@dxos/credentials 0.8.4-main.72ec0f3 → 0.8.4-main.74a063c4e0

package/dist/lib/{browser → neutral}/index.mjs

@@ -68,6 +68,14 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const assertion = copy.subject?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -314,7 +322,7 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
 });
 
 // src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 var CredentialGenerator = class {
   _signer;
@@ -328,7 +336,7 @@ var CredentialGenerator = class {
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -336,7 +344,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -463,7 +472,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -474,7 +483,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -631,7 +641,7 @@ import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // src/state-machine/feed-state-machine.ts
@@ -1498,6 +1508,8 @@ var SpaceStateMachine = class {
   _credentialsById = new ComplexMap6(PublicKey8.hash);
   _processedCredentials = new ComplexSet3(PublicKey8.hash);
   _genesisCredential;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
   _credentialProcessors = [];
   onCredentialProcessed = new Callback4();
   onMemberRoleChanged;
@@ -1532,6 +1544,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1573,7 +1591,7 @@ var SpaceStateMachine = class {
       if (result.kind !== "pass") {
         log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file6,
-          L: 162,
+          L: 173,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1586,7 +1604,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           log3.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file6,
-            L: 171,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1595,7 +1613,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file6,
-            L: 175,
+            L: 186,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1604,13 +1622,15 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file6,
-            L: 179,
+            L: 190,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1620,7 +1640,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 192,
+            L: 205,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1629,7 +1649,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 196,
+            L: 209,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1643,7 +1663,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 207,
+            L: 220,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1656,7 +1676,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file6,
-            L: 217,
+            L: 230,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1670,7 +1690,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 228,
+            L: 241,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1704,6 +1724,9 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
 };
@@ -1716,7 +1739,7 @@ var CredentialConsumer = class {
   _onClose;
   _ctx = new Context(void 0, {
     F: __dxlog_file6,
-    L: 273
+    L: 291
   });
   /**
   * @internal
@@ -1773,7 +1796,7 @@ var DeviceStateMachine = class {
       credential
     }, {
       F: __dxlog_file7,
-      L: 36,
+      L: 35,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1793,7 +1816,7 @@ var DeviceStateMachine = class {
           size: this.authorizedDeviceKeys.size
         }, {
           F: __dxlog_file7,
-          L: 56,
+          L: 55,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1803,7 +1826,7 @@ var DeviceStateMachine = class {
       case "dxos.halo.credentials.DeviceProfile": {
         invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
           F: __dxlog_file7,
-          L: 66,
+          L: 65,
           S: this,
           A: [
             "this.authorizedDeviceKeys.has(credential.subject.id)",
@@ -1816,7 +1839,7 @@ var DeviceStateMachine = class {
             profile: assertion.profile
           }, {
             F: __dxlog_file7,
-            L: 69,
+            L: 68,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1849,7 +1872,7 @@ var ProfileStateMachine = class {
             credential
           }, {
             F: __dxlog_file8,
-            L: 35,
+            L: 34,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1861,7 +1884,7 @@ var ProfileStateMachine = class {
           profile: this.profile
         }, {
           F: __dxlog_file8,
-          L: 41,
+          L: 40,
           S: this,
           C: (f, a) => f(...a)
         });

package/dist/lib/neutral/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/did.ts", "../../../src/invitations.ts", "../../../src/seedphrase.ts", "../../../src/passcode.ts", "../../../src/credentials/signing.ts", "../../../src/presentations/signing.ts", "../../../src/credentials/assertions.ts", "../../../src/credentials/credential-factory.ts", "../../../src/credentials/verifier.ts", "../../../src/credentials/credential-generator.ts", "../../../src/presentations/presentation.ts", "../../../src/presentations/verifier.ts", "../../../src/state-machine/space-state-machine.ts", "../../../src/state-machine/feed-state-machine.ts", "../../../src/state-machine/invitation-state-machine.ts", "../../../src/state-machine/member-state-machine.ts", "../../../src/graph/credential-graph.ts", "../../../src/processor/device-state-machine.ts", "../../../src/processor/profile-state-machine.ts"],
+  "sourcesContent": ["//\n// Copyright 2025 DXOS.org\n//\n\nimport { subtleCrypto } from '@dxos/crypto';\nimport { IdentityDid, PublicKey } from '@dxos/keys';\nimport { ComplexMap } from '@dxos/util';\n\nconst IDENTITY_DIDS_CACHE = new ComplexMap<PublicKey, IdentityDid>(PublicKey.hash);\n\n/**\n * Identity DIDs are generated by creating a keypair, and then taking the first 20 bytes of the SHA-256 hash of the public key and encoding them to multibase RFC4648 base-32 format (prefixed with B, see Multibase Table).\n * Inspired by how ethereum addresses are derived.\n */\nexport const createDidFromIdentityKey = async (identityKey: PublicKey): Promise<IdentityDid> => {\n  const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);\n  if (cachedValue !== undefined) {\n    return cachedValue;\n  }\n\n  const digest = await subtleCrypto.digest('SHA-256', identityKey.asUint8Array() as Uint8Array<ArrayBuffer>);\n\n  const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);\n  const identityDid = IdentityDid.encode(bytes);\n  IDENTITY_DIDS_CACHE.set(identityKey, identityDid);\n  return identityDid;\n};\n", "//\n// Copyright 2019 DXOS.org\n//\n\n/**\n * Info required for offline invitations.\n */\n// TODO(burdon): Define types.\nexport interface SecretInfo {\n  id: any;\n  authNonce: any;\n}\n\n/**\n * Provides a shared secret during an invitation process.\n */\nexport type SecretProvider = (info?: SecretInfo) => Promise<Buffer>;\n\n/**\n * Validates the shared secret during an invitation process.\n */\nexport type SecretValidator = (invitation: never, secret: Buffer) => Promise<boolean>;\n\nexport const defaultSecretProvider: SecretProvider = async () => Buffer.from('0000');\n\nexport const defaultSecretValidator: SecretValidator = async (invitation, secret) => true;\n", "//\n// Copyright 2020 DXOS.org\n//\n\nimport { generateMnemonic, mnemonicToSeedSync } from 'bip39';\n\nimport { createKeyPair } from '@dxos/crypto';\nimport { invariant } from '@dxos/invariant';\nimport { type KeyPair } from '@dxos/keys';\n\n/**\n * Generate bip39 seed phrase (aka mnemonic).\n */\nexport const generateSeedPhrase = (): string => generateMnemonic();\n\n/**\n * Generate key pair from seed phrase.\n */\nexport const keyPairFromSeedPhrase = (seedPhrase: string): KeyPair => {\n  invariant(seedPhrase);\n  const seed = mnemonicToSeedSync(seedPhrase);\n  return createKeyPair(seed);\n};\n", "//\n// Copyright 2019 DXOS.org\n//\n\n/**\n * Generates a numeric passcode.\n * @param {number} length\n * @returns {string}\n */\nexport const generatePasscode = (length = 4) => {\n  let passcode = '';\n  for (let i = 0; i < length; i++) {\n    passcode += `${Math.floor(Math.random() * 10)}`;\n  }\n\n  return passcode;\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport stableStringify from 'json-stable-stringify';\n\nimport { PublicKey } from '@dxos/keys';\nimport { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { Timeframe } from '@dxos/timeframe';\nimport { arrayToBuffer } from '@dxos/util';\n\n/**\n * @returns The input message to be signed for a given credential.\n */\n// TODO(nf): rename, this returns not the proof itself, but the payload for verifying against the proof.\nexport const getCredentialProofPayload = (credential: Credential): Uint8Array => {\n  const copy = {\n    ...credential,\n    proof: {\n      ...credential.proof,\n      value: new Uint8Array(),\n      chain: undefined,\n    },\n  };\n  if (copy.parentCredentialIds?.length === 0) {\n    delete copy.parentCredentialIds;\n  }\n  delete copy.id; // ID is not part of the signature payload.\n\n  // Normalize empty repeated fields in the assertion to avoid proto3 serialization asymmetry.\n  // Proto3 does not encode empty repeated fields, but the codec may restore them as [] after deserialization,\n  // causing a signature mismatch if the original signing payload did not include the field.\n  const assertion = (copy.subject as any)?.assertion;\n  if (assertion) {\n    for (const key of Object.keys(assertion)) {\n      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {\n        delete assertion[key];\n      }\n    }\n  }\n\n  return Buffer.from(canonicalStringify(copy));\n};\n\n/**\n * Utility method to produce stable output for signing/verifying.\n */\nexport const canonicalStringify = (obj: any): string =>\n  stableStringify(obj, {\n    /* The point of signing and verifying is not that the internal, private state of the objects be\n     * identical, but that the public contents can be verified not to have been altered. For that reason,\n     * really private fields (indicated by '__') are not included in the signature.\n     * This gives a mechanism for attaching other attributes to an object without breaking the signature.\n     * We also skip @type.\n     */\n    // TODO(dmaretskyi): Should we actually skip the @type field?\n    replacer: function (this: any, key: any, value: any) {\n      if (key.toString().startsWith('__') || key.toString() === '@type') {\n        return undefined;\n      }\n\n      if (value === null) {\n        return undefined;\n      }\n\n      // Value before .toJSON() is called.\n      const original = this[key];\n\n      if (value) {\n        if (PublicKey.isPublicKey(value)) {\n          return value.toHex();\n        }\n        if (Buffer.isBuffer(value)) {\n          return value.toString('hex');\n        }\n\n        if (value instanceof Uint8Array) {\n          return arrayToBuffer(value).toString('hex');\n        }\n        if (value.data && value.type === 'Buffer') {\n          return Buffer.from(value).toString('hex');\n        }\n        if (original instanceof Timeframe) {\n          // Uses old key truncation method (339d...9d66) to keep backwards compatibility.\n          return original.frames().reduce((frames: Record<string, number>, [key, seq]) => {\n            frames[truncateKey(key)] = seq;\n            return frames;\n          }, {});\n        }\n      }\n\n      return value;\n    },\n  }) as string;\n\n/**\n * Old key truncation method (339d...9d66) to keep backwards compatibility with credentials signed with old method\n */\nconst truncateKey = (key: PublicKey) => {\n  const str = key.toHex();\n  return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;\n};\n\n/**\n * export const truncateKey = (key: any, { length = 8, start }: TruncateKeyOptions = {}) => {\nconst str = String(key);\nif (str.length <= length) {\n  return str;\n}\n\nreturn start\n  ? `${str.slice(0, length)}...`\n  : `${str.substring(0, length / 2)}...${str.substring(str.length - length / 2)}`;\n};\n\n{\n\"04009285\": 20,\n\"0415004f\": 0,\n\"0415e6d7\": 9964,\n\"042a4fa9\": 8,\n\"0448e62f\": 3,\n\"04775053\": 257,\n\"04a6b603\": 97,\n\"04bc5c9d\": 198,\n\"04da9930\": 59,\n\"04df0449\": 676,\n\"04e122ae\": 5435,\n\"04ee588b\": 1703\n}\n\n */\n", "//\n// Copyright 2023 DXOS.org\n//\n\nimport { type Credential, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { canonicalStringify } from '../credentials/signing';\n\nexport const getPresentationProofPayload = (credentials: Credential[], proof: Proof): Uint8Array => {\n  const copy = {\n    credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),\n    proof: {\n      ...proof,\n      value: new Uint8Array(),\n      chain: undefined,\n    },\n  };\n\n  return Buffer.from(canonicalStringify(copy));\n};\n\nconst removeEmptyParentCredentialIds = (credential: Credential): Credential => {\n  const copy = {\n    ...credential,\n    proof: credential.proof\n      ? {\n          ...credential.proof,\n          chain: credential.proof.chain\n            ? { credential: removeEmptyParentCredentialIds(credential.proof.chain.credential) }\n            : undefined,\n        }\n      : undefined,\n  };\n  if (copy.parentCredentialIds?.length === 0) {\n    delete copy.parentCredentialIds;\n  }\n  return copy;\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { type PublicKey } from '@dxos/keys';\nimport { type TYPES, type TypedMessage } from '@dxos/protocols/proto';\nimport { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nexport const getCredentialAssertion = (credential: Credential): TypedMessage => credential.subject.assertion;\n\nexport const isValidAuthorizedDeviceCredential = (\n  credential: Credential,\n  identityKey: PublicKey,\n  deviceKey: PublicKey,\n): boolean => {\n  const assertion = getCredentialAssertion(credential);\n  return (\n    credential.subject.id.equals(deviceKey) &&\n    credential.issuer.equals(identityKey) &&\n    assertion['@type'] === 'dxos.halo.credentials.AuthorizedDevice' &&\n    assertion.identityKey.equals(identityKey) &&\n    assertion.deviceKey.equals(deviceKey)\n  );\n};\n\nexport type SpecificCredential<T> = Omit<Credential, 'subject'> & {\n  subject: Omit<Credential['subject'], 'assertion'> & { assertion: T };\n};\n\nexport const checkCredentialType = <K extends keyof TYPES>(\n  credential: Credential,\n  type: K,\n): credential is SpecificCredential<TYPES[K]> => credential.subject.assertion['@type'] === type;\n\nexport const credentialTypeFilter =\n  <K extends keyof TYPES>(type: K) =>\n  (credential: Credential): credential is SpecificCredential<TYPES[K]> =>\n    checkCredentialType(credential, type);\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { type Signer, subtleCrypto } from '@dxos/crypto';\nimport { invariant } from '@dxos/invariant';\nimport { PublicKey } from '@dxos/keys';\nimport { type TypedMessage } from '@dxos/protocols/proto';\nimport { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { getCredentialProofPayload } from './signing';\nimport { SIGNATURE_TYPE_ED25519, verifyChain } from './verifier';\n\nexport type CreateCredentialSignerProps = {\n  subject: PublicKey;\n  assertion: TypedMessage;\n  nonce?: Uint8Array;\n  parentCredentialIds?: PublicKey[];\n};\n\nexport type CreateCredentialProps = {\n  signer: Signer;\n  issuer: PublicKey;\n  signingKey?: PublicKey;\n\n  // Provided only if signer is different from issuer.\n  chain?: Chain;\n\n  subject: PublicKey;\n  assertion: TypedMessage;\n  nonce?: Uint8Array;\n  parentCredentialIds?: PublicKey[];\n};\n\n/**\n * Construct a signed credential message.\n */\nexport const createCredential = async ({\n  signer,\n  issuer,\n  subject,\n  assertion,\n  signingKey,\n  chain,\n  nonce,\n  parentCredentialIds,\n}: CreateCredentialProps): Promise<Credential> => {\n  invariant(assertion['@type'], 'Invalid assertion.');\n  invariant(!!signingKey === !!chain, 'Chain must be provided if and only if the signing key differs from the issuer.');\n  if (chain) {\n    const result = await verifyChain(chain, issuer, signingKey!);\n    invariant(result.kind === 'pass', 'Invalid chain.');\n  }\n\n  // Create the credential with proof value and chain fields missing (for signature payload).\n  const credential: Credential = {\n    issuer,\n    issuanceDate: new Date(),\n    subject: {\n      id: subject,\n      assertion,\n    },\n    parentCredentialIds,\n    proof: {\n      type: SIGNATURE_TYPE_ED25519,\n      creationDate: new Date(),\n      signer: signingKey ?? issuer,\n      value: new Uint8Array(),\n      nonce,\n    },\n  };\n\n  // Set proof after creating signature.\n  const signedPayload = getCredentialProofPayload(credential);\n  credential.proof!.value = await signer.sign(signingKey ?? issuer, signedPayload);\n  if (chain) {\n    credential.proof!.chain = chain;\n  }\n\n  credential.id = PublicKey.from(await subtleCrypto.digest('SHA-256', signedPayload as Uint8Array<ArrayBuffer>));\n\n  return credential;\n};\n\n// TODO(burdon): Use consistently (merge halo/echo protocol packages).\nexport const createCredentialMessage = (credential: Credential) => {\n  return {\n    '@type': 'dxos.echo.feed.CredentialsMessage',\n    credential,\n  };\n};\n\n// TODO(burdon): Vs. Signer.\nexport interface CredentialSigner {\n  getIssuer(): PublicKey;\n  createCredential: (params: CreateCredentialSignerProps) => Promise<Credential>;\n}\n\n/**\n * Issue credentials directly signed by the issuer.\n */\nexport const createCredentialSignerWithKey = (signer: Signer, issuer: PublicKey): CredentialSigner => ({\n  getIssuer: () => issuer,\n  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) =>\n    createCredential({\n      signer,\n      issuer,\n      subject,\n      assertion,\n      nonce,\n      parentCredentialIds,\n    }),\n});\n\n/**\n * Issue credentials with transitive proof via a chain.\n */\nexport const createCredentialSignerWithChain = (\n  signer: Signer,\n  chain: Chain,\n  signingKey: PublicKey,\n): CredentialSigner => ({\n  getIssuer: () => chain.credential.issuer,\n  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) =>\n    createCredential({\n      signer,\n      issuer: chain.credential.issuer,\n      signingKey,\n      chain,\n      subject,\n      assertion,\n      nonce,\n      parentCredentialIds,\n    }),\n});\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { verifySignature } from '@dxos/crypto';\nimport { type PublicKey } from '@dxos/keys';\nimport { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { isValidAuthorizedDeviceCredential } from './assertions';\nimport { getCredentialProofPayload } from './signing';\n\nexport const SIGNATURE_TYPE_ED25519 = 'ED25519Signature';\n\nexport type VerificationResult = { kind: 'pass' } | { kind: 'fail'; errors: string[] };\n\nexport const verifyCredential = async (credential: Credential): Promise<VerificationResult> => {\n  if (credential.parentCredentialIds?.length === 0) {\n    delete credential.parentCredentialIds;\n  }\n\n  if (!credential.issuer.equals(credential.proof!.signer)) {\n    if (!credential.proof!.chain) {\n      return {\n        kind: 'fail',\n        errors: ['Delegated credential is missing credential chain.'],\n      };\n    }\n\n    const result = await verifyChain(credential.proof!.chain, credential.issuer, credential.proof!.signer);\n    if (result.kind === 'fail') {\n      return result;\n    }\n  }\n\n  const result = await verifyCredentialSignature(credential);\n  if (result.kind === 'fail') {\n    return result;\n  }\n\n  return { kind: 'pass' };\n};\n\n/**\n * Verifies that the signature is valid and was made by the signer.\n * Does not validate other semantics (e.g. chains).\n */\nexport const verifyCredentialSignature = async (credential: Credential): Promise<VerificationResult> => {\n  if (credential.proof!.type !== SIGNATURE_TYPE_ED25519) {\n    return {\n      kind: 'fail',\n      errors: [`Invalid signature type: ${credential.proof!.type}`],\n    };\n  }\n\n  const signData = getCredentialProofPayload(credential);\n  if (!(await verifySignature(credential.proof!.signer, signData, credential.proof!.value))) {\n    return { kind: 'fail', errors: ['Invalid signature'] };\n  }\n\n  return { kind: 'pass' };\n};\n\n/**\n * Verifies that the signer has the delegated authority to create credentials on behalf of the issuer.\n */\nexport const verifyChain = async (\n  chain: Chain,\n  authority: PublicKey,\n  subject: PublicKey,\n): Promise<VerificationResult> => {\n  const result = await verifyCredential(chain.credential);\n  if (result.kind === 'fail') {\n    return result;\n  }\n\n  if (!isValidAuthorizedDeviceCredential(chain.credential, authority, subject)) {\n    return {\n      kind: 'fail',\n      errors: [`Invalid credential chain: invalid assertion for key: ${subject}`],\n    };\n  }\n\n  return { kind: 'pass' };\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { type Signer } from '@dxos/crypto';\nimport { type PublicKey } from '@dxos/keys';\nimport { type TypedMessage } from '@dxos/protocols/proto';\nimport { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';\nimport {\n  AdmittedFeed,\n  type Credential,\n  type DeviceProfileDocument,\n  MembershipPolicy,\n  type ProfileDocument,\n  SpaceMember,\n} from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';\nimport { Timeframe } from '@dxos/timeframe';\n\nimport { type CredentialSigner, createCredential } from './credential-factory';\n\n// TODO(burdon): Normalize generate and functions below.\n//  Use throughout stack and in tests.\n\n/**\n * Utility class for generating credential messages, where the issuer is the current identity or device.\n */\nexport class CredentialGenerator {\n  constructor(\n    private readonly _signer: Signer,\n    private readonly _identityKey: PublicKey,\n    private readonly _deviceKey: PublicKey,\n  ) {}\n\n  /**\n   * Create genesis messages for new Space.\n   */\n  async createSpaceGenesis(\n    spaceKey: PublicKey,\n    controlKey: PublicKey,\n    creatorProfile?: ProfileDocument,\n    membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE,\n  ): Promise<Credential[]> {\n    return [\n      await createCredential({\n        signer: this._signer,\n        issuer: spaceKey,\n        subject: spaceKey,\n        assertion: {\n          '@type': 'dxos.halo.credentials.SpaceGenesis',\n          spaceKey,\n          membershipPolicy,\n        },\n      }),\n\n      await createCredential({\n        signer: this._signer,\n        issuer: spaceKey,\n        subject: this._identityKey,\n        assertion: {\n          '@type': 'dxos.halo.credentials.SpaceMember',\n          spaceKey,\n          role: SpaceMember.Role.ADMIN,\n          profile: creatorProfile,\n          genesisFeedKey: controlKey,\n        },\n      }),\n\n      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL),\n    ];\n  }\n\n  /**\n   * Create invitation.\n   * Admit identity and control and data feeds.\n   */\n  // TODO(burdon): Reconcile with above (esp. Signer).\n  async createMemberInvitation(\n    spaceKey: PublicKey,\n    identityKey: PublicKey,\n    deviceKey: PublicKey,\n    controlKey: PublicKey,\n    dataKey: PublicKey,\n    genesisFeedKey: PublicKey,\n  ): Promise<Credential[]> {\n    return [\n      await createCredential({\n        signer: this._signer,\n        issuer: this._identityKey,\n        subject: identityKey,\n        assertion: {\n          '@type': 'dxos.halo.credentials.SpaceMember',\n          spaceKey,\n          role: SpaceMember.Role.EDITOR,\n          genesisFeedKey,\n        },\n      }),\n\n      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL),\n      await this.createFeedAdmission(spaceKey, dataKey, AdmittedFeed.Designation.DATA),\n    ];\n  }\n\n  /**\n   * Add device to space.\n   */\n  // TODO(burdon): Reconcile with below.\n  async createDeviceAuthorization(deviceKey: PublicKey): Promise<Credential> {\n    return createCredential({\n      signer: this._signer,\n      issuer: this._identityKey,\n      subject: deviceKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.AuthorizedDevice',\n        identityKey: this._identityKey,\n        deviceKey,\n      },\n    });\n  }\n\n  /**\n   * Add device metadata.\n   */\n  async createDeviceProfile(profile: DeviceProfileDocument): Promise<Credential> {\n    return createCredential({\n      signer: this._signer,\n      issuer: this._identityKey,\n      subject: this._deviceKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.DeviceProfile',\n        profile,\n      },\n    });\n  }\n\n  /**\n   * Add feed to space.\n   */\n  async createFeedAdmission(\n    spaceKey: PublicKey,\n    feedKey: PublicKey,\n    designation: AdmittedFeed.Designation,\n  ): Promise<Credential> {\n    return createCredential({\n      signer: this._signer,\n      issuer: this._identityKey,\n      subject: feedKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.AdmittedFeed',\n        spaceKey,\n        identityKey: this._identityKey,\n        deviceKey: this._deviceKey,\n        designation,\n      },\n    });\n  }\n\n  async createProfileCredential(profile: ProfileDocument): Promise<Credential> {\n    return createCredential({\n      signer: this._signer,\n      issuer: this._identityKey,\n      subject: this._identityKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.IdentityProfile',\n        profile,\n      },\n    });\n  }\n\n  async createEpochCredential(spaceKey: PublicKey): Promise<Credential> {\n    return createCredential({\n      signer: this._signer,\n      issuer: this._identityKey,\n      subject: spaceKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.Epoch',\n        number: 0,\n        timeframe: new Timeframe(),\n      },\n    });\n  }\n}\n\n// TODO(burdon): Reconcile with above (esp. Signer).\nexport const createDeviceAuthorization = async (\n  signer: CredentialSigner,\n  identityKey: PublicKey,\n  deviceKey: PublicKey,\n): Promise<TypedMessage[]> => {\n  const credentials = await Promise.all([\n    await signer.createCredential({\n      subject: deviceKey,\n      assertion: {\n        '@type': 'dxos.halo.credentials.AuthorizedDevice',\n        identityKey,\n        deviceKey,\n      },\n    }),\n  ]);\n\n  return credentials.map((credential) => ({\n    '@type': 'dxos.echo.feed.CredentialsMessage',\n    credential,\n  }));\n};\n\n// TODO(burdon): Reconcile with above (esp. Signer).\n/**\n * @param signer - invitation signer.\n * @param identityKey - identity key of the admitted member.\n * @param spaceKey - subject space key.\n * @param genesisFeedKey - genesis feed key of the space.\n * @param role - role of the newly added member.\n * @param membershipChainHeads - ids of the last known SpaceMember credentials (branching possible).\n * @param profile - profile of the newly added member.\n * @param invitationCredentialId - id of the delegated invitation credential in case one was used to add the member.\n */\nexport const createAdmissionCredentials = async (\n  signer: CredentialSigner,\n  identityKey: PublicKey,\n  spaceKey: PublicKey,\n  genesisFeedKey: PublicKey,\n  role: SpaceMember.Role = SpaceMember.Role.ADMIN,\n  membershipChainHeads: PublicKey[] = [],\n  profile?: ProfileDocument,\n  invitationCredentialId?: PublicKey,\n  tags?: string[],\n): Promise<FeedMessage.Payload[]> => {\n  const credentials = await Promise.all([\n    await signer.createCredential({\n      subject: identityKey,\n      parentCredentialIds: membershipChainHeads,\n      assertion: {\n        '@type': 'dxos.halo.credentials.SpaceMember',\n        spaceKey,\n        role,\n        profile,\n        genesisFeedKey,\n        invitationCredentialId,\n        tags: tags ?? [],\n      },\n    }),\n  ]);\n\n  return credentials.map((credential) => ({\n    credential: { credential },\n  }));\n};\n\nexport const createDelegatedSpaceInvitationCredential = async (\n  signer: CredentialSigner,\n  subject: PublicKey,\n  invitation: DelegateSpaceInvitation,\n): Promise<FeedMessage.Payload> => {\n  const credential = await signer.createCredential({\n    subject,\n    assertion: {\n      '@type': 'dxos.halo.invitations.DelegateSpaceInvitation',\n      invitationId: invitation.invitationId,\n      authMethod: invitation.authMethod,\n      swarmKey: invitation.swarmKey,\n      role: invitation.role,\n      guestKey: invitation.guestKey,\n      expiresOn: invitation.expiresOn,\n      multiUse: invitation.multiUse,\n    },\n  });\n  return { credential: { credential } };\n};\n\n/**\n * @param signer - credential issuer.\n * @param subject - key of the space the invitation was for.\n * @param invitationCredentialId id of a dxos.halo.invitations.DelegateSpaceInvitation credential.\n */\nexport const createCancelDelegatedSpaceInvitationCredential = async (\n  signer: CredentialSigner,\n  subject: PublicKey,\n  invitationCredentialId: PublicKey,\n): Promise<FeedMessage.Payload> => {\n  const credential = await signer.createCredential({\n    subject,\n    assertion: {\n      '@type': 'dxos.halo.invitations.CancelDelegatedInvitation',\n      credentialId: invitationCredentialId,\n    },\n  });\n  return { credential: { credential } };\n};\n", "//\n// Copyright 2023 DXOS.org\n//\n\nimport { type Signer } from '@dxos/crypto';\nimport { type PublicKey } from '@dxos/keys';\nimport { type Chain, type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { SIGNATURE_TYPE_ED25519 } from '../credentials';\nimport { getPresentationProofPayload } from './signing';\n\n// TODO(burdon): Rename createPresentation?\nexport const signPresentation = async ({\n  presentation,\n  signer,\n  signerKey,\n  chain,\n  nonce,\n}: {\n  presentation: Presentation;\n  signer: Signer;\n  signerKey: PublicKey;\n  chain?: Chain;\n  nonce?: Uint8Array;\n}): Promise<Presentation> => {\n  const proof: Proof = {\n    type: SIGNATURE_TYPE_ED25519,\n    value: new Uint8Array(),\n    creationDate: new Date(),\n    signer: signerKey,\n    nonce,\n  };\n\n  const signedPayload = getPresentationProofPayload(presentation.credentials ?? [], proof);\n  proof.value = await signer.sign(signerKey, signedPayload);\n  if (chain) {\n    proof.chain = chain;\n  }\n\n  return {\n    credentials: presentation.credentials,\n    proofs: [...(presentation.proofs ?? []), proof],\n  };\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { verifySignature } from '@dxos/crypto';\nimport { type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { SIGNATURE_TYPE_ED25519, type VerificationResult, verifyChain, verifyCredential } from '../credentials';\nimport { getPresentationProofPayload } from './signing';\n\nexport const verifyPresentation = async (presentation: Presentation): Promise<VerificationResult> => {\n  const errors: string[] = [];\n\n  // Verify all credentials.\n  const credentialsVerifications = await Promise.all(\n    presentation.credentials?.map((credential) => verifyCredential(credential)) ?? [],\n  );\n  for (const verification of credentialsVerifications) {\n    if (verification.kind === 'fail') {\n      errors.push(...verification.errors);\n    }\n  }\n\n  // Verify all proofs.\n  const proofVerification = await Promise.all(\n    presentation.proofs?.map(async (proof) => {\n      const chainVerification = await verifyPresentationChain(presentation, proof);\n      if (chainVerification.kind === 'fail') {\n        return chainVerification;\n      }\n      const signatureVerification = await verifyPresentationSignature(presentation, proof);\n      if (signatureVerification.kind === 'fail') {\n        return signatureVerification;\n      }\n      return { kind: 'pass' } as VerificationResult;\n    }) ?? [],\n  );\n  for (const verification of proofVerification) {\n    if (verification.kind === 'fail') {\n      errors.push(...verification.errors);\n    }\n  }\n\n  if (errors.length === 0) {\n    return { kind: 'pass' };\n  }\n  {\n    return {\n      kind: 'fail',\n      errors,\n    };\n  }\n};\n\nexport const verifyPresentationChain = async (\n  presentation: Presentation,\n  proof: Proof,\n): Promise<VerificationResult> => {\n  for (const credential of presentation.credentials ?? []) {\n    if (!credential.issuer.equals(proof.signer)) {\n      if (!proof.chain) {\n        return {\n          kind: 'fail',\n          errors: ['Delegated credential is missing credential chain.'],\n        };\n      }\n\n      const chainVerification = await verifyChain(proof.chain, credential.subject.id, proof.signer);\n      if (chainVerification.kind === 'fail') {\n        return chainVerification;\n      }\n    }\n  }\n\n  return { kind: 'pass' };\n};\n\n/**\n * Verifies that the signature is valid and was made by the signer.\n * Does not validate other semantics (e.g. chains).\n */\nexport const verifyPresentationSignature = async (\n  presentation: Presentation,\n  proof: Proof,\n): Promise<VerificationResult> => {\n  if (proof.type !== SIGNATURE_TYPE_ED25519) {\n    return {\n      kind: 'fail',\n      errors: [`Invalid signature type: ${proof.type}`],\n    };\n  }\n\n  const signData = getPresentationProofPayload(presentation.credentials ?? [], proof);\n  if (!(await verifySignature(proof.signer, signData, proof.value))) {\n    return { kind: 'fail', errors: ['Invalid signature'] };\n  }\n\n  return { kind: 'pass' };\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { runInContextAsync, synchronized } from '@dxos/async';\nimport { Context } from '@dxos/context';\nimport { PublicKey } from '@dxos/keys';\nimport { log } from '@dxos/log';\nimport { type TypedMessage } from '@dxos/protocols/proto';\nimport { type Credential, MembershipPolicy, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';\nimport { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';\n\nimport { getCredentialAssertion, verifyCredential } from '../credentials';\nimport { type CredentialProcessor } from '../processor/credential-processor';\nimport { type FeedInfo, FeedStateMachine } from './feed-state-machine';\nimport { InvitationStateMachine } from './invitation-state-machine';\nimport { type MemberInfo, MemberStateMachine } from './member-state-machine';\n\nexport interface SpaceState {\n  readonly members: ReadonlyMap<PublicKey, MemberInfo>;\n  readonly membershipChainHeads: PublicKey[];\n  readonly feeds: ReadonlyMap<PublicKey, FeedInfo>;\n  readonly credentials: Credential[];\n  readonly genesisCredential: Credential | undefined;\n  readonly tags: string[];\n  readonly membershipPolicy: MembershipPolicy;\n  readonly creator: MemberInfo | undefined;\n  readonly invitations: ReadonlyMap<PublicKey, DelegateSpaceInvitation>;\n\n  addCredentialProcessor(processor: CredentialProcessor): Promise<void>;\n  removeCredentialProcessor(processor: CredentialProcessor): Promise<void>;\n\n  getCredentialsOfType(type: TypedMessage['@type']): Credential[];\n\n  getMemberRole(memberKey: PublicKey): SpaceMember.Role;\n  hasMembershipManagementPermission(memberKey: PublicKey): boolean;\n}\n\nexport type ProcessOptions = {\n  sourceFeed: PublicKey;\n  skipVerification?: boolean;\n};\n\nexport type CredentialEntry = {\n  credential: Credential;\n  sourceFeed: PublicKey;\n  revoked: boolean;\n};\n\n/**\n * Validates and processes credentials for a single space.\n * Keeps a list of members and feeds.\n * Keeps and in-memory index of credentials and allows to query them.\n */\nexport class SpaceStateMachine implements SpaceState {\n  private readonly _members: MemberStateMachine;\n  private readonly _feeds: FeedStateMachine;\n  private readonly _invitations = new InvitationStateMachine();\n  private readonly _credentials: CredentialEntry[] = [];\n  private readonly _credentialsById = new ComplexMap<PublicKey, CredentialEntry>(PublicKey.hash);\n  private readonly _processedCredentials = new ComplexSet<PublicKey>(PublicKey.hash);\n\n  private _genesisCredential: Credential | undefined;\n  private _tags: string[] = [];\n  private _membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE;\n  private _credentialProcessors: CredentialConsumer<any>[] = [];\n\n  readonly onCredentialProcessed = new Callback<AsyncCallback<Credential>>();\n  readonly onMemberRoleChanged: Callback<AsyncCallback<MemberInfo[]>>;\n  readonly onFeedAdmitted: Callback<AsyncCallback<FeedInfo>>;\n  readonly onDelegatedInvitation = this._invitations.onDelegatedInvitation;\n  readonly onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;\n\n  constructor(private readonly _spaceKey: PublicKey) {\n    this._members = new MemberStateMachine(this._spaceKey);\n    this._feeds = new FeedStateMachine(this._spaceKey);\n    this.onMemberRoleChanged = this._members.onMemberRoleChanged;\n    this.onFeedAdmitted = this._feeds.onFeedAdmitted;\n  }\n\n  get creator(): MemberInfo | undefined {\n    return this._members.creator;\n  }\n\n  get members(): ReadonlyMap<PublicKey, MemberInfo> {\n    return this._members.members;\n  }\n\n  get membershipChainHeads(): PublicKey[] {\n    return this._members.membershipChainHeads;\n  }\n\n  get feeds(): ReadonlyMap<PublicKey, FeedInfo> {\n    return this._feeds.feeds;\n  }\n\n  get credentials(): Credential[] {\n    return this._credentials.map((entry) => entry.credential);\n  }\n\n  get credentialEntries(): CredentialEntry[] {\n    return this._credentials;\n  }\n\n  get genesisCredential(): Credential | undefined {\n    return this._genesisCredential;\n  }\n\n  get tags(): string[] {\n    return this._tags;\n  }\n\n  get membershipPolicy(): MembershipPolicy {\n    return this._membershipPolicy;\n  }\n\n  get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {\n    return this._invitations.invitations;\n  }\n\n  async addCredentialProcessor(processor: CredentialProcessor): Promise<void> {\n    if (this._credentialProcessors.find((p) => p.processor === processor)) {\n      throw new Error('Credential processor already added.');\n    }\n\n    const consumer = new CredentialConsumer(\n      processor,\n      async () => {\n        for (const credential of this.credentials) {\n          await consumer._process(credential);\n        }\n\n        // NOTE: It is important to set this flag after immediately after processing existing credentials.\n        // Otherwise, we might miss some credentials.\n        // Having an `await` statement between the end of the loop and setting the flag would cause a race condition.\n        consumer._isReadyForLiveCredentials = true;\n      },\n      async () => {\n        this._credentialProcessors = this._credentialProcessors.filter((p) => p !== consumer);\n      },\n    );\n    this._credentialProcessors.push(consumer);\n\n    await consumer.open();\n  }\n\n  async removeCredentialProcessor(processor: CredentialProcessor): Promise<void> {\n    const consumer = this._credentialProcessors.find((p) => p.processor === processor);\n    await consumer?.close();\n  }\n\n  getCredentialsOfType(type: TypedMessage['@type']): Credential[] {\n    return this.credentials.filter((credential) => getCredentialAssertion(credential)['@type'] === type);\n  }\n\n  /**\n   * @param credential Message to process.\n   * @param fromFeed Key of the feed where this credential is recorded.\n   */\n  @synchronized\n  async process(credential: Credential, { sourceFeed, skipVerification }: ProcessOptions): Promise<boolean> {\n    if (credential.id) {\n      if (this._processedCredentials.has(credential.id)) {\n        return true;\n      }\n      this._processedCredentials.add(credential.id);\n    }\n\n    if (!skipVerification) {\n      const result = await verifyCredential(credential);\n      if (result.kind !== 'pass') {\n        log.warn(`Invalid credential: ${result.errors.join(', ')}`);\n        return false;\n      }\n    }\n\n    const assertion = getCredentialAssertion(credential);\n    switch (assertion['@type']) {\n      case 'dxos.halo.credentials.SpaceGenesis': {\n        if (this._genesisCredential) {\n          log.warn('Space already has a genesis credential.');\n          return false;\n        }\n        if (!credential.issuer.equals(this._spaceKey)) {\n          log.warn('Space genesis credential must be issued by space.');\n          return false;\n        }\n        if (!credential.subject.id.equals(this._spaceKey)) {\n          log.warn('Space genesis credential must be issued to space.');\n          return false;\n        }\n        this._genesisCredential = credential;\n        this._tags = assertion.tags ?? [];\n        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy.INVITE;\n        break;\n      }\n\n      case 'dxos.halo.credentials.SpaceMember': {\n        if (!assertion.spaceKey.equals(this._spaceKey)) {\n          break; // Ignore credentials for other spaces.\n        }\n\n        if (!this._genesisCredential) {\n          log.warn('Space must have a genesis credential before adding members.');\n          return false;\n        }\n        if (!this._canInviteNewMembers(credential.issuer)) {\n          log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`);\n          return false;\n        }\n\n        await this._members.process(credential);\n        await this._invitations.process(credential);\n        break;\n      }\n\n      case 'dxos.halo.credentials.MemberProfile': {\n        if (!this._genesisCredential) {\n          log.warn('Space must have a genesis credential before adding members.');\n          return false;\n        }\n\n        await this._members.process(credential);\n        break;\n      }\n\n      case 'dxos.halo.credentials.AdmittedFeed': {\n        if (!this._genesisCredential) {\n          log.warn('Space must have a genesis credential before admitting feeds.');\n          return false;\n        }\n\n        // We don't do any validation on feed admission since we would perform the same validation on the credentials inside .\n        await this._feeds.process(credential, sourceFeed);\n        break;\n      }\n      case 'dxos.halo.invitations.CancelDelegatedInvitation':\n      case 'dxos.halo.invitations.DelegateSpaceInvitation': {\n        if (!this._canInviteNewMembers(credential.issuer)) {\n          log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`);\n          return false;\n        }\n        await this._invitations.process(credential);\n        break;\n      }\n    }\n\n    const newEntry: CredentialEntry = { credential, sourceFeed, revoked: false };\n    this._credentials.push(newEntry);\n\n    // TODO(dmaretskyi): Invariant on every credential having an id?\n    if (credential.id) {\n      this._credentialsById.set(credential.id, newEntry);\n    }\n\n    for (const processor of this._credentialProcessors) {\n      if (processor._isReadyForLiveCredentials) {\n        await processor._process(credential);\n      }\n    }\n\n    await this.onCredentialProcessed.callIfSet(credential);\n    return true;\n  }\n\n  public getMemberRole(memberKey: PublicKey): SpaceMember.Role {\n    return this._members.getRole(memberKey);\n  }\n\n  public hasMembershipManagementPermission(memberKey: PublicKey): boolean {\n    return this._canInviteNewMembers(memberKey);\n  }\n\n  private _canInviteNewMembers(key: PublicKey): boolean {\n    if (this._membershipPolicy === MembershipPolicy.LOCKED) {\n      // When locked, only the space key can add the initial owner during genesis.\n      // Once a member exists, no new members can be added.\n      return key.equals(this._spaceKey) && this._members.members.size === 0;\n    }\n    return (\n      key.equals(this._spaceKey) ||\n      this._members.getRole(key) === SpaceMember.Role.ADMIN ||\n      this._members.getRole(key) === SpaceMember.Role.OWNER\n    );\n  }\n}\n\n// TODO(dmaretskyi): Simplify.\nclass CredentialConsumer<T extends CredentialProcessor> {\n  private _ctx = new Context();\n\n  /**\n   * @internal\n   * Processor is ready to process live credentials.\n   * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.\n   * Set externally.\n   */\n  _isReadyForLiveCredentials = false;\n\n  constructor(\n    public readonly processor: T,\n    private readonly _onOpen: () => Promise<void>,\n    private readonly _onClose: () => Promise<void>,\n  ) {}\n\n  /**\n   * @internal\n   */\n  async _process(credential: Credential): Promise<void> {\n    await runInContextAsync(this._ctx, async () => {\n      await this.processor.processCredential(credential);\n    });\n  }\n\n  async open(): Promise<void> {\n    if (this._ctx.disposed) {\n      throw new Error('CredentialProcessor is disposed');\n    }\n\n    await this._onOpen();\n  }\n\n  async close(): Promise<void> {\n    await this._ctx.dispose();\n\n    await this._onClose();\n  }\n}\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { invariant } from '@dxos/invariant';\nimport { PublicKey } from '@dxos/keys';\nimport { type AdmittedFeed, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { type AsyncCallback, Callback, ComplexMap } from '@dxos/util';\n\nimport { getCredentialAssertion } from '../credentials';\n\nexport interface FeedInfo {\n  key: PublicKey;\n  /**\n   * Parent feed from the feed tree.\n   * This is the feed where the AdmittedFeed assertion is written.\n   * The genesis feed will have itself as a parent.\n   */\n  parent: PublicKey;\n  credential: Credential;\n  assertion: AdmittedFeed;\n}\n\n/**\n * Tracks the feed tree for a space.\n * Provides a list of admitted feeds.\n */\nexport class FeedStateMachine {\n  private _feeds = new ComplexMap<PublicKey, FeedInfo>(PublicKey.hash);\n\n  readonly onFeedAdmitted = new Callback<AsyncCallback<FeedInfo>>();\n\n  constructor(private readonly _spaceKey: PublicKey) {}\n\n  get feeds(): ReadonlyMap<PublicKey, FeedInfo> {\n    return this._feeds;\n  }\n\n  /**\n   * Processes the AdmittedFeed credential.\n   * Assumes the credential is already pre-verified\n   * and the issuer has been authorized to issue credentials of this type.\n   * @param fromFeed Key of the feed where this credential is recorded.\n   */\n  async process(credential: Credential, fromFeed: PublicKey): Promise<void> {\n    const assertion = getCredentialAssertion(credential);\n    invariant(assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed');\n    invariant(assertion.spaceKey.equals(this._spaceKey));\n\n    const info: FeedInfo = {\n      key: credential.subject.id,\n      credential,\n      assertion,\n      parent: fromFeed,\n    };\n\n    this._feeds.set(credential.subject.id, info);\n    await this.onFeedAdmitted.callIfSet(info);\n  }\n}\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { PublicKey } from '@dxos/keys';\nimport { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';\nimport { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';\n\nimport { getCredentialAssertion } from '../credentials';\n\nexport interface DelegateInvitationCredential {\n  credentialId: PublicKey;\n  invitation: DelegateSpaceInvitation;\n}\n\n/**\n * Tracks the feed tree for a space.\n * Provides a list of admitted feeds.\n */\nexport class InvitationStateMachine {\n  private readonly _invitations = new ComplexMap<PublicKey, DelegateSpaceInvitation>(PublicKey.hash);\n  private readonly _redeemedInvitationCredentialIds = new ComplexSet(PublicKey.hash);\n  private readonly _cancelledInvitationCredentialIds = new ComplexSet(PublicKey.hash);\n\n  readonly onDelegatedInvitation = new Callback<AsyncCallback<DelegateInvitationCredential>>();\n  readonly onDelegatedInvitationRemoved = new Callback<AsyncCallback<DelegateInvitationCredential>>();\n\n  get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {\n    return this._invitations;\n  }\n\n  async process(credential: Credential): Promise<void> {\n    const credentialId = credential.id;\n    if (credentialId == null) {\n      return;\n    }\n    const assertion = getCredentialAssertion(credential);\n    switch (assertion['@type']) {\n      case 'dxos.halo.invitations.CancelDelegatedInvitation': {\n        this._cancelledInvitationCredentialIds.add(assertion.credentialId);\n        const existingInvitation = this._invitations.get(assertion.credentialId);\n        if (existingInvitation != null) {\n          this._invitations.delete(assertion.credentialId);\n          await this.onDelegatedInvitationRemoved.callIfSet({\n            credentialId: assertion.credentialId,\n            invitation: existingInvitation,\n          });\n        }\n        break;\n      }\n      case 'dxos.halo.invitations.DelegateSpaceInvitation': {\n        if (credential.id) {\n          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();\n          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;\n          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);\n          if (isExpired || wasCancelled || wasUsed) {\n            return;\n          }\n          const invitation: DelegateSpaceInvitation = { ...assertion };\n          this._invitations.set(credential.id, invitation);\n          await this.onDelegatedInvitation.callIfSet({\n            credentialId: credential.id,\n            invitation,\n          });\n        }\n        break;\n      }\n      case 'dxos.halo.credentials.SpaceMember': {\n        if (assertion.invitationCredentialId != null) {\n          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);\n          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);\n          if (existingInvitation != null && !existingInvitation.multiUse) {\n            this._invitations.delete(assertion.invitationCredentialId);\n            await this.onDelegatedInvitationRemoved.callIfSet({\n              credentialId: assertion.invitationCredentialId,\n              invitation: existingInvitation,\n            });\n          }\n        }\n        break;\n      }\n    }\n  }\n}\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { invariant } from '@dxos/invariant';\nimport { PublicKey } from '@dxos/keys';\nimport { log } from '@dxos/log';\nimport { type Credential, type ProfileDocument, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { ComplexMap } from '@dxos/util';\n\nimport { getCredentialAssertion } from '../credentials';\nimport {\n  type ChainVertex,\n  CredentialGraph,\n  type CredentialGraphStateHandler,\n  type PathState,\n  type StateScope,\n} from '../graph/credential-graph';\n\nexport interface MemberInfo {\n  key: PublicKey;\n  role: SpaceMember.Role;\n  credential: Credential;\n  assertion: SpaceMember;\n  profile?: ProfileDocument;\n}\n\n/**\n * Tracks the list of members (with roles) for the space.\n * Provides a list of admitted feeds.\n */\nexport class MemberStateMachine implements CredentialGraphStateHandler<SpaceMember, MemberInfo> {\n  private _ownerKey: PublicKey | undefined;\n  private _memberProfiles = new ComplexMap<PublicKey, ProfileDocument | undefined>(PublicKey.hash);\n  private _hashgraph = new CredentialGraph<SpaceMember, MemberInfo>(this);\n\n  readonly onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;\n\n  constructor(private readonly _spaceKey: PublicKey) {}\n\n  get creator(): MemberInfo | undefined {\n    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);\n  }\n\n  get members(): ReadonlyMap<PublicKey, MemberInfo> {\n    return this._hashgraph.getState();\n  }\n\n  get membershipChainHeads(): PublicKey[] {\n    return this._hashgraph.getLeafIds();\n  }\n\n  getRole(member: PublicKey): SpaceMember.Role {\n    return this._getRole(this._hashgraph.getGlobalStateScope(), member);\n  }\n\n  /**\n   * Processes the SpaceMember credential.\n   * Assumes the credential is already pre-verified and the issuer has been authorized to issue credentials of this type.\n   */\n  async process(credential: Credential): Promise<void> {\n    const assertion = getCredentialAssertion(credential);\n\n    switch (assertion['@type']) {\n      case 'dxos.halo.credentials.SpaceMember': {\n        invariant(assertion.spaceKey.equals(this._spaceKey));\n        if (this._ownerKey == null && credential.issuer === this._spaceKey) {\n          this._ownerKey = credential.subject.id;\n        }\n        if (assertion.profile != null) {\n          this._memberProfiles.set(credential.subject.id, assertion.profile);\n        }\n        await this._hashgraph.addVertex(credential, assertion);\n        break;\n      }\n      case 'dxos.halo.credentials.MemberProfile': {\n        const member = this._hashgraph.getSubjectState(credential.subject.id);\n        if (member) {\n          member.profile = assertion.profile;\n        } else {\n          log.warn('Member not found', { id: credential.subject.id });\n        }\n        this._memberProfiles.set(credential.subject.id, assertion.profile);\n        break;\n      }\n      default:\n        throw new Error('Invalid assertion type');\n    }\n  }\n\n  public createState(credential: Credential, assertion: SpaceMember): MemberInfo {\n    const memberKey = credential.subject.id;\n    return {\n      key: memberKey,\n      role: assertion.role,\n      credential,\n      assertion,\n      profile: this._memberProfiles.get(memberKey),\n    };\n  }\n\n  public isUpdateAllowed(scope: StateScope<SpaceMember>, credential: Credential, assertion: SpaceMember): boolean {\n    if (assertion.role === SpaceMember.Role.OWNER) {\n      return credential!.issuer.equals(this._spaceKey);\n    }\n    const issuer = credential.issuer;\n    const isChangingOwnRole = issuer.equals(credential.subject.id);\n    if (isChangingOwnRole) {\n      return false;\n    }\n    if (issuer.equals(assertion.spaceKey)) {\n      return true;\n    }\n    const issuerRole = this._getRole(scope, issuer);\n    return issuerRole === SpaceMember.Role.ADMIN || issuerRole === SpaceMember.Role.OWNER;\n  }\n\n  public getConflictingPaths(\n    paths: PathState<SpaceMember>[],\n    update: ChainVertex<SpaceMember>,\n  ): PathState<SpaceMember>[] {\n    // a member can't be an issuer in a concurrent branch if we decided to remove or revoke admin permissions during merge\n    if (update.assertion.role !== SpaceMember.Role.REMOVED && update.assertion.role !== SpaceMember.Role.EDITOR) {\n      return [];\n    }\n    const memberId = update.credential!.subject.id!;\n    return paths.filter((p) => p.forkIssuers.has(memberId));\n  }\n\n  public tryPickWinningUpdate(\n    scope1: StateScope<SpaceMember>,\n    update1: Credential,\n    scope2: StateScope<SpaceMember>,\n    update2: Credential,\n  ): Credential | null {\n    const path1IssuerRole = this._getRole(scope1, update1.issuer);\n    const path2IssuerRole = this._getRole(scope2, update2.issuer);\n    if ((path2IssuerRole === SpaceMember.Role.OWNER) !== (path1IssuerRole === SpaceMember.Role.OWNER)) {\n      log('owner decision used to break the tie');\n      return path1IssuerRole === SpaceMember.Role.OWNER ? update1 : update2;\n    }\n    return null;\n  }\n\n  public toLogString(assertion: SpaceMember | undefined): string {\n    const role = assertion?.role ?? SpaceMember.Role.REMOVED;\n    return Object.entries(SpaceMember.Role).find(([_, value]) => value === role)![0];\n  }\n\n  public hasStateChanged(s1?: MemberInfo, s2?: MemberInfo): boolean {\n    return s1?.role !== s2?.role;\n  }\n\n  private _getRole(scope: StateScope<SpaceMember>, memberId: PublicKey): SpaceMember.Role {\n    if (this._ownerKey?.equals(memberId)) {\n      return SpaceMember.Role.OWNER;\n    }\n    const realRole = scope.state.get(memberId)?.assertion?.role ?? SpaceMember.Role.REMOVED;\n    if (scope.stateOverrides != null) {\n      const override = scope.stateOverrides.get(memberId);\n      if (override != null) {\n        log('member role overridden in path', () => ({\n          headId: scope.head?.id,\n          roleOverride: this.toLogString(override.assertion),\n          realRole: this.toLogString(scope.state.get(memberId)?.assertion),\n        }));\n        return override.assertion.role;\n      }\n    }\n    return realRole;\n  }\n}\n", "//\n// Copyright 2024 DXOS.org\n//\n\nimport { invariant } from '@dxos/invariant';\nimport { PublicKey } from '@dxos/keys';\nimport { log } from '@dxos/log';\nimport { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';\n\nexport class CredentialGraph<A, State> {\n  /**\n   * Local ids are used during traversals.\n   */\n  private _vertexIdGenerator = 1;\n  /**\n   * All credentials without parent references are connected to the root.\n   */\n  private _root = { id: -1, parents: [], children: [] } as any as ChainVertex<A>;\n  /**\n   * A credential which is not a parent of any other credential has the sentinel as a child.\n   * Sentinel is a virtual merge-point of all credentials.\n   */\n  private _sentinel = { id: -2, parents: [], children: [] } as any as ChainVertex<A>;\n  /**\n   * Vertex references are used for fast credential inserts into the graph.\n   */\n  private _vertexByCredentialId = new ComplexMap<PublicKey, ChainVertex<A>>(PublicKey.hash);\n  /**\n   * The current state of the graph.\n   */\n  private _subjectToVertex = new ComplexMap<PublicKey, ChainVertex<A>>(PublicKey.hash);\n  private _subjectToState = new ComplexMap<PublicKey, State>(PublicKey.hash);\n\n  public onSubjectStateChanged = new Callback<AsyncCallback<State[]>>();\n\n  constructor(private readonly _stateHandler: CredentialGraphStateHandler<A, State>) {}\n\n  public getSubjectState(subjectId: PublicKey): State | undefined {\n    return this._subjectToState.get(subjectId);\n  }\n\n  public getState(): ReadonlyMap<PublicKey, State> {\n    return this._subjectToState;\n  }\n\n  public getLeafIds(): PublicKey[] {\n    return this._sentinel.parents.map((v) => v.credential!.id!);\n  }\n\n  public getGlobalStateScope(): StateScope<A> {\n    return { state: this._subjectToVertex };\n  }\n\n  public addVertex(credential: Credential, assertion: A): Promise<void> {\n    const newVertex: ChainVertex<A> = {\n      id: this._vertexIdGenerator++,\n      credential,\n      assertion,\n      parents: [],\n      children: [],\n    };\n    this._vertexByCredentialId.set(credential.id!, newVertex);\n    const parentIds = credential.parentCredentialIds ?? [];\n    if (parentIds.length === 0) {\n      this._root.children.push(newVertex);\n      newVertex.parents.push(this._root);\n    } else {\n      for (const parentId of parentIds) {\n        const parentVertex = this._vertexByCredentialId.get(parentId);\n        if (parentVertex == null) {\n          log.error('credential skipped because of the unknown parent', { credential, parentId });\n          continue;\n        }\n        parentVertex.children.push(newVertex);\n        newVertex.parents.push(parentVertex);\n        this._removeSentinelConnection(parentVertex);\n      }\n    }\n    newVertex.children.push(this._sentinel);\n    this._sentinel.parents.push(newVertex);\n    return this._onVertexInserted(newVertex);\n  }\n\n  private _removeSentinelConnection(vertex: ChainVertex<A>): void {\n    const sentinelIdx = vertex.children.indexOf(this._sentinel);\n    if (sentinelIdx >= 0) {\n      vertex.children.splice(sentinelIdx, 1);\n      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);\n      invariant(vertexInSentinelIdx >= 0);\n      this._sentinel.parents.splice(vertexInSentinelIdx, 1);\n    }\n  }\n\n  private async _onVertexInserted(newVertex: ChainVertex<A>): Promise<void> {\n    const { credential, assertion } = newVertex;\n    invariant(credential);\n    let changedSubjects: State[] = [];\n    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;\n    if (isUpdateAppliedOnTopOfThePreviousState) {\n      const subjectId = credential.subject.id;\n      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {\n        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);\n        const prevSubjectState = this._subjectToState.get(subjectId);\n        this._subjectToState.set(subjectId, newSubjectState);\n        this._subjectToVertex.set(subjectId, newVertex);\n        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {\n          changedSubjects.push(newSubjectState);\n        }\n      }\n    } else {\n      changedSubjects = this._recomputeState();\n    }\n    if (changedSubjects.length > 0) {\n      await this.onSubjectStateChanged.callIfSet(changedSubjects);\n    }\n  }\n\n  /**\n   * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).\n   * Continue after all paths leading to a merge point converge by merging their states.\n   * In case of a concurrent update paths are replayed taking into account the state set\n   * by the winning branch.\n   */\n  private _recomputeState(): State[] {\n    // ID of a merge point to the list of paths that reached the point.\n    const pendingPaths = new Map<number, PathState<A>[]>();\n    const paths: PathState<A>[] = [this._createRootPath()];\n    let lastPath: PathState<A> | null = null;\n    while (lastPath == null) {\n      const path = paths.pop()!;\n      log('visit vertex', { id: path.head.id });\n      this._updatePathState(path);\n      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);\n      if (convergedPaths == null) {\n        log('waiting for other paths');\n        continue;\n      }\n      const mergeResult = this._mergePaths(convergedPaths);\n      if (mergeResult.type === 'replay_required') {\n        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);\n        continue;\n      }\n      const merged = mergeResult.path;\n      if (merged.head.children.length === 0) {\n        lastPath = merged;\n      } else if (merged.head.children.length === 1) {\n        merged.head = merged.head.children[0];\n        paths.push(merged);\n      } else {\n        this._forkTraversal(paths, merged);\n      }\n    }\n    if (paths.length > 0) {\n      log.error('traversal finished while there were active paths', {\n        paths: paths.map((p) => ({ path: toChosenPath(p), head: p.head.id })),\n      });\n    }\n    return this._setCurrentState(lastPath);\n  }\n\n  private _replayFailedPaths(\n    paths: PathState<A>[],\n    pendingPaths: Map<number, PathState<A>[]>,\n    mergeResult: ReplayRequiredMergeResult<A>,\n    convergedPaths: PathState<A>[],\n  ): void {\n    paths.push(\n      ...mergeResult.replay.map((path) => {\n        const stateOverrides = path.stateOverrides ?? new ComplexMap<PublicKey, ChainVertex<A>>(PublicKey.hash);\n        mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));\n        return { ...mergeResult.from, chosenPath: path.chosenPath, stateOverrides };\n      }),\n    );\n    log('replay paths', () => ({\n      count: paths.length,\n      paths: paths.map((path) => ({\n        from: mergeResult.from.head.id,\n        path: toChosenPath(path),\n        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion)),\n      })),\n    }));\n    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));\n    pendingPaths.set(convergedPaths[0].head.id, clearedPending);\n  }\n\n  private _handleMergePoint(\n    paths: PathState<A>[],\n    pendingPaths: Map<number, PathState<A>[]>,\n    path: PathState<A>,\n  ): PathState<A>[] | null {\n    const pendingList = pendingPaths.get(path.head.id) ?? [];\n    pendingPaths.set(path.head.id, pendingList);\n    pendingList.push(path);\n    if (pendingList.length < path.head.parents.length) {\n      return null;\n    }\n    if (path.head.id === this._sentinel.id && paths.length > 0) {\n      log('waiting for all the active paths to converge on the sentinel');\n      return null;\n    }\n    pendingPaths.delete(path.head.id);\n    return pendingList;\n  }\n\n  private _updatePathState(path: PathState<A>): void {\n    const headCredential = path.head.credential;\n    if (headCredential == null) {\n      return;\n    }\n    const updatedSubject = headCredential.subject.id;\n    path.credentials.add(headCredential.id!);\n    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);\n    // Compatibility with old credentials where parent references were not specified.\n    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {\n      const globalState = this.getGlobalStateScope();\n      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);\n    }\n    if (isUpdateAllowed) {\n      path.forkChangedSubjects.add(updatedSubject);\n      path.forkIssuers.add(headCredential.issuer);\n      path.state.set(updatedSubject, path.head);\n      log('path state updated', () => ({\n        subject: updatedSubject,\n        newState: this._stateHandler.toLogString(path.head.assertion),\n      }));\n    }\n  }\n\n  private _forkTraversal(paths: PathState<A>[], path: PathState<A>): void {\n    const replayChoice = path.chosenPath?.[path.head.id];\n    const choices = replayChoice ?? path.head.children;\n    for (const choice of choices) {\n      log('edge traversal', { from: path.head.id, to: choice.id });\n      const fork: PathState<A> = {\n        forkPoint: path,\n        chosenPath: { ...path.chosenPath, [path.head.id]: [choice] },\n        head: choice,\n        credentials: new ComplexSet(PublicKey.hash, path.credentials),\n        state: new ComplexMap(PublicKey.hash, [...path.state.entries()]),\n        forkIssuers: new ComplexSet(PublicKey.hash),\n        forkChangedSubjects: new ComplexSet(PublicKey.hash),\n        stateOverrides: path.stateOverrides,\n      };\n      paths.push(fork);\n    }\n  }\n\n  /**\n   * Updates the current graph state.\n   * @returns changed states.\n   */\n  private _setCurrentState(path: PathState<A>): State[] {\n    const changedSubjects: State[] = [];\n    const newStateMap = new ComplexMap<PublicKey, State>(PublicKey.hash);\n    const newVertexMap = new ComplexMap<PublicKey, ChainVertex<A>>(PublicKey.hash);\n    for (const [subjectKey, subjectVertex] of path.state.entries()) {\n      const newState = this._stateHandler.createState(subjectVertex.credential!, subjectVertex.assertion);\n      const prevState = this._subjectToState.get(subjectKey);\n      newStateMap.set(subjectKey, newState);\n      newVertexMap.set(subjectKey, subjectVertex);\n      if (this._stateHandler.hasStateChanged(newState, prevState)) {\n        changedSubjects.push(newState);\n      }\n    }\n    this._subjectToState = newStateMap;\n    this._subjectToVertex = newVertexMap;\n    return changedSubjects;\n  }\n\n  /*\n   * Walk up all the fork points and return the first one present in all the paths.\n   * We use local id to determine vertex position in the graph, because nodes can't\n   * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.\n   */\n  private _leastCommonAncestor(paths: PathState<A>[]): PathState<A> {\n    const uniqueForkPoints = paths.reduce((acc, path) => {\n      let it = path.forkPoint;\n      while (it) {\n        acc.set(it.head.id, it);\n        it = it.forkPoint;\n      }\n      return acc;\n    }, new Map<number, PathState<A>>());\n    let maxId = this._root.id;\n    let maxState: PathState<A> | null = null;\n    for (const [id, state] of uniqueForkPoints.entries()) {\n      const headCredential = state.head.credential;\n      if (headCredential != null) {\n        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id!));\n        if (isPointInEveryPath && id > maxId) {\n          maxId = id;\n          maxState = state;\n        }\n      }\n    }\n    return maxState ?? this._createRootPath();\n  }\n\n  /**\n   * We might be merging paths where some of them had fork points after the initial forking.\n   * We need all the paths to point to the least common fork point and contain all the changes\n   * that happened after it.\n   */\n  private _moveUpToForkPoint(forkPoint: PathState<A>, path: PathState<A>): PathState<A> {\n    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;\n    if (isForkPointInPath) {\n      return path;\n    }\n    if (forkPoint.head.id === path.forkPoint?.head.id) {\n      return path;\n    }\n    let it = path.forkPoint!;\n    while (it.head.id !== forkPoint.head.id) {\n      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));\n      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));\n      it = it!.forkPoint!;\n      path.forkPoint = it;\n    }\n    return path;\n  }\n\n  private _mergePaths(convergedPaths: PathState<A>[]): PathMergeResult<A> {\n    invariant(convergedPaths.length >= 1);\n    if (convergedPaths.length === 1) {\n      return { type: 'merged', path: convergedPaths[0] };\n    }\n    const forkPoint = this._leastCommonAncestor(convergedPaths);\n    log('merging paths', () => ({\n      forkPointId: forkPoint.head.id,\n      pathCount: convergedPaths.length,\n      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id),\n    }));\n    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));\n    invariant(forkPoint);\n    const result: PathState<A> = {\n      forkPoint: forkPoint.forkPoint,\n      chosenPath: { ...forkPoint.chosenPath, [forkPoint.head.id]: [] },\n      stateOverrides: forkPoint.stateOverrides,\n      credentials: new ComplexSet(PublicKey.hash, forkPoint.credentials),\n      forkIssuers: new ComplexSet(PublicKey.hash, forkPoint.forkIssuers),\n      forkChangedSubjects: new ComplexSet(PublicKey.hash, forkPoint.forkChangedSubjects),\n      state: forkPoint.state.mapValues((v) => v),\n      head: paths[0].head,\n    };\n    const subjectToBranch = new ComplexMap<PublicKey, PathState<A>>(PublicKey.hash);\n    for (const path of paths) {\n      log('processing a path', () => ({\n        choices: toChosenPath(path),\n        modified: path.forkChangedSubjects,\n        forkIssuers: path.forkIssuers,\n        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion)),\n      }));\n      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));\n      path.credentials.forEach((cred) => result.credentials.add(cred));\n      result.chosenPath![forkPoint.head.id].push(...(path.chosenPath![forkPoint.head.id] ?? []));\n      for (const modifiedSubject of path.forkChangedSubjects) {\n        const existingBranch = subjectToBranch.get(modifiedSubject);\n        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {\n          subjectToBranch.set(modifiedSubject, path);\n        }\n      }\n    }\n    const replayPaths = new Set<PathState<A>>();\n    const addReplayPath = replayPaths.add.bind(replayPaths);\n    for (const [subject, branch] of subjectToBranch.entries()) {\n      result.forkChangedSubjects.add(subject);\n      const vertex = branch.state.get(subject)!;\n      result.state.set(subject, vertex);\n      log('set subject state', () => ({ subject, state: this._stateHandler.toLogString(vertex.assertion) }));\n      const otherPaths = paths.filter((p) => p !== branch);\n      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);\n    }\n    if (replayPaths.size > 0) {\n      return {\n        type: 'replay_required',\n        replay: [...replayPaths.values()],\n        from: forkPoint,\n        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key)!),\n      };\n    }\n    return { type: 'merged', path: result };\n  }\n\n  /**\n   * A candidate credential is preferred over the existing credential if:\n   *  1. It is the merge-point, because it's the last credential that was issued in awareness of all\n   *  the previously existing ones.\n   *  2. A path where candidate was set contains existing credential in it, which means that the candidate\n   *  was issued after the existing credential by a legitimate issuer.\n   *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.\n   *  4. The path where candidate was set has more issuers than the existing path (longer branch).\n   *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).\n   */\n  private _shouldOverrideCredential(\n    existing: PathState<A>,\n    candidate: PathState<A>,\n    modifiedSubject: PublicKey,\n  ): boolean {\n    const candidateVertex = candidate.state.get(modifiedSubject)!;\n    const currentVertex = existing.state.get(modifiedSubject)!;\n    if (candidateVertex.id === currentVertex.id) {\n      return false;\n    }\n    // During merge all paths are pointing to the same head, which is the merge point.\n    const mergePointId = existing.head.id;\n    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {\n      log('merge point chosen to break the tie', { mergePointId: existing.head.id });\n      return mergePointId === candidateVertex.id;\n    }\n    const candidateCredential = candidateVertex.credential!;\n    const currentCredential = currentVertex.credential!;\n    // A credential is contained in a branch where another credential for this subject was issued.\n    if (existing.credentials.has(candidateCredential.id!) !== candidate.credentials.has(currentCredential.id!)) {\n      log('one of the credentials was overridden in another branch', {\n        current: currentVertex.id,\n        candidate: candidateVertex.id,\n      });\n      return candidate.credentials.has(currentCredential.id!);\n    }\n    // Give a chance to state-specific conflict resolution logic.\n    const winningCredential = this._stateHandler.tryPickWinningUpdate(\n      existing,\n      currentCredential,\n      candidate,\n      candidateCredential,\n    );\n    if (winningCredential != null) {\n      return winningCredential === candidateCredential;\n    }\n    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {\n      log('longer issuers branch used to break the tie', {\n        issuerCount: [existing.forkIssuers.size, candidate.forkIssuers.size],\n      });\n      return candidate.forkIssuers.size > existing.forkIssuers.size;\n    }\n    log('issuance date used to break the tie');\n    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();\n  }\n\n  private _createRootPath(): PathState<A> {\n    return {\n      head: this._root,\n      chosenPath: {},\n      forkIssuers: new ComplexSet(PublicKey.hash),\n      forkChangedSubjects: new ComplexSet(PublicKey.hash),\n      state: new ComplexMap<PublicKey, ChainVertex<A>>(PublicKey.hash),\n      credentials: new ComplexSet(PublicKey.hash),\n    };\n  }\n}\n\nexport interface StateScope<A> {\n  head?: { id: number };\n  state: ReadonlyMap<PublicKey, ChainVertex<A>>;\n  stateOverrides?: ReadonlyMap<PublicKey, ChainVertex<A>>;\n}\n\nexport interface CredentialGraphStateHandler<Assertion, State> {\n  hasStateChanged(s1?: State, s2?: State): boolean;\n\n  createState(credential: Credential, assertion: Assertion): State;\n\n  isUpdateAllowed: (scope: StateScope<Assertion>, update: Credential, assertion: Assertion) => boolean;\n\n  getConflictingPaths(paths: PathState<Assertion>[], update: ChainVertex<Assertion>): PathState<Assertion>[];\n\n  tryPickWinningUpdate(\n    scope1: StateScope<Assertion>,\n    update1: Credential,\n    scope2: StateScope<Assertion>,\n    update2: Credential,\n  ): Credential | null;\n\n  toLogString(assertion: Assertion): string;\n}\n\nexport interface PathState<A> {\n  /**\n   * The current vertex position in path, always advances.\n   */\n  head: ChainVertex<A>;\n  /**\n   * Subject info local to the current path.\n   */\n  state: ComplexMap<PublicKey, ChainVertex<A>>;\n  /**\n   * Used during path replay to throw away cascading concurrent modifications.\n   * Overrides pathState.\n   */\n  stateOverrides?: ComplexMap<PublicKey, ChainVertex<A>>;\n  /**\n   * Used to faster search of conflicting branches. Is different from pathState.keys()\n   * because pathState is not reset on forks.\n   */\n  forkChangedSubjects: ComplexSet<PublicKey>;\n  /**\n   * Used to find winning branches. A branch wins if it had more participants.\n   * Ties are broken using credential issuance date.\n   */\n  forkIssuers: ComplexSet<PublicKey>;\n  /**\n   * All the credentials processed during this path traversal.\n   */\n  credentials: ComplexSet<PublicKey>;\n  /**\n   * PathState where we had multiple children in the current vertex.\n   * Will be merged with child branches when they converge.\n   */\n  forkPoint?: PathState<A>;\n  /**\n   * Used for a particular path replay with stateOverrides for conflict resolution\n   * forkVertexId is mapped to child vertex selection.\n   * Contains choices that lead to the current state. Value is an array when\n   * some branches converged before converging with the remaining branches.\n   */\n  chosenPath: { [forkVertexId: number]: ChainVertex<A>[] };\n}\n\nexport interface ChainVertex<Assertion> {\n  /**\n   * The field is missing on root and sentinel vertices. Assertion is not undefined to avoid\n   * always asserting two fields.\n   */\n  credential?: Credential;\n  assertion: Assertion;\n  /**\n   * Local incrementing counter used to form paths. Is used only for causality resolution.\n   */\n  id: number;\n  /**\n   * Parents references are used to handle divergent branch merge-points.\n   */\n  parents: ChainVertex<Assertion>[];\n  /**\n   * Child references are traversed when computing the current state.\n   */\n  children: ChainVertex<Assertion>[];\n}\n\ntype PathMergeResult<A> = SuccessfulMergeResult<A> | ReplayRequiredMergeResult<A>;\n\ninterface SuccessfulMergeResult<A> {\n  type: 'merged';\n  path: PathState<A>;\n}\n\ninterface ReplayRequiredMergeResult<A> {\n  type: 'replay_required';\n  from: PathState<A>;\n  replay: PathState<A>[];\n  stateOverrides: ComplexMap<PublicKey, ChainVertex<A>>;\n}\n\nconst toChosenPath = <A>(path: PathState<A>) => {\n  return Object.fromEntries(Object.entries(path.chosenPath!).map(([k, vs]) => [k, vs.map((v) => v.id)]));\n};\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { Trigger } from '@dxos/async';\nimport { invariant } from '@dxos/invariant';\nimport { PublicKey } from '@dxos/keys';\nimport { log } from '@dxos/log';\nimport { type Chain, type Credential, type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';\nimport { ComplexMap } from '@dxos/util';\n\nimport { getCredentialAssertion, isValidAuthorizedDeviceCredential } from '../credentials';\nimport { type CredentialProcessor } from './credential-processor';\n\nexport type DeviceStateMachineProps = {\n  identityKey: PublicKey;\n  deviceKey: PublicKey;\n  onUpdate?: () => void;\n};\n\n/**\n * Processes device invitation credentials.\n */\nexport class DeviceStateMachine implements CredentialProcessor {\n  // TODO(burdon): Return values via getter.\n  public readonly authorizedDeviceKeys = new ComplexMap<PublicKey, DeviceProfileDocument>(PublicKey.hash);\n\n  public readonly deviceChainReady = new Trigger();\n\n  public deviceCredentialChain?: Chain;\n\n  constructor(private readonly _params: DeviceStateMachineProps) {}\n\n  async processCredential(credential: Credential): Promise<void> {\n    log('processing credential...', {\n      identityKey: this._params.identityKey,\n      deviceKey: this._params.deviceKey,\n      credential,\n    });\n\n    // Save device keychain credential when processed by the space state machine.\n    if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {\n      this.deviceCredentialChain = { credential };\n      this.deviceChainReady.wake();\n    }\n\n    const assertion = getCredentialAssertion(credential);\n\n    switch (assertion['@type']) {\n      case 'dxos.halo.credentials.AuthorizedDevice': {\n        // We don't need to validate that the device is already added since the credentials are considered idempotent.\n        // In the future, when we will have device-specific attributes, we should join them from all concurrent credentials.\n        this.authorizedDeviceKeys.set(assertion.deviceKey, this.authorizedDeviceKeys.get(assertion.deviceKey) ?? {});\n\n        log('added device', {\n          localDeviceKey: this._params.deviceKey,\n          deviceKey: assertion.deviceKey,\n          size: this.authorizedDeviceKeys.size,\n        });\n        this._params.onUpdate?.();\n        break;\n      }\n\n      case 'dxos.halo.credentials.DeviceProfile': {\n        invariant(this.authorizedDeviceKeys.has(credential.subject.id), 'Device not found.');\n\n        if (assertion && credential.subject.id.equals(this._params.deviceKey)) {\n          log.trace('dxos.halo.device', {\n            deviceKey: credential.subject.id,\n            profile: assertion.profile,\n          });\n        }\n\n        this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);\n        this._params.onUpdate?.();\n        break;\n      }\n    }\n  }\n}\n", "//\n// Copyright 2022 DXOS.org\n//\n\nimport { type PublicKey } from '@dxos/keys';\nimport { log } from '@dxos/log';\nimport { type Credential, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';\n\nimport { getCredentialAssertion } from '../credentials';\nimport { type CredentialProcessor } from './credential-processor';\n\nexport type ProfileStateMachineProps = {\n  identityKey: PublicKey;\n  onUpdate?: () => void;\n};\n\n/**\n * Processes device invitation credentials.\n */\nexport class ProfileStateMachine implements CredentialProcessor {\n  // TODO(burdon): Return values via getter.\n  public profile?: ProfileDocument;\n\n  constructor(private readonly _params: ProfileStateMachineProps) {}\n\n  async processCredential(credential: Credential): Promise<void> {\n    const assertion = getCredentialAssertion(credential);\n    switch (assertion['@type']) {\n      case 'dxos.halo.credentials.IdentityProfile': {\n        if (\n          !credential.issuer.equals(this._params.identityKey) ||\n          !credential.subject.id.equals(this._params.identityKey)\n        ) {\n          log.warn('Invalid profile credential', { expectedIdentity: this._params.identityKey, credential });\n          return;\n        }\n\n        // TODO(dmaretskyi): Extra validation for the credential?\n        this.profile = assertion.profile;\n        log('updated profile', {\n          identityKey: this._params.identityKey,\n          profile: this.profile,\n        });\n        this._params.onUpdate?.();\n        break;\n      }\n    }\n  }\n}\n"],
+  "mappings": ";;;AAIA,SAASA,oBAAoB;AAC7B,SAASC,aAAaC,iBAAiB;AACvC,SAASC,kBAAkB;AAE3B,IAAMC,sBAAsB,IAAIC,WAAmCC,UAAUC,IAAI;AAM1E,IAAMC,2BAA2B,OAAOC,gBAAAA;AAC7C,QAAMC,cAAcN,oBAAoBO,IAAIF,WAAAA;AAC5C,MAAIC,gBAAgBE,QAAW;AAC7B,WAAOF;EACT;AAEA,QAAMG,SAAS,MAAMC,aAAaD,OAAO,WAAWJ,YAAYM,aAAY,CAAA;AAE5E,QAAMC,QAAQ,IAAIC,WAAWJ,MAAAA,EAAQK,MAAM,GAAGC,YAAYC,UAAU;AACpE,QAAMC,cAAcF,YAAYG,OAAON,KAAAA;AACvCZ,sBAAoBmB,IAAId,aAAaY,WAAAA;AACrC,SAAOA;AACT;;;ACHO,IAAMG,wBAAwC,YAAYC,OAAOC,KAAK,MAAA;AAEtE,IAAMC,yBAA0C,OAAOC,YAAYC,WAAW;;;ACrBrF,SAASC,kBAAkBC,0BAA0B;AAErD,SAASC,qBAAqB;AAC9B,SAASC,iBAAiB;;AAMnB,IAAMC,qBAAqB,MAAcJ,iBAAAA;AAKzC,IAAMK,wBAAwB,CAACC,eAAAA;AACpCH,YAAUG,YAAAA,QAAAA;;;;;;;;;AACV,QAAMC,OAAON,mBAAmBK,UAAAA;AAChC,SAAOJ,cAAcK,IAAAA;AACvB;;;ACbO,IAAMC,mBAAmB,CAACC,SAAS,MAAC;AACzC,MAAIC,WAAW;AACf,WAASC,IAAI,GAAGA,IAAIF,QAAQE,KAAK;AAC/BD,gBAAY,GAAGE,KAAKC,MAAMD,KAAKE,OAAM,IAAK,EAAA,CAAA;EAC5C;AAEA,SAAOJ;AACT;;;ACZA,OAAOK,qBAAqB;AAE5B,SAASC,aAAAA,kBAAiB;AAE1B,SAASC,iBAAiB;AAC1B,SAASC,qBAAqB;AAMvB,IAAMC,4BAA4B,CAACC,eAAAA;AACxC,QAAMC,OAAO;IACX,GAAGD;IACHE,OAAO;MACL,GAAGF,WAAWE;MACdC,OAAO,IAAIC,WAAAA;MACXC,OAAOC;IACT;EACF;AACA,MAAIL,KAAKM,qBAAqBC,WAAW,GAAG;AAC1C,WAAOP,KAAKM;EACd;AACA,SAAON,KAAKQ;AAKZ,QAAMC,YAAaT,KAAKU,SAAiBD;AACzC,MAAIA,WAAW;AACb,eAAWE,OAAOC,OAAOC,KAAKJ,SAAAA,GAAY;AACxC,UAAIK,MAAMC,QAAQN,UAAUE,GAAAA,CAAI,KAAKF,UAAUE,GAAAA,EAAKJ,WAAW,GAAG;AAChE,eAAOE,UAAUE,GAAAA;MACnB;IACF;EACF;AAEA,SAAOK,OAAOC,KAAKC,mBAAmBlB,IAAAA,CAAAA;AACxC;AAKO,IAAMkB,qBAAqB,CAACC,QACjCC,gBAAgBD,KAAK;;;;;;;;EAQnBE,UAAU,SAAqBV,KAAUT,OAAU;AACjD,QAAIS,IAAIW,SAAQ,EAAGC,WAAW,IAAA,KAASZ,IAAIW,SAAQ,MAAO,SAAS;AACjE,aAAOjB;IACT;AAEA,QAAIH,UAAU,MAAM;AAClB,aAAOG;IACT;AAGA,UAAMmB,WAAW,KAAKb,GAAAA;AAEtB,QAAIT,OAAO;AACT,UAAIuB,WAAUC,YAAYxB,KAAAA,GAAQ;AAChC,eAAOA,MAAMyB,MAAK;MACpB;AACA,UAAIX,OAAOY,SAAS1B,KAAAA,GAAQ;AAC1B,eAAOA,MAAMoB,SAAS,KAAA;MACxB;AAEA,UAAIpB,iBAAiBC,YAAY;AAC/B,eAAO0B,cAAc3B,KAAAA,EAAOoB,SAAS,KAAA;MACvC;AACA,UAAIpB,MAAM4B,QAAQ5B,MAAM6B,SAAS,UAAU;AACzC,eAAOf,OAAOC,KAAKf,KAAAA,EAAOoB,SAAS,KAAA;MACrC;AACA,UAAIE,oBAAoBQ,WAAW;AAEjC,eAAOR,SAASS,OAAM,EAAGC,OAAO,CAACD,QAAgC,CAACtB,MAAKwB,GAAAA,MAAI;AACzEF,iBAAOG,YAAYzB,IAAAA,CAAAA,IAAQwB;AAC3B,iBAAOF;QACT,GAAG,CAAC,CAAA;MACN;IACF;AAEA,WAAO/B;EACT;AACF,CAAA;AAKF,IAAMkC,cAAc,CAACzB,QAAAA;AACnB,QAAM0B,MAAM1B,IAAIgB,MAAK;AACrB,SAAO,GAAGU,IAAIC,UAAU,GAAG,CAAA,CAAA,MAAQD,IAAIC,UAAUD,IAAI9B,SAAS,CAAA,CAAA;AAChE;;;AC7FO,IAAMgC,8BAA8B,CAACC,aAA2BC,UAAAA;AACrE,QAAMC,OAAO;IACXF,aAAaA,YAAYG,IAAI,CAACC,eAAeC,+BAA+BD,UAAAA,CAAAA;IAC5EH,OAAO;MACL,GAAGA;MACHK,OAAO,IAAIC,WAAAA;MACXC,OAAOC;IACT;EACF;AAEA,SAAOC,OAAOC,KAAKC,mBAAmBV,IAAAA,CAAAA;AACxC;AAEA,IAAMG,iCAAiC,CAACD,eAAAA;AACtC,QAAMF,OAAO;IACX,GAAGE;IACHH,OAAOG,WAAWH,QACd;MACE,GAAGG,WAAWH;MACdO,OAAOJ,WAAWH,MAAMO,QACpB;QAAEJ,YAAYC,+BAA+BD,WAAWH,MAAMO,MAAMJ,UAAU;MAAE,IAChFK;IACN,IACAA;EACN;AACA,MAAIP,KAAKW,qBAAqBC,WAAW,GAAG;AAC1C,WAAOZ,KAAKW;EACd;AACA,SAAOX;AACT;;;AC7BO,IAAMa,yBAAyB,CAACC,eAAyCA,WAAWC,QAAQC;AAE5F,IAAMC,oCAAoC,CAC/CH,YACAI,aACAC,cAAAA;AAEA,QAAMH,YAAYH,uBAAuBC,UAAAA;AACzC,SACEA,WAAWC,QAAQK,GAAGC,OAAOF,SAAAA,KAC7BL,WAAWQ,OAAOD,OAAOH,WAAAA,KACzBF,UAAU,OAAA,MAAa,4CACvBA,UAAUE,YAAYG,OAAOH,WAAAA,KAC7BF,UAAUG,UAAUE,OAAOF,SAAAA;AAE/B;AAMO,IAAMI,sBAAsB,CACjCT,YACAU,SAC+CV,WAAWC,QAAQC,UAAU,OAAA,MAAaQ;AAEpF,IAAMC,uBACX,CAAwBD,SACxB,CAACV,eACCS,oBAAoBT,YAAYU,IAAAA;;;ACjCpC,SAAsBE,gBAAAA,qBAAoB;AAC1C,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,aAAAA,kBAAiB;;;ACF1B,SAASC,uBAAuB;AAOzB,IAAMC,yBAAyB;AAI/B,IAAMC,mBAAmB,OAAOC,eAAAA;AACrC,MAAIA,WAAWC,qBAAqBC,WAAW,GAAG;AAChD,WAAOF,WAAWC;EACpB;AAEA,MAAI,CAACD,WAAWG,OAAOC,OAAOJ,WAAWK,MAAOC,MAAM,GAAG;AACvD,QAAI,CAACN,WAAWK,MAAOE,OAAO;AAC5B,aAAO;QACLC,MAAM;QACNC,QAAQ;UAAC;;MACX;IACF;AAEA,UAAMC,UAAS,MAAMC,YAAYX,WAAWK,MAAOE,OAAOP,WAAWG,QAAQH,WAAWK,MAAOC,MAAM;AACrG,QAAII,QAAOF,SAAS,QAAQ;AAC1B,aAAOE;IACT;EACF;AAEA,QAAMA,SAAS,MAAME,0BAA0BZ,UAAAA;AAC/C,MAAIU,OAAOF,SAAS,QAAQ;AAC1B,WAAOE;EACT;AAEA,SAAO;IAAEF,MAAM;EAAO;AACxB;AAMO,IAAMI,4BAA4B,OAAOZ,eAAAA;AAC9C,MAAIA,WAAWK,MAAOQ,SAASf,wBAAwB;AACrD,WAAO;MACLU,MAAM;MACNC,QAAQ;QAAC,2BAA2BT,WAAWK,MAAOQ,IAAI;;IAC5D;EACF;AAEA,QAAMC,WAAWC,0BAA0Bf,UAAAA;AAC3C,MAAI,CAAE,MAAMgB,gBAAgBhB,WAAWK,MAAOC,QAAQQ,UAAUd,WAAWK,MAAOY,KAAK,GAAI;AACzF,WAAO;MAAET,MAAM;MAAQC,QAAQ;QAAC;;IAAqB;EACvD;AAEA,SAAO;IAAED,MAAM;EAAO;AACxB;AAKO,IAAMG,cAAc,OACzBJ,OACAW,WACAC,YAAAA;AAEA,QAAMT,SAAS,MAAMX,iBAAiBQ,MAAMP,UAAU;AACtD,MAAIU,OAAOF,SAAS,QAAQ;AAC1B,WAAOE;EACT;AAEA,MAAI,CAACU,kCAAkCb,MAAMP,YAAYkB,WAAWC,OAAAA,GAAU;AAC5E,WAAO;MACLX,MAAM;MACNC,QAAQ;QAAC,wDAAwDU,OAAAA;;IACnE;EACF;AAEA,SAAO;IAAEX,MAAM;EAAO;AACxB;;;;AD9CO,IAAMa,mBAAmB,OAAO,EACrCC,QACAC,QACAC,SACAC,WACAC,YACAC,OACAC,OACAC,oBAAmB,MACG;AACtBC,EAAAA,WAAUL,UAAU,OAAA,GAAU,sBAAA;;;;;;;;;AAC9BK,EAAAA,WAAU,CAAC,CAACJ,eAAe,CAAC,CAACC,OAAO,kFAAA;;;;;;;;;AACpC,MAAIA,OAAO;AACT,UAAMI,SAAS,MAAMC,YAAYL,OAAOJ,QAAQG,UAAAA;AAChDI,IAAAA,WAAUC,OAAOE,SAAS,QAAQ,kBAAA;;;;;;;;;EACpC;AAGA,QAAMC,aAAyB;IAC7BX;IACAY,cAAc,oBAAIC,KAAAA;IAClBZ,SAAS;MACPa,IAAIb;MACJC;IACF;IACAI;IACAS,OAAO;MACLC,MAAMC;MACNC,cAAc,oBAAIL,KAAAA;MAClBd,QAAQI,cAAcH;MACtBmB,OAAO,IAAIC,WAAAA;MACXf;IACF;EACF;AAGA,QAAMgB,gBAAgBC,0BAA0BX,UAAAA;AAChDA,aAAWI,MAAOI,QAAQ,MAAMpB,OAAOwB,KAAKpB,cAAcH,QAAQqB,aAAAA;AAClE,MAAIjB,OAAO;AACTO,eAAWI,MAAOX,QAAQA;EAC5B;AAEAO,aAAWG,KAAKU,WAAUC,KAAK,MAAMC,cAAaC,OAAO,WAAWN,aAAAA,CAAAA;AAEpE,SAAOV;AACT;AAGO,IAAMiB,0BAA0B,CAACjB,eAAAA;AACtC,SAAO;IACL,SAAS;IACTA;EACF;AACF;AAWO,IAAMkB,gCAAgC,CAAC9B,QAAgBC,YAAyC;EACrG8B,WAAW,MAAM9B;EACjBF,kBAAkB,CAAC,EAAEG,SAASC,WAAWG,OAAOC,oBAAmB,MACjER,iBAAiB;IACfC;IACAC;IACAC;IACAC;IACAG;IACAC;EACF,CAAA;AACJ;AAKO,IAAMyB,kCAAkC,CAC7ChC,QACAK,OACAD,gBACsB;EACtB2B,WAAW,MAAM1B,MAAMO,WAAWX;EAClCF,kBAAkB,CAAC,EAAEG,SAASC,WAAWG,OAAOC,oBAAmB,MACjER,iBAAiB;IACfC;IACAC,QAAQI,MAAMO,WAAWX;IACzBG;IACAC;IACAH;IACAC;IACAG;IACAC;EACF,CAAA;AACJ;;;AE9HA,SACE0B,cAGAC,kBAEAC,mBACK;AAEP,SAASC,aAAAA,kBAAiB;AAUnB,IAAMC,sBAAN,MAAMA;;;;EACX,YACmBC,SACAC,cACAC,YACjB;SAHiBF,UAAAA;SACAC,eAAAA;SACAC,aAAAA;EAChB;;;;EAKH,MAAMC,mBACJC,UACAC,YACAC,gBACAC,mBAAqCC,iBAAiBC,QAC/B;AACvB,WAAO;MACL,MAAMC,iBAAiB;QACrBC,QAAQ,KAAKX;QACbY,QAAQR;QACRS,SAAST;QACTU,WAAW;UACT,SAAS;UACTV;UACAG;QACF;MACF,CAAA;MAEA,MAAMG,iBAAiB;QACrBC,QAAQ,KAAKX;QACbY,QAAQR;QACRS,SAAS,KAAKZ;QACda,WAAW;UACT,SAAS;UACTV;UACAW,MAAMC,YAAYC,KAAKC;UACvBC,SAASb;UACTc,gBAAgBf;QAClB;MACF,CAAA;MAEA,MAAM,KAAKgB,oBAAoBjB,UAAUC,YAAYiB,aAAaC,YAAYC,OAAO;;EAEzF;;;;;;EAOA,MAAMC,uBACJrB,UACAsB,aACAC,WACAtB,YACAuB,SACAR,gBACuB;AACvB,WAAO;MACL,MAAMV,iBAAiB;QACrBC,QAAQ,KAAKX;QACbY,QAAQ,KAAKX;QACbY,SAASa;QACTZ,WAAW;UACT,SAAS;UACTV;UACAW,MAAMC,YAAYC,KAAKY;UACvBT;QACF;MACF,CAAA;MAEA,MAAM,KAAKC,oBAAoBjB,UAAUC,YAAYiB,aAAaC,YAAYC,OAAO;MACrF,MAAM,KAAKH,oBAAoBjB,UAAUwB,SAASN,aAAaC,YAAYO,IAAI;;EAEnF;;;;;EAMA,MAAMC,0BAA0BJ,WAA2C;AACzE,WAAOjB,iBAAiB;MACtBC,QAAQ,KAAKX;MACbY,QAAQ,KAAKX;MACbY,SAASc;MACTb,WAAW;QACT,SAAS;QACTY,aAAa,KAAKzB;QAClB0B;MACF;IACF,CAAA;EACF;;;;EAKA,MAAMK,oBAAoBb,SAAqD;AAC7E,WAAOT,iBAAiB;MACtBC,QAAQ,KAAKX;MACbY,QAAQ,KAAKX;MACbY,SAAS,KAAKX;MACdY,WAAW;QACT,SAAS;QACTK;MACF;IACF,CAAA;EACF;;;;EAKA,MAAME,oBACJjB,UACA6B,SACAC,aACqB;AACrB,WAAOxB,iBAAiB;MACtBC,QAAQ,KAAKX;MACbY,QAAQ,KAAKX;MACbY,SAASoB;MACTnB,WAAW;QACT,SAAS;QACTV;QACAsB,aAAa,KAAKzB;QAClB0B,WAAW,KAAKzB;QAChBgC;MACF;IACF,CAAA;EACF;EAEA,MAAMC,wBAAwBhB,SAA+C;AAC3E,WAAOT,iBAAiB;MACtBC,QAAQ,KAAKX;MACbY,QAAQ,KAAKX;MACbY,SAAS,KAAKZ;MACda,WAAW;QACT,SAAS;QACTK;MACF;IACF,CAAA;EACF;EAEA,MAAMiB,sBAAsBhC,UAA0C;AACpE,WAAOM,iBAAiB;MACtBC,QAAQ,KAAKX;MACbY,QAAQ,KAAKX;MACbY,SAAST;MACTU,WAAW;QACT,SAAS;QACTuB,QAAQ;QACRC,WAAW,IAAIC,WAAAA;MACjB;IACF,CAAA;EACF;AACF;AAGO,IAAMR,4BAA4B,OACvCpB,QACAe,aACAC,cAAAA;AAEA,QAAMa,cAAc,MAAMC,QAAQC,IAAI;IACpC,MAAM/B,OAAOD,iBAAiB;MAC5BG,SAASc;MACTb,WAAW;QACT,SAAS;QACTY;QACAC;MACF;IACF,CAAA;GACD;AAED,SAAOa,YAAYG,IAAI,CAACC,gBAAgB;IACtC,SAAS;IACTA;EACF,EAAA;AACF;AAaO,IAAMC,6BAA6B,OACxClC,QACAe,aACAtB,UACAgB,gBACAL,OAAyBC,YAAYC,KAAKC,OAC1C4B,uBAAoC,CAAA,GACpC3B,SACA4B,wBACAC,SAAAA;AAEA,QAAMR,cAAc,MAAMC,QAAQC,IAAI;IACpC,MAAM/B,OAAOD,iBAAiB;MAC5BG,SAASa;MACTuB,qBAAqBH;MACrBhC,WAAW;QACT,SAAS;QACTV;QACAW;QACAI;QACAC;QACA2B;QACAC,MAAMA,QAAQ,CAAA;MAChB;IACF,CAAA;GACD;AAED,SAAOR,YAAYG,IAAI,CAACC,gBAAgB;IACtCA,YAAY;MAAEA;IAAW;EAC3B,EAAA;AACF;AAEO,IAAMM,2CAA2C,OACtDvC,QACAE,SACAsC,eAAAA;AAEA,QAAMP,aAAa,MAAMjC,OAAOD,iBAAiB;IAC/CG;IACAC,WAAW;MACT,SAAS;MACTsC,cAAcD,WAAWC;MACzBC,YAAYF,WAAWE;MACvBC,UAAUH,WAAWG;MACrBvC,MAAMoC,WAAWpC;MACjBwC,UAAUJ,WAAWI;MACrBC,WAAWL,WAAWK;MACtBC,UAAUN,WAAWM;IACvB;EACF,CAAA;AACA,SAAO;IAAEb,YAAY;MAAEA;IAAW;EAAE;AACtC;AAOO,IAAMc,iDAAiD,OAC5D/C,QACAE,SACAkC,2BAAAA;AAEA,QAAMH,aAAa,MAAMjC,OAAOD,iBAAiB;IAC/CG;IACAC,WAAW;MACT,SAAS;MACT6C,cAAcZ;IAChB;EACF,CAAA;AACA,SAAO;IAAEH,YAAY;MAAEA;IAAW;EAAE;AACtC;;;ACpRO,IAAMgB,mBAAmB,OAAO,EACrCC,cACAC,QACAC,WACAC,OACAC,MAAK,MAON;AACC,QAAMC,QAAe;IACnBC,MAAMC;IACNC,OAAO,IAAIC,WAAAA;IACXC,cAAc,oBAAIC,KAAAA;IAClBV,QAAQC;IACRE;EACF;AAEA,QAAMQ,gBAAgBC,4BAA4Bb,aAAac,eAAe,CAAA,GAAIT,KAAAA;AAClFA,QAAMG,QAAQ,MAAMP,OAAOc,KAAKb,WAAWU,aAAAA;AAC3C,MAAIT,OAAO;AACTE,UAAMF,QAAQA;EAChB;AAEA,SAAO;IACLW,aAAad,aAAac;IAC1BE,QAAQ;SAAKhB,aAAagB,UAAU,CAAA;MAAKX;;EAC3C;AACF;;;ACvCA,SAASY,mBAAAA,wBAAuB;AAMzB,IAAMC,qBAAqB,OAAOC,iBAAAA;AACvC,QAAMC,SAAmB,CAAA;AAGzB,QAAMC,2BAA2B,MAAMC,QAAQC,IAC7CJ,aAAaK,aAAaC,IAAI,CAACC,eAAeC,iBAAiBD,UAAAA,CAAAA,KAAgB,CAAA,CAAE;AAEnF,aAAWE,gBAAgBP,0BAA0B;AACnD,QAAIO,aAAaC,SAAS,QAAQ;AAChCT,aAAOU,KAAI,GAAIF,aAAaR,MAAM;IACpC;EACF;AAGA,QAAMW,oBAAoB,MAAMT,QAAQC,IACtCJ,aAAaa,QAAQP,IAAI,OAAOQ,UAAAA;AAC9B,UAAMC,oBAAoB,MAAMC,wBAAwBhB,cAAcc,KAAAA;AACtE,QAAIC,kBAAkBL,SAAS,QAAQ;AACrC,aAAOK;IACT;AACA,UAAME,wBAAwB,MAAMC,4BAA4BlB,cAAcc,KAAAA;AAC9E,QAAIG,sBAAsBP,SAAS,QAAQ;AACzC,aAAOO;IACT;AACA,WAAO;MAAEP,MAAM;IAAO;EACxB,CAAA,KAAM,CAAA,CAAE;AAEV,aAAWD,gBAAgBG,mBAAmB;AAC5C,QAAIH,aAAaC,SAAS,QAAQ;AAChCT,aAAOU,KAAI,GAAIF,aAAaR,MAAM;IACpC;EACF;AAEA,MAAIA,OAAOkB,WAAW,GAAG;AACvB,WAAO;MAAET,MAAM;IAAO;EACxB;AACA;AACE,WAAO;MACLA,MAAM;MACNT;IACF;EACF;AACF;AAEO,IAAMe,0BAA0B,OACrChB,cACAc,UAAAA;AAEA,aAAWP,cAAcP,aAAaK,eAAe,CAAA,GAAI;AACvD,QAAI,CAACE,WAAWa,OAAOC,OAAOP,MAAMQ,MAAM,GAAG;AAC3C,UAAI,CAACR,MAAMS,OAAO;AAChB,eAAO;UACLb,MAAM;UACNT,QAAQ;YAAC;;QACX;MACF;AAEA,YAAMc,oBAAoB,MAAMS,YAAYV,MAAMS,OAAOhB,WAAWkB,QAAQC,IAAIZ,MAAMQ,MAAM;AAC5F,UAAIP,kBAAkBL,SAAS,QAAQ;AACrC,eAAOK;MACT;IACF;EACF;AAEA,SAAO;IAAEL,MAAM;EAAO;AACxB;AAMO,IAAMQ,8BAA8B,OACzClB,cACAc,UAAAA;AAEA,MAAIA,MAAMa,SAASC,wBAAwB;AACzC,WAAO;MACLlB,MAAM;MACNT,QAAQ;QAAC,2BAA2Ba,MAAMa,IAAI;;IAChD;EACF;AAEA,QAAME,WAAWC,4BAA4B9B,aAAaK,eAAe,CAAA,GAAIS,KAAAA;AAC7E,MAAI,CAAE,MAAMiB,iBAAgBjB,MAAMQ,QAAQO,UAAUf,MAAMkB,KAAK,GAAI;AACjE,WAAO;MAAEtB,MAAM;MAAQT,QAAQ;QAAC;;IAAqB;EACvD;AAEA,SAAO;IAAES,MAAM;EAAO;AACxB;;;AC9FA,SAASuB,mBAAmBC,oBAAoB;AAChD,SAASC,eAAe;AACxB,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,OAAAA,YAAW;AAEpB,SAA0BC,oBAAAA,mBAAkBC,eAAAA,oBAAmB;AAE/D,SAA6BC,YAAAA,WAAUC,cAAAA,aAAYC,cAAAA,mBAAkB;;;ACPrE,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,aAAAA,kBAAiB;AAE1B,SAA6BC,UAAUC,cAAAA,mBAAkB;;AAoBlD,IAAMC,mBAAN,MAAMA;;EACHC,SAAS,IAAIC,YAAgCC,WAAUC,IAAI;EAE1DC,iBAAiB,IAAIC,SAAAA;EAE9B,YAA6BC,WAAsB;SAAtBA,YAAAA;EAAuB;EAEpD,IAAIC,QAA0C;AAC5C,WAAO,KAAKP;EACd;;;;;;;EAQA,MAAMQ,QAAQC,YAAwBC,UAAoC;AACxE,UAAMC,YAAYC,uBAAuBH,UAAAA;AACzCI,IAAAA,WAAUF,UAAU,OAAA,MAAa,sCAAA,QAAA;;;;;;;;;AACjCE,IAAAA,WAAUF,UAAUG,SAASC,OAAO,KAAKT,SAAS,GAAA,QAAA;;;;;;;;;AAElD,UAAMU,OAAiB;MACrBC,KAAKR,WAAWS,QAAQC;MACxBV;MACAE;MACAS,QAAQV;IACV;AAEA,SAAKV,OAAOqB,IAAIZ,WAAWS,QAAQC,IAAIH,IAAAA;AACvC,UAAM,KAAKZ,eAAekB,UAAUN,IAAAA;EACtC;AACF;;;ACvDA,SAASO,aAAAA,kBAAiB;AAG1B,SAA6BC,YAAAA,WAAUC,cAAAA,aAAYC,kBAAkB;AAa9D,IAAMC,yBAAN,MAAMA;EACMC,eAAe,IAAIC,YAA+CC,WAAUC,IAAI;EAChFC,mCAAmC,IAAIC,WAAWH,WAAUC,IAAI;EAChEG,oCAAoC,IAAID,WAAWH,WAAUC,IAAI;EAEzEI,wBAAwB,IAAIC,UAAAA;EAC5BC,+BAA+B,IAAID,UAAAA;EAE5C,IAAIE,cAA+D;AACjE,WAAO,KAAKV;EACd;EAEA,MAAMW,QAAQC,YAAuC;AACnD,UAAMC,eAAeD,WAAWE;AAChC,QAAID,gBAAgB,MAAM;AACxB;IACF;AACA,UAAME,YAAYC,uBAAuBJ,UAAAA;AACzC,YAAQG,UAAU,OAAA,GAAQ;MACxB,KAAK,mDAAmD;AACtD,aAAKT,kCAAkCW,IAAIF,UAAUF,YAAY;AACjE,cAAMK,qBAAqB,KAAKlB,aAAamB,IAAIJ,UAAUF,YAAY;AACvE,YAAIK,sBAAsB,MAAM;AAC9B,eAAKlB,aAAaoB,OAAOL,UAAUF,YAAY;AAC/C,gBAAM,KAAKJ,6BAA6BY,UAAU;YAChDR,cAAcE,UAAUF;YACxBS,YAAYJ;UACd,CAAA;QACF;AACA;MACF;MACA,KAAK,iDAAiD;AACpD,YAAIN,WAAWE,IAAI;AACjB,gBAAMS,YAAYR,UAAUS,aAAaT,UAAUS,UAAUC,QAAO,IAAKC,KAAKC,IAAG;AACjF,gBAAMC,UAAU,KAAKxB,iCAAiCyB,IAAIjB,WAAWE,EAAE,KAAK,CAACC,UAAUe;AACvF,gBAAMC,eAAe,KAAKzB,kCAAkCuB,IAAIjB,WAAWE,EAAE;AAC7E,cAAIS,aAAaQ,gBAAgBH,SAAS;AACxC;UACF;AACA,gBAAMN,aAAsC;YAAE,GAAGP;UAAU;AAC3D,eAAKf,aAAagC,IAAIpB,WAAWE,IAAIQ,UAAAA;AACrC,gBAAM,KAAKf,sBAAsBc,UAAU;YACzCR,cAAcD,WAAWE;YACzBQ;UACF,CAAA;QACF;AACA;MACF;MACA,KAAK,qCAAqC;AACxC,YAAIP,UAAUkB,0BAA0B,MAAM;AAC5C,eAAK7B,iCAAiCa,IAAIF,UAAUkB,sBAAsB;AAC1E,gBAAMf,qBAAqB,KAAKlB,aAAamB,IAAIJ,UAAUkB,sBAAsB;AACjF,cAAIf,sBAAsB,QAAQ,CAACA,mBAAmBY,UAAU;AAC9D,iBAAK9B,aAAaoB,OAAOL,UAAUkB,sBAAsB;AACzD,kBAAM,KAAKxB,6BAA6BY,UAAU;cAChDR,cAAcE,UAAUkB;cACxBX,YAAYJ;YACd,CAAA;UACF;QACF;AACA;MACF;IACF;EACF;AACF;;;AChFA,SAASgB,aAAAA,kBAAiB;AAC1B,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,OAAAA,YAAW;AACpB,SAAgDC,eAAAA,oBAAmB;AACnE,SAASC,cAAAA,mBAAkB;;;ACJ3B,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,WAAW;AAEpB,SAA6BC,YAAAA,WAAUC,cAAAA,aAAYC,cAAAA,mBAAkB;;AAE9D,IAAMC,kBAAN,MAAMA;;;;;EAIHC,qBAAqB;;;;EAIrBC,QAAQ;IAAEC,IAAI;IAAIC,SAAS,CAAA;IAAIC,UAAU,CAAA;EAAG;;;;;EAK5CC,YAAY;IAAEH,IAAI;IAAIC,SAAS,CAAA;IAAIC,UAAU,CAAA;EAAG;;;;EAIhDE,wBAAwB,IAAIT,YAAsCH,WAAUa,IAAI;;;;EAIhFC,mBAAmB,IAAIX,YAAsCH,WAAUa,IAAI;EAC3EE,kBAAkB,IAAIZ,YAA6BH,WAAUa,IAAI;EAElEG,wBAAwB,IAAId,UAAAA;EAEnC,YAA6Be,eAAsD;SAAtDA,gBAAAA;EAAuD;EAE7EC,gBAAgBC,WAAyC;AAC9D,WAAO,KAAKJ,gBAAgBK,IAAID,SAAAA;EAClC;EAEOE,WAA0C;AAC/C,WAAO,KAAKN;EACd;EAEOO,aAA0B;AAC/B,WAAO,KAAKX,UAAUF,QAAQc,IAAI,CAACC,MAAMA,EAAEC,WAAYjB,EAAE;EAC3D;EAEOkB,sBAAqC;AAC1C,WAAO;MAAEC,OAAO,KAAKb;IAAiB;EACxC;EAEOc,UAAUH,YAAwBI,WAA6B;AACpE,UAAMC,YAA4B;MAChCtB,IAAI,KAAKF;MACTmB;MACAI;MACApB,SAAS,CAAA;MACTC,UAAU,CAAA;IACZ;AACA,SAAKE,sBAAsBmB,IAAIN,WAAWjB,IAAKsB,SAAAA;AAC/C,UAAME,YAAYP,WAAWQ,uBAAuB,CAAA;AACpD,QAAID,UAAUE,WAAW,GAAG;AAC1B,WAAK3B,MAAMG,SAASyB,KAAKL,SAAAA;AACzBA,gBAAUrB,QAAQ0B,KAAK,KAAK5B,KAAK;IACnC,OAAO;AACL,iBAAW6B,YAAYJ,WAAW;AAChC,cAAMK,eAAe,KAAKzB,sBAAsBQ,IAAIgB,QAAAA;AACpD,YAAIC,gBAAgB,MAAM;AACxBpC,cAAIqC,MAAM,oDAAoD;YAAEb;YAAYW;UAAS,GAAA;;;;;;AACrF;QACF;AACAC,qBAAa3B,SAASyB,KAAKL,SAAAA;AAC3BA,kBAAUrB,QAAQ0B,KAAKE,YAAAA;AACvB,aAAKE,0BAA0BF,YAAAA;MACjC;IACF;AACAP,cAAUpB,SAASyB,KAAK,KAAKxB,SAAS;AACtC,SAAKA,UAAUF,QAAQ0B,KAAKL,SAAAA;AAC5B,WAAO,KAAKU,kBAAkBV,SAAAA;EAChC;EAEQS,0BAA0BE,QAA8B;AAC9D,UAAMC,cAAcD,OAAO/B,SAASiC,QAAQ,KAAKhC,SAAS;AAC1D,QAAI+B,eAAe,GAAG;AACpBD,aAAO/B,SAASkC,OAAOF,aAAa,CAAA;AACpC,YAAMG,sBAAsB,KAAKlC,UAAUF,QAAQkC,QAAQF,MAAAA;AAC3D1C,MAAAA,WAAU8C,uBAAuB,GAAA,QAAA;;;;;;;;;AACjC,WAAKlC,UAAUF,QAAQmC,OAAOC,qBAAqB,CAAA;IACrD;EACF;EAEA,MAAcL,kBAAkBV,WAA0C;AACxE,UAAM,EAAEL,YAAYI,UAAS,IAAKC;AAClC/B,IAAAA,WAAU0B,YAAAA,QAAAA;;;;;;;;;AACV,QAAIqB,kBAA2B,CAAA;AAC/B,UAAMC,yCAAyC,KAAKpC,UAAUF,QAAQyB,WAAW;AACjF,QAAIa,wCAAwC;AAC1C,YAAM5B,YAAYM,WAAWuB,QAAQxC;AACrC,UAAI,KAAKS,cAAcgC,gBAAgB,KAAKvB,oBAAmB,GAAID,YAAYI,SAAAA,GAAY;AACzF,cAAMqB,kBAAkB,KAAKjC,cAAckC,YAAY1B,YAAYK,UAAUD,SAAS;AACtF,cAAMuB,mBAAmB,KAAKrC,gBAAgBK,IAAID,SAAAA;AAClD,aAAKJ,gBAAgBgB,IAAIZ,WAAW+B,eAAAA;AACpC,aAAKpC,iBAAiBiB,IAAIZ,WAAWW,SAAAA;AACrC,YAAI,KAAKb,cAAcoC,gBAAgBH,iBAAiBE,gBAAAA,GAAmB;AACzEN,0BAAgBX,KAAKe,eAAAA;QACvB;MACF;IACF,OAAO;AACLJ,wBAAkB,KAAKQ,gBAAe;IACxC;AACA,QAAIR,gBAAgBZ,SAAS,GAAG;AAC9B,YAAM,KAAKlB,sBAAsBuC,UAAUT,eAAAA;IAC7C;EACF;;;;;;;EAQQQ,kBAA2B;AAEjC,UAAME,eAAe,oBAAIC,IAAAA;AACzB,UAAMC,QAAwB;MAAC,KAAKC,gBAAe;;AACnD,QAAIC,WAAgC;AACpC,WAAOA,YAAY,MAAM;AACvB,YAAMC,OAAOH,MAAMI,IAAG;AACtB7D,UAAI,gBAAgB;QAAEO,IAAIqD,KAAKE,KAAKvD;MAAG,GAAA;;;;;;AACvC,WAAKwD,iBAAiBH,IAAAA;AACtB,YAAMI,iBAAiB,KAAKC,kBAAkBR,OAAOF,cAAcK,IAAAA;AACnE,UAAII,kBAAkB,MAAM;AAC1BhE,YAAI,2BAAA,QAAA;;;;;;AACJ;MACF;AACA,YAAMkE,cAAc,KAAKC,YAAYH,cAAAA;AACrC,UAAIE,YAAYE,SAAS,mBAAmB;AAC1C,aAAKC,mBAAmBZ,OAAOF,cAAcW,aAAaF,cAAAA;AAC1D;MACF;AACA,YAAMM,SAASJ,YAAYN;AAC3B,UAAIU,OAAOR,KAAKrD,SAASwB,WAAW,GAAG;AACrC0B,mBAAWW;MACb,WAAWA,OAAOR,KAAKrD,SAASwB,WAAW,GAAG;AAC5CqC,eAAOR,OAAOQ,OAAOR,KAAKrD,SAAS,CAAA;AACnCgD,cAAMvB,KAAKoC,MAAAA;MACb,OAAO;AACL,aAAKC,eAAed,OAAOa,MAAAA;MAC7B;IACF;AACA,QAAIb,MAAMxB,SAAS,GAAG;AACpBjC,UAAIqC,MAAM,oDAAoD;QAC5DoB,OAAOA,MAAMnC,IAAI,CAACkD,OAAO;UAAEZ,MAAMa,aAAaD,CAAAA;UAAIV,MAAMU,EAAEV,KAAKvD;QAAG,EAAA;MACpE,GAAA;;;;;;IACF;AACA,WAAO,KAAKmE,iBAAiBf,QAAAA;EAC/B;EAEQU,mBACNZ,OACAF,cACAW,aACAF,gBACM;AACNP,UAAMvB,KAAI,GACLgC,YAAYS,OAAOrD,IAAI,CAACsC,SAAAA;AACzB,YAAMgB,iBAAiBhB,KAAKgB,kBAAkB,IAAI1E,YAAsCH,WAAUa,IAAI;AACtGsD,kBAAYU,eAAeC,QAAQ,CAACC,OAAOC,QAAQH,eAAe9C,IAAIiD,KAAKD,KAAAA,CAAAA;AAC3E,aAAO;QAAE,GAAGZ,YAAYc;QAAMC,YAAYrB,KAAKqB;QAAYL;MAAe;IAC5E,CAAA,CAAA;AAEF5E,QAAI,gBAAgB,OAAO;MACzBkF,OAAOzB,MAAMxB;MACbwB,OAAOA,MAAMnC,IAAI,CAACsC,UAAU;QAC1BoB,MAAMd,YAAYc,KAAKlB,KAAKvD;QAC5BqD,MAAMa,aAAab,IAAAA;QACnBuB,WAAWvB,MAAMgB,gBAAgBQ,UAAU,CAAC7D,MAAM,KAAKP,cAAcqE,YAAY9D,EAAEK,SAAS,CAAA;MAC9F,EAAA;IACF,IAAA;;;;;;AACA,UAAM0D,iBAAiBtB,eAAeuB,OAAO,CAACC,MAAM,CAACtB,YAAYS,OAAOc,SAASD,CAAAA,CAAAA;AACjFjC,iBAAazB,IAAIkC,eAAe,CAAA,EAAGF,KAAKvD,IAAI+E,cAAAA;EAC9C;EAEQrB,kBACNR,OACAF,cACAK,MACuB;AACvB,UAAM8B,cAAcnC,aAAapC,IAAIyC,KAAKE,KAAKvD,EAAE,KAAK,CAAA;AACtDgD,iBAAazB,IAAI8B,KAAKE,KAAKvD,IAAImF,WAAAA;AAC/BA,gBAAYxD,KAAK0B,IAAAA;AACjB,QAAI8B,YAAYzD,SAAS2B,KAAKE,KAAKtD,QAAQyB,QAAQ;AACjD,aAAO;IACT;AACA,QAAI2B,KAAKE,KAAKvD,OAAO,KAAKG,UAAUH,MAAMkD,MAAMxB,SAAS,GAAG;AAC1DjC,UAAI,gEAAA,QAAA;;;;;;AACJ,aAAO;IACT;AACAuD,iBAAaoC,OAAO/B,KAAKE,KAAKvD,EAAE;AAChC,WAAOmF;EACT;EAEQ3B,iBAAiBH,MAA0B;AACjD,UAAMgC,iBAAiBhC,KAAKE,KAAKtC;AACjC,QAAIoE,kBAAkB,MAAM;AAC1B;IACF;AACA,UAAMC,iBAAiBD,eAAe7C,QAAQxC;AAC9CqD,SAAKkC,YAAYC,IAAIH,eAAerF,EAAE;AACtC,QAAIyC,kBAAkB,KAAKhC,cAAcgC,gBAAgBY,MAAMgC,gBAAgBhC,KAAKE,KAAKlC,SAAS;AAElG,QAAI,CAACoB,mBAAmBY,KAAKE,KAAKtD,QAAQ,CAAA,GAAID,OAAO,KAAKD,MAAMC,IAAI;AAClE,YAAMyF,cAAc,KAAKvE,oBAAmB;AAC5CuB,wBAAkB,KAAKhC,cAAcgC,gBAAgBgD,aAAaJ,gBAAgBhC,KAAKE,KAAKlC,SAAS;IACvG;AACA,QAAIoB,iBAAiB;AACnBY,WAAKqC,oBAAoBF,IAAIF,cAAAA;AAC7BjC,WAAKsC,YAAYH,IAAIH,eAAeO,MAAM;AAC1CvC,WAAKlC,MAAMI,IAAI+D,gBAAgBjC,KAAKE,IAAI;AACxC9D,UAAI,sBAAsB,OAAO;QAC/B+C,SAAS8C;QACTO,UAAU,KAAKpF,cAAcqE,YAAYzB,KAAKE,KAAKlC,SAAS;MAC9D,IAAA;;;;;;IACF;EACF;EAEQ2C,eAAed,OAAuBG,MAA0B;AACtE,UAAMyC,eAAezC,KAAKqB,aAAarB,KAAKE,KAAKvD,EAAE;AACnD,UAAM+F,UAAUD,gBAAgBzC,KAAKE,KAAKrD;AAC1C,eAAW8F,UAAUD,SAAS;AAC5BtG,UAAI,kBAAkB;QAAEgF,MAAMpB,KAAKE,KAAKvD;QAAIiG,IAAID,OAAOhG;MAAG,GAAA;;;;;;AAC1D,YAAMkG,OAAqB;QACzBC,WAAW9C;QACXqB,YAAY;UAAE,GAAGrB,KAAKqB;UAAY,CAACrB,KAAKE,KAAKvD,EAAE,GAAG;YAACgG;;QAAQ;QAC3DzC,MAAMyC;QACNT,aAAa,IAAI3F,YAAWJ,WAAUa,MAAMgD,KAAKkC,WAAW;QAC5DpE,OAAO,IAAIxB,YAAWH,WAAUa,MAAM;aAAIgD,KAAKlC,MAAMiF,QAAO;SAAG;QAC/DT,aAAa,IAAI/F,YAAWJ,WAAUa,IAAI;QAC1CqF,qBAAqB,IAAI9F,YAAWJ,WAAUa,IAAI;QAClDgE,gBAAgBhB,KAAKgB;MACvB;AACAnB,YAAMvB,KAAKuE,IAAAA;IACb;EACF;;;;;EAMQ/B,iBAAiBd,MAA6B;AACpD,UAAMf,kBAA2B,CAAA;AACjC,UAAM+D,cAAc,IAAI1G,YAA6BH,WAAUa,IAAI;AACnE,UAAMiG,eAAe,IAAI3G,YAAsCH,WAAUa,IAAI;AAC7E,eAAW,CAACkG,YAAYC,aAAAA,KAAkBnD,KAAKlC,MAAMiF,QAAO,GAAI;AAC9D,YAAMP,WAAW,KAAKpF,cAAckC,YAAY6D,cAAcvF,YAAauF,cAAcnF,SAAS;AAClG,YAAMoF,YAAY,KAAKlG,gBAAgBK,IAAI2F,UAAAA;AAC3CF,kBAAY9E,IAAIgF,YAAYV,QAAAA;AAC5BS,mBAAa/E,IAAIgF,YAAYC,aAAAA;AAC7B,UAAI,KAAK/F,cAAcoC,gBAAgBgD,UAAUY,SAAAA,GAAY;AAC3DnE,wBAAgBX,KAAKkE,QAAAA;MACvB;IACF;AACA,SAAKtF,kBAAkB8F;AACvB,SAAK/F,mBAAmBgG;AACxB,WAAOhE;EACT;;;;;;EAOQoE,qBAAqBxD,OAAqC;AAChE,UAAMyD,mBAAmBzD,MAAM0D,OAAO,CAACC,KAAKxD,SAAAA;AAC1C,UAAIyD,KAAKzD,KAAK8C;AACd,aAAOW,IAAI;AACTD,YAAItF,IAAIuF,GAAGvD,KAAKvD,IAAI8G,EAAAA;AACpBA,aAAKA,GAAGX;MACV;AACA,aAAOU;IACT,GAAG,oBAAI5D,IAAAA,CAAAA;AACP,QAAI8D,QAAQ,KAAKhH,MAAMC;AACvB,QAAIgH,WAAgC;AACpC,eAAW,CAAChH,IAAImB,KAAAA,KAAUwF,iBAAiBP,QAAO,GAAI;AACpD,YAAMf,iBAAiBlE,MAAMoC,KAAKtC;AAClC,UAAIoE,kBAAkB,MAAM;AAC1B,cAAM4B,qBAAqB/D,MAAMgE,MAAM,CAACjD,MAAMA,EAAEsB,YAAY4B,IAAI9B,eAAerF,EAAE,CAAA;AACjF,YAAIiH,sBAAsBjH,KAAK+G,OAAO;AACpCA,kBAAQ/G;AACRgH,qBAAW7F;QACb;MACF;IACF;AACA,WAAO6F,YAAY,KAAK7D,gBAAe;EACzC;;;;;;EAOQiE,mBAAmBjB,WAAyB9C,MAAkC;AACpF,UAAMgE,oBAAoBhE,KAAKqB,WAAWyB,UAAU5C,KAAKvD,EAAE,KAAK,QAAQqD,KAAK8C,aAAa;AAC1F,QAAIkB,mBAAmB;AACrB,aAAOhE;IACT;AACA,QAAI8C,UAAU5C,KAAKvD,OAAOqD,KAAK8C,WAAW5C,KAAKvD,IAAI;AACjD,aAAOqD;IACT;AACA,QAAIyD,KAAKzD,KAAK8C;AACd,WAAOW,GAAGvD,KAAKvD,OAAOmG,UAAU5C,KAAKvD,IAAI;AACvC8G,SAAGnB,YAAYrB,QAAQ,CAACgD,QAAQjE,KAAKsC,YAAYH,IAAI8B,GAAAA,CAAAA;AACrDR,SAAGpB,oBAAoBpB,QAAQ,CAACiD,MAAMlE,KAAKqC,oBAAoBF,IAAI+B,CAAAA,CAAAA;AACnET,WAAKA,GAAIX;AACT9C,WAAK8C,YAAYW;IACnB;AACA,WAAOzD;EACT;EAEQO,YAAYH,gBAAoD;AACtElE,IAAAA,WAAUkE,eAAe/B,UAAU,GAAA,QAAA;;;;;;;;;AACnC,QAAI+B,eAAe/B,WAAW,GAAG;AAC/B,aAAO;QAAEmC,MAAM;QAAUR,MAAMI,eAAe,CAAA;MAAG;IACnD;AACA,UAAM0C,YAAY,KAAKO,qBAAqBjD,cAAAA;AAC5ChE,QAAI,iBAAiB,OAAO;MAC1B+H,aAAarB,UAAU5C,KAAKvD;MAC5ByH,WAAWhE,eAAe/B;MAC1BgG,YAAYjE,eAAe1C,IAAI,CAAC4G,OAAOA,GAAGxB,WAAW5C,KAAKvD,EAAAA;IAC5D,IAAA;;;;;;AACA,UAAMkD,QAAQO,eAAe1C,IAAI,CAACkD,MAAM,KAAKmD,mBAAmBjB,WAAWlC,CAAAA,CAAAA;AAC3E1E,IAAAA,WAAU4G,WAAAA,QAAAA;;;;;;;;;AACV,UAAMyB,SAAuB;MAC3BzB,WAAWA,UAAUA;MACrBzB,YAAY;QAAE,GAAGyB,UAAUzB;QAAY,CAACyB,UAAU5C,KAAKvD,EAAE,GAAG,CAAA;MAAG;MAC/DqE,gBAAgB8B,UAAU9B;MAC1BkB,aAAa,IAAI3F,YAAWJ,WAAUa,MAAM8F,UAAUZ,WAAW;MACjEI,aAAa,IAAI/F,YAAWJ,WAAUa,MAAM8F,UAAUR,WAAW;MACjED,qBAAqB,IAAI9F,YAAWJ,WAAUa,MAAM8F,UAAUT,mBAAmB;MACjFvE,OAAOgF,UAAUhF,MAAM0D,UAAU,CAAC7D,MAAMA,CAAAA;MACxCuC,MAAML,MAAM,CAAA,EAAGK;IACjB;AACA,UAAMsE,kBAAkB,IAAIlI,YAAoCH,WAAUa,IAAI;AAC9E,eAAWgD,QAAQH,OAAO;AACxBzD,UAAI,qBAAqB,OAAO;QAC9BsG,SAAS7B,aAAab,IAAAA;QACtByE,UAAUzE,KAAKqC;QACfC,aAAatC,KAAKsC;QAClBxE,OAAOkC,KAAKlC,MAAM0D,UAAU,CAAC7D,MAAM,KAAKP,cAAcqE,YAAY9D,EAAEK,SAAS,CAAA;MAC/E,IAAA;;;;;;AACAgC,WAAKsC,YAAYrB,QAAQ,CAACgD,QAAQM,OAAOjC,YAAYH,IAAI8B,GAAAA,CAAAA;AACzDjE,WAAKkC,YAAYjB,QAAQ,CAACyD,SAASH,OAAOrC,YAAYC,IAAIuC,IAAAA,CAAAA;AAC1DH,aAAOlD,WAAYyB,UAAU5C,KAAKvD,EAAE,EAAE2B,KAAI,GAAK0B,KAAKqB,WAAYyB,UAAU5C,KAAKvD,EAAE,KAAK,CAAA,CAAE;AACxF,iBAAWgI,mBAAmB3E,KAAKqC,qBAAqB;AACtD,cAAMuC,iBAAiBJ,gBAAgBjH,IAAIoH,eAAAA;AAC3C,YAAIC,kBAAkB,QAAQ,KAAKC,0BAA0BD,gBAAgB5E,MAAM2E,eAAAA,GAAkB;AACnGH,0BAAgBtG,IAAIyG,iBAAiB3E,IAAAA;QACvC;MACF;IACF;AACA,UAAM8E,cAAc,oBAAIC,IAAAA;AACxB,UAAMC,gBAAgBF,YAAY3C,IAAI8C,KAAKH,WAAAA;AAC3C,eAAW,CAAC3F,SAAS+F,MAAAA,KAAWV,gBAAgBzB,QAAO,GAAI;AACzDwB,aAAOlC,oBAAoBF,IAAIhD,OAAAA;AAC/B,YAAMP,SAASsG,OAAOpH,MAAMP,IAAI4B,OAAAA;AAChCoF,aAAOzG,MAAMI,IAAIiB,SAASP,MAAAA;AAC1BxC,UAAI,qBAAqB,OAAO;QAAE+C;QAASrB,OAAO,KAAKV,cAAcqE,YAAY7C,OAAOZ,SAAS;MAAE,IAAA;;;;;;AACnG,YAAMmH,aAAatF,MAAM8B,OAAO,CAACf,MAAMA,MAAMsE,MAAAA;AAC7C,WAAK9H,cAAcgI,oBAAoBD,YAAYvG,MAAAA,EAAQqC,QAAQ+D,aAAAA;IACrE;AACA,QAAIF,YAAYO,OAAO,GAAG;AACxB,aAAO;QACL7E,MAAM;QACNO,QAAQ;aAAI+D,YAAYQ,OAAM;;QAC9BlE,MAAM0B;QACN9B,gBAAgBwD,gBAAgBhD,UAAU,CAAC7D,GAAGwD,QAAQxD,EAAEG,MAAMP,IAAI4D,GAAAA,CAAAA;MACpE;IACF;AACA,WAAO;MAAEX,MAAM;MAAUR,MAAMuE;IAAO;EACxC;;;;;;;;;;;EAYQM,0BACNU,UACAC,WACAb,iBACS;AACT,UAAMc,kBAAkBD,UAAU1H,MAAMP,IAAIoH,eAAAA;AAC5C,UAAMe,gBAAgBH,SAASzH,MAAMP,IAAIoH,eAAAA;AACzC,QAAIc,gBAAgB9I,OAAO+I,cAAc/I,IAAI;AAC3C,aAAO;IACT;AAEA,UAAMgJ,eAAeJ,SAASrF,KAAKvD;AACnC,QAAI8I,gBAAgB9I,OAAOgJ,gBAAgBD,cAAc/I,OAAOgJ,cAAc;AAC5EvJ,UAAI,uCAAuC;QAAEuJ,cAAcJ,SAASrF,KAAKvD;MAAG,GAAA;;;;;;AAC5E,aAAOgJ,iBAAiBF,gBAAgB9I;IAC1C;AACA,UAAMiJ,sBAAsBH,gBAAgB7H;AAC5C,UAAMiI,oBAAoBH,cAAc9H;AAExC,QAAI2H,SAASrD,YAAY4B,IAAI8B,oBAAoBjJ,EAAE,MAAO6I,UAAUtD,YAAY4B,IAAI+B,kBAAkBlJ,EAAE,GAAI;AAC1GP,UAAI,2DAA2D;QAC7D0J,SAASJ,cAAc/I;QACvB6I,WAAWC,gBAAgB9I;MAC7B,GAAA;;;;;;AACA,aAAO6I,UAAUtD,YAAY4B,IAAI+B,kBAAkBlJ,EAAE;IACvD;AAEA,UAAMoJ,oBAAoB,KAAK3I,cAAc4I,qBAC3CT,UACAM,mBACAL,WACAI,mBAAAA;AAEF,QAAIG,qBAAqB,MAAM;AAC7B,aAAOA,sBAAsBH;IAC/B;AACA,QAAIJ,UAAUlD,YAAY+C,SAASE,SAASjD,YAAY+C,MAAM;AAC5DjJ,UAAI,+CAA+C;QACjD6J,aAAa;UAACV,SAASjD,YAAY+C;UAAMG,UAAUlD,YAAY+C;;MACjE,GAAA;;;;;;AACA,aAAOG,UAAUlD,YAAY+C,OAAOE,SAASjD,YAAY+C;IAC3D;AACAjJ,QAAI,uCAAA,QAAA;;;;;;AACJ,WAAOwJ,oBAAoBM,aAAaC,QAAO,IAAKN,kBAAkBK,aAAaC,QAAO;EAC5F;EAEQrG,kBAAgC;AACtC,WAAO;MACLI,MAAM,KAAKxD;MACX2E,YAAY,CAAC;MACbiB,aAAa,IAAI/F,YAAWJ,WAAUa,IAAI;MAC1CqF,qBAAqB,IAAI9F,YAAWJ,WAAUa,IAAI;MAClDc,OAAO,IAAIxB,YAAsCH,WAAUa,IAAI;MAC/DkF,aAAa,IAAI3F,YAAWJ,WAAUa,IAAI;IAC5C;EACF;AACF;AAwGA,IAAM6D,eAAe,CAAIb,SAAAA;AACvB,SAAOoG,OAAOC,YAAYD,OAAOrD,QAAQ/C,KAAKqB,UAAU,EAAG3D,IAAI,CAAC,CAAC4I,GAAGC,EAAAA,MAAQ;IAACD;IAAGC,GAAG7I,IAAI,CAACC,MAAMA,EAAEhB,EAAE;GAAE,CAAA;AACtG;;;;AD7gBO,IAAM6J,qBAAN,MAAMA;;EACHC;EACAC,kBAAkB,IAAIC,YAAmDC,WAAUC,IAAI;EACvFC,aAAa,IAAIC,gBAAyC,IAAI;EAE7DC,sBAAsB,KAAKF,WAAWG;EAE/C,YAA6BC,WAAsB;SAAtBA,YAAAA;EAAuB;EAEpD,IAAIC,UAAkC;AACpC,WAAO,KAAKV,aAAa,KAAKK,WAAWM,gBAAgB,KAAKX,SAAS;EACzE;EAEA,IAAIY,UAA8C;AAChD,WAAO,KAAKP,WAAWQ,SAAQ;EACjC;EAEA,IAAIC,uBAAoC;AACtC,WAAO,KAAKT,WAAWU,WAAU;EACnC;EAEAC,QAAQC,QAAqC;AAC3C,WAAO,KAAKC,SAAS,KAAKb,WAAWc,oBAAmB,GAAIF,MAAAA;EAC9D;;;;;EAMA,MAAMG,QAAQC,YAAuC;AACnD,UAAMC,YAAYC,uBAAuBF,UAAAA;AAEzC,YAAQC,UAAU,OAAA,GAAQ;MACxB,KAAK,qCAAqC;AACxCE,QAAAA,WAAUF,UAAUG,SAASC,OAAO,KAAKjB,SAAS,GAAA,QAAA;;;;;;;;;AAClD,YAAI,KAAKT,aAAa,QAAQqB,WAAWM,WAAW,KAAKlB,WAAW;AAClE,eAAKT,YAAYqB,WAAWO,QAAQC;QACtC;AACA,YAAIP,UAAUQ,WAAW,MAAM;AAC7B,eAAK7B,gBAAgB8B,IAAIV,WAAWO,QAAQC,IAAIP,UAAUQ,OAAO;QACnE;AACA,cAAM,KAAKzB,WAAW2B,UAAUX,YAAYC,SAAAA;AAC5C;MACF;MACA,KAAK,uCAAuC;AAC1C,cAAML,SAAS,KAAKZ,WAAWM,gBAAgBU,WAAWO,QAAQC,EAAE;AACpE,YAAIZ,QAAQ;AACVA,iBAAOa,UAAUR,UAAUQ;QAC7B,OAAO;AACLG,UAAAA,KAAIC,KAAK,oBAAoB;YAAEL,IAAIR,WAAWO,QAAQC;UAAG,GAAA;;;;;;QAC3D;AACA,aAAK5B,gBAAgB8B,IAAIV,WAAWO,QAAQC,IAAIP,UAAUQ,OAAO;AACjE;MACF;MACA;AACE,cAAM,IAAIK,MAAM,wBAAA;IACpB;EACF;EAEOC,YAAYf,YAAwBC,WAAoC;AAC7E,UAAMe,YAAYhB,WAAWO,QAAQC;AACrC,WAAO;MACLS,KAAKD;MACLE,MAAMjB,UAAUiB;MAChBlB;MACAC;MACAQ,SAAS,KAAK7B,gBAAgBuC,IAAIH,SAAAA;IACpC;EACF;EAEOI,gBAAgBC,OAAgCrB,YAAwBC,WAAiC;AAC9G,QAAIA,UAAUiB,SAASI,aAAYC,KAAKC,OAAO;AAC7C,aAAOxB,WAAYM,OAAOD,OAAO,KAAKjB,SAAS;IACjD;AACA,UAAMkB,SAASN,WAAWM;AAC1B,UAAMmB,oBAAoBnB,OAAOD,OAAOL,WAAWO,QAAQC,EAAE;AAC7D,QAAIiB,mBAAmB;AACrB,aAAO;IACT;AACA,QAAInB,OAAOD,OAAOJ,UAAUG,QAAQ,GAAG;AACrC,aAAO;IACT;AACA,UAAMsB,aAAa,KAAK7B,SAASwB,OAAOf,MAAAA;AACxC,WAAOoB,eAAeJ,aAAYC,KAAKI,SAASD,eAAeJ,aAAYC,KAAKC;EAClF;EAEOI,oBACLC,OACAC,QAC0B;AAE1B,QAAIA,OAAO7B,UAAUiB,SAASI,aAAYC,KAAKQ,WAAWD,OAAO7B,UAAUiB,SAASI,aAAYC,KAAKS,QAAQ;AAC3G,aAAO,CAAA;IACT;AACA,UAAMC,WAAWH,OAAO9B,WAAYO,QAAQC;AAC5C,WAAOqB,MAAMK,OAAO,CAACC,MAAMA,EAAEC,YAAYC,IAAIJ,QAAAA,CAAAA;EAC/C;EAEOK,qBACLC,QACAC,SACAC,QACAC,SACmB;AACnB,UAAMC,kBAAkB,KAAK9C,SAAS0C,QAAQC,QAAQlC,MAAM;AAC5D,UAAMsC,kBAAkB,KAAK/C,SAAS4C,QAAQC,QAAQpC,MAAM;AAC5D,QAAKsC,oBAAoBtB,aAAYC,KAAKC,WAAYmB,oBAAoBrB,aAAYC,KAAKC,QAAQ;AACjGZ,MAAAA,KAAI,wCAAA,QAAA;;;;;;AACJ,aAAO+B,oBAAoBrB,aAAYC,KAAKC,QAAQgB,UAAUE;IAChE;AACA,WAAO;EACT;EAEOG,YAAY5C,WAA4C;AAC7D,UAAMiB,OAAOjB,WAAWiB,QAAQI,aAAYC,KAAKQ;AACjD,WAAOe,OAAOC,QAAQzB,aAAYC,IAAI,EAAEyB,KAAK,CAAC,CAACC,GAAGC,KAAAA,MAAWA,UAAUhC,IAAAA,EAAO,CAAA;EAChF;EAEOiC,gBAAgBC,IAAiBC,IAA0B;AAChE,WAAOD,IAAIlC,SAASmC,IAAInC;EAC1B;EAEQrB,SAASwB,OAAgCY,UAAuC;AACtF,QAAI,KAAKtD,WAAW0B,OAAO4B,QAAAA,GAAW;AACpC,aAAOX,aAAYC,KAAKC;IAC1B;AACA,UAAM8B,WAAWjC,MAAMkC,MAAMpC,IAAIc,QAAAA,GAAWhC,WAAWiB,QAAQI,aAAYC,KAAKQ;AAChF,QAAIV,MAAMmC,kBAAkB,MAAM;AAChC,YAAMC,WAAWpC,MAAMmC,eAAerC,IAAIc,QAAAA;AAC1C,UAAIwB,YAAY,MAAM;AACpB7C,QAAAA,KAAI,kCAAkC,OAAO;UAC3C8C,QAAQrC,MAAMsC,MAAMnD;UACpBoD,cAAc,KAAKf,YAAYY,SAASxD,SAAS;UACjDqD,UAAU,KAAKT,YAAYxB,MAAMkC,MAAMpC,IAAIc,QAAAA,GAAWhC,SAAAA;QACxD,IAAA;;;;;;AACA,eAAOwD,SAASxD,UAAUiB;MAC5B;IACF;AACA,WAAOoC;EACT;AACF;;;;;;;;;;AHpHO,IAAMO,oBAAN,MAAMA;;EACMC;EACAC;EACAC,eAAe,IAAIC,uBAAAA;EACnBC,eAAkC,CAAA;EAClCC,mBAAmB,IAAIC,YAAuCC,WAAUC,IAAI;EAC5EC,wBAAwB,IAAIC,YAAsBH,WAAUC,IAAI;EAEzEG;EACAC,QAAkB,CAAA;EAClBC,oBAAsCC,kBAAiBC;EACvDC,wBAAmD,CAAA;EAElDC,wBAAwB,IAAIC,UAAAA;EAC5BC;EACAC;EACAC,wBAAwB,KAAKnB,aAAamB;EAC1CC,+BAA+B,KAAKpB,aAAaoB;EAE1D,YAA6BC,WAAsB;SAAtBA,YAAAA;AAC3B,SAAKvB,WAAW,IAAIwB,mBAAmB,KAAKD,SAAS;AACrD,SAAKtB,SAAS,IAAIwB,iBAAiB,KAAKF,SAAS;AACjD,SAAKJ,sBAAsB,KAAKnB,SAASmB;AACzC,SAAKC,iBAAiB,KAAKnB,OAAOmB;EACpC;EAEA,IAAIM,UAAkC;AACpC,WAAO,KAAK1B,SAAS0B;EACvB;EAEA,IAAIC,UAA8C;AAChD,WAAO,KAAK3B,SAAS2B;EACvB;EAEA,IAAIC,uBAAoC;AACtC,WAAO,KAAK5B,SAAS4B;EACvB;EAEA,IAAIC,QAA0C;AAC5C,WAAO,KAAK5B,OAAO4B;EACrB;EAEA,IAAIC,cAA4B;AAC9B,WAAO,KAAK1B,aAAa2B,IAAI,CAACC,UAAUA,MAAMC,UAAU;EAC1D;EAEA,IAAIC,oBAAuC;AACzC,WAAO,KAAK9B;EACd;EAEA,IAAI+B,oBAA4C;AAC9C,WAAO,KAAKxB;EACd;EAEA,IAAIyB,OAAiB;AACnB,WAAO,KAAKxB;EACd;EAEA,IAAIyB,mBAAqC;AACvC,WAAO,KAAKxB;EACd;EAEA,IAAIyB,cAA+D;AACjE,WAAO,KAAKpC,aAAaoC;EAC3B;EAEA,MAAMC,uBAAuBC,WAA+C;AAC1E,QAAI,KAAKxB,sBAAsByB,KAAK,CAACC,MAAMA,EAAEF,cAAcA,SAAAA,GAAY;AACrE,YAAM,IAAIG,MAAM,qCAAA;IAClB;AAEA,UAAMC,WAAW,IAAIC,mBACnBL,WACA,YAAA;AACE,iBAAWP,cAAc,KAAKH,aAAa;AACzC,cAAMc,SAASE,SAASb,UAAAA;MAC1B;AAKAW,eAASG,6BAA6B;IACxC,GACA,YAAA;AACE,WAAK/B,wBAAwB,KAAKA,sBAAsBgC,OAAO,CAACN,MAAMA,MAAME,QAAAA;IAC9E,CAAA;AAEF,SAAK5B,sBAAsBiC,KAAKL,QAAAA;AAEhC,UAAMA,SAASM,KAAI;EACrB;EAEA,MAAMC,0BAA0BX,WAA+C;AAC7E,UAAMI,WAAW,KAAK5B,sBAAsByB,KAAK,CAACC,MAAMA,EAAEF,cAAcA,SAAAA;AACxE,UAAMI,UAAUQ,MAAAA;EAClB;EAEAC,qBAAqBC,MAA2C;AAC9D,WAAO,KAAKxB,YAAYkB,OAAO,CAACf,eAAesB,uBAAuBtB,UAAAA,EAAY,OAAA,MAAaqB,IAAAA;EACjG;;;;;EAMA,MACME,QAAQvB,YAAwB,EAAEwB,YAAYC,iBAAgB,GAAsC;AACxG,QAAIzB,WAAW0B,IAAI;AACjB,UAAI,KAAKlD,sBAAsBmD,IAAI3B,WAAW0B,EAAE,GAAG;AACjD,eAAO;MACT;AACA,WAAKlD,sBAAsBoD,IAAI5B,WAAW0B,EAAE;IAC9C;AAEA,QAAI,CAACD,kBAAkB;AACrB,YAAMI,SAAS,MAAMC,iBAAiB9B,UAAAA;AACtC,UAAI6B,OAAOE,SAAS,QAAQ;AAC1BC,QAAAA,KAAIC,KAAK,uBAAuBJ,OAAOK,OAAOC,KAAK,IAAA,CAAA,IAAO,QAAA;;;;;;AAC1D,eAAO;MACT;IACF;AAEA,UAAMC,YAAYd,uBAAuBtB,UAAAA;AACzC,YAAQoC,UAAU,OAAA,GAAQ;MACxB,KAAK,sCAAsC;AACzC,YAAI,KAAK1D,oBAAoB;AAC3BsD,UAAAA,KAAIC,KAAK,2CAAA,QAAA;;;;;;AACT,iBAAO;QACT;AACA,YAAI,CAACjC,WAAWqC,OAAOC,OAAO,KAAKhD,SAAS,GAAG;AAC7C0C,UAAAA,KAAIC,KAAK,qDAAA,QAAA;;;;;;AACT,iBAAO;QACT;AACA,YAAI,CAACjC,WAAWuC,QAAQb,GAAGY,OAAO,KAAKhD,SAAS,GAAG;AACjD0C,UAAAA,KAAIC,KAAK,qDAAA,QAAA;;;;;;AACT,iBAAO;QACT;AACA,aAAKvD,qBAAqBsB;AAC1B,aAAKrB,QAAQyD,UAAUjC,QAAQ,CAAA;AAC/B,aAAKvB,oBAAoBwD,UAAUhC,oBAAoBvB,kBAAiBC;AACxE;MACF;MAEA,KAAK,qCAAqC;AACxC,YAAI,CAACsD,UAAUI,SAASF,OAAO,KAAKhD,SAAS,GAAG;AAC9C;QACF;AAEA,YAAI,CAAC,KAAKZ,oBAAoB;AAC5BsD,UAAAA,KAAIC,KAAK,+DAAA,QAAA;;;;;;AACT,iBAAO;QACT;AACA,YAAI,CAAC,KAAKQ,qBAAqBzC,WAAWqC,MAAM,GAAG;AACjDL,UAAAA,KAAIC,KAAK,yDAAyDjC,WAAWqC,MAAM,IAAE,QAAA;;;;;;AACrF,iBAAO;QACT;AAEA,cAAM,KAAKtE,SAASwD,QAAQvB,UAAAA;AAC5B,cAAM,KAAK/B,aAAasD,QAAQvB,UAAAA;AAChC;MACF;MAEA,KAAK,uCAAuC;AAC1C,YAAI,CAAC,KAAKtB,oBAAoB;AAC5BsD,UAAAA,KAAIC,KAAK,+DAAA,QAAA;;;;;;AACT,iBAAO;QACT;AAEA,cAAM,KAAKlE,SAASwD,QAAQvB,UAAAA;AAC5B;MACF;MAEA,KAAK,sCAAsC;AACzC,YAAI,CAAC,KAAKtB,oBAAoB;AAC5BsD,UAAAA,KAAIC,KAAK,gEAAA,QAAA;;;;;;AACT,iBAAO;QACT;AAGA,cAAM,KAAKjE,OAAOuD,QAAQvB,YAAYwB,UAAAA;AACtC;MACF;MACA,KAAK;MACL,KAAK,iDAAiD;AACpD,YAAI,CAAC,KAAKiB,qBAAqBzC,WAAWqC,MAAM,GAAG;AACjDL,UAAAA,KAAIC,KAAK,6EAA6EjC,WAAWqC,MAAM,IAAE,QAAA;;;;;;AACzG,iBAAO;QACT;AACA,cAAM,KAAKpE,aAAasD,QAAQvB,UAAAA;AAChC;MACF;IACF;AAEA,UAAM0C,WAA4B;MAAE1C;MAAYwB;MAAYmB,SAAS;IAAM;AAC3E,SAAKxE,aAAa6C,KAAK0B,QAAAA;AAGvB,QAAI1C,WAAW0B,IAAI;AACjB,WAAKtD,iBAAiBwE,IAAI5C,WAAW0B,IAAIgB,QAAAA;IAC3C;AAEA,eAAWnC,aAAa,KAAKxB,uBAAuB;AAClD,UAAIwB,UAAUO,4BAA4B;AACxC,cAAMP,UAAUM,SAASb,UAAAA;MAC3B;IACF;AAEA,UAAM,KAAKhB,sBAAsB6D,UAAU7C,UAAAA;AAC3C,WAAO;EACT;EAEO8C,cAAcC,WAAwC;AAC3D,WAAO,KAAKhF,SAASiF,QAAQD,SAAAA;EAC/B;EAEOE,kCAAkCF,WAA+B;AACtE,WAAO,KAAKN,qBAAqBM,SAAAA;EACnC;EAEQN,qBAAqBS,KAAyB;AACpD,QAAI,KAAKtE,sBAAsBC,kBAAiBsE,QAAQ;AAGtD,aAAOD,IAAIZ,OAAO,KAAKhD,SAAS,KAAK,KAAKvB,SAAS2B,QAAQ0D,SAAS;IACtE;AACA,WACEF,IAAIZ,OAAO,KAAKhD,SAAS,KACzB,KAAKvB,SAASiF,QAAQE,GAAAA,MAASG,aAAYC,KAAKC,SAChD,KAAKxF,SAASiF,QAAQE,GAAAA,MAASG,aAAYC,KAAKE;EAEpD;AACF;;;;AAGA,IAAM5C,qBAAN,MAAMA;;;;EACI6C,OAAO,IAAIC,QAAAA,QAAAA;;;;;;;;;;EAQnB5C,6BAA6B;EAE7B,YACkBP,WACCoD,SACAC,UACjB;SAHgBrD,YAAAA;SACCoD,UAAAA;SACAC,WAAAA;EAChB;;;;EAKH,MAAM/C,SAASb,YAAuC;AACpD,UAAM6D,kBAAkB,KAAKJ,MAAM,YAAA;AACjC,YAAM,KAAKlD,UAAUuD,kBAAkB9D,UAAAA;IACzC,CAAA;EACF;EAEA,MAAMiB,OAAsB;AAC1B,QAAI,KAAKwC,KAAKM,UAAU;AACtB,YAAM,IAAIrD,MAAM,iCAAA;IAClB;AAEA,UAAM,KAAKiD,QAAO;EACpB;EAEA,MAAMxC,QAAuB;AAC3B,UAAM,KAAKsC,KAAKO,QAAO;AAEvB,UAAM,KAAKJ,SAAQ;EACrB;AACF;;;AKpUA,SAASK,eAAe;AACxB,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,aAAAA,kBAAiB;AAC1B,SAASC,OAAAA,YAAW;AAEpB,SAASC,cAAAA,mBAAkB;;AAcpB,IAAMC,qBAAN,MAAMA;;;EAEKC,uBAAuB,IAAIC,YAA6CC,WAAUC,IAAI;EAEtFC,mBAAmB,IAAIC,QAAAA;EAEhCC;EAEP,YAA6BC,SAAkC;SAAlCA,UAAAA;EAAmC;EAEhE,MAAMC,kBAAkBC,YAAuC;AAC7DC,IAAAA,KAAI,4BAA4B;MAC9BC,aAAa,KAAKJ,QAAQI;MAC1BC,WAAW,KAAKL,QAAQK;MACxBH;IACF,GAAA;;;;;;AAGA,QAAII,kCAAkCJ,YAAY,KAAKF,QAAQI,aAAa,KAAKJ,QAAQK,SAAS,GAAG;AACnG,WAAKN,wBAAwB;QAAEG;MAAW;AAC1C,WAAKL,iBAAiBU,KAAI;IAC5B;AAEA,UAAMC,YAAYC,uBAAuBP,UAAAA;AAEzC,YAAQM,UAAU,OAAA,GAAQ;MACxB,KAAK,0CAA0C;AAG7C,aAAKf,qBAAqBiB,IAAIF,UAAUH,WAAW,KAAKZ,qBAAqBkB,IAAIH,UAAUH,SAAS,KAAK,CAAC,CAAA;AAE1GF,QAAAA,KAAI,gBAAgB;UAClBS,gBAAgB,KAAKZ,QAAQK;UAC7BA,WAAWG,UAAUH;UACrBQ,MAAM,KAAKpB,qBAAqBoB;QAClC,GAAA;;;;;;AACA,aAAKb,QAAQc,WAAQ;AACrB;MACF;MAEA,KAAK,uCAAuC;AAC1CC,QAAAA,WAAU,KAAKtB,qBAAqBuB,IAAId,WAAWe,QAAQC,EAAE,GAAG,qBAAA;;;;;;;;;AAEhE,YAAIV,aAAaN,WAAWe,QAAQC,GAAGC,OAAO,KAAKnB,QAAQK,SAAS,GAAG;AACrEF,UAAAA,KAAIiB,MAAM,oBAAoB;YAC5Bf,WAAWH,WAAWe,QAAQC;YAC9BG,SAASb,UAAUa;UACrB,GAAA;;;;;;QACF;AAEA,aAAK5B,qBAAqBiB,IAAIR,WAAWe,QAAQC,IAAIV,UAAUa,OAAO;AACtE,aAAKrB,QAAQc,WAAQ;AACrB;MACF;IACF;EACF;AACF;;;AC1EA,SAASQ,OAAAA,YAAW;;AAcb,IAAMC,sBAAN,MAAMA;;;EAEJC;EAEP,YAA6BC,SAAmC;SAAnCA,UAAAA;EAAoC;EAEjE,MAAMC,kBAAkBC,YAAuC;AAC7D,UAAMC,YAAYC,uBAAuBF,UAAAA;AACzC,YAAQC,UAAU,OAAA,GAAQ;MACxB,KAAK,yCAAyC;AAC5C,YACE,CAACD,WAAWG,OAAOC,OAAO,KAAKN,QAAQO,WAAW,KAClD,CAACL,WAAWM,QAAQC,GAAGH,OAAO,KAAKN,QAAQO,WAAW,GACtD;AACAG,UAAAA,KAAIC,KAAK,8BAA8B;YAAEC,kBAAkB,KAAKZ,QAAQO;YAAaL;UAAW,GAAA;;;;;;AAChG;QACF;AAGA,aAAKH,UAAUI,UAAUJ;AACzBW,QAAAA,KAAI,mBAAmB;UACrBH,aAAa,KAAKP,QAAQO;UAC1BR,SAAS,KAAKA;QAChB,GAAA;;;;;;AACA,aAAKC,QAAQa,WAAQ;AACrB;MACF;IACF;EACF;AACF;",
+  "names": ["subtleCrypto", "IdentityDid", "PublicKey", "ComplexMap", "IDENTITY_DIDS_CACHE", "ComplexMap", "PublicKey", "hash", "createDidFromIdentityKey", "identityKey", "cachedValue", "get", "undefined", "digest", "subtleCrypto", "asUint8Array", "bytes", "Uint8Array", "slice", "IdentityDid", "byteLength", "identityDid", "encode", "set", "defaultSecretProvider", "Buffer", "from", "defaultSecretValidator", "invitation", "secret", "generateMnemonic", "mnemonicToSeedSync", "createKeyPair", "invariant", "generateSeedPhrase", "keyPairFromSeedPhrase", "seedPhrase", "seed", "generatePasscode", "length", "passcode", "i", "Math", "floor", "random", "stableStringify", "PublicKey", "Timeframe", "arrayToBuffer", "getCredentialProofPayload", "credential", "copy", "proof", "value", "Uint8Array", "chain", "undefined", "parentCredentialIds", "length", "id", "assertion", "subject", "key", "Object", "keys", "Array", "isArray", "Buffer", "from", "canonicalStringify", "obj", "stableStringify", "replacer", "toString", "startsWith", "original", "PublicKey", "isPublicKey", "toHex", "isBuffer", "arrayToBuffer", "data", "type", "Timeframe", "frames", "reduce", "seq", "truncateKey", "str", "substring", "getPresentationProofPayload", "credentials", "proof", "copy", "map", "credential", "removeEmptyParentCredentialIds", "value", "Uint8Array", "chain", "undefined", "Buffer", "from", "canonicalStringify", "parentCredentialIds", "length", "getCredentialAssertion", "credential", "subject", "assertion", "isValidAuthorizedDeviceCredential", "identityKey", "deviceKey", "id", "equals", "issuer", "checkCredentialType", "type", "credentialTypeFilter", "subtleCrypto", "invariant", "PublicKey", "verifySignature", "SIGNATURE_TYPE_ED25519", "verifyCredential", "credential", "parentCredentialIds", "length", "issuer", "equals", "proof", "signer", "chain", "kind", "errors", "result", "verifyChain", "verifyCredentialSignature", "type", "signData", "getCredentialProofPayload", "verifySignature", "value", "authority", "subject", "isValidAuthorizedDeviceCredential", "createCredential", "signer", "issuer", "subject", "assertion", "signingKey", "chain", "nonce", "parentCredentialIds", "invariant", "result", "verifyChain", "kind", "credential", "issuanceDate", "Date", "id", "proof", "type", "SIGNATURE_TYPE_ED25519", "creationDate", "value", "Uint8Array", "signedPayload", "getCredentialProofPayload", "sign", "PublicKey", "from", "subtleCrypto", "digest", "createCredentialMessage", "createCredentialSignerWithKey", "getIssuer", "createCredentialSignerWithChain", "AdmittedFeed", "MembershipPolicy", "SpaceMember", "Timeframe", "CredentialGenerator", "_signer", "_identityKey", "_deviceKey", "createSpaceGenesis", "spaceKey", "controlKey", "creatorProfile", "membershipPolicy", "MembershipPolicy", "INVITE", "createCredential", "signer", "issuer", "subject", "assertion", "role", "SpaceMember", "Role", "ADMIN", "profile", "genesisFeedKey", "createFeedAdmission", "AdmittedFeed", "Designation", "CONTROL", "createMemberInvitation", "identityKey", "deviceKey", "dataKey", "EDITOR", "DATA", "createDeviceAuthorization", "createDeviceProfile", "feedKey", "designation", "createProfileCredential", "createEpochCredential", "number", "timeframe", "Timeframe", "credentials", "Promise", "all", "map", "credential", "createAdmissionCredentials", "membershipChainHeads", "invitationCredentialId", "tags", "parentCredentialIds", "createDelegatedSpaceInvitationCredential", "invitation", "invitationId", "authMethod", "swarmKey", "guestKey", "expiresOn", "multiUse", "createCancelDelegatedSpaceInvitationCredential", "credentialId", "signPresentation", "presentation", "signer", "signerKey", "chain", "nonce", "proof", "type", "SIGNATURE_TYPE_ED25519", "value", "Uint8Array", "creationDate", "Date", "signedPayload", "getPresentationProofPayload", "credentials", "sign", "proofs", "verifySignature", "verifyPresentation", "presentation", "errors", "credentialsVerifications", "Promise", "all", "credentials", "map", "credential", "verifyCredential", "verification", "kind", "push", "proofVerification", "proofs", "proof", "chainVerification", "verifyPresentationChain", "signatureVerification", "verifyPresentationSignature", "length", "issuer", "equals", "signer", "chain", "verifyChain", "subject", "id", "type", "SIGNATURE_TYPE_ED25519", "signData", "getPresentationProofPayload", "verifySignature", "value", "runInContextAsync", "synchronized", "Context", "PublicKey", "log", "MembershipPolicy", "SpaceMember", "Callback", "ComplexMap", "ComplexSet", "invariant", "PublicKey", "Callback", "ComplexMap", "FeedStateMachine", "_feeds", "ComplexMap", "PublicKey", "hash", "onFeedAdmitted", "Callback", "_spaceKey", "feeds", "process", "credential", "fromFeed", "assertion", "getCredentialAssertion", "invariant", "spaceKey", "equals", "info", "key", "subject", "id", "parent", "set", "callIfSet", "PublicKey", "Callback", "ComplexMap", "ComplexSet", "InvitationStateMachine", "_invitations", "ComplexMap", "PublicKey", "hash", "_redeemedInvitationCredentialIds", "ComplexSet", "_cancelledInvitationCredentialIds", "onDelegatedInvitation", "Callback", "onDelegatedInvitationRemoved", "invitations", "process", "credential", "credentialId", "id", "assertion", "getCredentialAssertion", "add", "existingInvitation", "get", "delete", "callIfSet", "invitation", "isExpired", "expiresOn", "getTime", "Date", "now", "wasUsed", "has", "multiUse", "wasCancelled", "set", "invitationCredentialId", "invariant", "PublicKey", "log", "SpaceMember", "ComplexMap", "invariant", "PublicKey", "log", "Callback", "ComplexMap", "ComplexSet", "CredentialGraph", "_vertexIdGenerator", "_root", "id", "parents", "children", "_sentinel", "_vertexByCredentialId", "hash", "_subjectToVertex", "_subjectToState", "onSubjectStateChanged", "_stateHandler", "getSubjectState", "subjectId", "get", "getState", "getLeafIds", "map", "v", "credential", "getGlobalStateScope", "state", "addVertex", "assertion", "newVertex", "set", "parentIds", "parentCredentialIds", "length", "push", "parentId", "parentVertex", "error", "_removeSentinelConnection", "_onVertexInserted", "vertex", "sentinelIdx", "indexOf", "splice", "vertexInSentinelIdx", "changedSubjects", "isUpdateAppliedOnTopOfThePreviousState", "subject", "isUpdateAllowed", "newSubjectState", "createState", "prevSubjectState", "hasStateChanged", "_recomputeState", "callIfSet", "pendingPaths", "Map", "paths", "_createRootPath", "lastPath", "path", "pop", "head", "_updatePathState", "convergedPaths", "_handleMergePoint", "mergeResult", "_mergePaths", "type", "_replayFailedPaths", "merged", "_forkTraversal", "p", "toChosenPath", "_setCurrentState", "replay", "stateOverrides", "forEach", "value", "key", "from", "chosenPath", "count", "overrides", "mapValues", "toLogString", "clearedPending", "filter", "l", "includes", "pendingList", "delete", "headCredential", "updatedSubject", "credentials", "add", "globalState", "forkChangedSubjects", "forkIssuers", "issuer", "newState", "replayChoice", "choices", "choice", "to", "fork", "forkPoint", "entries", "newStateMap", "newVertexMap", "subjectKey", "subjectVertex", "prevState", "_leastCommonAncestor", "uniqueForkPoints", "reduce", "acc", "it", "maxId", "maxState", "isPointInEveryPath", "every", "has", "_moveUpToForkPoint", "isForkPointInPath", "iss", "m", "forkPointId", "pathCount", "forkPoints", "fp", "result", "subjectToBranch", "modified", "cred", "modifiedSubject", "existingBranch", "_shouldOverrideCredential", "replayPaths", "Set", "addReplayPath", "bind", "branch", "otherPaths", "getConflictingPaths", "size", "values", "existing", "candidate", "candidateVertex", "currentVertex", "mergePointId", "candidateCredential", "currentCredential", "current", "winningCredential", "tryPickWinningUpdate", "issuerCount", "issuanceDate", "getTime", "Object", "fromEntries", "k", "vs", "MemberStateMachine", "_ownerKey", "_memberProfiles", "ComplexMap", "PublicKey", "hash", "_hashgraph", "CredentialGraph", "onMemberRoleChanged", "onSubjectStateChanged", "_spaceKey", "creator", "getSubjectState", "members", "getState", "membershipChainHeads", "getLeafIds", "getRole", "member", "_getRole", "getGlobalStateScope", "process", "credential", "assertion", "getCredentialAssertion", "invariant", "spaceKey", "equals", "issuer", "subject", "id", "profile", "set", "addVertex", "log", "warn", "Error", "createState", "memberKey", "key", "role", "get", "isUpdateAllowed", "scope", "SpaceMember", "Role", "OWNER", "isChangingOwnRole", "issuerRole", "ADMIN", "getConflictingPaths", "paths", "update", "REMOVED", "EDITOR", "memberId", "filter", "p", "forkIssuers", "has", "tryPickWinningUpdate", "scope1", "update1", "scope2", "update2", "path1IssuerRole", "path2IssuerRole", "toLogString", "Object", "entries", "find", "_", "value", "hasStateChanged", "s1", "s2", "realRole", "state", "stateOverrides", "override", "headId", "head", "roleOverride", "SpaceStateMachine", "_members", "_feeds", "_invitations", "InvitationStateMachine", "_credentials", "_credentialsById", "ComplexMap", "PublicKey", "hash", "_processedCredentials", "ComplexSet", "_genesisCredential", "_tags", "_membershipPolicy", "MembershipPolicy", "INVITE", "_credentialProcessors", "onCredentialProcessed", "Callback", "onMemberRoleChanged", "onFeedAdmitted", "onDelegatedInvitation", "onDelegatedInvitationRemoved", "_spaceKey", "MemberStateMachine", "FeedStateMachine", "creator", "members", "membershipChainHeads", "feeds", "credentials", "map", "entry", "credential", "credentialEntries", "genesisCredential", "tags", "membershipPolicy", "invitations", "addCredentialProcessor", "processor", "find", "p", "Error", "consumer", "CredentialConsumer", "_process", "_isReadyForLiveCredentials", "filter", "push", "open", "removeCredentialProcessor", "close", "getCredentialsOfType", "type", "getCredentialAssertion", "process", "sourceFeed", "skipVerification", "id", "has", "add", "result", "verifyCredential", "kind", "log", "warn", "errors", "join", "assertion", "issuer", "equals", "subject", "spaceKey", "_canInviteNewMembers", "newEntry", "revoked", "set", "callIfSet", "getMemberRole", "memberKey", "getRole", "hasMembershipManagementPermission", "key", "LOCKED", "size", "SpaceMember", "Role", "ADMIN", "OWNER", "_ctx", "Context", "_onOpen", "_onClose", "runInContextAsync", "processCredential", "disposed", "dispose", "Trigger", "invariant", "PublicKey", "log", "ComplexMap", "DeviceStateMachine", "authorizedDeviceKeys", "ComplexMap", "PublicKey", "hash", "deviceChainReady", "Trigger", "deviceCredentialChain", "_params", "processCredential", "credential", "log", "identityKey", "deviceKey", "isValidAuthorizedDeviceCredential", "wake", "assertion", "getCredentialAssertion", "set", "get", "localDeviceKey", "size", "onUpdate", "invariant", "has", "subject", "id", "equals", "trace", "profile", "log", "ProfileStateMachine", "profile", "_params", "processCredential", "credential", "assertion", "getCredentialAssertion", "issuer", "equals", "identityKey", "subject", "id", "log", "warn", "expectedIdentity", "onUpdate"]
+}