@interop/wallet-core 0.23.1 → 0.25.0

package/dist/keys/userKeyRoster.d.ts

@@ -2,7 +2,7 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The user key wrap set: the `key-map/user-key.json` roster resource. Its body
+ * The user key wrap set: the roster governed by `key-map/user-key.jsonl`. Its state
  * is a `CollectionEncryption` descriptor verbatim, whose current epoch IS the
  * current user key -- the epoch id is the user key's did:key and the wrapped
  * secret is the user key's raw 32-byte key, wrapped to each enrolled client's
@@ -10,25 +10,34 @@
  * each client keeps the user key in its own local state under the unlock layer,
  * and the roster's epoch stamp marks a cached copy stale.
  *
- * Everything mutates through was-client's descriptor-store seam (the
- * plain-resource adapter): read-with-etag, compare-and-swap writes, and a
- * guarded create for the initially-absent roster. No descriptor logic is
+ * Everything mutates through was-client's descriptor-store seam -- since the
+ * roster became log-governed, the log-backed adapter
+ * (`logGovernedDescriptorStore`): reads resolve to the roster log's VERIFIED
+ * head state, writes append signed entries. No descriptor logic is
  * reimplemented here.
  *
  * A resource-hosted descriptor gets NONE of the server-side epoch invariants a
  * Collection Description enforces (append-only epochs, monotone
- * `currentEpoch`), so four client-side compensations are load-bearing alone
+ * `currentEpoch`), so the client-side compensations are load-bearing alone
  * against a tampering host:
  *
- * - **`epochsMac`** -- the epoch configuration is authenticated under the
- *   current epoch's secret, which the server never holds; a fabricated
- *   configuration fails the MAC (`UserKeyRosterIntegrityError`).
+ * - **The resource log** -- the roster is governed by a hash-linked log whose
+ *   every entry is signed by an enrolled client's key, anchored in the
+ *   locally verified did:webvh document, and continuity-checked against the
+ *   client's chain-head pin (the `resourceLog` module). A fabricated roster
+ *   fails entry-proof verification (`ResourceLogIntegrityError`); a rolled
+ *   back, forked, or format-switched log fails continuity
+ *   (`ResourceLogContinuityError`). This is the successor of the retired
+ *   detached `epochsSig`: the entry proof covers the whole configuration, on
+ *   every read instead of only the adopt path. (The `epochsMac`
+ *   epoch-configuration MAC that used to sit beneath it is retired stack-wide:
+ *   on a log-governed resource its coverage was a strict subset of chain
+ *   verification.)
  * - **The epoch pin** -- the latest-seen roster epoch is pinned locally by the
  *   consuming app (beside the account-pointer pin); a served
  *   roster that rolls back behind the pin is refused
- *   (`UserKeyRosterContinuityError`) rather than followed. Stale-roster replay
- *   thereby lands in the same accepted continuity class as a substituted
- *   account pointer.
+ *   (`UserKeyRosterContinuityError`) rather than followed, even where the
+ *   chain-head pin was lost with a reinstalled client.
  * - **The roster delivers, never sources** -- the recipient-key source of
  *   record is the locally verified did:webvh document (one `keyAgreement`
  *   verification method per enrolled client). When an epoch rotates, each
@@ -37,28 +46,18 @@
  *   verification method is dropped and never receives a wrap, so a
  *   server-injected entry sits ignored. Wraps are minted only by enrolled
  *   clients, against log-verified keys.
- * - **`epochsSig`** -- the epoch configuration is additionally SIGNED by the
- *   writing client's enrolled Ed25519 key (`userKeyRosterEpochsSigner`), and a
- *   read that adopts an epoch this client has not vouched for itself (a
- *   rotated read, or a freshly enrolled client's first read) verifies that
- *   signature against the locally verified did:webvh document
- *   (`verifyUserKeyRosterEpochsSig`). This is the check the `epochsMac` alone
- *   cannot make on those paths: the MAC is keyed by a secret unwrapped from
- *   the served descriptor itself, so a host that mints its own epoch, wraps
- *   it to this client's world-readable key-agreement key, and MACs the
- *   fabricated configuration under the same minted secret passes the MAC --
- *   but it cannot produce a signature by a key the document backs.
  */
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
-import { type EncryptionDescriptorStore, type EpochsSigner, type RecipientPublicKey } from '@interop/was-client/edv';
+import { type EncryptionDescriptorStore, type RecipientPublicKey } from '@interop/was-client/edv';
+import type { ResourceLogSigner } from '../resourceLog/index.js';
 import { type ICapabilityAgent } from '../webvh/zcap.js';
 import type { UserKey } from './userKey.js';
 /**
- * Thrown when a served roster fails its client-side authentication: a
- * missing/unsupported/invalid `epochsMac`, or a descriptor whose `currentEpoch`
- * names no epoch in its own list. The server (or whoever can write to it) has
- * produced a configuration no enrolled client authenticated.
+ * Thrown when a served roster fails its client-side consistency checks: a
+ * descriptor whose `currentEpoch` names no epoch in its own list. The server
+ * (or whoever can write to it) has produced a configuration no enrolled
+ * client authenticated.
  */
 export declare class UserKeyRosterIntegrityError extends Error {
     constructor(message: string);
@@ -67,8 +66,7 @@ export declare class UserKeyRosterIntegrityError extends Error {
  * Thrown when a served roster conflicts with the locally pinned latest-seen
  * epoch -- the epochs list no longer contains the pinned epoch, or
  * `currentEpoch` precedes it in the (append-only) list. A rollback/replay of
- * an older consistent configuration, which a valid `epochsMac` alone cannot
- * catch; refused rather than followed.
+ * an older consistent configuration; refused rather than followed.
  */
 export declare class UserKeyRosterContinuityError extends Error {
     pinnedEpochId: string;
@@ -101,40 +99,22 @@ export interface RosterRecipientDocument {
     }>;
 }
 /**
- * The roster's epoch-configuration signer: signs each roster write's epoch
- * configuration with this client's own Ed25519 signing key, under a `kid`
- * that is the key's public multibase -- exactly the string enrolled as this
- * client's verification method in the did:webvh document, so a reader
- * resolves the signature against the document rather than anything the
- * roster (or the server) supplies.
+ * The roster's log signer: signs each roster log append with this client's
+ * own Ed25519 signing key, named by its public multibase -- exactly the
+ * string enrolled as this client's verification method in the did:webvh
+ * document, so a reader resolves the entry proof against the document rather
+ * than anything the roster (or the server) supplies. Successor of the retired
+ * `epochsSig` signer under the log design.
  *
  * @param options {object}
  * @param options.keyAgent {ICapabilityAgent}   this client's signing key
  *   agent (the `keyAgent` of `agentsFromSeed`)
- * @returns {EpochsSigner}   the `signEpochs` hook for roster writes
+ * @returns {ResourceLogSigner}   the signer for the log-governed store's
+ *   appends
  */
-export declare function userKeyRosterEpochsSigner({ keyAgent }: {
+export declare function userKeyRosterLogSigner({ keyAgent }: {
     keyAgent: ICapabilityAgent;
-}): EpochsSigner;
-/**
- * Verifies a served roster's `epochsSig` against the locally verified
- * did:webvh document -- the root of trust the server cannot mint. The
- * signature must be present and supported, its `kid` must be the public
- * multibase of one of the document's verification methods (an enrolled
- * client's signing key), and it must verify over the canonical
- * epoch-configuration payload. Throws {@link UserKeyRosterIntegrityError}
- * otherwise: a configuration no enrolled client signed.
- *
- * @param options {object}
- * @param options.descriptor {CollectionEncryption}   the served roster
- * @param options.document {RosterRecipientDocument}   the locally verified
- *   did:webvh document (never a server-supplied roster field)
- * @returns {Promise<void>}
- */
-export declare function verifyUserKeyRosterEpochsSig({ descriptor, document }: {
-    descriptor: CollectionEncryption;
-    document: RosterRecipientDocument;
-}): Promise<void>;
+}): ResourceLogSigner;
 /**
  * A wallet client's roster kid: its key-agreement key's id exactly as
  * `agentsFromSeed` derives it at the client's own logins
@@ -185,16 +165,12 @@ export declare function userKeyRosterRecipientResolver({ document }: {
  * @param options.userKey {UserKey}   the account's user key
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key -- the roster recipient
- * @param options.signEpochs {EpochsSigner}   this client's epoch-configuration
- *   signer ({@link userKeyRosterEpochsSigner}), so the first configuration is
- *   vouched for by an enrollable key rather than only its own MAC
  * @returns {Promise<CollectionEncryption>}   the roster descriptor
  */
-export declare function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKey, signEpochs }: {
+export declare function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKey }: {
     store: EncryptionDescriptorStore;
     userKey: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
-    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Wraps the user key to a client being enrolled -- the roster half of the
@@ -246,16 +222,12 @@ export declare function addUserKeyRosterRecipient({ store, recipient, ownerKeyAg
  *   did:webvh document, AFTER the removal edit
  * @param options.retireRecipientId {string}   the removed recipient's roster
  *   kid
- * @param options.signEpochs {EpochsSigner}   the rotating client's
- *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), vouching for
- *   the fresh epoch so other clients' rotated reads accept it
  * @returns {Promise<CollectionEncryption>}   the rotated roster descriptor
  */
-export declare function rotateUserKeyRoster({ store, document, retireRecipientId, signEpochs }: {
+export declare function rotateUserKeyRoster({ store, document, retireRecipientId }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     retireRecipientId: string;
-    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Converges the roster onto the account document: the standing detector for a
@@ -291,18 +263,14 @@ export declare function rotateUserKeyRoster({ store, document, retireRecipientId
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
- * @param options.signEpochs {EpochsSigner}   the converging client's
- *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), for the
- *   rotation this call may perform
  * @returns {Promise<object>}   whether the roster rotated on this call, the
  *   stale recipient kids found, and the roster descriptor as it now stands
  *   (`null` when the account has no roster yet)
  */
-export declare function convergeUserKeyRosterToDocument({ store, document, descriptor, signEpochs }: {
+export declare function convergeUserKeyRosterToDocument({ store, document, descriptor }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     descriptor?: CollectionEncryption;
-    signEpochs: EpochsSigner;
 }): Promise<{
     rotated: boolean;
     staleRecipientIds: string[];
@@ -325,24 +293,19 @@ export interface UserKeyRosterReadResult {
  * mismatch. Resolves `null` when the roster does not exist yet (an account
  * provisioned before the roster, or provisioning still in flight); otherwise:
  *
- * 1. **Continuity**: the served epochs must contain the pinned latest-seen
+ * 1. **Provenance** is the store's: a log-governed store resolves the read
+ *    from the roster log's verified head -- entry proofs checked against the
+ *    locally verified did:webvh document, chain-head pin enforced -- so
+ *    every epoch this read can deliver was signed onto the log by an
+ *    enrolled client. (The detached `epochsSig` this step used to verify on
+ *    the adopt path is retired; the entry proof covers every read.)
+ * 2. **Continuity**: the served epochs must contain the pinned latest-seen
  *    epoch, and `currentEpoch` must not precede it in the append-only list
  *    (`UserKeyRosterContinuityError` -- the rollback/replay refusal).
- * 2. **Possession**: `currentEpoch === userKey.id` confirms the cached user key
+ * 3. **Possession**: `currentEpoch === userKey.id` confirms the cached user key
  *    current; otherwise the current epoch was rotated by another client and
  *    this client's wrap is unwrapped with its own key-agreement key
  *    (`UserKeyRosterUnwrapError` when it holds none).
- * 3. **Provenance** (the rotated/first-read path only): the epoch
- *    configuration's `epochsSig` is verified against the locally verified
- *    did:webvh document ({@link verifyUserKeyRosterEpochsSig}) BEFORE the epoch
- *    it delivers is adopted. On this path the `epochsMac` alone proves
- *    nothing against the host -- its key is unwrapped from the served
- *    descriptor itself -- so an epoch no enrolled client signed is refused
- *    (`UserKeyRosterIntegrityError`). The cached-current path needs no signature:
- *    there the MAC is keyed by a secret this client already trusts.
- * 4. **Authentication**: the descriptor's `epochsMac` is verified under the
- *    current epoch's secret (`UserKeyRosterIntegrityError` on any mismatch -- a
- *    fabricated configuration).
  *
  * A rotated read returns the fresh user key; its Ed25519 signing seed does not
  * travel through the roster (the roster wraps the key-agreement secret
@@ -351,10 +314,7 @@ export interface UserKeyRosterReadResult {
  * A caller with no cached user key at all -- a freshly enrolled client making
  * its first post-enrollment read -- omits `userKey` and always takes the unwrap
  * path; the result's `rotated` is then true (the user key was adopted from the
- * roster). Every unwrap-path caller must therefore supply the account document
- * (or a way to resolve it): `document` when it already holds a verified copy,
- * or `resolveDocument` to fetch-and-verify lazily, only when the read actually
- * rotates.
+ * roster).
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -364,19 +324,12 @@ export interface UserKeyRosterReadResult {
  *   (identity) key-agreement key, unwrapping a rotated epoch
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch, when this client has seen the roster before
- * @param [options.document] {RosterRecipientDocument}   the locally verified
- *   did:webvh document, when the caller already holds one
- * @param [options.resolveDocument] {function}   resolves the locally verified
- *   did:webvh document on demand; called only when the read takes the
- *   rotated/first-read path
  * @returns {Promise<UserKeyRosterReadResult | null>}
  */
-export declare function readUserKeyRoster({ store, userKey, clientKeyAgreementKey, pinnedEpochId, document, resolveDocument }: {
+export declare function readUserKeyRoster({ store, userKey, clientKeyAgreementKey, pinnedEpochId }: {
     store: EncryptionDescriptorStore;
     userKey?: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
     pinnedEpochId?: string | null;
-    document?: RosterRecipientDocument;
-    resolveDocument?: () => Promise<RosterRecipientDocument>;
 }): Promise<UserKeyRosterReadResult | null>;
 //# sourceMappingURL=userKeyRoster.d.ts.map

package/dist/keys/userKeyRoster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyRoster.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAQL,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzE;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACV,QAAQ,EACT,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAiDD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzD,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8F1C"}
+{"version":3,"file":"userKeyRoster.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAML,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iBAAiB,CAgBpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCtD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACtB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAUhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAClB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAgDD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACd,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8D1C"}

package/dist/keys/userKeyRoster.js

@@ -1,12 +1,10 @@
-import { addRecipient, epochsSigPayload, initRecipients, ownerRecipient, removeRecipient, unwrapEpochSecret, verifyEpochsMac } from '@interop/was-client/edv';
-import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
-import { base64urlnopad } from '@scure/base';
+import { addRecipient, initRecipients, ownerRecipient, removeRecipient, unwrapEpochSecret } from '@interop/was-client/edv';
 import { clientSigningKeyMultibase } from '../webvh/zcap.js';
 /**
- * Thrown when a served roster fails its client-side authentication: a
- * missing/unsupported/invalid `epochsMac`, or a descriptor whose `currentEpoch`
- * names no epoch in its own list. The server (or whoever can write to it) has
- * produced a configuration no enrolled client authenticated.
+ * Thrown when a served roster fails its client-side consistency checks: a
+ * descriptor whose `currentEpoch` names no epoch in its own list. The server
+ * (or whoever can write to it) has produced a configuration no enrolled
+ * client authenticated.
  */
 export class UserKeyRosterIntegrityError extends Error {
     constructor(message) {
@@ -18,8 +16,7 @@ export class UserKeyRosterIntegrityError extends Error {
  * Thrown when a served roster conflicts with the locally pinned latest-seen
  * epoch -- the epochs list no longer contains the pinned epoch, or
  * `currentEpoch` precedes it in the (append-only) list. A rollback/replay of
- * an older consistent configuration, which a valid `epochsMac` alone cannot
- * catch; refused rather than followed.
+ * an older consistent configuration; refused rather than followed.
  */
 export class UserKeyRosterContinuityError extends Error {
     pinnedEpochId;
@@ -43,85 +40,32 @@ export class UserKeyRosterUnwrapError extends Error {
     }
 }
 /**
- * The `epochsSig` construction this module mints and accepts: version 1,
- * Ed25519 (`EdDSA`), `kid` the signer's public-key multibase (`z6Mk...`) --
- * the same string that names the client's verification method in the
- * did:webvh document.
- */
-const EPOCHS_SIG_V = 1;
-const EPOCHS_SIG_ALG = 'EdDSA';
-/**
- * The roster's epoch-configuration signer: signs each roster write's epoch
- * configuration with this client's own Ed25519 signing key, under a `kid`
- * that is the key's public multibase -- exactly the string enrolled as this
- * client's verification method in the did:webvh document, so a reader
- * resolves the signature against the document rather than anything the
- * roster (or the server) supplies.
+ * The roster's log signer: signs each roster log append with this client's
+ * own Ed25519 signing key, named by its public multibase -- exactly the
+ * string enrolled as this client's verification method in the did:webvh
+ * document, so a reader resolves the entry proof against the document rather
+ * than anything the roster (or the server) supplies. Successor of the retired
+ * `epochsSig` signer under the log design.
  *
  * @param options {object}
  * @param options.keyAgent {ICapabilityAgent}   this client's signing key
  *   agent (the `keyAgent` of `agentsFromSeed`)
- * @returns {EpochsSigner}   the `signEpochs` hook for roster writes
+ * @returns {ResourceLogSigner}   the signer for the log-governed store's
+ *   appends
  */
-export function userKeyRosterEpochsSigner({ keyAgent }) {
-    const kid = clientSigningKeyMultibase({ keyAgent });
+export function userKeyRosterLogSigner({ keyAgent }) {
+    const keyMultibase = clientSigningKeyMultibase({ keyAgent });
     const signer = keyAgent.getSigner();
-    return async function signEpochs({ payload }) {
-        const signature = await signer.sign({ data: payload });
-        return {
-            v: EPOCHS_SIG_V,
-            alg: EPOCHS_SIG_ALG,
-            kid,
-            sig: base64urlnopad.encode(signature)
-        };
+    return {
+        keyMultibase,
+        async sign({ data }) {
+            const signature = await signer.sign({ data });
+            // Re-wrap as a plain Uint8Array: a signer may return a Node Buffer (or
+            // a cross-realm view), which the kernel's strict byte check rejects.
+            return new Uint8Array(signature.buffer, signature.byteOffset, signature.byteLength);
+        }
     };
 }
-/**
- * Verifies a served roster's `epochsSig` against the locally verified
- * did:webvh document -- the root of trust the server cannot mint. The
- * signature must be present and supported, its `kid` must be the public
- * multibase of one of the document's verification methods (an enrolled
- * client's signing key), and it must verify over the canonical
- * epoch-configuration payload. Throws {@link UserKeyRosterIntegrityError}
- * otherwise: a configuration no enrolled client signed.
- *
- * @param options {object}
- * @param options.descriptor {CollectionEncryption}   the served roster
- * @param options.document {RosterRecipientDocument}   the locally verified
- *   did:webvh document (never a server-supplied roster field)
- * @returns {Promise<void>}
- */
-export async function verifyUserKeyRosterEpochsSig({ descriptor, document }) {
-    const epochsSig = descriptor.epochsSig;
-    if (!epochsSig ||
-        epochsSig.v !== EPOCHS_SIG_V ||
-        epochsSig.alg !== EPOCHS_SIG_ALG) {
-        throw new UserKeyRosterIntegrityError('The user key roster carries no supported epoch-configuration signature.');
-    }
-    const backed = (document.verificationMethod ?? []).some(method => method.publicKeyMultibase === epochsSig.kid);
-    if (!backed) {
-        throw new UserKeyRosterIntegrityError('The user key roster epoch configuration is signed by a key the account ' +
-            'document does not back.');
-    }
-    let signature;
-    try {
-        signature = base64urlnopad.decode(epochsSig.sig);
-    }
-    catch {
-        throw new UserKeyRosterIntegrityError('The user key roster epoch-configuration signature is malformed.');
-    }
-    const verifier = new Ed25519VerificationKey({
-        controller: `did:key:${epochsSig.kid}`,
-        publicKeyMultibase: epochsSig.kid
-    }).verifier();
-    const verified = await verifier.verify({
-        data: epochsSigPayload(descriptor),
-        signature
-    });
-    if (!verified) {
-        throw new UserKeyRosterIntegrityError('The user key roster epoch-configuration signature failed verification.');
-    }
-}
 /**
  * A wallet client's roster kid: its key-agreement key's id exactly as
  * `agentsFromSeed` derives it at the client's own logins
@@ -212,12 +156,9 @@ export function userKeyRosterRecipientResolver({ document }) {
  * @param options.userKey {UserKey}   the account's user key
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key -- the roster recipient
- * @param options.signEpochs {EpochsSigner}   this client's epoch-configuration
- *   signer ({@link userKeyRosterEpochsSigner}), so the first configuration is
- *   vouched for by an enrollable key rather than only its own MAC
  * @returns {Promise<CollectionEncryption>}   the roster descriptor
  */
-export async function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKey, signEpochs }) {
+export async function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKey }) {
     const current = await store.read();
     if (current !== null) {
         return current.descriptor;
@@ -225,8 +166,7 @@ export async function ensureUserKeyRoster({ store, userKey, clientKeyAgreementKe
     return initRecipients({
         store,
         recipients: [ownerRecipient({ keyAgreementKey: clientKeyAgreementKey })],
-        epoch: { epochId: userKey.id, secret: userKey.secret },
-        signEpochs
+        epoch: { epochId: userKey.id, secret: userKey.secret }
     });
 }
 /**
@@ -295,18 +235,14 @@ export async function addUserKeyRosterRecipient({ store, recipient, ownerKeyAgre
  *   did:webvh document, AFTER the removal edit
  * @param options.retireRecipientId {string}   the removed recipient's roster
  *   kid
- * @param options.signEpochs {EpochsSigner}   the rotating client's
- *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), vouching for
- *   the fresh epoch so other clients' rotated reads accept it
  * @returns {Promise<CollectionEncryption>}   the rotated roster descriptor
  */
-export async function rotateUserKeyRoster({ store, document, retireRecipientId, signEpochs }) {
+export async function rotateUserKeyRoster({ store, document, retireRecipientId }) {
     return removeRecipient({
         store,
         recipientId: retireRecipientId,
         resolveRecipientKey: userKeyRosterRecipientResolver({ document }),
-        pull: async () => { },
-        signEpochs
+        pull: async () => { }
     });
 }
 /**
@@ -343,14 +279,11 @@ export async function rotateUserKeyRoster({ store, document, retireRecipientId,
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
- * @param options.signEpochs {EpochsSigner}   the converging client's
- *   epoch-configuration signer ({@link userKeyRosterEpochsSigner}), for the
- *   rotation this call may perform
  * @returns {Promise<object>}   whether the roster rotated on this call, the
  *   stale recipient kids found, and the roster descriptor as it now stands
  *   (`null` when the account has no roster yet)
  */
-export async function convergeUserKeyRosterToDocument({ store, document, descriptor, signEpochs }) {
+export async function convergeUserKeyRosterToDocument({ store, document, descriptor }) {
     let roster = descriptor;
     if (!roster) {
         const read = await store.read();
@@ -388,8 +321,7 @@ export async function convergeUserKeyRosterToDocument({ store, document, descrip
     const rotated = await rotateUserKeyRoster({
         store,
         document,
-        retireRecipientId: staleRecipientIds[0],
-        signEpochs
+        retireRecipientId: staleRecipientIds[0]
     });
     return { rotated: true, staleRecipientIds, descriptor: rotated };
 }
@@ -398,24 +330,19 @@ export async function convergeUserKeyRosterToDocument({ store, document, descrip
  * mismatch. Resolves `null` when the roster does not exist yet (an account
  * provisioned before the roster, or provisioning still in flight); otherwise:
  *
- * 1. **Continuity**: the served epochs must contain the pinned latest-seen
+ * 1. **Provenance** is the store's: a log-governed store resolves the read
+ *    from the roster log's verified head -- entry proofs checked against the
+ *    locally verified did:webvh document, chain-head pin enforced -- so
+ *    every epoch this read can deliver was signed onto the log by an
+ *    enrolled client. (The detached `epochsSig` this step used to verify on
+ *    the adopt path is retired; the entry proof covers every read.)
+ * 2. **Continuity**: the served epochs must contain the pinned latest-seen
  *    epoch, and `currentEpoch` must not precede it in the append-only list
  *    (`UserKeyRosterContinuityError` -- the rollback/replay refusal).
- * 2. **Possession**: `currentEpoch === userKey.id` confirms the cached user key
+ * 3. **Possession**: `currentEpoch === userKey.id` confirms the cached user key
  *    current; otherwise the current epoch was rotated by another client and
  *    this client's wrap is unwrapped with its own key-agreement key
  *    (`UserKeyRosterUnwrapError` when it holds none).
- * 3. **Provenance** (the rotated/first-read path only): the epoch
- *    configuration's `epochsSig` is verified against the locally verified
- *    did:webvh document ({@link verifyUserKeyRosterEpochsSig}) BEFORE the epoch
- *    it delivers is adopted. On this path the `epochsMac` alone proves
- *    nothing against the host -- its key is unwrapped from the served
- *    descriptor itself -- so an epoch no enrolled client signed is refused
- *    (`UserKeyRosterIntegrityError`). The cached-current path needs no signature:
- *    there the MAC is keyed by a secret this client already trusts.
- * 4. **Authentication**: the descriptor's `epochsMac` is verified under the
- *    current epoch's secret (`UserKeyRosterIntegrityError` on any mismatch -- a
- *    fabricated configuration).
  *
  * A rotated read returns the fresh user key; its Ed25519 signing seed does not
  * travel through the roster (the roster wraps the key-agreement secret
@@ -424,10 +351,7 @@ export async function convergeUserKeyRosterToDocument({ store, document, descrip
  * A caller with no cached user key at all -- a freshly enrolled client making
  * its first post-enrollment read -- omits `userKey` and always takes the unwrap
  * path; the result's `rotated` is then true (the user key was adopted from the
- * roster). Every unwrap-path caller must therefore supply the account document
- * (or a way to resolve it): `document` when it already holds a verified copy,
- * or `resolveDocument` to fetch-and-verify lazily, only when the read actually
- * rotates.
+ * roster).
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -437,14 +361,9 @@ export async function convergeUserKeyRosterToDocument({ store, document, descrip
  *   (identity) key-agreement key, unwrapping a rotated epoch
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch, when this client has seen the roster before
- * @param [options.document] {RosterRecipientDocument}   the locally verified
- *   did:webvh document, when the caller already holds one
- * @param [options.resolveDocument] {function}   resolves the locally verified
- *   did:webvh document on demand; called only when the read takes the
- *   rotated/first-read path
  * @returns {Promise<UserKeyRosterReadResult | null>}
  */
-export async function readUserKeyRoster({ store, userKey, clientKeyAgreementKey, pinnedEpochId, document, resolveDocument }) {
+export async function readUserKeyRoster({ store, userKey, clientKeyAgreementKey, pinnedEpochId }) {
     const current = await store.read();
     if (current === null) {
         return null;
@@ -463,11 +382,6 @@ export async function readUserKeyRoster({ store, userKey, clientKeyAgreementKey,
             throw new UserKeyRosterContinuityError({ pinnedEpochId });
         }
     }
-    // The epochsMac construction's own version/alg are the caller's to check.
-    const epochsMac = descriptor.epochsMac;
-    if (!epochsMac || epochsMac.v !== 1 || epochsMac.alg !== 'HS256') {
-        throw new UserKeyRosterIntegrityError('The user key roster carries no supported epoch-configuration MAC.');
-    }
     let currentUserKey;
     let rotated;
     if (userKey && descriptor.currentEpoch === userKey.id) {
@@ -475,22 +389,10 @@ export async function readUserKeyRoster({ store, userKey, clientKeyAgreementKey,
         rotated = false;
     }
     else {
-        // Rotated by another client (or this client's first read): before
-        // adopting the delivered epoch, trace it to a root of trust the server
-        // cannot mint -- the epoch configuration must be signed by a key the
-        // locally verified account document backs. The epochsMac below cannot
-        // carry this: on this path its key comes out of the served descriptor
-        // itself.
-        const accountDocument = document ?? (resolveDocument ? await resolveDocument() : undefined);
-        if (!accountDocument) {
-            throw new Error('A user key roster read that adopts an epoch from the roster needs the ' +
-                'account document (pass `document` or `resolveDocument`) to verify ' +
-                'the epoch configuration signature.');
-        }
-        await verifyUserKeyRosterEpochsSig({
-            descriptor,
-            document: accountDocument
-        });
+        // Rotated by another client (or this client's first read): the epoch
+        // being adopted traces to a root of trust the server cannot mint through
+        // the store itself -- a log-governed read only ever resolves to a head
+        // whose entry proofs the locally verified account document backs.
         // Unwrap this client's entry in the current epoch with its own
         // key-agreement key (rotation delivery).
         const entry = descriptor.epochs[currentIndex].recipients.find(recipient => recipient.header.kid === clientKeyAgreementKey.id);
@@ -507,9 +409,6 @@ export async function readUserKeyRoster({ store, userKey, clientKeyAgreementKey,
         currentUserKey = { id: descriptor.currentEpoch, secret };
         rotated = true;
     }
-    if (!(await verifyEpochsMac({ descriptor, epochSecret: currentUserKey.secret }))) {
-        throw new UserKeyRosterIntegrityError('The user key roster epoch configuration failed authentication.');
-    }
     return {
         descriptor,
         userKey: currentUserKey,

package/dist/keys/userKeyRoster.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyRoster.js","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAwDA,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,eAAe,EAIhB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EACL,yBAAyB,EAE1B,MAAM,kBAAkB,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,4EAA4E;YAC1E,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAYD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,cAAc,GAAG,OAAO,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,QAAQ,EAGT;IACC,MAAM,GAAG,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO,KAAK,UAAU,UAAU,CAAC,EAC/B,OAAO,EAGR;QACC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QACtD,OAAO;YACL,CAAC,EAAE,YAAY;YACf,GAAG,EAAE,cAAc;YACnB,GAAG;YACH,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;SACtC,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EACV,QAAQ,EAIT;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IACE,CAAC,SAAS;QACV,SAAS,CAAC,CAAC,KAAK,YAAY;QAC5B,SAAS,CAAC,GAAG,KAAK,cAAc,EAChC,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,yEAAyE,CAC1E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,GAAG,CACtD,CAAA;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAA2B,CACnC,yEAAyE;YACvE,yBAAyB,CAC5B,CAAA;IACH,CAAC;IACD,IAAI,SAAqB,CAAA;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CACnC,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC;QAC1C,UAAU,EAAE,WAAW,SAAS,CAAC,GAAG,EAAE;QACtC,kBAAkB,EAAE,SAAS,CAAC,GAAG;KAClC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACb,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC;QAClC,SAAS;KACV,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CACnC,wEAAwE,CACzE,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,QAAQ,EAGT;IACC,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwD,CAAA;IAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,mBAAmB,GAGpB,EAAE,CAAA;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC5B,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CACjD,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,UAAU,EAMX;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACtD,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,UAAU,EAMX;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC;QACjE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACpB,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EAMX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACxE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,0EAA0E;YACxE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;QACxC,UAAU;KACX,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,QAAQ,EACR,eAAe,EAQhB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IAErC,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,IAAI,cAAuB,CAAA;IAC3B,IAAI,OAAgB,CAAA;IACpB,IAAI,OAAO,IAAI,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtD,cAAc,GAAG,OAAO,CAAA;QACxB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,UAAU;QACV,MAAM,eAAe,GACnB,QAAQ,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACrE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,oEAAoE;gBACpE,oCAAoC,CACvC,CAAA;QACH,CAAC;QACD,MAAM,4BAA4B,CAAC;YACjC,UAAU;YACV,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAA;QAEF,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,oEAAoE,CACrE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,cAAc,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACzD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IACE,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,gEAAgE,CACjE,CAAA;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE,cAAc;QACvB,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"userKeyRoster.js","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAmDA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EAGlB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,yBAAyB,EAE1B,MAAM,kBAAkB,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,4EAA4E;YAC1E,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,EAGT;IACC,MAAM,YAAY,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAwB;YACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7C,uEAAuE;YACvE,qEAAqE;YACrE,OAAO,IAAI,UAAU,CACnB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CACrB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,QAAQ,EAGT;IACC,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwD,CAAA;IAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,mBAAmB,GAGpB,EAAE,CAAA;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC5B,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CACjD,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EAKtB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACvD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAKlB;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC;QACjE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EAKX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACxE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,0EAA0E;YACxE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;KACzC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EAMd;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IAErC,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,cAAuB,CAAA;IAC3B,IAAI,OAAgB,CAAA;IACpB,IAAI,OAAO,IAAI,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtD,cAAc,GAAG,OAAO,CAAA;QACxB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,oEAAoE,CACrE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,cAAc,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACzD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE,cAAc;QACvB,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}