@interop/wallet-core 0.14.0 → 0.16.0

package/dist/keys/clientKeyRecord.d.ts

@@ -0,0 +1,124 @@
+import type { ClientWebvhUpdateKeys } from '../webvh/didWebvh.js';
+import type { Puk } from './puk.js';
+/**
+ * A client-key record's contents, decoded.
+ *
+ * `clientSeed` is the only always-present member: the rest are absent on
+ * records written before that member existed (a PUK-less account, a record
+ * written before the update keys became client-held, a first client whose own
+ * did:key IS the account controller), or simply not stored by the app.
+ */
+export interface ClientKeyRecord {
+    clientSeed: Uint8Array;
+    puk?: Puk;
+    webvhUpdateKeys?: ClientWebvhUpdateKeys;
+    controller?: string;
+    pointerDid?: string;
+}
+/**
+ * A client-key record's contents as they are stored: plain JSON, every byte
+ * field base64url-encoded without padding. This is what an app wraps, seals,
+ * or stringifies -- the codec never decides where it goes.
+ */
+export interface ClientKeyRecordJson {
+    clientSeed: string;
+    puk?: {
+        id: string;
+        secret: string;
+        signingSeed?: string;
+    };
+    webvh?: {
+        updateSeed: string;
+        stagedSeed: string;
+        pendingStagedSeed?: string;
+    };
+    controller?: string;
+    pointerDid?: string;
+    createdAt?: string;
+}
+/**
+ * A record whose every member is present: what an ENROLLED client holds once
+ * the enrollment ceremony has landed (a key set, a delivered PUK, its own
+ * update-key seeds, and the account it belongs to).
+ */
+export interface EnrolledClientKeyRecord extends ClientKeyRecord {
+    puk: Puk;
+    webvhUpdateKeys: ClientWebvhUpdateKeys;
+    controller: string;
+    pointerDid: string;
+}
+/**
+ * Parses and validates the optional `puk` member. An absent member resolves to
+ * `undefined` (a record written for an account minted before the PUK); a
+ * present-but-malformed one throws.
+ *
+ * The signing seed is absent on a PUK adopted from a roster rotation (the
+ * roster wraps the key-agreement secret alone); when present it must be
+ * well-formed.
+ *
+ * @param value {unknown}   the record's `puk` member
+ * @returns {Puk | undefined}
+ */
+export declare function parseClientRecordPuk(value: unknown): Puk | undefined;
+/**
+ * Parses and validates the optional `webvh` member: this client's did:webvh
+ * update-key seeds. An absent member resolves to `undefined` (a record written
+ * before the update keys became client-held); a present-but-malformed one
+ * throws.
+ *
+ * @param value {unknown}   the record's `webvh` member
+ * @returns {ClientWebvhUpdateKeys | undefined}
+ */
+export declare function parseClientRecordWebvhKeys(value: unknown): ClientWebvhUpdateKeys | undefined;
+/**
+ * Encodes a client-key record's contents for storage: base64url byte fields,
+ * optional members omitted rather than written as null.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   this client's 32-byte seed
+ * @param [options.puk] {Puk}   the cached per-user key
+ * @param [options.webvhUpdateKeys] {ClientWebvhUpdateKeys}   this client's
+ *   did:webvh update-key seeds
+ * @param [options.controller] {string}   the account controller this key set
+ *   was bound for -- on an enrolled (non-first) client it differs from the
+ *   client's own did:key
+ * @param [options.pointerDid] {string}   the account's did:webvh
+ * @param [options.createdAt] {string}   when the record was written; defaults
+ *   to now
+ * @returns {ClientKeyRecordJson}
+ */
+export declare function encodeClientKeyRecord({ clientSeed, puk, webvhUpdateKeys, controller, pointerDid, createdAt }: {
+    clientSeed: Uint8Array;
+    puk?: Puk;
+    webvhUpdateKeys?: ClientWebvhUpdateKeys;
+    controller?: string;
+    pointerDid?: string;
+    createdAt?: string;
+}): ClientKeyRecordJson;
+/**
+ * Decodes and validates a stored client-key record's contents. Throws on any
+ * malformed member -- see the module doc for why nothing here is tolerated
+ * into a degraded record.
+ *
+ * @param options {object}
+ * @param options.contents {unknown}   the stored JSON contents (an app that
+ *   stores a string parses it first)
+ * @returns {ClientKeyRecord}
+ */
+export declare function decodeClientKeyRecord({ contents }: {
+    contents: unknown;
+}): ClientKeyRecord;
+/**
+ * Narrows a decoded record to a complete enrolled-client key set, throwing
+ * when any member an enrolled client needs is absent. For an app whose stored
+ * records are only ever written by the enrollment ceremony, this turns "the
+ * codec tolerates older records" into a single checked boundary.
+ *
+ * @param options {object}
+ * @param options.record {ClientKeyRecord}
+ * @returns {EnrolledClientKeyRecord}
+ */
+export declare function assertEnrolledClientKeyRecord({ record }: {
+    record: ClientKeyRecord;
+}): EnrolledClientKeyRecord;
+//# sourceMappingURL=clientKeyRecord.d.ts.map

package/dist/keys/clientKeyRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientKeyRecord.d.ts","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAOnC;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,MAAM,CAAA;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,GAAG,EAAE,GAAG,CAAA;IACR,eAAe,EAAE,qBAAqB,CAAA;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,GAAG,SAAS,CA2BpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,qBAAqB,GAAG,SAAS,CA8BnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,UAAU,EACV,GAAG,EACH,eAAe,EACf,UAAU,EACV,UAAU,EACV,SAAoC,EACrC,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,eAAe,CAAC,EAAE,qBAAqB,CAAA;IACvC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,mBAAmB,CAsCtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,OAAO,CAAA;CAClB,GAAG,eAAe,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,CAAA;CACxB,GAAG,uBAAuB,CAe1B"}

package/dist/keys/clientKeyRecord.js

@@ -0,0 +1,265 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The client-key record: the contents codec and validation for the local
+ * record every wallet client keeps its own key material in -- the random
+ * 32-byte client seed behind its Ed25519 signing key and X25519 twin, the
+ * cached per-user key (PUK) delivered through the wrap-set roster, this
+ * client's own did:webvh update-key seeds, the account controller the record
+ * was bound for, and (when the app stores it beside the keys) the account's
+ * did:webvh pointer.
+ *
+ * Only the CONTENTS live here. Where the record is stored, and what wraps it,
+ * stay with the app: a browser wallet wraps it under its unlock layer and puts
+ * it in local storage, a mobile wallet puts the encoded JSON in an encrypted
+ * database column. Both encode and validate identically, so a record one
+ * wallet writes is a record the other accepts.
+ *
+ * Byte fields travel as base64url without padding; every one of them is a
+ * 32-byte secret and is length-checked on the way back in. Validation is
+ * strict on purpose: an absent optional member is a record written before that
+ * member existed, but a present-and-malformed one throws, because both of the
+ * members that can be malformed are load-bearing -- the account's encrypted
+ * collections are keyed on the PUK, and the account's identity log can only be
+ * extended with the update-key seeds, so proceeding without either would
+ * silently orphan data or strand update authority.
+ *
+ * Two ordering invariants govern how an app persists what this codec encodes.
+ * Neither is enforceable here (the writes are the app's), and both are
+ * durability rules a crash must not be able to break:
+ *
+ * 1. **The PUK and the roster epoch pin persist atomically.** The pin is what
+ *    refuses a rolled-back roster, so it must never advance without the key
+ *    that authenticated the roster it advanced to -- and the key must never be
+ *    adopted without the pin moving with it. One write, or none.
+ * 2. **Rolled update-key seeds persist BEFORE the log entry that publishes
+ *    them.** A did:webvh rotation writes `pendingStagedSeed` (and the rolled
+ *    `updateSeed` / `stagedSeed`) first and publishes second: a tear after the
+ *    persist costs an unused staged key, while a tear after the publish would
+ *    strand the log with an update key this client no longer holds -- an
+ *    account that can never be updated again.
+ *
+ * This module is a LEAF, exported as `@interop/wallet-core/keys/clientKeyRecord`
+ * as well as through the `keys` subpath. Encoding a record is something the
+ * storage layer does, far from any key operation, so it imports only a base64url
+ * codec (its two key types are type-only imports, erased at compile time) and
+ * reaches nothing in the crypto / EDV graph. A wallet whose storage tests run
+ * without that graph loaded imports the leaf path directly.
+ */
+import { base64urlnopad } from '@scure/base';
+/**
+ * The number of bytes every secret in the record carries.
+ */
+const SECRET_BYTES = 32;
+/**
+ * Decodes one base64url byte field, checking its length.
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the encoded member
+ * @param options.name {string}   the member's name, for the error message
+ * @returns {Uint8Array}
+ */
+function decodeSecret({ value, name }) {
+    if (typeof value !== 'string') {
+        throw new Error(`Client-key record ${name} is missing.`);
+    }
+    let bytes;
+    try {
+        bytes = base64urlnopad.decode(value);
+    }
+    catch (err) {
+        throw new Error(`Client-key record ${name} is not base64url.`, {
+            cause: err
+        });
+    }
+    if (bytes.length !== SECRET_BYTES) {
+        throw new Error(`Client-key record ${name} is not ${SECRET_BYTES} bytes.`);
+    }
+    return bytes;
+}
+/**
+ * Parses and validates the optional `puk` member. An absent member resolves to
+ * `undefined` (a record written for an account minted before the PUK); a
+ * present-but-malformed one throws.
+ *
+ * The signing seed is absent on a PUK adopted from a roster rotation (the
+ * roster wraps the key-agreement secret alone); when present it must be
+ * well-formed.
+ *
+ * @param value {unknown}   the record's `puk` member
+ * @returns {Puk | undefined}
+ */
+export function parseClientRecordPuk(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === null || typeof value !== 'object') {
+        throw new Error('Client-key record has a malformed PUK.');
+    }
+    const { id, secret, signingSeed } = value;
+    if (typeof id !== 'string' || !id) {
+        throw new Error('Client-key record PUK is missing its key id.');
+    }
+    const secretBytes = decodeSecret({ value: secret, name: 'PUK key material' });
+    if (signingSeed === undefined) {
+        return { id, secret: secretBytes };
+    }
+    return {
+        id,
+        secret: secretBytes,
+        signingSeed: decodeSecret({
+            value: signingSeed,
+            name: 'PUK signing seed'
+        })
+    };
+}
+/**
+ * Parses and validates the optional `webvh` member: this client's did:webvh
+ * update-key seeds. An absent member resolves to `undefined` (a record written
+ * before the update keys became client-held); a present-but-malformed one
+ * throws.
+ *
+ * @param value {unknown}   the record's `webvh` member
+ * @returns {ClientWebvhUpdateKeys | undefined}
+ */
+export function parseClientRecordWebvhKeys(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === null || typeof value !== 'object') {
+        throw new Error('Client-key record has malformed did:webvh update keys.');
+    }
+    const { updateSeed, stagedSeed, pendingStagedSeed } = value;
+    return {
+        updateSeed: decodeSecret({
+            value: updateSeed,
+            name: 'did:webvh update seed'
+        }),
+        stagedSeed: decodeSecret({
+            value: stagedSeed,
+            name: 'did:webvh staged seed'
+        }),
+        ...(pendingStagedSeed !== undefined
+            ? {
+                pendingStagedSeed: decodeSecret({
+                    value: pendingStagedSeed,
+                    name: 'did:webvh pending staged seed'
+                })
+            }
+            : {})
+    };
+}
+/**
+ * Encodes a client-key record's contents for storage: base64url byte fields,
+ * optional members omitted rather than written as null.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   this client's 32-byte seed
+ * @param [options.puk] {Puk}   the cached per-user key
+ * @param [options.webvhUpdateKeys] {ClientWebvhUpdateKeys}   this client's
+ *   did:webvh update-key seeds
+ * @param [options.controller] {string}   the account controller this key set
+ *   was bound for -- on an enrolled (non-first) client it differs from the
+ *   client's own did:key
+ * @param [options.pointerDid] {string}   the account's did:webvh
+ * @param [options.createdAt] {string}   when the record was written; defaults
+ *   to now
+ * @returns {ClientKeyRecordJson}
+ */
+export function encodeClientKeyRecord({ clientSeed, puk, webvhUpdateKeys, controller, pointerDid, createdAt = new Date().toISOString() }) {
+    if (clientSeed.length !== SECRET_BYTES) {
+        throw new Error(`Client-key record client seed is not ${SECRET_BYTES} bytes.`);
+    }
+    return {
+        clientSeed: base64urlnopad.encode(clientSeed),
+        ...(puk
+            ? {
+                puk: {
+                    id: puk.id,
+                    secret: base64urlnopad.encode(puk.secret),
+                    ...(puk.signingSeed
+                        ? { signingSeed: base64urlnopad.encode(puk.signingSeed) }
+                        : {})
+                }
+            }
+            : {}),
+        ...(webvhUpdateKeys
+            ? {
+                webvh: {
+                    updateSeed: base64urlnopad.encode(webvhUpdateKeys.updateSeed),
+                    stagedSeed: base64urlnopad.encode(webvhUpdateKeys.stagedSeed),
+                    ...(webvhUpdateKeys.pendingStagedSeed
+                        ? {
+                            pendingStagedSeed: base64urlnopad.encode(webvhUpdateKeys.pendingStagedSeed)
+                        }
+                        : {})
+                }
+            }
+            : {}),
+        ...(controller ? { controller } : {}),
+        ...(pointerDid ? { pointerDid } : {}),
+        createdAt
+    };
+}
+/**
+ * Decodes and validates a stored client-key record's contents. Throws on any
+ * malformed member -- see the module doc for why nothing here is tolerated
+ * into a degraded record.
+ *
+ * @param options {object}
+ * @param options.contents {unknown}   the stored JSON contents (an app that
+ *   stores a string parses it first)
+ * @returns {ClientKeyRecord}
+ */
+export function decodeClientKeyRecord({ contents }) {
+    if (contents === null || typeof contents !== 'object') {
+        throw new Error('Malformed client-key record.');
+    }
+    const { clientSeed, puk, webvh, controller, pointerDid } = contents;
+    const seed = decodeSecret({ value: clientSeed, name: 'client seed' });
+    if (controller !== undefined &&
+        (typeof controller !== 'string' || !controller)) {
+        throw new Error('Client-key record has a malformed controller.');
+    }
+    if (pointerDid !== undefined &&
+        (typeof pointerDid !== 'string' || !pointerDid)) {
+        throw new Error('Client-key record has a malformed account pointer DID.');
+    }
+    const parsedPuk = parseClientRecordPuk(puk);
+    const webvhUpdateKeys = parseClientRecordWebvhKeys(webvh);
+    return {
+        clientSeed: seed,
+        ...(parsedPuk ? { puk: parsedPuk } : {}),
+        ...(webvhUpdateKeys ? { webvhUpdateKeys } : {}),
+        ...(controller ? { controller } : {}),
+        ...(pointerDid ? { pointerDid } : {})
+    };
+}
+/**
+ * Narrows a decoded record to a complete enrolled-client key set, throwing
+ * when any member an enrolled client needs is absent. For an app whose stored
+ * records are only ever written by the enrollment ceremony, this turns "the
+ * codec tolerates older records" into a single checked boundary.
+ *
+ * @param options {object}
+ * @param options.record {ClientKeyRecord}
+ * @returns {EnrolledClientKeyRecord}
+ */
+export function assertEnrolledClientKeyRecord({ record }) {
+    const { puk, webvhUpdateKeys, controller, pointerDid } = record;
+    if (!puk) {
+        throw new Error('Client-key record carries no per-user key.');
+    }
+    if (!webvhUpdateKeys) {
+        throw new Error('Client-key record carries no did:webvh update keys.');
+    }
+    if (!controller) {
+        throw new Error('Client-key record carries no account controller.');
+    }
+    if (!pointerDid) {
+        throw new Error('Client-key record carries no account pointer DID.');
+    }
+    return { ...record, puk, webvhUpdateKeys, controller, pointerDid };
+}
+//# sourceMappingURL=clientKeyRecord.js.map

package/dist/keys/clientKeyRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientKeyRecord.js","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAgDvB;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EAIL;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE;YAC7D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,YAAY,SAAS,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAInC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC7E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,YAAY,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,kBAAkB;SACzB,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAIrD,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,GAAG,CAAC,iBAAiB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACE,iBAAiB,EAAE,YAAY,CAAC;oBAC9B,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,+BAA+B;iBACtC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,GAAG,EACH,eAAe,EACf,UAAU,EACV,UAAU,EACV,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAQrC;IACC,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,wCAAwC,YAAY,SAAS,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;oBACzC,GAAG,CAAC,GAAG,CAAC,WAAW;wBACjB,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;wBACzD,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;oBAC7D,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;oBAC7D,GAAG,CAAC,eAAe,CAAC,iBAAiB;wBACnC,CAAC,CAAC;4BACE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CACtC,eAAe,CAAC,iBAAiB,CAClC;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAM1D,CAAA;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC3C,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,MAAM,EAGP;IACC,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACpE,CAAC"}

package/dist/keys/index.d.ts

@@ -8,6 +8,9 @@
  *
  * - `mintPuk` / `pukVaultKeys` -- minting the account's PUK and rebuilding the
  *   vault key-agreement key + resolver from stored material.
+ * - `encodeClientKeyRecord` / `decodeClientKeyRecord` -- the contents codec and
+ *   strict validation of the local client-key record each client keeps its own
+ *   key material in (storage and wrapping stay app-side).
  * - `ensurePukRoster` / `addPukRosterRecipient` / `readPukRoster` /
  *   `pukRosterRecipientResolver` -- the `key-map/puk.json` roster over the
  *   was-client descriptor-store seam, with the three client-side guards a
@@ -34,6 +37,8 @@
  */
 export { mintPuk, pukVaultKeys } from './puk.js';
 export type { Puk } from './puk.js';
+export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordPuk, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
+export type { ClientKeyRecord, ClientKeyRecordJson, EnrolledClientKeyRecord } from './clientKeyRecord.js';
 export { addPukRosterRecipient, convergePukRosterToDocument, ensurePukRoster, PukRosterContinuityError, PukRosterIntegrityError, PukRosterUnwrapError, pukRosterRecipientResolver, readPukRoster, rosterRecipientKid, rotatePukRoster } from './pukRoster.js';
 export { cascadeCollectionsToPuk, pukAsRecipient, rotateCollectionEpochsToPuk, unwrapPukGenerations } from './pukCascade.js';
 export type { CollectionPukRotationOutcome, PukCascadeResult } from './pukCascade.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAChD,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAChD,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -8,6 +8,9 @@
  *
  * - `mintPuk` / `pukVaultKeys` -- minting the account's PUK and rebuilding the
  *   vault key-agreement key + resolver from stored material.
+ * - `encodeClientKeyRecord` / `decodeClientKeyRecord` -- the contents codec and
+ *   strict validation of the local client-key record each client keeps its own
+ *   key material in (storage and wrapping stay app-side).
  * - `ensurePukRoster` / `addPukRosterRecipient` / `readPukRoster` /
  *   `pukRosterRecipientResolver` -- the `key-map/puk.json` roster over the
  *   was-client descriptor-store seam, with the three client-side guards a
@@ -33,6 +36,7 @@
  *   names (also the completion sweep's driver).
  */
 export { mintPuk, pukVaultKeys } from './puk.js';
+export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordPuk, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
 export { addPukRosterRecipient, convergePukRosterToDocument, ensurePukRoster, PukRosterContinuityError, PukRosterIntegrityError, PukRosterUnwrapError, pukRosterRecipientResolver, readPukRoster, rosterRecipientKid, rotatePukRoster } from './pukRoster.js';
 export { cascadeCollectionsToPuk, pukAsRecipient, rotateCollectionEpochsToPuk, unwrapPukGenerations } from './pukCascade.js';
 export { pukRosterDescriptorStore } from './rosterStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AAUxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AAUxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/request/index.d.ts

@@ -19,6 +19,9 @@
  *   `interactionUrl` resolves VCALM `interaction:` URLs.
  * - `processRequest` is the pure request-to-response pipeline, with the
  *   app-side side effects injected.
+ * - `classifyWalletInput` / `handleWalletInput` are the ordered
+ *   discrimination every "scan or paste something" entry point runs, with the
+ *   per-grammar handlers injected.
  *
  * The signing / document-loader dependency graph lives entirely behind this
  * subpath; `@interop/wallet-core`'s plaintext consumers never pull it in.
@@ -32,4 +35,5 @@ export * from './composeVp.js';
 export * from './exchangeClient.js';
 export * from './interactionUrl.js';
 export * from './processRequest.js';
+export * from './walletInput.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}

package/dist/request/index.js

@@ -19,6 +19,9 @@
  *   `interactionUrl` resolves VCALM `interaction:` URLs.
  * - `processRequest` is the pure request-to-response pipeline, with the
  *   app-side side effects injected.
+ * - `classifyWalletInput` / `handleWalletInput` are the ordered
+ *   discrimination every "scan or paste something" entry point runs, with the
+ *   per-grammar handlers injected.
  *
  * The signing / document-loader dependency graph lives entirely behind this
  * subpath; `@interop/wallet-core`'s plaintext consumers never pull it in.
@@ -32,4 +35,5 @@ export * from './composeVp.js';
 export * from './exchangeClient.js';
 export * from './interactionUrl.js';
 export * from './processRequest.js';
+export * from './walletInput.js';
 //# sourceMappingURL=index.js.map

package/dist/request/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}

package/dist/request/walletInput.d.ts

@@ -0,0 +1,93 @@
+import type { WalletApiMessage } from './types.js';
+/**
+ * What a piece of wallet input turned out to be. Every variant carries the
+ * trimmed `text` it was classified from, plus whatever the classification
+ * already parsed (a classifier that recognized a grammar has usually parsed
+ * enough of it that re-parsing in the handler would be waste and drift).
+ */
+export type WalletInput = {
+    kind: 'was-link';
+    text: string;
+} | {
+    kind: 'connect-code';
+    text: string;
+} | {
+    kind: 'legacy-request';
+    text: string;
+    params: Record<string, string>;
+} | {
+    kind: 'interaction-url';
+    text: string;
+} | {
+    kind: 'deep-link';
+    text: string;
+} | {
+    kind: 'wallet-api-message';
+    text: string;
+    message: WalletApiMessage;
+} | {
+    kind: 'credentials';
+    text: string;
+};
+/**
+ * Classifies one piece of wallet input. See the module doc for the order and
+ * why each branch sits where it does.
+ *
+ * @param text {string}   the scanned, pasted, or opened text
+ * @param [options] {object}
+ * @param [options.deepLinkSchemes] {string[]}   the link prefixes this app has
+ *   registered (custom protocols and universal app links). Empty, the
+ *   deep-link and legacy-request branches never match -- a wallet with no
+ *   registered links has nothing to route them to
+ * @returns {WalletInput}
+ */
+export declare function classifyWalletInput(text: string, { deepLinkSchemes }?: {
+    deepLinkSchemes?: string[];
+}): WalletInput;
+/**
+ * The handlers a caller injects, one per classified kind. Every handler is
+ * optional: an input whose kind has no handler throws, which is what keeps a
+ * wallet that does not implement a grammar from silently doing the wrong thing
+ * with it.
+ */
+export interface WalletInputHandlers<T> {
+    wasLink?: (input: {
+        text: string;
+    }) => T | Promise<T>;
+    connectCode?: (input: {
+        text: string;
+    }) => T | Promise<T>;
+    legacyRequest?: (input: {
+        text: string;
+        params: Record<string, string>;
+    }) => T | Promise<T>;
+    interactionUrl?: (input: {
+        text: string;
+    }) => T | Promise<T>;
+    deepLink?: (input: {
+        text: string;
+    }) => T | Promise<T>;
+    walletApiMessage?: (input: {
+        text: string;
+        message: WalletApiMessage;
+    }) => T | Promise<T>;
+    credentials?: (input: {
+        text: string;
+    }) => T | Promise<T>;
+}
+/**
+ * Classifies input and dispatches it to the matching handler.
+ *
+ * @param options {object}
+ * @param options.text {string}   the scanned, pasted, or opened text
+ * @param [options.deepLinkSchemes] {string[]}   this app's registered link
+ *   prefixes
+ * @param options.handlers {WalletInputHandlers}   the injected handlers
+ * @returns {Promise<*>}   whatever the matching handler resolves to
+ */
+export declare function handleWalletInput<T>({ text, deepLinkSchemes, handlers }: {
+    text: string;
+    deepLinkSchemes?: string[];
+    handlers: WalletInputHandlers<T>;
+}): Promise<T>;
+//# sourceMappingURL=walletInput.d.ts.map

package/dist/request/walletInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletInput.d.ts","sourceRoot":"","sources":["../../src/request/walletInput.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AASlD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAsCzC;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,EAAE,eAAoB,EAAE,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC5D,WAAW,CA2Cb;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACrD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACzD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAC/B,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACtD,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,gBAAgB,CAAA;KAC1B,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,EACzC,IAAI,EACJ,eAAe,EACf,QAAQ,EACT,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;CACjC,GAAG,OAAO,CAAC,CAAC,CAAC,CAkBb"}