run402 4.68.3 → 4.69.1

package/sdk/dist/node/gitvault-writer-state.d.ts

@@ -0,0 +1,201 @@
+/**
+ * The exact, closed set of refusal codes this module can ever return —
+ * mirrors the gateway's `WriterStateRefusalCode` exactly (same union, same
+ * names) so a caller's error mapping needs no translation table.
+ */
+export type WriterStateRefusalCode = "VALIDATION_FAILED" | "GITVAULT_WRITER_NOT_ADMITTED" | "HANDOFF_KEY_REVOKED" | "RECIPIENT_SET_MISMATCH" | "EPOCH_ROTATION_WOULD_LEAVE_VAULT_UNCOVERED";
+export type WriterStateVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    code: WriterStateRefusalCode;
+    detail: string;
+};
+export declare const ORG_ROLE_RANK: Readonly<Record<string, number>>;
+export declare const WRITER_ELIGIBLE_ROLE_RANK: number;
+/** Does `role` meet the writer-eligibility threshold (developer or above)? An unknown/absent role never does. */
+export declare function meetsWriterEligibleRole(role: string | null | undefined): boolean;
+/**
+ * gitvault-multi-writer rev 47 (task 5.5) — predicts the role a handoff mint
+ * will actually confer, mirroring the gateway's OWN attenuation exactly
+ * (`services/gitvault/claims.ts mintHandoff`: `requestedRole &&
+ * roleRank(requestedRole) < roleRank(minterRole) ? requestedRole :
+ * minterRole`). The mint's `writer_admission_grant.minted_role` must equal
+ * this prediction byte-for-byte or the gateway refuses VALIDATION_FAILED —
+ * after the checkpoint push has already been paid for — so getting the
+ * comparison direction right matters. An unrecognized `requestedRole`
+ * (never a legal `OrgRole` server-side either) is treated as "no request":
+ * a garbage role string fails the gateway's OWN mint validation before its
+ * attenuation logic — and therefore before this grant-mismatch check —
+ * ever runs, so predicting `minterRole` for that case is never observed as
+ * wrong, only moot.
+ */
+export declare function predictMintedRole(requestedRole: string | undefined, minterRole: string): string;
+export interface WriterKeyEntry {
+    writer_key_id: string;
+    signing_pubkey: string;
+}
+/** The full chain-derived writer state at some generation — protocol §4.15. */
+export interface WriterChainState {
+    version: string;
+    writers: readonly WriterKeyEntry[];
+    sha256: string;
+    /** Permanently burned writer_key_ids — protocol §4.15, never re-addable, on this vault, ever. */
+    burnedWriterKeyIds: ReadonlySet<string>;
+    /** Permanently consumed handoff_ids — protocol §4.17, a writer_admission_grant is single-use. */
+    consumedHandoffIds: ReadonlySet<string>;
+}
+/**
+ * `vk_` fingerprint of a base64url-encoded Ed25519 public key, or `null` for
+ * anything that doesn't decode as a canonical 32-byte base64url scalar —
+ * mirrors the gateway's `writerKeyIdOf` (never throws on a malformed key).
+ */
+export declare function writerKeyIdOf(signingPubkeyB64u: string): string | null;
+/** protocol §4.15: writer_set_sha256 = SHA-256(JCS({format, repo_id, version, writers})). */
+export declare function writerSetSha256(repoId: string, version: string, writers: readonly WriterKeyEntry[]): string;
+/**
+ * protocol §4.15: the version-0 singleton, derived from `creator_signing_pubkey`
+ * (see the module doc for why this diverges from reading a `writer_key_id`
+ * field directly).
+ */
+export declare function initialWriterState(repoId: string, genesis: {
+    creator_signing_pubkey: string;
+}): WriterChainState;
+/**
+ * protocol §4.16: apply an ALREADY-ADMITTED `add_writer_key` transition.
+ * Caller MUST have validated it first (`validateAddWriterKeyPayload`) — this
+ * function performs no checks, it only advances state.
+ */
+/**
+ * gitvault-multi-writer (task 5.6) — builds a well-formed `handoff`-door
+ * `add_writer_key` payload (schema `r402s.add-writer-key/v1`) from a
+ * predecessor writer-set pin and the claimant's own key — the pure
+ * assembly step `GitvaultVault.submitWriterActivationHead` delegates to,
+ * kept separate so it can be unit-tested directly against
+ * {@link validateAddWriterKeyPayload} without a full vault/keystore/git
+ * harness. `predecessorPin` needs only `{version, sha256, writers}` — the
+ * caller's persisted `writer_set_pin` shape already matches, no
+ * `WriterChainState` (with its Sets) is required to build an OUTGOING
+ * payload; only to VALIDATE an incoming one.
+ */
+export declare function buildAddWriterKeyActivationPayload(repoId: string, predecessorPin: {
+    version: string;
+    sha256: string;
+    writers: readonly WriterKeyEntry[];
+}, addedWriter: WriterKeyEntry & {
+    principal_id: string;
+}, handoffId: string, grant: Record<string, unknown>, acceptance: Record<string, unknown>): AddWriterKeyPayload;
+/**
+ * gitvault-multi-writer (task 5.7) — builds a well-formed `writer`-door
+ * `add_writer_key` payload from a predecessor writer-set pin and the
+ * candidate's own published signing key. Unlike {@link
+ * buildAddWriterKeyActivationPayload} (the handoff door), this authorization
+ * carries no grant/acceptance — `validateAddWriterKeyPayload`'s `"writer"`
+ * branch licenses it purely by the CARRYING HEAD's own signer already being
+ * an active writer (checked at admission time, both client-side replay and
+ * gateway-side `checkTransitionAdmissible`), so the acting writer's identity
+ * never appears IN the payload itself, only in the head that carries it.
+ */
+export declare function buildWriterDoorAddWriterKeyPayload(repoId: string, predecessorPin: {
+    version: string;
+    sha256: string;
+    writers: readonly WriterKeyEntry[];
+}, addedWriter: WriterKeyEntry & {
+    principal_id: string;
+}): AddWriterKeyPayload;
+export declare function applyAddWriterKey(repoId: string, state: WriterChainState, addedWriter: WriterKeyEntry, consumedHandoffId: string | null): WriterChainState;
+/**
+ * protocol §4.18: apply an ALREADY-ADMITTED `rotate_epoch{writer_set_update}`.
+ * Caller MUST have validated it first (`validateWriterSetUpdate`). `writers`
+ * MAY be empty — the explicit sole-writer `writer_key_revoked` read-only
+ * terminal (D228) is a legal resulting state, not an error at this layer.
+ */
+export declare function applyWriterSetUpdate(repoId: string, state: WriterChainState, removedWriterKeyIds: readonly string[]): WriterChainState;
+/**
+ * The FIRST, ordinary-case lookup (protocol §5A step 1): is this head's own
+ * `writer_key_id` already active in the predecessor writer state? A null
+ * result does not by itself mean refusal — the caller still checks for a
+ * qualifying `add_writer_key{"handoff"}` transition naming exactly this key
+ * before concluding `GITVAULT_WRITER_NOT_ADMITTED`.
+ */
+export declare function resolveActiveWriter(state: WriterChainState, headWriterKeyId: string): WriterKeyEntry | null;
+export interface AddWriterKeyPayload {
+    schema: "r402s.add-writer-key/v1";
+    repo_id: string;
+    base_writer_set: {
+        version: string;
+        sha256: string;
+    };
+    next_writer_set: {
+        version: string;
+        writers: WriterKeyEntry[];
+        sha256: string;
+    };
+    added_writer: {
+        writer_key_id: string;
+        signing_pubkey: string;
+        principal_id: string;
+    };
+    authorization: {
+        kind: "writer";
+    } | {
+        kind: "handoff";
+        grant: Record<string, unknown>;
+        acceptance: Record<string, unknown>;
+    };
+}
+/**
+ * The FULL cryptographic + structural validation of an `add_writer_key`
+ * payload (protocol §4.16/§4.17), given the writer state at the PREDECESSOR
+ * generation and the carrying head's own `writer_key_id`. Does NOT check
+ * `authorization.kind:"writer"`'s org-membership eligibility (active
+ * membership >= developer, directory possession-verification) — that is
+ * gateway-only, live-state-dependent, and re-checked under the admission
+ * fence server-side; a client validating its OWN candidate transition before
+ * submission relies on the gateway's fence-time re-check as the backstop.
+ */
+export declare function validateAddWriterKeyPayload(repoId: string, predecessorState: WriterChainState, payload: AddWriterKeyPayload, headWriterKeyId: string): WriterStateVerdict;
+export interface WriterSetUpdatePayload {
+    base_version: string;
+    base_sha256: string;
+    next_version: string;
+    next_sha256: string;
+    removed: readonly {
+        writer_key_id: string;
+        principal_id: string;
+        reason: string;
+    }[];
+    writers: readonly WriterKeyEntry[];
+}
+/**
+ * The FULL cryptographic + structural validation of a `rotate_epoch`
+ * transition's `writer_set_update` field (protocol §4.18, D227), given the
+ * writer state at the PREDECESSOR generation, the carrying head's own
+ * `writer_key_id`, and the caller's own belief about which writer keys are
+ * due for removal (`gatewayBlockedWriterKeyIds` — for a client building a
+ * CANDIDATE rotation this is `state read (blocked set)`; the gateway's own
+ * fence-time re-check is the source of truth at admission). `allowEmptyResult`
+ * is true ONLY for the explicit, owner+step-up, sole remaining writer
+ * `writer_key_revoked` removal (D228); every other call site passes `false`.
+ */
+export declare function validateWriterSetUpdate(repoId: string, predecessorState: WriterChainState, update: WriterSetUpdatePayload, headWriterKeyId: string, gatewayBlockedWriterKeyIds: ReadonlySet<string>, allowEmptyResult: boolean): WriterStateVerdict;
+/**
+ * DR / offline replay (protocol §5A "Writer-set DR"): rebuild the writer
+ * state purely from genesis + admitted writer-changing transitions, in
+ * order. Every transition MUST already be admitted (this performs no
+ * validation — apply-only, mirroring `applyAddWriterKey`/`applyWriterSetUpdate`).
+ */
+export type AdmittedWriterTransition = {
+    kind: "add_writer_key";
+    addedWriter: WriterKeyEntry;
+    consumedHandoffId: string | null;
+} | {
+    kind: "writer_set_update";
+    removedWriterKeyIds: readonly string[];
+};
+export declare function replayWriterState(repoId: string, genesis: {
+    creator_signing_pubkey: string;
+}, transitions: readonly AdmittedWriterTransition[]): WriterChainState;
+/** protocol §4.15: `MAX_VAULT_WRITERS`. A writer-changing transition producing more active writers than this is refused. */
+export declare const MAX_VAULT_WRITERS = 64;
+//# sourceMappingURL=gitvault-writer-state.d.ts.map

package/sdk/dist/node/gitvault-writer-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-writer-state.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-writer-state.ts"],"names":[],"mappings":"AAwCA;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAC9B,mBAAmB,GACnB,8BAA8B,GAC9B,qBAAqB,GACrB,wBAAwB,GACxB,4CAA4C,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5G,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzD,CAAC;AACH,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AAEjE,iHAAiH;AACjH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/F;AAID,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,iGAAiG;IACjG,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC;AAoBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtE;AAaD,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAG3G;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,sBAAsB,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAiBhH;AAED;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,MAAM,EACd,cAAc,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,EACvF,WAAW,EAAE,cAAc,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EACtD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,mBAAmB,CAWrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,MAAM,EACd,cAAc,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,EACvF,WAAW,EAAE,cAAc,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACrD,mBAAmB,CAWrB;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,cAAc,EAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,gBAAgB,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,gBAAgB,EACvB,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,gBAAgB,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAE3G;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,eAAe,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,YAAY,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,aAAa,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAC9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,mBAAmB,EAC5B,eAAe,EAAE,MAAM,GACtB,kBAAkB,CAsGpB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,SAAS;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpF,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,sBAAsB,EAC9B,eAAe,EAAE,MAAM,EACvB,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAAC,EAC/C,gBAAgB,EAAE,OAAO,GACxB,kBAAkB,CAgCpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE1E,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,sBAAsB,EAAE,MAAM,CAAA;CAAE,EAC3C,WAAW,EAAE,SAAS,wBAAwB,EAAE,GAC/C,gBAAgB,CASlB;AAED,4HAA4H;AAC5H,eAAO,MAAM,iBAAiB,KAAK,CAAC"}

package/sdk/dist/node/gitvault-writer-state.js

@@ -0,0 +1,357 @@
+/**
+ * r402s/v0 rev 47 — the writer set as CHAIN STATE (protocol §4.15), and the
+ * pure cryptographic half of `add_writer_key` / `rotate_epoch{writer_set_update}`
+ * admission (§4.16–§4.18, D221–D227). Client-side mirror of the gateway's
+ * `services/gitvault/writer-state.ts` (task gitvault-multi-writer 2.3) — same
+ * functions, same Verdict shape, same crypto rules — so both sides reach the
+ * SAME conclusion from the SAME chain bytes with no shared network call.
+ *
+ * Deliberately pure and isomorphic (no I/O, no Node-only APIs): a recovering
+ * client, the browser viewer, and `r402s-verify` all need to replay writer
+ * state from nothing but genesis + admitted chain objects. `checkChainLink`'s
+ * own asserts stay ignorant of transition PAYLOADS (protocol discipline); this
+ * module is where a transition's writer-set content gets opened and verified,
+ * once the caller has already established the transition is admitted or is
+ * validating a candidate before submission.
+ *
+ * One deliberate divergence from the gateway's file: `initialWriterState`
+ * DERIVES the version-0 writer_key_id from `creator_signing_pubkey` rather
+ * than reading a `genesis.writer_key_id` field — the gateway's own genesis
+ * admission already asserts `writerKeyIdOf(creator_signing_pubkey) ===
+ * genesis.writer_key_id` (chain.ts), so for any validly-admitted genesis both
+ * approaches agree; deriving is simpler for a client that has no reason to
+ * trust an extra redundant field over the pubkey it already verified.
+ */
+import { LocalError } from "../errors.js";
+import { GITVAULT_B64U_32_RE, GITVAULT_B64U_64_RE, ed25519VerifyStrict, fromBase64url, gitvaultWithoutSignature, isCanonicalBase64url, jcs, sha256Hex, signaturePreimage, vkFingerprint, } from "../namespaces/gitvault.crypto.js";
+// ─── Org role lattice (mirrors org-owned-control-plane's owner > admin > developer > billing > viewer) ──
+export const ORG_ROLE_RANK = Object.freeze({
+    viewer: 0,
+    billing: 1,
+    developer: 2,
+    admin: 3,
+    owner: 4,
+});
+export const WRITER_ELIGIBLE_ROLE_RANK = ORG_ROLE_RANK.developer;
+/** Does `role` meet the writer-eligibility threshold (developer or above)? An unknown/absent role never does. */
+export function meetsWriterEligibleRole(role) {
+    return !!role && (ORG_ROLE_RANK[role] ?? -1) >= WRITER_ELIGIBLE_ROLE_RANK;
+}
+/**
+ * gitvault-multi-writer rev 47 (task 5.5) — predicts the role a handoff mint
+ * will actually confer, mirroring the gateway's OWN attenuation exactly
+ * (`services/gitvault/claims.ts mintHandoff`: `requestedRole &&
+ * roleRank(requestedRole) < roleRank(minterRole) ? requestedRole :
+ * minterRole`). The mint's `writer_admission_grant.minted_role` must equal
+ * this prediction byte-for-byte or the gateway refuses VALIDATION_FAILED —
+ * after the checkpoint push has already been paid for — so getting the
+ * comparison direction right matters. An unrecognized `requestedRole`
+ * (never a legal `OrgRole` server-side either) is treated as "no request":
+ * a garbage role string fails the gateway's OWN mint validation before its
+ * attenuation logic — and therefore before this grant-mismatch check —
+ * ever runs, so predicting `minterRole` for that case is never observed as
+ * wrong, only moot.
+ */
+export function predictMintedRole(requestedRole, minterRole) {
+    return requestedRole !== undefined && requestedRole in ORG_ROLE_RANK && ORG_ROLE_RANK[requestedRole] < ORG_ROLE_RANK[minterRole] ? requestedRole : minterRole;
+}
+const WRITER_SET_FORMAT = "r402s/writer-set/v1";
+function asStr(v) {
+    return typeof v === "string" ? v : null;
+}
+function sortWriters(writers) {
+    return [...writers].sort((a, b) => (a.writer_key_id < b.writer_key_id ? -1 : a.writer_key_id > b.writer_key_id ? 1 : 0));
+}
+function writersArraysEqual(a, b) {
+    return a.length === b.length && a.every((w, i) => w.writer_key_id === b[i].writer_key_id && w.signing_pubkey === b[i].signing_pubkey);
+}
+function nextVersionHex16(hex16) {
+    return (BigInt("0x" + hex16) + 1n).toString(16).padStart(16, "0");
+}
+/**
+ * `vk_` fingerprint of a base64url-encoded Ed25519 public key, or `null` for
+ * anything that doesn't decode as a canonical 32-byte base64url scalar —
+ * mirrors the gateway's `writerKeyIdOf` (never throws on a malformed key).
+ */
+export function writerKeyIdOf(signingPubkeyB64u) {
+    if (!GITVAULT_B64U_32_RE.test(signingPubkeyB64u) || !isCanonicalBase64url(signingPubkeyB64u))
+        return null;
+    return vkFingerprint(fromBase64url(signingPubkeyB64u));
+}
+/**
+ * Strict Ed25519 verification of a detached (b64u-encoded) signature over
+ * `message`, given a b64u-encoded public key. Never throws — a malformed
+ * scalar is simply `false`, matching `ed25519VerifyStrict`'s own contract.
+ */
+function verifyDetachedB64u(publicKeyB64u, signatureB64u, message) {
+    if (!GITVAULT_B64U_32_RE.test(publicKeyB64u) || !isCanonicalBase64url(publicKeyB64u))
+        return false;
+    if (!GITVAULT_B64U_64_RE.test(signatureB64u) || !isCanonicalBase64url(signatureB64u))
+        return false;
+    return ed25519VerifyStrict(fromBase64url(signatureB64u), message, fromBase64url(publicKeyB64u));
+}
+/** protocol §4.15: writer_set_sha256 = SHA-256(JCS({format, repo_id, version, writers})). */
+export function writerSetSha256(repoId, version, writers) {
+    const writersJson = writers.map((w) => ({ writer_key_id: w.writer_key_id, signing_pubkey: w.signing_pubkey }));
+    return sha256Hex(jcs({ format: WRITER_SET_FORMAT, repo_id: repoId, version, writers: writersJson }));
+}
+/**
+ * protocol §4.15: the version-0 singleton, derived from `creator_signing_pubkey`
+ * (see the module doc for why this diverges from reading a `writer_key_id`
+ * field directly).
+ */
+export function initialWriterState(repoId, genesis) {
+    const writerKeyId = writerKeyIdOf(genesis.creator_signing_pubkey);
+    if (writerKeyId === null) {
+        throw new LocalError("genesis.creator_signing_pubkey is not a canonical base64url Ed25519 public key", "computing the vault's initial writer state", { code: "GITVAULT_BAD_GENESIS" });
+    }
+    const writers = [{ writer_key_id: writerKeyId, signing_pubkey: genesis.creator_signing_pubkey }];
+    return {
+        version: "0000000000000000",
+        writers,
+        sha256: writerSetSha256(repoId, "0000000000000000", writers),
+        burnedWriterKeyIds: new Set(),
+        consumedHandoffIds: new Set(),
+    };
+}
+/**
+ * protocol §4.16: apply an ALREADY-ADMITTED `add_writer_key` transition.
+ * Caller MUST have validated it first (`validateAddWriterKeyPayload`) — this
+ * function performs no checks, it only advances state.
+ */
+/**
+ * gitvault-multi-writer (task 5.6) — builds a well-formed `handoff`-door
+ * `add_writer_key` payload (schema `r402s.add-writer-key/v1`) from a
+ * predecessor writer-set pin and the claimant's own key — the pure
+ * assembly step `GitvaultVault.submitWriterActivationHead` delegates to,
+ * kept separate so it can be unit-tested directly against
+ * {@link validateAddWriterKeyPayload} without a full vault/keystore/git
+ * harness. `predecessorPin` needs only `{version, sha256, writers}` — the
+ * caller's persisted `writer_set_pin` shape already matches, no
+ * `WriterChainState` (with its Sets) is required to build an OUTGOING
+ * payload; only to VALIDATE an incoming one.
+ */
+export function buildAddWriterKeyActivationPayload(repoId, predecessorPin, addedWriter, handoffId, grant, acceptance) {
+    const predecessorState = { version: predecessorPin.version, writers: predecessorPin.writers, sha256: predecessorPin.sha256, burnedWriterKeyIds: new Set(), consumedHandoffIds: new Set() };
+    const nextState = applyAddWriterKey(repoId, predecessorState, { writer_key_id: addedWriter.writer_key_id, signing_pubkey: addedWriter.signing_pubkey }, handoffId);
+    return {
+        schema: "r402s.add-writer-key/v1",
+        repo_id: repoId,
+        base_writer_set: { version: predecessorPin.version, sha256: predecessorPin.sha256 },
+        next_writer_set: { version: nextState.version, writers: [...nextState.writers], sha256: nextState.sha256 },
+        added_writer: { writer_key_id: addedWriter.writer_key_id, signing_pubkey: addedWriter.signing_pubkey, principal_id: addedWriter.principal_id },
+        authorization: { kind: "handoff", grant, acceptance },
+    };
+}
+/**
+ * gitvault-multi-writer (task 5.7) — builds a well-formed `writer`-door
+ * `add_writer_key` payload from a predecessor writer-set pin and the
+ * candidate's own published signing key. Unlike {@link
+ * buildAddWriterKeyActivationPayload} (the handoff door), this authorization
+ * carries no grant/acceptance — `validateAddWriterKeyPayload`'s `"writer"`
+ * branch licenses it purely by the CARRYING HEAD's own signer already being
+ * an active writer (checked at admission time, both client-side replay and
+ * gateway-side `checkTransitionAdmissible`), so the acting writer's identity
+ * never appears IN the payload itself, only in the head that carries it.
+ */
+export function buildWriterDoorAddWriterKeyPayload(repoId, predecessorPin, addedWriter) {
+    const predecessorState = { version: predecessorPin.version, writers: predecessorPin.writers, sha256: predecessorPin.sha256, burnedWriterKeyIds: new Set(), consumedHandoffIds: new Set() };
+    const nextState = applyAddWriterKey(repoId, predecessorState, { writer_key_id: addedWriter.writer_key_id, signing_pubkey: addedWriter.signing_pubkey }, null);
+    return {
+        schema: "r402s.add-writer-key/v1",
+        repo_id: repoId,
+        base_writer_set: { version: predecessorPin.version, sha256: predecessorPin.sha256 },
+        next_writer_set: { version: nextState.version, writers: [...nextState.writers], sha256: nextState.sha256 },
+        added_writer: { writer_key_id: addedWriter.writer_key_id, signing_pubkey: addedWriter.signing_pubkey, principal_id: addedWriter.principal_id },
+        authorization: { kind: "writer" },
+    };
+}
+export function applyAddWriterKey(repoId, state, addedWriter, consumedHandoffId) {
+    const writers = sortWriters([...state.writers, addedWriter]);
+    const version = nextVersionHex16(state.version);
+    return {
+        version,
+        writers,
+        sha256: writerSetSha256(repoId, version, writers),
+        burnedWriterKeyIds: state.burnedWriterKeyIds,
+        consumedHandoffIds: consumedHandoffId === null ? state.consumedHandoffIds : new Set([...state.consumedHandoffIds, consumedHandoffId]),
+    };
+}
+/**
+ * protocol §4.18: apply an ALREADY-ADMITTED `rotate_epoch{writer_set_update}`.
+ * Caller MUST have validated it first (`validateWriterSetUpdate`). `writers`
+ * MAY be empty — the explicit sole-writer `writer_key_revoked` read-only
+ * terminal (D228) is a legal resulting state, not an error at this layer.
+ */
+export function applyWriterSetUpdate(repoId, state, removedWriterKeyIds) {
+    const removed = new Set(removedWriterKeyIds);
+    const writers = sortWriters(state.writers.filter((w) => !removed.has(w.writer_key_id)));
+    const version = nextVersionHex16(state.version);
+    return {
+        version,
+        writers,
+        sha256: writerSetSha256(repoId, version, writers),
+        burnedWriterKeyIds: new Set([...state.burnedWriterKeyIds, ...removed]),
+        consumedHandoffIds: state.consumedHandoffIds,
+    };
+}
+/**
+ * The FIRST, ordinary-case lookup (protocol §5A step 1): is this head's own
+ * `writer_key_id` already active in the predecessor writer state? A null
+ * result does not by itself mean refusal — the caller still checks for a
+ * qualifying `add_writer_key{"handoff"}` transition naming exactly this key
+ * before concluding `GITVAULT_WRITER_NOT_ADMITTED`.
+ */
+export function resolveActiveWriter(state, headWriterKeyId) {
+    return state.writers.find((w) => w.writer_key_id === headWriterKeyId) ?? null;
+}
+/**
+ * The FULL cryptographic + structural validation of an `add_writer_key`
+ * payload (protocol §4.16/§4.17), given the writer state at the PREDECESSOR
+ * generation and the carrying head's own `writer_key_id`. Does NOT check
+ * `authorization.kind:"writer"`'s org-membership eligibility (active
+ * membership >= developer, directory possession-verification) — that is
+ * gateway-only, live-state-dependent, and re-checked under the admission
+ * fence server-side; a client validating its OWN candidate transition before
+ * submission relies on the gateway's fence-time re-check as the backstop.
+ */
+export function validateAddWriterKeyPayload(repoId, predecessorState, payload, headWriterKeyId) {
+    if (payload.base_writer_set.version !== predecessorState.version || payload.base_writer_set.sha256 !== predecessorState.sha256) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "base_writer_set does not match the writer state at the predecessor generation" };
+    }
+    const addedKeyId = writerKeyIdOf(payload.added_writer.signing_pubkey);
+    if (addedKeyId === null || addedKeyId !== payload.added_writer.writer_key_id) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "added_writer.writer_key_id does not derive from added_writer.signing_pubkey" };
+    }
+    if (predecessorState.burnedWriterKeyIds.has(addedKeyId)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: `writer_key_id ${addedKeyId} was permanently removed and can never be re-added` };
+    }
+    if (predecessorState.writers.some((w) => w.writer_key_id === addedKeyId)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: `writer_key_id ${addedKeyId} is already an active writer` };
+    }
+    if (predecessorState.writers.length >= MAX_VAULT_WRITERS) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: `this vault already has ${MAX_VAULT_WRITERS} active writers, the protocol maximum (MAX_VAULT_WRITERS)` };
+    }
+    const expectedNextWriters = sortWriters([
+        ...predecessorState.writers,
+        { writer_key_id: addedKeyId, signing_pubkey: payload.added_writer.signing_pubkey },
+    ]);
+    const expectedNextVersion = nextVersionHex16(predecessorState.version);
+    const expectedNextSha = writerSetSha256(repoId, expectedNextVersion, expectedNextWriters);
+    if (payload.next_writer_set.version !== expectedNextVersion ||
+        payload.next_writer_set.sha256 !== expectedNextSha ||
+        !writersArraysEqual(payload.next_writer_set.writers, expectedNextWriters)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "next_writer_set is not exactly base_writer_set plus added_writer" };
+    }
+    if (payload.authorization.kind === "writer") {
+        if (headWriterKeyId === addedKeyId) {
+            return { ok: false, code: "VALIDATION_FAILED", detail: 'authorization.kind:"writer" cannot be self-signed by the added key' };
+        }
+        if (!predecessorState.writers.some((w) => w.writer_key_id === headWriterKeyId)) {
+            return { ok: false, code: "GITVAULT_WRITER_NOT_ADMITTED", detail: "the carrying head's signer is not an active writer at the predecessor generation" };
+        }
+        return { ok: true };
+    }
+    // authorization.kind === "handoff"
+    if (headWriterKeyId !== addedKeyId) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "a handoff activation head must be signed by the added key itself" };
+    }
+    const { grant, acceptance } = payload.authorization;
+    const grantorKeyId = asStr(grant.grantor_writer_key_id);
+    const grantorEntry = grantorKeyId === null ? null : (predecessorState.writers.find((w) => w.writer_key_id === grantorKeyId) ?? null);
+    if (grantorEntry === null) {
+        return { ok: false, code: "HANDOFF_KEY_REVOKED", detail: "grantor_not_active" };
+    }
+    if (asStr(grant.object_kind) !== "writer_admission_grant") {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_admission_grant.object_kind is not writer_admission_grant" };
+    }
+    const grantSignature = asStr(grant.signature);
+    const grantPreimage = signaturePreimage("writer_admission_grant", gitvaultWithoutSignature(grant));
+    if (grantSignature === null || !verifyDetachedB64u(grantorEntry.signing_pubkey, grantSignature, grantPreimage)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_admission_grant signature does not verify under the grantor's writer key" };
+    }
+    const statementRaw = acceptance.statement;
+    if (typeof statementRaw !== "object" || statementRaw === null || Array.isArray(statementRaw)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_acceptance.statement is missing or malformed" };
+    }
+    const statement = statementRaw;
+    const statementPreimage = signaturePreimage("handoff-writer-accept/v1", statement);
+    const handoffAdmissionPubkey = asStr(grant.handoff_admission_pubkey);
+    const acceptanceSignature = asStr(acceptance.acceptance_signature);
+    if (handoffAdmissionPubkey === null ||
+        acceptanceSignature === null ||
+        !verifyDetachedB64u(handoffAdmissionPubkey, acceptanceSignature, statementPreimage)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_acceptance.acceptance_signature does not verify under the grant's admission key" };
+    }
+    const possessionSignature = asStr(acceptance.possession_signature);
+    if (possessionSignature === null ||
+        !verifyDetachedB64u(payload.added_writer.signing_pubkey, possessionSignature, statementPreimage)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_acceptance.possession_signature does not verify under the added writer's own key" };
+    }
+    const handoffId = asStr(grant.handoff_id);
+    if (handoffId === null || handoffId !== asStr(statement.handoff_id)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "grant.handoff_id != acceptance.statement.handoff_id" };
+    }
+    if (asStr(grant.auth_hash) !== asStr(statement.auth_hash)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "grant.auth_hash != acceptance.statement.auth_hash" };
+    }
+    if (asStr(statement.writer_key_id) !== addedKeyId || asStr(statement.signing_pubkey) !== payload.added_writer.signing_pubkey) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "acceptance.statement writer identity does not match added_writer" };
+    }
+    if (predecessorState.consumedHandoffIds.has(handoffId)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: `handoff_id ${handoffId} has already been consumed in this vault's writer history` };
+    }
+    return { ok: true };
+}
+/**
+ * The FULL cryptographic + structural validation of a `rotate_epoch`
+ * transition's `writer_set_update` field (protocol §4.18, D227), given the
+ * writer state at the PREDECESSOR generation, the carrying head's own
+ * `writer_key_id`, and the caller's own belief about which writer keys are
+ * due for removal (`gatewayBlockedWriterKeyIds` — for a client building a
+ * CANDIDATE rotation this is `state read (blocked set)`; the gateway's own
+ * fence-time re-check is the source of truth at admission). `allowEmptyResult`
+ * is true ONLY for the explicit, owner+step-up, sole remaining writer
+ * `writer_key_revoked` removal (D228); every other call site passes `false`.
+ */
+export function validateWriterSetUpdate(repoId, predecessorState, update, headWriterKeyId, gatewayBlockedWriterKeyIds, allowEmptyResult) {
+    if (update.base_version !== predecessorState.version || update.base_sha256 !== predecessorState.sha256) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_set_update base does not match the writer state at the predecessor generation" };
+    }
+    const removedIds = new Set(update.removed.map((r) => r.writer_key_id));
+    const blockedSorted = [...gatewayBlockedWriterKeyIds].sort();
+    const removedSorted = [...removedIds].sort();
+    const exactMatch = blockedSorted.length === removedSorted.length && blockedSorted.every((id, i) => id === removedSorted[i]);
+    if (!exactMatch) {
+        return { ok: false, code: "RECIPIENT_SET_MISMATCH", detail: "writer_set_update.removed does not equal exactly the blocked writer key set" };
+    }
+    const expectedWriters = sortWriters(predecessorState.writers.filter((w) => !removedIds.has(w.writer_key_id)));
+    if (!writersArraysEqual(update.writers, expectedWriters)) {
+        return { ok: false, code: "RECIPIENT_SET_MISMATCH", detail: "writer_set_update.writers is not base_writer_set minus exactly the removed set" };
+    }
+    if (expectedWriters.length === 0 && !allowEmptyResult) {
+        return { ok: false, code: "EPOCH_ROTATION_WOULD_LEAVE_VAULT_UNCOVERED", detail: "this rotation would leave the vault with zero writers" };
+    }
+    if (expectedWriters.length > 0 && !expectedWriters.some((w) => w.writer_key_id === headWriterKeyId)) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "the rotation head's own signer must remain in the next writer set" };
+    }
+    const expectedNextVersion = nextVersionHex16(predecessorState.version);
+    const expectedNextSha = writerSetSha256(repoId, expectedNextVersion, expectedWriters);
+    if (update.next_version !== expectedNextVersion || update.next_sha256 !== expectedNextSha) {
+        return { ok: false, code: "VALIDATION_FAILED", detail: "writer_set_update next commitment does not match the recomputed removal" };
+    }
+    return { ok: true };
+}
+export function replayWriterState(repoId, genesis, transitions) {
+    let state = initialWriterState(repoId, genesis);
+    for (const t of transitions) {
+        state =
+            t.kind === "add_writer_key"
+                ? applyAddWriterKey(repoId, state, t.addedWriter, t.consumedHandoffId)
+                : applyWriterSetUpdate(repoId, state, t.removedWriterKeyIds);
+    }
+    return state;
+}
+/** protocol §4.15: `MAX_VAULT_WRITERS`. A writer-changing transition producing more active writers than this is refused. */
+export const MAX_VAULT_WRITERS = 64;
+//# sourceMappingURL=gitvault-writer-state.js.map

package/sdk/dist/node/gitvault-writer-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-writer-state.js","sourceRoot":"","sources":["../../src/node/gitvault-writer-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,GAAG,EACH,SAAS,EACT,iBAAiB,EACjB,aAAa,GACd,MAAM,kCAAkC,CAAC;AAkB1C,2GAA2G;AAE3G,MAAM,CAAC,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,CAAC;IACZ,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC,SAAS,CAAC;AAEjE,iHAAiH;AACjH,MAAM,UAAU,uBAAuB,CAAC,IAA+B;IACrE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAiC,EAAE,UAAkB;IACrF,OAAO,aAAa,KAAK,SAAS,IAAI,aAAa,IAAI,aAAa,IAAI,aAAa,CAAC,aAAa,CAAE,GAAG,aAAa,CAAC,UAAU,CAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;AAClK,CAAC;AAoBD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEhD,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,OAAkC;IACrD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,kBAAkB,CAAC,CAA4B,EAAE,CAA4B;IACpF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,CAAC;AAC1I,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,iBAAyB;IACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1G,OAAO,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,aAAqB,EAAE,aAAqB,EAAE,OAAmB;IAC3F,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,OAAO,mBAAmB,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAe,EAAE,OAAkC;IACjG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAA2C;IAC5F,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,gFAAgF,EAChF,4CAA4C,EAC5C,EAAE,IAAI,EAAE,sBAAsB,EAAE,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAqB,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnH,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,OAAO;QACP,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,CAAC;QAC5D,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,kBAAkB,EAAE,IAAI,GAAG,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc,EACd,cAAuF,EACvF,WAAsD,EACtD,SAAiB,EACjB,KAA8B,EAC9B,UAAmC;IAEnC,MAAM,gBAAgB,GAAqB,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC7M,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;IACnK,OAAO;QACL,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE;QACnF,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QAC1G,YAAY,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;QAC9I,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc,EACd,cAAuF,EACvF,WAAsD;IAEtD,MAAM,gBAAgB,GAAqB,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC7M,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9J,OAAO;QACL,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE;QACnF,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QAC1G,YAAY,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;QAC9I,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAuB,EACvB,WAA2B,EAC3B,iBAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,OAAO;QACP,OAAO;QACP,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QACjD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAChB,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;KACpH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAuB,EACvB,mBAAsC;IAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,OAAO;QACP,OAAO;QACP,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QACjD,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,kBAAkB,EAAE,GAAG,OAAO,CAAC,CAAC;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB,EAAE,eAAuB;IAClF,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAChF,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAc,EACd,gBAAkC,EAClC,OAA4B,EAC5B,eAAuB;IAEvB,IAAI,OAAO,CAAC,eAAe,CAAC,OAAO,KAAK,gBAAgB,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC/H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;IAC3I,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,UAAU,oDAAoD,EAAE,CAAC;IAC3I,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,UAAU,8BAA8B,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,0BAA0B,iBAAiB,2DAA2D,EAAE,CAAC;IAClK,CAAC;IAED,MAAM,mBAAmB,GAAG,WAAW,CAAC;QACtC,GAAG,gBAAgB,CAAC,OAAO;QAC3B,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,cAAc,EAAE;KACnF,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAC1F,IACE,OAAO,CAAC,eAAe,CAAC,OAAO,KAAK,mBAAmB;QACvD,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,eAAe;QAClD,CAAC,kBAAkB,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,mBAAmB,CAAC,EACzE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAC9H,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;QAChI,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,eAAe,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;QACzJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,mCAAmC;IACnC,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAC9H,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAEpD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;IACrI,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,wBAAwB,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAC9H,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,iBAAiB,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,KAAK,CAA4B,CAAC,CAAC;IAC9H,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAC;IAC7I,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;IAC1C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACjH,CAAC;IACD,MAAM,SAAS,GAAG,YAAuC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAEnF,MAAM,sBAAsB,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACnE,IACE,sBAAsB,KAAK,IAAI;QAC/B,mBAAmB,KAAK,IAAI;QAC5B,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EACnF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;IACpJ,CAAC;IACD,MAAM,mBAAmB,GAAG,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACnE,IACE,mBAAmB,KAAK,IAAI;QAC5B,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAChG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,yFAAyF,EAAE,CAAC;IACrJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAC7H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAC9H,CAAC;IACD,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,SAAS,2DAA2D,EAAE,CAAC;IAC9I,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,gBAAkC,EAClC,MAA8B,EAC9B,eAAuB,EACvB,0BAA+C,EAC/C,gBAAyB;IAEzB,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,sFAAsF,EAAE,CAAC;IAClJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IAC9I,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACjJ,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,4CAA4C,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC5I,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,eAAe,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IAC/H,CAAC;IAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,YAAY,KAAK,mBAAmB,IAAI,MAAM,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC;IACrI,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAYD,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,OAA2C,EAC3C,WAAgD;IAEhD,IAAI,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,KAAK;YACH,CAAC,CAAC,IAAI,KAAK,gBAAgB;gBACzB,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,iBAAiB,CAAC;gBACtE,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4HAA4H;AAC5H,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC"}

package/sdk/dist/node/index.d.ts

@@ -118,7 +118,7 @@ export { GitvaultKeystore, getGitvaultKeystoreRoot, readFileNoFollow, writeFileA
 export type { GitvaultAuditEntry, GitvaultAuditEvent, GitvaultHeadPin, GitvaultIdentityFile, GitvaultKeystoreOptions, GitvaultKeystoreState, GitvaultLockOptions, GitvaultPermissionFinding, GitvaultRepoFile, } from "./gitvault-keystore.js";
 export { GITVAULT_CREATION_STAGES, GitvaultCreation, createGitvault, findResumableGitvaultJournal, findResumablePushToCreateJournal, gitvaultDoctorRecoveryText, gitvaultJournalPath, listIncompleteGitvaultJournals, readGitvaultJournal, } from "./gitvault-creation-journal.js";
 export type { GitvaultAdmitGenesisRequest, GitvaultAdmitGenesisResult, GitvaultAllocateRequest, GitvaultCreationJournal, GitvaultCreationOptions, GitvaultCreationResult, GitvaultCreationStage, GitvaultCreationTransport, GitvaultDoctorRecoveryText, GitvaultJournaledObject, GitvaultObjectReceipt, GitvaultPushToCreateAddress, GitvaultPutObjectRequest, } from "./gitvault-creation-journal.js";
-export { GITVAULT_DEPLOY_REF, GITVAULT_HANDOFF_SENSITIVE_DENYLIST, GITVAULT_MAX_GIT_OBJECT_BYTES, GITVAULT_MIN_GIT_VERSION, HARDENED_GIT_ARGV_PREFIX, captureHandoffSnapshot, captureSnapshot, capturedSetDigest, capturedSetUnchanged, deriveCapturedSet, detectActiveFilters, diffCapturedSets, discoverGlobalExcludes, findOversizeObjects, gitvaultCommitLine, globMatchesGitPath, hardenedGit, hardenedGitEnv, hasObject, inspectRepository, isAncestor, isHandoffSensitivePath, materializeSnapshot, parseGitConfigAsData, probeGitVersion, resolveGitInvocationRepo, snapshotCommitment, } from "./gitvault-snapshot.js";
+export { GITVAULT_DEPLOY_REF, GITVAULT_HANDOFF_SENSITIVE_DENYLIST, GITVAULT_MAX_GIT_OBJECT_BYTES, GITVAULT_MIN_GIT_VERSION, HARDENED_GIT_ARGV_PREFIX, captureHandoffSnapshot, captureSnapshot, capturedSetDigest, capturedSetUnchanged, deriveCapturedSet, detectActiveFilters, diffCapturedSets, discoverGlobalExcludes, findOversizeObjects, gitvaultCommitLine, globMatchesGitPath, hardenedGit, hardenedGitEnv, run402PassthroughEnv, hasObject, inspectRepository, isAncestor, isHandoffSensitivePath, materializeSnapshot, parseGitConfigAsData, probeGitVersion, resolveGitInvocationRepo, snapshotCommitment, } from "./gitvault-snapshot.js";
 export type { GitConfigDiscoveryEnv, GitInvocationRepo, GitvaultCapturedFile, GitvaultCapturedSetDrift, GitvaultHandoffCaptureOptions, GitvaultHandoffCaptureStats, GitvaultHandoffSnapshot, GitvaultRepositoryInspection, GitvaultRepositoryRefusalCode, GitvaultSnapshot, GitvaultSnapshotOptions, GitvaultSnapshotRefusalPath, GlobalExcludesDiscovery, GlobalExcludesRefusal, HardenedGitOptions, HardenedGitResult, ParsedGitConfigEntry, } from "./gitvault-snapshot.js";
 export { GITVAULT_INLINE_UPLOAD_MAX_OBJECT_BYTES, GITVAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES, GITVAULT_MAX_CANONICAL_REFS, GITVAULT_MAX_CHECKPOINT_PACKS, GITVAULT_MAX_CHECKPOINT_TOTAL_STORED_BYTES, GITVAULT_MAX_HEADS_PER_LISTING_PAGE, GITVAULT_MAX_REF_STATE_OBJECT_BYTES, GITVAULT_MAX_REF_UPDATES_PER_TRANSACTION, GITVAULT_MAX_REPAIR_ADDED_ROOTS, GITVAULT_MAX_RETENTION_ROOT_ENTRIES, GITVAULT_MAX_WAL_RECEIPTS_PER_HEAD, GITVAULT_MULTI_OBJECT_PACK_TARGET_BYTES, GITVAULT_PUSH_CONFLICT_RETRIES, GITVAULT_R402_REF_NAMESPACE, GITVAULT_RETAIN_REF_PREFIX, GITVAULT_RETENTION_MIN_DAYS, GITVAULT_VERIFICATION_BUDGET_HEADS, GitvaultVault, assertNoTransition, assertRefMapCardinality, bigIntToGeneration, captureBinding, checkChainLink, checkClaimSetEquality, checkGenerationRegression, checkOpenBinding, compareRoots, createGitvaultHttpTransport, deployRefTransaction, effectiveAdmittedAt, evaluateRefTransaction, evolveRetentionRoots, generationToBigInt, gitvaultInlineUploadEligible, gitvaultPaths, gitvaultRetainedRefName, isRootEligibleForRemoval, nextGeneration, nextListingRequest, gitvaultLedgerId, gitvaultManifestEntry, gitvaultWireRefForPath, openBindingDigest, reconcileRetainedTipRefs, validateHeadsListingRequest, verifyHeadsListingPage, readGitvaultRestoreMarker, GITVAULT_AUTO_GC_GENERATIONS_DEFAULT, readGitvaultAutoGcThreshold, writeGitvaultAutoGcThreshold, } from "./gitvault-publication.js";
 export type { GitvaultAdmitHeadRequest, GitvaultAdmitHeadResult, GitvaultBuiltCheckpoint, GitvaultChainLinkInput, GitvaultCutoffOptions, GitvaultDroppedTip, GitvaultEvaluateRefTransactionOptions, GitvaultEvolveRootsOptions, GitvaultHttpTransportOptions, GitvaultListingProgress, GitvaultMaintenanceLease, GitvaultMaintenanceLeaseRequest, GitvaultObjectReadRequest, GitvaultResourceBinding, GitvaultVaultRecord, GitvaultVaultState, GitvaultWireRef, GitvaultMaterializedState, GitvaultOpenBindingRecord, GitvaultPublishResult, GitvaultPushOptions, GitvaultPushPlan, GitvaultRefMap, GitvaultRefTransactionEvaluation, GitvaultRefUpdateFailure, GitvaultRestoreMarker, GitvaultRetainedRefsReconcileResult, GitvaultRetentionCutoffIssued, GitvaultTransport, GitvaultUploadObject, GitvaultUploadReceipt, GitvaultVaultOptions, GitvaultVerifiedState, GitvaultCompactionGrant, } from "./gitvault-publication.js";
@@ -126,6 +126,10 @@ export { GITVAULT_DEPLOY_OUTCOMES, SNAPSHOT_MOVED_DURING_DEPLOY, checkActivation
 export type { GitvaultCaptureReceiptMatch, GitvaultDeployError, GitvaultDeployLane, GitvaultDeployLaneCommitInput, GitvaultDeployLanePlan, GitvaultDeployLanePlanInput, GitvaultDeployNextAction, GitvaultDeployOptions, GitvaultDeployOutcome, GitvaultDeployResult, GitvaultOverrideDrainReport, GitvaultOverrideJournal, GitvaultSnapshotMovedDetails, } from "./gitvault-deploy.js";
 export { HANDOFF_ENVELOPE_KIND, HANDOFF_KEY_PREFIXES, assembleHandoffKey, assertHandoffNoteHasNoSecret, deriveHandoffSecrets, isKygitHandoffNote, openHandoffEnvelope, parseHandoffKey, scanHandoffNoteForSecrets, sealHandoffEnvelope, uuidToBytes, } from "./gitvault-handoff.js";
 export type { HandoffEnvelopePayload, HandoffKeyParts, HandoffKeyPrefixEntry, HandoffNoteSecretFinding, HandoffSecrets, KygitHandoffNote, KygitHandoffNoteCapture, } from "./gitvault-handoff.js";
+export { HANDOFF_WRITER_ACCEPT_DOMAIN, buildWriterAcceptance, buildWriterAdmissionGrant, deriveWriterAdmissionSeed, verifyWriterAcceptance, verifyWriterAdmissionGrant, } from "./gitvault-handoff.js";
+export type { BuildWriterAcceptanceInput, BuildWriterAdmissionGrantInput, GitvaultWriterMintedRole, HandoffWriterAcceptStatement, WriterAcceptance, WriterAdmissionGrant, } from "./gitvault-handoff.js";
+export { MAX_VAULT_WRITERS, ORG_ROLE_RANK, WRITER_ELIGIBLE_ROLE_RANK, applyAddWriterKey, applyWriterSetUpdate, buildAddWriterKeyActivationPayload, buildWriterDoorAddWriterKeyPayload, initialWriterState, meetsWriterEligibleRole, predictMintedRole, replayWriterState, resolveActiveWriter, validateAddWriterKeyPayload, validateWriterSetUpdate, writerKeyIdOf, writerSetSha256, } from "./gitvault-writer-state.js";
+export type { AddWriterKeyPayload, AdmittedWriterTransition, WriterChainState, WriterKeyEntry, WriterSetUpdatePayload, WriterStateRefusalCode, WriterStateVerdict, } from "./gitvault-writer-state.js";
 export { applyHandoffCheckpoint, cloneGitvaultRemote, readGitCommitMessage, resolveResumeTargetDir } from "./gitvault-restore.js";
 export type { GitvaultHandoffRestoreOptions, GitvaultHandoffRestoreResult } from "./gitvault-restore.js";
 export { openOrCreateGitvault } from "./gitvault-open-or-create.js";