@interop/wallet-core 0.16.0 → 0.18.0

package/dist/keys/{pukRoster.d.ts → userKeyRoster.d.ts}

@@ -2,14 +2,13 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The PUK wrap set: the `key-map/puk.json` roster resource. Its body is a
- * `CollectionEncryption` descriptor verbatim, whose current epoch IS the
- * current
- * per-user key -- the epoch id is the PUK's did:key and the wrapped secret is
- * the PUK's raw 32-byte key, wrapped to each enrolled client's key-agreement
- * key. The roster is the delivery channel for PUK rotation: each client keeps
- * the PUK in its own local state under the unlock layer, and the roster's
- * epoch stamp marks a cached copy stale.
+ * The user key wrap set: the `key-map/user-key.json` roster resource. Its body
+ * is a `CollectionEncryption` descriptor verbatim, whose current epoch IS the
+ * current user key -- the epoch id is the user key's did:key and the wrapped
+ * secret is the user key's raw 32-byte key, wrapped to each enrolled client's
+ * key-agreement key. The roster is the delivery channel for user key rotation:
+ * each client keeps the user key in its own local state under the unlock layer,
+ * and the roster's epoch stamp marks a cached copy stale.
  *
  * Everything mutates through was-client's descriptor-store seam (the
  * plain-resource adapter): read-with-etag, compare-and-swap writes, and a
@@ -18,38 +17,50 @@
  *
  * A resource-hosted descriptor gets NONE of the server-side epoch invariants a
  * Collection Description enforces (append-only epochs, monotone
- * `currentEpoch`), so three client-side compensations are load-bearing alone
+ * `currentEpoch`), so four client-side compensations are load-bearing alone
  * against a tampering host:
  *
  * - **`epochsMac`** -- the epoch configuration is authenticated under the
  *   current epoch's secret, which the server never holds; a fabricated
- *   configuration fails the MAC (`PukRosterIntegrityError`).
+ *   configuration fails the MAC (`UserKeyRosterIntegrityError`).
  * - **The epoch pin** -- the latest-seen roster epoch is pinned locally by the
  *   consuming app (beside the account-pointer pin); a served
  *   roster that rolls back behind the pin is refused
- *   (`PukRosterContinuityError`) rather than followed. Stale-roster replay
+ *   (`UserKeyRosterContinuityError`) rather than followed. Stale-roster replay
  *   thereby lands in the same accepted continuity class as a substituted
  *   account pointer.
  * - **The roster delivers, never sources** -- the recipient-key source of
  *   record is the locally verified did:webvh document (one `keyAgreement`
  *   verification method per enrolled client). When an epoch rotates, each
  *   remaining recipient's key is resolved from that document
- *   (`pukRosterRecipientResolver`); a roster entry with no matching document
+ *   (`userKeyRosterRecipientResolver`); a roster entry with no matching document
  *   verification method is dropped and never receives a wrap, so a
  *   server-injected entry sits ignored. Wraps are minted only by enrolled
  *   clients, against log-verified keys.
+ * - **`epochsSig`** -- the epoch configuration is additionally SIGNED by the
+ *   writing client's enrolled Ed25519 key (`userKeyRosterEpochsSigner`), and a
+ *   read that adopts an epoch this client has not vouched for itself (a
+ *   rotated read, or a freshly enrolled client's first read) verifies that
+ *   signature against the locally verified did:webvh document
+ *   (`verifyUserKeyRosterEpochsSig`). This is the check the `epochsMac` alone
+ *   cannot make on those paths: the MAC is keyed by a secret unwrapped from
+ *   the served descriptor itself, so a host that mints its own epoch, wraps
+ *   it to this client's world-readable key-agreement key, and MACs the
+ *   fabricated configuration under the same minted secret passes the MAC --
+ *   but it cannot produce a signature by a key the document backs.
  */
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
-import { type EncryptionDescriptorStore, type RecipientPublicKey } from '@interop/was-client/edv';
-import type { Puk } from './puk.js';
+import { type EncryptionDescriptorStore, type EpochsSigner, type RecipientPublicKey } from '@interop/was-client/edv';
+import { type ICapabilityAgent } from '../webvh/zcap.js';
+import type { UserKey } from './userKey.js';
 /**
  * Thrown when a served roster fails its client-side authentication: a
  * missing/unsupported/invalid `epochsMac`, or a descriptor whose `currentEpoch`
  * names no epoch in its own list. The server (or whoever can write to it) has
  * produced a configuration no enrolled client authenticated.
  */
-export declare class PukRosterIntegrityError extends Error {
+export declare class UserKeyRosterIntegrityError extends Error {
     constructor(message: string);
 }
 /**
@@ -59,7 +70,7 @@ export declare class PukRosterIntegrityError extends Error {
  * an older consistent configuration, which a valid `epochsMac` alone cannot
  * catch; refused rather than followed.
  */
-export declare class PukRosterContinuityError extends Error {
+export declare class UserKeyRosterContinuityError extends Error {
     pinnedEpochId: string;
     constructor({ pinnedEpochId }: {
         pinnedEpochId: string;
@@ -68,10 +79,10 @@ export declare class PukRosterContinuityError extends Error {
 /**
  * Thrown when this client holds no usable wrap in the roster's current epoch
  * (no recipient entry for its key-agreement key, or the entry fails to
- * unwrap). The client cannot obtain the current PUK -- it may have been
+ * unwrap). The client cannot obtain the current user key -- it may have been
  * rotated off the roster.
  */
-export declare class PukRosterUnwrapError extends Error {
+export declare class UserKeyRosterUnwrapError extends Error {
     constructor(message: string);
 }
 /**
@@ -89,6 +100,41 @@ export interface RosterRecipientDocument {
         publicKeyMultibase?: string;
     }>;
 }
+/**
+ * The roster's epoch-configuration signer: signs each roster write's epoch
+ * configuration with this client's own Ed25519 signing key, under a `kid`
+ * that is the key's public multibase -- exactly the string enrolled as this
+ * client's verification method in the did:webvh document, so a reader
+ * resolves the signature against the document rather than anything the
+ * roster (or the server) supplies.
+ *
+ * @param options {object}
+ * @param options.keyAgent {ICapabilityAgent}   this client's signing key
+ *   agent (the `keyAgent` of `agentsFromSeed`)
+ * @returns {EpochsSigner}   the `signEpochs` hook for roster writes
+ */
+export declare function userKeyRosterEpochsSigner({ keyAgent }: {
+    keyAgent: ICapabilityAgent;
+}): EpochsSigner;
+/**
+ * Verifies a served roster's `epochsSig` against the locally verified
+ * did:webvh document -- the root of trust the server cannot mint. The
+ * signature must be present and supported, its `kid` must be the public
+ * multibase of one of the document's verification methods (an enrolled
+ * client's signing key), and it must verify over the canonical
+ * epoch-configuration payload. Throws {@link UserKeyRosterIntegrityError}
+ * otherwise: a configuration no enrolled client signed.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the served roster
+ * @param options.document {RosterRecipientDocument}   the locally verified
+ *   did:webvh document (never a server-supplied roster field)
+ * @returns {Promise<void>}
+ */
+export declare function verifyUserKeyRosterEpochsSig({ descriptor, document }: {
+    descriptor: CollectionEncryption;
+    document: RosterRecipientDocument;
+}): Promise<void>;
 /**
  * A wallet client's roster kid: its key-agreement key's id exactly as
  * `agentsFromSeed` derives it at the client's own logins
@@ -122,32 +168,36 @@ export declare function rosterRecipientKid({ signingKeyMultibase, keyAgreementKe
  *   did:webvh document (never a server-supplied roster field)
  * @returns {function}   a `resolveRecipientKey` for `removeRecipient`
  */
-export declare function pukRosterRecipientResolver({ document }: {
+export declare function userKeyRosterRecipientResolver({ document }: {
     document: RosterRecipientDocument;
 }): (kid: string) => Promise<RecipientPublicKey | null>;
 /**
- * Ensures the roster exists, create-if-absent: an absent roster is
- * initialized with the account's existing PUK installed as the first epoch,
- * wrapped to this client's key-agreement key; an existing roster is returned
- * as-is (authentication is the read path's job, and provisioning must never
- * clobber an established roster). Idempotent -- losing the guarded-create
- * race to a concurrent first init converges on the winner's roster.
+ * Ensures the roster exists, create-if-absent: an absent roster is initialized
+ * with the account's existing user key installed as the first epoch, wrapped to
+ * this client's key-agreement key; an existing roster is returned as-is
+ * (authentication is the read path's job, and provisioning must never clobber
+ * an established roster). Idempotent -- losing the guarded-create race to a
+ * concurrent first init converges on the winner's roster.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
  *   store
- * @param options.puk {Puk}   the account's per-user key
+ * @param options.userKey {UserKey}   the account's user key
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key -- the roster recipient
+ * @param options.signEpochs {EpochsSigner}   this client's epoch-configuration
+ *   signer ({@link userKeyRosterEpochsSigner}), so the first configuration is
+ *   vouched for by an enrollable key rather than only its own MAC
  * @returns {Promise<CollectionEncryption>}   the roster descriptor
  */
-export declare function ensurePukRoster({ store, puk, clientKeyAgreementKey }: {
+export declare function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKey, signEpochs }: {
     store: EncryptionDescriptorStore;
-    puk: Puk;
+    userKey: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
+    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
- * Wraps the PUK to a client being enrolled -- the roster half of the
+ * Wraps the user key to a client being enrolled -- the roster half of the
  * enrollment ceremony, and deliberately its FIRST write (decryption material
  * before authorization, the push order): the wrap lands before the did:webvh
  * log entries, so no enrolled client is ever authorized but blind, and a tear
@@ -172,22 +222,22 @@ export declare function ensurePukRoster({ store, puk, clientKeyAgreementKey }: {
  *   re-wrapping
  * @returns {Promise<CollectionEncryption>}   the refreshed roster descriptor
  */
-export declare function addPukRosterRecipient({ store, recipient, ownerKeyAgreementKey }: {
+export declare function addUserKeyRosterRecipient({ store, recipient, ownerKeyAgreementKey }: {
     store: EncryptionDescriptorStore;
     recipient: RecipientPublicKey;
     ownerKeyAgreementKey: IKeyAgreementKey;
 }): Promise<CollectionEncryption>;
 /**
- * Rotates the PUK roster off one recipient -- the roster half of revoking an
- * enrolled wallet client or a recovery code. A thin, deliberate composition
+ * Rotates the user key roster off one recipient -- the roster half of revoking
+ * an enrolled wallet client or a recovery code. A thin, deliberate composition
  * of was-client's `removeRecipient` with the two roster-specific choices
- * spelled once: the remaining recipients are resolved from the locally
- * verified did:webvh document ("the roster delivers, never sources" -- an
- * entry with no matching `keyAgreement` verification method is dropped and
- * never receives a wrap), and the pull axis is a no-op, because for a roster
- * recipient the pull axis IS the document edit the caller performed first --
- * under the current-key-set rule the removed party's server-side access died
- * the moment its verification method left the document.
+ * spelled once: the remaining recipients are resolved from the locally verified
+ * did:webvh document ("the roster delivers, never sources" -- an entry with no
+ * matching `keyAgreement` verification method is dropped and never receives a
+ * wrap), and the pull axis is a no-op, because for a roster recipient the pull
+ * axis IS the document edit the caller performed first -- under the
+ * current-key-set rule the removed party's server-side access died the moment
+ * its verification method left the document.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -196,18 +246,22 @@ export declare function addPukRosterRecipient({ store, recipient, ownerKeyAgreem
  *   did:webvh document, AFTER the removal edit
  * @param options.retireRecipientId {string}   the removed recipient's roster
  *   kid
+ * @param options.signEpochs {EpochsSigner}   the rotating client's
+ *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), vouching for
+ *   the fresh epoch so other clients' rotated reads accept it
  * @returns {Promise<CollectionEncryption>}   the rotated roster descriptor
  */
-export declare function rotatePukRoster({ store, document, retireRecipientId }: {
+export declare function rotateUserKeyRoster({ store, document, retireRecipientId, signEpochs }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     retireRecipientId: string;
+    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Converges the roster onto the account document: the standing detector for a
  * revocation cascade torn between its two halves. The cascade edits the
  * document first and rotates the roster second, so a client that crashes in
- * between leaves a roster that keeps wrapping the CURRENT per-user key to a
+ * between leaves a roster that keeps wrapping the CURRENT user key to a
  * recipient the document no longer keys -- durable, silent, and permanent,
  * since the revoked client's document edit will never be re-run.
  *
@@ -215,7 +269,7 @@ export declare function rotatePukRoster({ store, document, retireRecipientId }:
  * document-backed resolver cannot answer for is exactly a recipient the
  * document no longer keys, so a healthy account reads the descriptor and
  * writes nothing. When any such recipient is found the roster is rotated away
- * from ALL of them at once -- a single {@link rotatePukRoster} suffices,
+ * from ALL of them at once -- a single {@link rotateUserKeyRoster} suffices,
  * because the resolver drops every unbacked entry from the fresh epoch, not
  * just the one named as retiring.
  *
@@ -224,8 +278,8 @@ export declare function rotatePukRoster({ store, document, retireRecipientId }:
  * account), not a cascade to finish, and completing it would lock every
  * client out of the account.
  *
- * The fresh per-user key itself is not returned: the caller adopts it the
- * ordinary way, by re-reading the roster ({@link readPukRoster}) once
+ * The fresh user key itself is not returned: the caller adopts it the
+ * ordinary way, by re-reading the roster ({@link readUserKeyRoster}) once
  * `rotated` says there is something to adopt, and then runs the collection
  * fan-out.
  *
@@ -237,14 +291,18 @@ export declare function rotatePukRoster({ store, document, retireRecipientId }:
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
+ * @param options.signEpochs {EpochsSigner}   the converging client's
+ *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), for the
+ *   rotation this call may perform
  * @returns {Promise<object>}   whether the roster rotated on this call, the
  *   stale recipient kids found, and the roster descriptor as it now stands
  *   (`null` when the account has no roster yet)
  */
-export declare function convergePukRosterToDocument({ store, document, descriptor }: {
+export declare function convergeUserKeyRosterToDocument({ store, document, descriptor, signEpochs }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     descriptor?: CollectionEncryption;
+    signEpochs: EpochsSigner;
 }): Promise<{
     rotated: boolean;
     staleRecipientIds: string[];
@@ -252,13 +310,13 @@ export declare function convergePukRosterToDocument({ store, document, descripto
 }>;
 /**
  * What a roster read resolves to: the authenticated descriptor, the current
- * PUK (the cached one confirmed current, or a fresh one unwrapped from a
+ * user key (the cached one confirmed current, or a fresh one unwrapped from a
  * rotated epoch -- `rotated` says which), and the epoch id the caller must pin
  * as the new latest-seen.
  */
-export interface PukRosterReadResult {
+export interface UserKeyRosterReadResult {
     descriptor: CollectionEncryption;
-    puk: Puk;
+    userKey: UserKey;
     rotated: boolean;
     latestEpochId: string;
 }
@@ -269,37 +327,56 @@ export interface PukRosterReadResult {
  *
  * 1. **Continuity**: the served epochs must contain the pinned latest-seen
  *    epoch, and `currentEpoch` must not precede it in the append-only list
- *    (`PukRosterContinuityError` -- the rollback/replay refusal).
- * 2. **Possession**: `currentEpoch === puk.id` confirms the cached PUK
+ *    (`UserKeyRosterContinuityError` -- the rollback/replay refusal).
+ * 2. **Possession**: `currentEpoch === userKey.id` confirms the cached user key
  *    current; otherwise the current epoch was rotated by another client and
  *    this client's wrap is unwrapped with its own key-agreement key
- *    (`PukRosterUnwrapError` when it holds none).
- * 3. **Authentication**: the descriptor's `epochsMac` is verified under the
- *    current epoch's secret (`PukRosterIntegrityError` on any mismatch -- a
+ *    (`UserKeyRosterUnwrapError` when it holds none).
+ * 3. **Provenance** (the rotated/first-read path only): the epoch
+ *    configuration's `epochsSig` is verified against the locally verified
+ *    did:webvh document ({@link verifyUserKeyRosterEpochsSig}) BEFORE the epoch
+ *    it delivers is adopted. On this path the `epochsMac` alone proves
+ *    nothing against the host -- its key is unwrapped from the served
+ *    descriptor itself -- so an epoch no enrolled client signed is refused
+ *    (`UserKeyRosterIntegrityError`). The cached-current path needs no signature:
+ *    there the MAC is keyed by a secret this client already trusts.
+ * 4. **Authentication**: the descriptor's `epochsMac` is verified under the
+ *    current epoch's secret (`UserKeyRosterIntegrityError` on any mismatch -- a
  *    fabricated configuration).
  *
- * A rotated read returns the fresh PUK; its Ed25519 signing seed does not
+ * A rotated read returns the fresh user key; its Ed25519 signing seed does not
  * travel through the roster (the roster wraps the key-agreement secret
- * alone), so the returned PUK carries none.
+ * alone), so the returned user key carries none.
  *
- * A caller with no cached PUK at all -- a freshly enrolled client making its
- * first post-enrollment read -- omits `puk` and always takes the unwrap path;
- * the result's `rotated` is then true (the PUK was adopted from the roster).
+ * A caller with no cached user key at all -- a freshly enrolled client making
+ * its first post-enrollment read -- omits `userKey` and always takes the unwrap
+ * path; the result's `rotated` is then true (the user key was adopted from the
+ * roster). Every unwrap-path caller must therefore supply the account document
+ * (or a way to resolve it): `document` when it already holds a verified copy,
+ * or `resolveDocument` to fetch-and-verify lazily, only when the read actually
+ * rotates.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
  *   store
- * @param [options.puk] {Puk}   this client's cached PUK, when it holds one
+ * @param [options.userKey] {UserKey}   this client's cached user key, when it holds one
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key, unwrapping a rotated epoch
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch, when this client has seen the roster before
- * @returns {Promise<PukRosterReadResult | null>}
+ * @param [options.document] {RosterRecipientDocument}   the locally verified
+ *   did:webvh document, when the caller already holds one
+ * @param [options.resolveDocument] {function}   resolves the locally verified
+ *   did:webvh document on demand; called only when the read takes the
+ *   rotated/first-read path
+ * @returns {Promise<UserKeyRosterReadResult | null>}
  */
-export declare function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedEpochId }: {
+export declare function readUserKeyRoster({ store, userKey, clientKeyAgreementKey, pinnedEpochId, document, resolveDocument }: {
     store: EncryptionDescriptorStore;
-    puk?: Puk;
+    userKey?: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
     pinnedEpochId?: string | null;
-}): Promise<PukRosterReadResult | null>;
-//# sourceMappingURL=pukRoster.d.ts.map
+    document?: RosterRecipientDocument;
+    resolveDocument?: () => Promise<RosterRecipientDocument>;
+}): Promise<UserKeyRosterReadResult | null>;
+//# sourceMappingURL=userKeyRoster.d.ts.map

package/dist/keys/userKeyRoster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userKeyRoster.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAQL,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzE;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACV,QAAQ,EACT,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAiDD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzD,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8F1C"}