@interop/wallet-core 0.41.0 → 0.42.0

package/dist/unlock/unlockRecord.js

@@ -0,0 +1,435 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unlock record codec for credentials with standing authority: the
+ * envelope stored as the one resource of a credential's unlock Space, for
+ * every unlock method in the standing posture -- a passphrase, a passkey PRF
+ * output, or a recovery code. Its frame is the ordinary keyring record's
+ * (`{ version, encryption, wrapped, proof }`), extended with three
+ * record-kind members the proof also covers:
+ *
+ * - `wrapped` (the SHELL): the account core -- controller, optional email,
+ *   pointer, bind timestamp -- sealed to the credential's unlock KAK. Carried
+ *   VERBATIM through every re-mint, so the bind timestamp (which apps pin
+ *   freshness on) and the email survive a re-mint that cannot decrypt them.
+ * - `bridge`: the pre-minted PUT-on-`did.jsonl` delegation, sealed in its own
+ *   self-contained `{ encryption, wrapped }` member. The one member a re-mint
+ *   replaces: revoking the client that signed the delegation rots it, and the
+ *   revocation cascade re-seals a fresh one to the credential's unlock KAK
+ *   public half ({@link remintUnlockRecordBridge}).
+ * - `ladder` (standing credentials only): the random 32-byte update-key
+ *   ladder seed (`./ladder`), sealed in its own `{ encryption, wrapped }`
+ *   member and carried VERBATIM through re-mints -- a re-mint can never read
+ *   or replace a credential's update authority. A recovery code carries none
+ *   (its single update key derives from the code bytes).
+ *
+ * The record splits into a credential-authenticated core and a re-mintable
+ * shell exactly as the recovery record did. The core is the account binding
+ * plus the ladder seed, authenticated by the `binding` frame member: an HMAC
+ * tag under a key derived from the credential itself, computed at bind time
+ * and verified BEFORE the pointer is trusted. Only the binder and the
+ * credential holder ever hold that key -- the storage host never does -- so a
+ * host-forged record redirecting login (or a host-substituted ladder seed)
+ * fails the tag however it is encrypted or signed. The tag rides the frame in
+ * the clear (it reveals nothing), so the re-mint path, which cannot decrypt
+ * the record or recompute the tag, preserves it verbatim. The consequence: a
+ * re-mint can never move the record to another account, and an account that
+ * moves hosts must rebind its credentials.
+ *
+ * The shell's signer is mixed, as before: at bind time the record is signed
+ * by the credential-derived unlock key (verified before decryption); a
+ * re-mint signs with the acting client's account verification method, which
+ * comes back as a pending proof state the caller settles against the account
+ * document the credential-authenticated pointer names.
+ */
+import { base64urlnopad } from '@scure/base';
+import { equalBytes } from '@noble/ciphers/utils.js';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, recordProofKeyMultibase, recordSealCipher, signRecordFrame, verifyRecordProof } from '../keyring/record.js';
+import { LADDER_SEED_BYTES } from './ladder.js';
+/**
+ * The context label mixed into the binding MAC input, versioning the tag
+ * construction. Permanent -- changing it orphans every bound credential.
+ * Supersedes the recovery record's `freewallet/recovery/binding/v1` (the
+ * standing layout is a re-provision boundary; issued codes are re-issued).
+ */
+const UNLOCK_BINDING_CONTEXT = 'freewallet/unlock/binding/v2';
+/**
+ * An unlock record's account binding is absent, malformed, or does not verify
+ * under the credential's binding MAC key. Its own class, distinct from a
+ * proof or decrypt failure: this is the refusal that says the record's
+ * account core (and ladder seed, where one rides) was not written by a holder
+ * of this credential -- a forged record redirecting login at another account,
+ * or a record from before the account moved hosts (either way the credential
+ * must be rebound).
+ */
+export class UnlockBindingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnlockBindingError';
+    }
+}
+/**
+ * The deterministic MAC input over a record's credential-authenticated core:
+ * a JSON array of the context label, the binding values, and the ladder seed
+ * (base64url, empty for a credential that carries none), so no delimiter
+ * ambiguity can make two cores collide.
+ */
+function bindingMacInput({ controller, pointer, ladderSeed }) {
+    return new TextEncoder().encode(JSON.stringify([
+        UNLOCK_BINDING_CONTEXT,
+        controller,
+        pointer.did ?? '',
+        pointer.spaceId,
+        pointer.host,
+        ladderSeed ? base64urlnopad.encode(ladderSeed) : ''
+    ]));
+}
+/**
+ * Computes the account-binding tag: HMAC-SHA-256 over the core values under
+ * the credential-derived binding MAC key, base64url (no pad). Bind time calls
+ * it to stamp the record; login recomputes it to verify.
+ *
+ * @param options {object}
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived MAC key
+ * @param options.controller {string}   the account controller
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param [options.ladderSeed] {Uint8Array}   the ladder seed, for a standing
+ *   credential
+ * @returns {string}
+ */
+export function computeUnlockBinding({ bindingMacKey, controller, pointer, ladderSeed }) {
+    return base64urlnopad.encode(hmac(sha256, bindingMacKey, bindingMacInput({
+        controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    })));
+}
+/**
+ * Reads the `binding` frame member off a stored unlock record without
+ * decrypting anything. The re-mint path uses it to confirm the record is
+ * re-mintable before touching it. Refuses a record with no binding: such a
+ * record predates the credential-authenticated core and cannot be re-minted
+ * -- its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @returns {string}
+ */
+export function unlockRecordBinding({ record }) {
+    const { binding } = (record ?? {});
+    if (typeof binding !== 'string' || !binding) {
+        throw new UnlockBindingError('The unlock record carries no credential-authenticated account ' +
+            'binding; the credential must be rebound.');
+    }
+    return binding;
+}
+/**
+ * Shape-checks a sealed record member (`{ encryption, wrapped }`).
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the frame member
+ * @param options.name {string}   names the member in the refusal
+ * @returns {SealedRecordMember}
+ */
+function parseSealedMember({ value, name }) {
+    const member = value;
+    if (member === null ||
+        typeof member !== 'object' ||
+        member.encryption === null ||
+        typeof member.encryption !== 'object' ||
+        member.wrapped === undefined ||
+        member.wrapped === null) {
+        throw new Error(`The unlock record's ${name} member is malformed.`);
+    }
+    return member;
+}
+/**
+ * Seals one self-contained record member to a KAK: a fresh one-epoch
+ * descriptor plus the envelope. Sealing needs no key-agreement secret, which
+ * is what lets the re-mint path (holding only the credential's unlock KAK
+ * public half) build a fresh bridge member.
+ *
+ * @param options {object}
+ * @param options.data {object}   the member plaintext
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK (public half suffices)
+ * @returns {Promise<SealedRecordMember>}
+ */
+async function sealMember({ data, keyAgreementKey }) {
+    const encryption = await mintRecordEncryption({ keyAgreementKey });
+    const cipher = await recordSealCipher({ encryption });
+    const { envelope } = await cipher.encrypt({
+        data: data
+    });
+    return { encryption, wrapped: envelope };
+}
+/**
+ * Opens one self-contained record member with the credential's unlock KAK.
+ *
+ * @param options {object}
+ * @param options.member {SealedRecordMember}
+ * @param options.keyAgreementKey {IKeyAgreementKey}
+ * @param options.keyResolver {IKeyResolver}
+ * @returns {Promise<unknown>}   the member plaintext
+ */
+async function openMember({ member, keyAgreementKey, keyResolver }) {
+    const cipher = await recordCipher({
+        keyAgreementKey,
+        keyResolver,
+        encryption: member.encryption
+    });
+    return cipher.decrypt({ envelope: member.wrapped });
+}
+/**
+ * Wraps an unlock record at bind time: the shell (controller, optional
+ * email, pointer, timestamp) sealed to the credential's unlock KAK, the
+ * bridge delegation and the optional ladder seed sealed as their own
+ * members, the credential-authenticated binding computed over the core, and
+ * the whole frame signed -- by the credential-derived unlock key at bind
+ * time, or by an acting client's account key where a ceremony rebuilds a
+ * record whole (the reader settles the mixed-signer policy either way).
+ *
+ * @param options {object}
+ * @param options.controller {string}   the account controller
+ * @param [options.email] {string}   the account email, when known
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param options.delegation {IZcap}   the PUT-on-`did.jsonl` delegation to
+ *   the credential-derived signing DID
+ * @param [options.ladderSeed] {Uint8Array}   the update-key ladder seed, for
+ *   a standing credential (a recovery code carries none)
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK -- its public half is all the wrap uses
+ * @param options.signer {RecordSigner}   the signing key
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key
+ * @param [options.createdAt] {string}   the bind timestamp to stamp, as an
+ *   ISO string; defaults to now. Supplied by a caller that pins record
+ *   freshness.
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export async function wrapUnlockRecord({ controller, email, pointer, delegation, ladderSeed, keyAgreementKey, signer, bindingMacKey, createdAt }) {
+    if (ladderSeed && ladderSeed.length !== LADDER_SEED_BYTES) {
+        throw new Error('The ladder seed must be 32 bytes.');
+    }
+    const binding = computeUnlockBinding({
+        bindingMacKey,
+        controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    });
+    const shell = await sealMember({
+        data: {
+            controller,
+            ...(email ? { email } : {}),
+            pointer: {
+                ...(pointer.did ? { did: pointer.did } : {}),
+                spaceId: pointer.spaceId,
+                host: pointer.host
+            },
+            createdAt: recordCreatedAtStamp({ createdAt })
+        },
+        keyAgreementKey
+    });
+    const bridge = await sealMember({ data: { delegation }, keyAgreementKey });
+    const ladder = ladderSeed
+        ? await sealMember({
+            data: { ladderSeed: base64urlnopad.encode(ladderSeed) },
+            keyAgreementKey
+        })
+        : undefined;
+    return (await signRecordFrame({
+        version: KEYRING_RECORD_VERSION,
+        encryption: shell.encryption,
+        wrapped: shell.wrapped,
+        signer,
+        members: { binding, bridge, ...(ladder ? { ladder } : {}) }
+    }));
+}
+/**
+ * Unwraps and validates an unlock record: the ordinary keyring-record frame
+ * checks plus the required pointer, bridge delegation, and
+ * credential-authenticated binding. A record without a bridge member is not
+ * an unlock record in the standing layout (an ordinary keyring record found
+ * under a credential's unlock Space would mean a torn bind) and is refused.
+ *
+ * The binding is verified before the contents are returned: the decrypted
+ * core must carry the tag the credential-derived MAC key computes over it, or
+ * the record is refused as forged ({@link UnlockBindingError}) -- the check
+ * that closes the host-forgery redirect, since the host never holds the MAC
+ * key. Nothing downstream may trust the pointer (or the ladder seed) before
+ * this returns.
+ *
+ * Proof verification is mixed-signer and ordered deliberately, exactly as the
+ * recovery record's was: a proof by the credential's own unlock key is
+ * verified BEFORE decryption; a proof by any other key comes back as a
+ * pending state naming the signer, for the caller to settle with
+ * `verifyRecordProof` against the verified document of the account the
+ * credential-authenticated pointer names.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.expectedKeyMultibase {string}   the credential-derived
+ *   unlock signing key's multibase
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key the record's account binding must verify under
+ * @returns {Promise<{ contents: UnlockRecordContents,
+ *   proofState: UnlockRecordProofState }>}
+ */
+export async function unwrapUnlockRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase, bindingMacKey }) {
+    const { encryption, wrapped, proof } = parseRecordFrame({
+        record,
+        label: 'unlock'
+    });
+    const binding = unlockRecordBinding({ record });
+    const { bridge: rawBridge, ladder: rawLadder } = record;
+    if (rawBridge === undefined) {
+        throw new Error('The unlock record carries no bridge member; it predates the standing ' +
+            'layout and the credential must be rebound.');
+    }
+    const bridge = parseSealedMember({ value: rawBridge, name: 'bridge' });
+    const ladder = rawLadder === undefined
+        ? undefined
+        : parseSealedMember({ value: rawLadder, name: 'ladder' });
+    // `parseRecordFrame` shape-checks the proof of a current-version frame, so
+    // it is present here.
+    const verificationMethod = proof.verificationMethod;
+    const keyMultibase = recordProofKeyMultibase({
+        verificationMethod,
+        label: 'unlock'
+    });
+    let proofState = {
+        pending: { verificationMethod, keyMultibase }
+    };
+    if (keyMultibase === expectedKeyMultibase) {
+        await verifyRecordProof({
+            record,
+            allowedKeyMultibases: expectedKeyMultibase,
+            label: 'unlock'
+        });
+        proofState = 'verified';
+    }
+    const shell = (await openMember({
+        member: { encryption, wrapped },
+        keyAgreementKey,
+        keyResolver
+    }));
+    if (typeof shell.controller !== 'string' || !shell.controller) {
+        throw new Error('Unlock record is missing a controller.');
+    }
+    const pointer = parseRecordPointer(shell.pointer);
+    if (!pointer) {
+        throw new Error('Unlock record is missing its account pointer.');
+    }
+    const createdAt = parseRecordCreatedAt({
+        value: shell.createdAt,
+        label: 'Unlock'
+    });
+    const bridgePlaintext = (await openMember({
+        member: bridge,
+        keyAgreementKey,
+        keyResolver
+    }));
+    if (bridgePlaintext.delegation === null ||
+        typeof bridgePlaintext.delegation !== 'object') {
+        throw new Error('Unlock record is missing its did.jsonl delegation.');
+    }
+    let ladderSeed;
+    if (ladder) {
+        const ladderPlaintext = (await openMember({
+            member: ladder,
+            keyAgreementKey,
+            keyResolver
+        }));
+        if (typeof ladderPlaintext.ladderSeed !== 'string') {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+        try {
+            ladderSeed = base64urlnopad.decode(ladderPlaintext.ladderSeed);
+        }
+        catch {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+        if (ladderSeed.length !== LADDER_SEED_BYTES) {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+    }
+    const expectedTag = hmac(sha256, bindingMacKey, bindingMacInput({
+        controller: shell.controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    }));
+    let servedTag;
+    try {
+        servedTag = base64urlnopad.decode(binding);
+    }
+    catch {
+        servedTag = null;
+    }
+    // `equalBytes` is @noble/ciphers' authentication-tag comparison (no early
+    // exit), so the check leaks nothing through timing.
+    if (servedTag === null || !equalBytes(servedTag, expectedTag)) {
+        throw new UnlockBindingError("The unlock record's account binding does not verify under this " +
+            'credential; the record is refused as forged.');
+    }
+    return {
+        contents: {
+            controller: shell.controller,
+            ...(typeof shell.email === 'string' && shell.email
+                ? { email: shell.email }
+                : {}),
+            pointer,
+            delegation: bridgePlaintext.delegation,
+            ...(ladderSeed ? { ladderSeed } : {}),
+            createdAt
+        },
+        proofState
+    };
+}
+/**
+ * Re-mints an unlock record's bridge: the revocation-cascade path that
+ * replaces a rotted or expiring delegation while touching nothing else. The
+ * shell, the ladder member, and the binding are carried VERBATIM (the re-mint
+ * cannot decrypt any of them and does not need to -- each is self-contained
+ * and the binding covers the core), a fresh bridge is sealed to the
+ * credential's unlock KAK public half, and the frame is re-signed by the
+ * acting client's account key -- the mixed-signer case the reader settles
+ * against the verified document.
+ *
+ * A record with no binding cannot be re-minted ({@link UnlockBindingError});
+ * its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the standing stored record
+ * @param options.delegation {IZcap}   the freshly minted `did.jsonl`
+ *   delegation
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK, public half only
+ * @param options.signer {RecordSigner}   the acting client's account key
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export async function remintUnlockRecordBridge({ record, delegation, keyAgreementKey, signer }) {
+    const { encryption, wrapped } = parseRecordFrame({
+        record,
+        label: 'unlock'
+    });
+    const binding = unlockRecordBinding({ record });
+    const { ladder: rawLadder } = record;
+    const ladder = rawLadder === undefined
+        ? undefined
+        : parseSealedMember({ value: rawLadder, name: 'ladder' });
+    const bridge = await sealMember({ data: { delegation }, keyAgreementKey });
+    return (await signRecordFrame({
+        version: KEYRING_RECORD_VERSION,
+        encryption,
+        wrapped,
+        signer,
+        members: { binding, bridge, ...(ladder ? { ladder } : {}) }
+    }));
+}
+//# sourceMappingURL=unlockRecord.js.map

package/dist/unlock/unlockRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlockRecord.js","sourceRoot":"","sources":["../../src/unlock/unlockRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAO9C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAE7D;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAmDD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,EACvB,UAAU,EACV,OAAO,EACP,UAAU,EAKX;IACC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,IAAI,CAAC,SAAS,CAAC;QACb,sBAAsB;QACtB,UAAU;QACV,OAAO,CAAC,GAAG,IAAI,EAAE;QACjB,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,IAAI;QACZ,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;KACpD,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,OAAO,cAAc,CAAC,MAAM,CAC1B,IAAI,CACF,MAAM,EACN,aAAa,EACb,eAAe,CAAC;QACd,UAAU;QACV,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CACH,CACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,EAAuB;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAA0B,CAAA;IAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE;YAC9D,0CAA0C,CAC7C,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,EACzB,KAAK,EACL,IAAI,EAIL;IACC,MAAM,MAAM,GAAG,KAA2C,CAAA;IAC1D,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,UAAU,KAAK,IAAI;QAC1B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,MAA4B,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,eAAe,EAIhB;IACC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE,IAA+D;KACtE,CAAC,CAAA;IACF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,MAAM,EACN,eAAe,EACf,WAAW,EAKZ;IACC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAgB,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,SAAS,EAWV;IACC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,aAAa;QACb,UAAU;QACV,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;QAC7B,IAAI,EAAE;YACJ,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB;YACD,SAAS,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC;SAC/C;QACD,eAAe;KAChB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YACvD,eAAe;SAChB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,OAAO,CAAC,MAAM,eAAe,CAAC;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAuB,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EAOd;IAIC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC;QACtD,MAAM;QACN,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAGhD,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4CAA4C,CAC/C,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtE,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE7D,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,kBAAkB,GAAG,KAAM,CAAC,kBAAkB,CAAA;IACpD,MAAM,YAAY,GAAG,uBAAuB,CAAC;QAC3C,kBAAkB;QAClB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,IAAI,UAAU,GAA2B;QACvC,OAAO,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE;KAC9C,CAAA;IACD,IAAI,YAAY,KAAK,oBAAoB,EAAE,CAAC;QAC1C,MAAM,iBAAiB,CAAC;YACtB,MAAM;YACN,oBAAoB,EAAE,oBAAoB;YAC1C,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QACF,UAAU,GAAG,UAAU,CAAA;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC;QAC9B,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;QAC/B,eAAe;QACf,WAAW;KACZ,CAAC,CAKD,CAAA;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,CAAC;QACxC,MAAM,EAAE,MAAM;QACd,eAAe;QACf,WAAW;KACZ,CAAC,CAA6B,CAAA;IAC/B,IACE,eAAe,CAAC,UAAU,KAAK,IAAI;QACnC,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAkC,CAAA;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,CAAC;YACxC,MAAM,EAAE,MAAM;YACd,eAAe;YACf,WAAW;SACZ,CAAC,CAA6B,CAAA;QAC/B,IAAI,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC;YACH,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,EACN,aAAa,EACb,eAAe,CAAC;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CACH,CAAA;IACD,IAAI,SAA4B,CAAA;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAA;IAClB,CAAC;IACD,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,iEAAiE;YAC/D,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE;YACR,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK;gBAChD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACxB,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;YACP,UAAU,EAAE,eAAe,CAAC,UAAmB;YAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,SAAS;SACV;QACD,UAAU;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,MAAM,EACN,UAAU,EACV,eAAe,EACf,MAAM,EAMP;IACC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC;QAC/C,MAAM;QACN,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAA8B,CAAA;IAC5D,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1E,OAAO,CAAC,MAAM,eAAe,CAAC;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,UAAU;QACV,OAAO;QACP,MAAM;QACN,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAuB,CAAA;AAC3B,CAAC"}

package/dist/webvh/didWebvh.d.ts

@@ -64,6 +64,23 @@ export interface WebvhIdStore {
  * it.
  */
 export declare const MULTIKEY_VM_TYPE = "Multikey";
+/**
+ * The verification-method type a hash commitment to a key-agreement key is
+ * published under, in place of the key itself
+ * ({@link keyAgreementCommitment}). It carries `publicKeyCommitment` rather
+ * than `publicKeyMultibase`, so a reader keying on `Multikey` never mispairs
+ * a commitment with real key material. Wire-level and permanent.
+ */
+export declare const MULTIKEY_COMMITMENT_VM_TYPE = "MultikeyCommitment";
+/**
+ * The context URL defining the `MultikeyCommitment` and `publicKeyCommitment`
+ * terms. Every account document carries it, so a commitment verification
+ * method is a defined term rather than a bare JSON property. The value is
+ * byoe-context's `VOCAB_CONTEXT_URL` (`https://w3id.org/byoe/v1`) -- the
+ * package whose contexts map backs the bundled document loader -- so the URL
+ * written into document bytes can never drift from the loader's coverage.
+ */
+export declare const BYOE_CONTEXT_URL = "https://w3id.org/byoe/v1";
 /**
  * The client-held did:webvh update-key material: 32-byte Ed25519 seeds.
  * `pendingStagedSeed` is present only mid-rotation (minted and persisted
@@ -125,6 +142,65 @@ export declare function clientKeyAgreementController({ signingKeyMultibase }: {
 export declare function keyAgreementTwinMultibase({ signingKeyMultibase }: {
     signingKeyMultibase: string;
 }): string;
+/**
+ * The hash commitment of a key-agreement key, as a document publishes it in
+ * place of the key itself for a low-entropy-derived standing unlock
+ * credential (the `MultikeyCommitment` verification-method convention): a
+ * bare multihash -- sha2-256 over the key's DECODED multikey bytes -- encoded
+ * base64url-no-pad, with no multibase prefix. The multihash header keeps the
+ * algorithm self-describing, so a verifier decodes rather than re-encodes.
+ * Deliberately independent of the `nextKeyHashes` rule, which keeps its own
+ * base58btc encoding.
+ *
+ * What the commitment provides is the document-anchored integrity check the
+ * roster's recipient resolver runs against a roster-carried key, plus
+ * non-disclosure of the key material itself. It does not reduce offline
+ * guessing exposure: under a fixed KDF salt a commitment costs one extra
+ * sha256 per guess, so that exposure belongs to the standing-credential model
+ * and its KDF choice rather than to this encoding. Wire-level and permanent.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKeyMultibase {string}
+ * @returns {Promise<string>}
+ */
+export declare function keyAgreementCommitment({ keyAgreementKeyMultibase }: {
+    keyAgreementKeyMultibase: string;
+}): Promise<string>;
+/**
+ * Whether a candidate key-agreement key is the one a published commitment
+ * commits to. Verification DECODES: the commitment's multihash header names
+ * the algorithm, the candidate's decoded multikey bytes are hashed with it,
+ * and the digests are compared -- so a future algorithm is an additive change
+ * rather than a format change. A commitment that does not decode, or names an
+ * algorithm with no implementation here, simply does not match.
+ *
+ * @param options {object}
+ * @param options.commitment {string}   a published `publicKeyCommitment`
+ * @param options.keyAgreementKeyMultibase {string}   the candidate key
+ * @returns {boolean}
+ */
+export declare function commitmentMatchesKey({ commitment, keyAgreementKeyMultibase }: {
+    commitment: string;
+    keyAgreementKeyMultibase: string;
+}): boolean;
+/**
+ * A pre-decoded matcher over a SET of published commitments, for a caller
+ * that checks many candidate keys against the same document (the user key
+ * roster's recipient resolver). Each commitment is decoded once up front --
+ * duplicates collapsed, one that does not decode or names an algorithm with
+ * no implementation here dropped, the {@link commitmentMatchesKey} non-match
+ * contract -- and each candidate is hashed once per call, so resolving N
+ * roster entries against K commitments costs N hashes rather than N*K
+ * decode-and-hash passes.
+ *
+ * @param options {object}
+ * @param options.commitments {string[]}   the published `publicKeyCommitment`
+ *   values
+ * @returns {function}   `(keyAgreementKeyMultibase: string) => boolean`
+ */
+export declare function commitmentMatcher({ commitments }: {
+    commitments: string[];
+}): (keyAgreementKeyMultibase: string) => boolean;
 /**
  * The one builder of a client's published verification-method pair: the
  * account-controlled Ed25519 signing method first, then the X25519
@@ -376,13 +452,16 @@ export interface PublishedWebvhLog {
  * @param options.idStore {WebvhIdStore}
  * @param [options.expectedDid] {string}   the DID the log must resolve to
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins for the account log
+ * @param [options.logId] {string}   the account log's pin-slot key, from
+ *   `accountLogPinId({ spaceId })`; required whenever a `pinStore` is supplied
  * @returns {Promise<PublishedWebvhLog | undefined>}
  */
-export declare function readPublishedLog({ idStore, expectedDid, pinStore }: {
+export declare function readPublishedLog({ idStore, expectedDid, pinStore, logId }: {
     idStore: WebvhIdStore;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<PublishedWebvhLog | undefined>;
 /**
  * The shared tail of every ceremony path that has nothing left to append to
@@ -478,7 +557,8 @@ export declare function effectiveParameters(log: DIDLog): Array<{
  * @param [options.expectedDid] {string}   the DID the published log must
  *   resolve to, when the caller holds the account pointer
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins; the account log's slot is keyed by `accountLogPinId` over the
+ *   `spaceId` above
  * @returns {Promise<{ did: string }>}
  */
 export declare function ensureDidWebvh(options: {
@@ -535,7 +615,10 @@ export declare function ensureDidWebvh(options: {
  * @param [options.expectedDid] {string}   the DID the published log must
  *   resolve to
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins for the account log
+ * @param [options.logId] {string}   the account log's pin-slot key, built by
+ *   the caller with `accountLogPinId({ spaceId })`; required whenever a
+ *   `pinStore` is supplied
  * @returns {Promise<{ did: string }>}
  */
 export declare function rotateWebvhUpdateKey(options: {
@@ -544,6 +627,7 @@ export declare function rotateWebvhUpdateKey(options: {
     persistUpdateKeys: (next: ClientWebvhUpdateKeys) => Promise<void>;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<{
     did: string;
 }>;
@@ -658,13 +742,17 @@ export declare function enrollWebvhClient(options: {
  * @param [options.expectedDid] {string}   the DID the published log must
  *   resolve to
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins for the account log
+ * @param [options.logId] {string}   the account log's pin-slot key, built by
+ *   the caller with `accountLogPinId({ spaceId })`; required whenever a
+ *   `pinStore` is supplied
  * @returns {Promise<DidWebKeyMapV2>}   the rebuilt, persisted keys.json
  */
-export declare function repairKeyBindings({ keystoreAgent, idStore, expectedDid, pinStore }: {
+export declare function repairKeyBindings({ keystoreAgent, idStore, expectedDid, pinStore, logId }: {
     keystoreAgent: KeystoreAgent;
     idStore: WebvhIdStore;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<DidWebKeyMapV2>;
 //# sourceMappingURL=didWebvh.d.ts.map

package/dist/webvh/didWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"didWebvh.d.ts","sourceRoot":"","sources":["../../src/webvh/didWebvh.ts"],"names":[],"mappings":"AA4EA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAO3D,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAa,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,OAAO,EAAE;QACxB,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACxD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAO1C;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,mBAAmB,EACpB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;CAC5B,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,mBAAmB,EACpB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;CAC5B,GAAG,MAAM,CAGT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,UAAU,EACV,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,kBAAkB,EAAE,CAyBvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG;IAAE,KAAK,CAAC,EAAE,aAAa,CAAA;CAAE,CAAA;AAErE;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,YAAY,EACZ,OAAO,EACR,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,MAAM,CAGT;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAKhF;AAWD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,EACpC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBlB;AA2JD;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAE5C,OAAO,SACkE,EACzE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EACP,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,GAAG,EACH,MAAM,EACN,OAAO,EACP,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,OAAO,EACP,OAAO,EACR,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAyBD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,OAAO,EACP,WAAW,EACX,QAAQ,EACT,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CA8CzC;AAeD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,OAAO,EACP,SAAS,EACV,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,SAAS,EAAE,iBAAiB,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAc1D;AA6DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,YAAY,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,UAAU,EAAE,eAAe,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAgHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAmID;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,SAAS,EACV,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,kBAAkB,EAAE,MAAM,CAAA;IAC1B,wBAAwB,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACpD,MAAM,EAAE,CASV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAqJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,aAAa,EACb,OAAO,EACP,WAAW,EACX,QAAQ,EACT,EAAE;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0F1B"}
+{"version":3,"file":"didWebvh.d.ts","sourceRoot":"","sources":["../../src/webvh/didWebvh.ts"],"names":[],"mappings":"AA4EA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAUlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAW3D,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAa,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,OAAO,EAAE;QACxB,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACxD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAA;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,6BAAoB,CAAA;AAOjD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,mBAAmB,EACpB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;CAC5B,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,mBAAmB,EACpB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;CAC5B,GAAG,MAAM,CAGT;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,wBAAwB,EACzB,EAAE;IACD,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,wBAAwB,EACzB,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,OAAO,CAIV;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACZ,EAAE;IACD,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB,GAAG,CAAC,wBAAwB,EAAE,MAAM,KAAK,OAAO,CA4BhD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,UAAU,EACV,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,kBAAkB,EAAE,CAyBvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG;IAAE,KAAK,CAAC,EAAE,aAAa,CAAA;CAAE,CAAA;AAErE;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,YAAY,EACZ,OAAO,EACR,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,MAAM,CAGT;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAKhF;AAWD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,EACpC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBlB;AA4JD;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAE5C,OAAO,SACkE,EACzE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EACP,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,GAAG,EACH,MAAM,EACN,OAAO,EACP,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,OAAO,EACP,OAAO,EACR,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAyBD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,OAAO,EACP,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAoDzC;AAeD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,OAAO,EACP,SAAS,EACV,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,SAAS,EAAE,iBAAiB,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAOxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAc1D;AA6DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,YAAY,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,UAAU,EAAE,eAAe,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAiHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAwID;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,SAAS,EACV,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,kBAAkB,EAAE,MAAM,CAAA;IAC1B,wBAAwB,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACpD,MAAM,EAAE,CASV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAqJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,aAAa,EACb,OAAO,EACP,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CA6F1B"}