
+                bindings.push("stored_envelope_repo_id");
+            if (envelope.epoch !== genesis.epoch)
+                bindings.push("stored_envelope_epoch");
+            if (envelope.created_by !== genesis.writer_key_id)
+                bindings.push("stored_envelope_created_by");
+        }
         if (bindings.length > 0) {
             fail("VAULT_CREATION_CONFLICT", "genesis key bindings do not hold for the stored envelope", "restoring gitvault repo state", { repo_id: genesis.repo_id, problems: bindings });
         }
         const genesisSha = storedBytesSha256(genesis);
+        // First-open pin (agent-envelopes D4): a genesis this keystore already
+        // pinned for this repo_id — in a surviving repo file or the cached genesis
+        // — must be the SAME genesis; a different one is a substituted vault.
+        const priorRepo = this.readRepo(genesis.repo_id);
+        const priorPin = priorRepo?.genesis_sha256 ?? this.readCachedGenesis(genesis.repo_id)?.sha256 ?? null;
+        if (priorPin && priorPin !== genesisSha) {
+            fail("VAULT_CREATION_CONFLICT", `the admitted genesis (${genesisSha}) is not the one this keystore pinned (${priorPin}); refusing a substituted vault`, "restoring gitvault repo state", { repo_id: genesis.repo_id, admitted: genesisSha, pinned: priorPin });
+        }
+        const continuity = priorPin ? "pinned" : "first_seen";
         const receipt = input.recovery_receipt ?? this.readRecoveryReceipt(genesis.repo_id);
-        let trust = "unauthenticated_salvage";
+        let trust = input.allocation_attested ? "platform_attested" : "unauthenticated_salvage";
         if (receipt) {
             const problems = checkRecoveryReceipt(receipt, genesis);
             if (problems.length > 0) {
@@ -725,8 +766,8 @@ export class GitvaultKeystore {
             last_ref_transaction: null,
             provenance: "restored_from_envelope",
         });
-        this.audit("repo_restored_from_envelope", genesis.repo_id, { trust });
-        return { repo, trust };
+        this.audit("repo_restored_from_envelope", genesis.repo_id, { trust, continuity });
+        return { repo, trust, continuity, independently_verified: trust === "receipt" };
     }
     /** Identity fingerprints for display/doctor (never key material). */
     identitySummary() {