@interop/wallet-core 0.41.0 → 0.43.0

package/dist/unlock/unlockRecord.d.ts

@@ -0,0 +1,207 @@
+import type { IKeyAgreementKey, IKeyResolver, IZcap } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import type { AccountPointer, RecordSigner, SignedRecord } from '../keyring/record.js';
+/**
+ * An unlock record's account binding is absent, malformed, or does not verify
+ * under the credential's binding MAC key. Its own class, distinct from a
+ * proof or decrypt failure: this is the refusal that says the record's
+ * account core (and ladder seed, where one rides) was not written by a holder
+ * of this credential -- a forged record redirecting login at another account,
+ * or a record from before the account moved hosts (either way the credential
+ * must be rebound).
+ */
+export declare class UnlockBindingError extends Error {
+    constructor(message: string);
+}
+/**
+ * A self-contained sealed record member: its own one-epoch descriptor plus
+ * the envelope sealed under it. Self-containment is what lets a member travel
+ * VERBATIM through a re-mint that re-seals its siblings -- each member
+ * decrypts against its own descriptor, not the frame's.
+ */
+export interface SealedRecordMember {
+    encryption: CollectionEncryption;
+    wrapped: unknown;
+}
+/**
+ * The unwrapped contents of an unlock record: the credential-authenticated
+ * account core (controller + pointer, plus the ladder seed where the
+ * credential is a standing method), the bridge delegation, the optional bind
+ * email, and the bind timestamp. `pointer` is required -- the record exists
+ * only on WAS deployments.
+ */
+export interface UnlockRecordContents {
+    controller: string;
+    email?: string;
+    pointer: AccountPointer;
+    delegation: IZcap;
+    ladderSeed?: Uint8Array;
+    createdAt: string;
+}
+/**
+ * A stored unlock record: the shared signed frame plus the record-kind
+ * members the frame proof also covers.
+ */
+export interface SignedUnlockRecord extends SignedRecord {
+    binding: string;
+    bridge: SealedRecordMember;
+    ladder?: SealedRecordMember;
+}
+/**
+ * Where an unlock record's proof stands after the unwrap: `'verified'` when
+ * the credential-derived unlock key signed it (checked before decryption), or
+ * a pending marker naming the signer the caller must still check against the
+ * account's verified did:webvh document -- the re-mint case, where an
+ * enrolled client signed on the credential's behalf. The pending case defers
+ * the shell's authenticity only, never the account identity: the binding is
+ * verified either way.
+ */
+export type UnlockRecordProofState = 'verified' | {
+    pending: {
+        verificationMethod: string;
+        keyMultibase: string;
+    };
+};
+/**
+ * Computes the account-binding tag: HMAC-SHA-256 over the core values under
+ * the credential-derived binding MAC key, base64url (no pad). Bind time calls
+ * it to stamp the record; login recomputes it to verify.
+ *
+ * @param options {object}
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived MAC key
+ * @param options.controller {string}   the account controller
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param [options.ladderSeed] {Uint8Array}   the ladder seed, for a standing
+ *   credential
+ * @returns {string}
+ */
+export declare function computeUnlockBinding({ bindingMacKey, controller, pointer, ladderSeed }: {
+    bindingMacKey: Uint8Array;
+    controller: string;
+    pointer: AccountPointer;
+    ladderSeed?: Uint8Array;
+}): string;
+/**
+ * Reads the `binding` frame member off a stored unlock record without
+ * decrypting anything. The re-mint path uses it to confirm the record is
+ * re-mintable before touching it. Refuses a record with no binding: such a
+ * record predates the credential-authenticated core and cannot be re-minted
+ * -- its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @returns {string}
+ */
+export declare function unlockRecordBinding({ record }: {
+    record: unknown;
+}): string;
+/**
+ * Wraps an unlock record at bind time: the shell (controller, optional
+ * email, pointer, timestamp) sealed to the credential's unlock KAK, the
+ * bridge delegation and the optional ladder seed sealed as their own
+ * members, the credential-authenticated binding computed over the core, and
+ * the whole frame signed -- by the credential-derived unlock key at bind
+ * time, or by an acting client's account key where a ceremony rebuilds a
+ * record whole (the reader settles the mixed-signer policy either way).
+ *
+ * @param options {object}
+ * @param options.controller {string}   the account controller
+ * @param [options.email] {string}   the account email, when known
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param options.delegation {IZcap}   the PUT-on-`did.jsonl` delegation to
+ *   the credential-derived signing DID
+ * @param [options.ladderSeed] {Uint8Array}   the update-key ladder seed, for
+ *   a standing credential (a recovery code carries none)
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK -- its public half is all the wrap uses
+ * @param options.signer {RecordSigner}   the signing key
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key
+ * @param [options.createdAt] {string}   the bind timestamp to stamp, as an
+ *   ISO string; defaults to now. Supplied by a caller that pins record
+ *   freshness.
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export declare function wrapUnlockRecord({ controller, email, pointer, delegation, ladderSeed, keyAgreementKey, signer, bindingMacKey, createdAt }: {
+    controller: string;
+    email?: string;
+    pointer: AccountPointer;
+    delegation: IZcap;
+    ladderSeed?: Uint8Array;
+    keyAgreementKey: IKeyAgreementKey;
+    signer: RecordSigner;
+    bindingMacKey: Uint8Array;
+    createdAt?: string;
+}): Promise<SignedUnlockRecord>;
+/**
+ * Unwraps and validates an unlock record: the ordinary keyring-record frame
+ * checks plus the required pointer, bridge delegation, and
+ * credential-authenticated binding. A record without a bridge member is not
+ * an unlock record in the standing layout (an ordinary keyring record found
+ * under a credential's unlock Space would mean a torn bind) and is refused.
+ *
+ * The binding is verified before the contents are returned: the decrypted
+ * core must carry the tag the credential-derived MAC key computes over it, or
+ * the record is refused as forged ({@link UnlockBindingError}) -- the check
+ * that closes the host-forgery redirect, since the host never holds the MAC
+ * key. Nothing downstream may trust the pointer (or the ladder seed) before
+ * this returns.
+ *
+ * Proof verification is mixed-signer and ordered deliberately, exactly as the
+ * recovery record's was: a proof by the credential's own unlock key is
+ * verified BEFORE decryption; a proof by any other key comes back as a
+ * pending state naming the signer, for the caller to settle with
+ * `verifyRecordProof` against the verified document of the account the
+ * credential-authenticated pointer names.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.expectedKeyMultibase {string}   the credential-derived
+ *   unlock signing key's multibase
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key the record's account binding must verify under
+ * @returns {Promise<{ contents: UnlockRecordContents,
+ *   proofState: UnlockRecordProofState }>}
+ */
+export declare function unwrapUnlockRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase, bindingMacKey }: {
+    record: unknown;
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+    expectedKeyMultibase: string;
+    bindingMacKey: Uint8Array;
+}): Promise<{
+    contents: UnlockRecordContents;
+    proofState: UnlockRecordProofState;
+}>;
+/**
+ * Re-mints an unlock record's bridge: the revocation-cascade path that
+ * replaces a rotted or expiring delegation while touching nothing else. The
+ * shell, the ladder member, and the binding are carried VERBATIM (the re-mint
+ * cannot decrypt any of them and does not need to -- each is self-contained
+ * and the binding covers the core), a fresh bridge is sealed to the
+ * credential's unlock KAK public half, and the frame is re-signed by the
+ * acting client's account key -- the mixed-signer case the reader settles
+ * against the verified document.
+ *
+ * A record with no binding cannot be re-minted ({@link UnlockBindingError});
+ * its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the standing stored record
+ * @param options.delegation {IZcap}   the freshly minted `did.jsonl`
+ *   delegation
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK, public half only
+ * @param options.signer {RecordSigner}   the acting client's account key
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export declare function remintUnlockRecordBridge({ record, delegation, keyAgreementKey, signer }: {
+    record: unknown;
+    delegation: IZcap;
+    keyAgreementKey: IKeyAgreementKey;
+    signer: RecordSigner;
+}): Promise<SignedUnlockRecord>;
+//# sourceMappingURL=unlockRecord.d.ts.map

package/dist/unlock/unlockRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlockRecord.d.ts","sourceRoot":"","sources":["../../src/unlock/unlockRecord.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAc/D,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACb,MAAM,sBAAsB,CAAA;AAW7B;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAChC,UAAU,GAAG;IAAE,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AA6BhF;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,aAAa,EAAE,UAAU,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,MAAM,CAYT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAS3E;AAoFD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,aAAa,EAAE,UAAU,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACd,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,aAAa,EAAE,UAAU,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,UAAU,EAAE,sBAAsB,CAAA;CACnC,CAAC,CAoID;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,MAAM,EACN,UAAU,EACV,eAAe,EACf,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;IACjB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;CACrB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB9B"}

package/dist/unlock/unlockRecord.js

@@ -0,0 +1,435 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unlock record codec for credentials with standing authority: the
+ * envelope stored as the one resource of a credential's unlock Space, for
+ * every unlock method in the standing posture -- a passphrase, a passkey PRF
+ * output, or a recovery code. Its frame is the ordinary keyring record's
+ * (`{ version, encryption, wrapped, proof }`), extended with three
+ * record-kind members the proof also covers:
+ *
+ * - `wrapped` (the SHELL): the account core -- controller, optional email,
+ *   pointer, bind timestamp -- sealed to the credential's unlock KAK. Carried
+ *   VERBATIM through every re-mint, so the bind timestamp (which apps pin
+ *   freshness on) and the email survive a re-mint that cannot decrypt them.
+ * - `bridge`: the pre-minted PUT-on-`did.jsonl` delegation, sealed in its own
+ *   self-contained `{ encryption, wrapped }` member. The one member a re-mint
+ *   replaces: revoking the client that signed the delegation rots it, and the
+ *   revocation cascade re-seals a fresh one to the credential's unlock KAK
+ *   public half ({@link remintUnlockRecordBridge}).
+ * - `ladder` (standing credentials only): the random 32-byte update-key
+ *   ladder seed (`./ladder`), sealed in its own `{ encryption, wrapped }`
+ *   member and carried VERBATIM through re-mints -- a re-mint can never read
+ *   or replace a credential's update authority. A recovery code carries none
+ *   (its single update key derives from the code bytes).
+ *
+ * The record splits into a credential-authenticated core and a re-mintable
+ * shell exactly as the recovery record did. The core is the account binding
+ * plus the ladder seed, authenticated by the `binding` frame member: an HMAC
+ * tag under a key derived from the credential itself, computed at bind time
+ * and verified BEFORE the pointer is trusted. Only the binder and the
+ * credential holder ever hold that key -- the storage host never does -- so a
+ * host-forged record redirecting login (or a host-substituted ladder seed)
+ * fails the tag however it is encrypted or signed. The tag rides the frame in
+ * the clear (it reveals nothing), so the re-mint path, which cannot decrypt
+ * the record or recompute the tag, preserves it verbatim. The consequence: a
+ * re-mint can never move the record to another account, and an account that
+ * moves hosts must rebind its credentials.
+ *
+ * The shell's signer is mixed, as before: at bind time the record is signed
+ * by the credential-derived unlock key (verified before decryption); a
+ * re-mint signs with the acting client's account verification method, which
+ * comes back as a pending proof state the caller settles against the account
+ * document the credential-authenticated pointer names.
+ */
+import { base64urlnopad } from '@scure/base';
+import { equalBytes } from '@noble/ciphers/utils.js';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, recordProofKeyMultibase, recordSealCipher, signRecordFrame, verifyRecordProof } from '../keyring/record.js';
+import { LADDER_SEED_BYTES } from './ladder.js';
+/**
+ * The context label mixed into the binding MAC input, versioning the tag
+ * construction. Permanent -- changing it orphans every bound credential.
+ * Supersedes the recovery record's `freewallet/recovery/binding/v1` (the
+ * standing layout is a re-provision boundary; issued codes are re-issued).
+ */
+const UNLOCK_BINDING_CONTEXT = 'freewallet/unlock/binding/v2';
+/**
+ * An unlock record's account binding is absent, malformed, or does not verify
+ * under the credential's binding MAC key. Its own class, distinct from a
+ * proof or decrypt failure: this is the refusal that says the record's
+ * account core (and ladder seed, where one rides) was not written by a holder
+ * of this credential -- a forged record redirecting login at another account,
+ * or a record from before the account moved hosts (either way the credential
+ * must be rebound).
+ */
+export class UnlockBindingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnlockBindingError';
+    }
+}
+/**
+ * The deterministic MAC input over a record's credential-authenticated core:
+ * a JSON array of the context label, the binding values, and the ladder seed
+ * (base64url, empty for a credential that carries none), so no delimiter
+ * ambiguity can make two cores collide.
+ */
+function bindingMacInput({ controller, pointer, ladderSeed }) {
+    return new TextEncoder().encode(JSON.stringify([
+        UNLOCK_BINDING_CONTEXT,
+        controller,
+        pointer.did ?? '',
+        pointer.spaceId,
+        pointer.host,
+        ladderSeed ? base64urlnopad.encode(ladderSeed) : ''
+    ]));
+}
+/**
+ * Computes the account-binding tag: HMAC-SHA-256 over the core values under
+ * the credential-derived binding MAC key, base64url (no pad). Bind time calls
+ * it to stamp the record; login recomputes it to verify.
+ *
+ * @param options {object}
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived MAC key
+ * @param options.controller {string}   the account controller
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param [options.ladderSeed] {Uint8Array}   the ladder seed, for a standing
+ *   credential
+ * @returns {string}
+ */
+export function computeUnlockBinding({ bindingMacKey, controller, pointer, ladderSeed }) {
+    return base64urlnopad.encode(hmac(sha256, bindingMacKey, bindingMacInput({
+        controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    })));
+}
+/**
+ * Reads the `binding` frame member off a stored unlock record without
+ * decrypting anything. The re-mint path uses it to confirm the record is
+ * re-mintable before touching it. Refuses a record with no binding: such a
+ * record predates the credential-authenticated core and cannot be re-minted
+ * -- its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @returns {string}
+ */
+export function unlockRecordBinding({ record }) {
+    const { binding } = (record ?? {});
+    if (typeof binding !== 'string' || !binding) {
+        throw new UnlockBindingError('The unlock record carries no credential-authenticated account ' +
+            'binding; the credential must be rebound.');
+    }
+    return binding;
+}
+/**
+ * Shape-checks a sealed record member (`{ encryption, wrapped }`).
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the frame member
+ * @param options.name {string}   names the member in the refusal
+ * @returns {SealedRecordMember}
+ */
+function parseSealedMember({ value, name }) {
+    const member = value;
+    if (member === null ||
+        typeof member !== 'object' ||
+        member.encryption === null ||
+        typeof member.encryption !== 'object' ||
+        member.wrapped === undefined ||
+        member.wrapped === null) {
+        throw new Error(`The unlock record's ${name} member is malformed.`);
+    }
+    return member;
+}
+/**
+ * Seals one self-contained record member to a KAK: a fresh one-epoch
+ * descriptor plus the envelope. Sealing needs no key-agreement secret, which
+ * is what lets the re-mint path (holding only the credential's unlock KAK
+ * public half) build a fresh bridge member.
+ *
+ * @param options {object}
+ * @param options.data {object}   the member plaintext
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK (public half suffices)
+ * @returns {Promise<SealedRecordMember>}
+ */
+async function sealMember({ data, keyAgreementKey }) {
+    const encryption = await mintRecordEncryption({ keyAgreementKey });
+    const cipher = await recordSealCipher({ encryption });
+    const { envelope } = await cipher.encrypt({
+        data: data
+    });
+    return { encryption, wrapped: envelope };
+}
+/**
+ * Opens one self-contained record member with the credential's unlock KAK.
+ *
+ * @param options {object}
+ * @param options.member {SealedRecordMember}
+ * @param options.keyAgreementKey {IKeyAgreementKey}
+ * @param options.keyResolver {IKeyResolver}
+ * @returns {Promise<unknown>}   the member plaintext
+ */
+async function openMember({ member, keyAgreementKey, keyResolver }) {
+    const cipher = await recordCipher({
+        keyAgreementKey,
+        keyResolver,
+        encryption: member.encryption
+    });
+    return cipher.decrypt({ envelope: member.wrapped });
+}
+/**
+ * Wraps an unlock record at bind time: the shell (controller, optional
+ * email, pointer, timestamp) sealed to the credential's unlock KAK, the
+ * bridge delegation and the optional ladder seed sealed as their own
+ * members, the credential-authenticated binding computed over the core, and
+ * the whole frame signed -- by the credential-derived unlock key at bind
+ * time, or by an acting client's account key where a ceremony rebuilds a
+ * record whole (the reader settles the mixed-signer policy either way).
+ *
+ * @param options {object}
+ * @param options.controller {string}   the account controller
+ * @param [options.email] {string}   the account email, when known
+ * @param options.pointer {AccountPointer}   the account pointer
+ * @param options.delegation {IZcap}   the PUT-on-`did.jsonl` delegation to
+ *   the credential-derived signing DID
+ * @param [options.ladderSeed] {Uint8Array}   the update-key ladder seed, for
+ *   a standing credential (a recovery code carries none)
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK -- its public half is all the wrap uses
+ * @param options.signer {RecordSigner}   the signing key
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key
+ * @param [options.createdAt] {string}   the bind timestamp to stamp, as an
+ *   ISO string; defaults to now. Supplied by a caller that pins record
+ *   freshness.
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export async function wrapUnlockRecord({ controller, email, pointer, delegation, ladderSeed, keyAgreementKey, signer, bindingMacKey, createdAt }) {
+    if (ladderSeed && ladderSeed.length !== LADDER_SEED_BYTES) {
+        throw new Error('The ladder seed must be 32 bytes.');
+    }
+    const binding = computeUnlockBinding({
+        bindingMacKey,
+        controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    });
+    const shell = await sealMember({
+        data: {
+            controller,
+            ...(email ? { email } : {}),
+            pointer: {
+                ...(pointer.did ? { did: pointer.did } : {}),
+                spaceId: pointer.spaceId,
+                host: pointer.host
+            },
+            createdAt: recordCreatedAtStamp({ createdAt })
+        },
+        keyAgreementKey
+    });
+    const bridge = await sealMember({ data: { delegation }, keyAgreementKey });
+    const ladder = ladderSeed
+        ? await sealMember({
+            data: { ladderSeed: base64urlnopad.encode(ladderSeed) },
+            keyAgreementKey
+        })
+        : undefined;
+    return (await signRecordFrame({
+        version: KEYRING_RECORD_VERSION,
+        encryption: shell.encryption,
+        wrapped: shell.wrapped,
+        signer,
+        members: { binding, bridge, ...(ladder ? { ladder } : {}) }
+    }));
+}
+/**
+ * Unwraps and validates an unlock record: the ordinary keyring-record frame
+ * checks plus the required pointer, bridge delegation, and
+ * credential-authenticated binding. A record without a bridge member is not
+ * an unlock record in the standing layout (an ordinary keyring record found
+ * under a credential's unlock Space would mean a torn bind) and is refused.
+ *
+ * The binding is verified before the contents are returned: the decrypted
+ * core must carry the tag the credential-derived MAC key computes over it, or
+ * the record is refused as forged ({@link UnlockBindingError}) -- the check
+ * that closes the host-forgery redirect, since the host never holds the MAC
+ * key. Nothing downstream may trust the pointer (or the ladder seed) before
+ * this returns.
+ *
+ * Proof verification is mixed-signer and ordered deliberately, exactly as the
+ * recovery record's was: a proof by the credential's own unlock key is
+ * verified BEFORE decryption; a proof by any other key comes back as a
+ * pending state naming the signer, for the caller to settle with
+ * `verifyRecordProof` against the verified document of the account the
+ * credential-authenticated pointer names.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.expectedKeyMultibase {string}   the credential-derived
+ *   unlock signing key's multibase
+ * @param options.bindingMacKey {Uint8Array}   the credential-derived binding
+ *   MAC key the record's account binding must verify under
+ * @returns {Promise<{ contents: UnlockRecordContents,
+ *   proofState: UnlockRecordProofState }>}
+ */
+export async function unwrapUnlockRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase, bindingMacKey }) {
+    const { encryption, wrapped, proof } = parseRecordFrame({
+        record,
+        label: 'unlock'
+    });
+    const binding = unlockRecordBinding({ record });
+    const { bridge: rawBridge, ladder: rawLadder } = record;
+    if (rawBridge === undefined) {
+        throw new Error('The unlock record carries no bridge member; it predates the standing ' +
+            'layout and the credential must be rebound.');
+    }
+    const bridge = parseSealedMember({ value: rawBridge, name: 'bridge' });
+    const ladder = rawLadder === undefined
+        ? undefined
+        : parseSealedMember({ value: rawLadder, name: 'ladder' });
+    // `parseRecordFrame` shape-checks the proof of a current-version frame, so
+    // it is present here.
+    const verificationMethod = proof.verificationMethod;
+    const keyMultibase = recordProofKeyMultibase({
+        verificationMethod,
+        label: 'unlock'
+    });
+    let proofState = {
+        pending: { verificationMethod, keyMultibase }
+    };
+    if (keyMultibase === expectedKeyMultibase) {
+        await verifyRecordProof({
+            record,
+            allowedKeyMultibases: expectedKeyMultibase,
+            label: 'unlock'
+        });
+        proofState = 'verified';
+    }
+    const shell = (await openMember({
+        member: { encryption, wrapped },
+        keyAgreementKey,
+        keyResolver
+    }));
+    if (typeof shell.controller !== 'string' || !shell.controller) {
+        throw new Error('Unlock record is missing a controller.');
+    }
+    const pointer = parseRecordPointer(shell.pointer);
+    if (!pointer) {
+        throw new Error('Unlock record is missing its account pointer.');
+    }
+    const createdAt = parseRecordCreatedAt({
+        value: shell.createdAt,
+        label: 'Unlock'
+    });
+    const bridgePlaintext = (await openMember({
+        member: bridge,
+        keyAgreementKey,
+        keyResolver
+    }));
+    if (bridgePlaintext.delegation === null ||
+        typeof bridgePlaintext.delegation !== 'object') {
+        throw new Error('Unlock record is missing its did.jsonl delegation.');
+    }
+    let ladderSeed;
+    if (ladder) {
+        const ladderPlaintext = (await openMember({
+            member: ladder,
+            keyAgreementKey,
+            keyResolver
+        }));
+        if (typeof ladderPlaintext.ladderSeed !== 'string') {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+        try {
+            ladderSeed = base64urlnopad.decode(ladderPlaintext.ladderSeed);
+        }
+        catch {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+        if (ladderSeed.length !== LADDER_SEED_BYTES) {
+            throw new Error('Unlock record has a malformed ladder member.');
+        }
+    }
+    const expectedTag = hmac(sha256, bindingMacKey, bindingMacInput({
+        controller: shell.controller,
+        pointer,
+        ...(ladderSeed ? { ladderSeed } : {})
+    }));
+    let servedTag;
+    try {
+        servedTag = base64urlnopad.decode(binding);
+    }
+    catch {
+        servedTag = null;
+    }
+    // `equalBytes` is @noble/ciphers' authentication-tag comparison (no early
+    // exit), so the check leaks nothing through timing.
+    if (servedTag === null || !equalBytes(servedTag, expectedTag)) {
+        throw new UnlockBindingError("The unlock record's account binding does not verify under this " +
+            'credential; the record is refused as forged.');
+    }
+    return {
+        contents: {
+            controller: shell.controller,
+            ...(typeof shell.email === 'string' && shell.email
+                ? { email: shell.email }
+                : {}),
+            pointer,
+            delegation: bridgePlaintext.delegation,
+            ...(ladderSeed ? { ladderSeed } : {}),
+            createdAt
+        },
+        proofState
+    };
+}
+/**
+ * Re-mints an unlock record's bridge: the revocation-cascade path that
+ * replaces a rotted or expiring delegation while touching nothing else. The
+ * shell, the ladder member, and the binding are carried VERBATIM (the re-mint
+ * cannot decrypt any of them and does not need to -- each is self-contained
+ * and the binding covers the core), a fresh bridge is sealed to the
+ * credential's unlock KAK public half, and the frame is re-signed by the
+ * acting client's account key -- the mixed-signer case the reader settles
+ * against the verified document.
+ *
+ * A record with no binding cannot be re-minted ({@link UnlockBindingError});
+ * its credential must be rebound.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the standing stored record
+ * @param options.delegation {IZcap}   the freshly minted `did.jsonl`
+ *   delegation
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the credential's unlock
+ *   KAK, public half only
+ * @param options.signer {RecordSigner}   the acting client's account key
+ * @returns {Promise<SignedUnlockRecord>}
+ */
+export async function remintUnlockRecordBridge({ record, delegation, keyAgreementKey, signer }) {
+    const { encryption, wrapped } = parseRecordFrame({
+        record,
+        label: 'unlock'
+    });
+    const binding = unlockRecordBinding({ record });
+    const { ladder: rawLadder } = record;
+    const ladder = rawLadder === undefined
+        ? undefined
+        : parseSealedMember({ value: rawLadder, name: 'ladder' });
+    const bridge = await sealMember({ data: { delegation }, keyAgreementKey });
+    return (await signRecordFrame({
+        version: KEYRING_RECORD_VERSION,
+        encryption,
+        wrapped,
+        signer,
+        members: { binding, bridge, ...(ladder ? { ladder } : {}) }
+    }));
+}
+//# sourceMappingURL=unlockRecord.js.map

package/dist/unlock/unlockRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlockRecord.js","sourceRoot":"","sources":["../../src/unlock/unlockRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAO9C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAE7D;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAmDD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,EACvB,UAAU,EACV,OAAO,EACP,UAAU,EAKX;IACC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,IAAI,CAAC,SAAS,CAAC;QACb,sBAAsB;QACtB,UAAU;QACV,OAAO,CAAC,GAAG,IAAI,EAAE;QACjB,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,IAAI;QACZ,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;KACpD,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,OAAO,cAAc,CAAC,MAAM,CAC1B,IAAI,CACF,MAAM,EACN,aAAa,EACb,eAAe,CAAC;QACd,UAAU;QACV,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CACH,CACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,MAAM,EAAuB;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAA0B,CAAA;IAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE;YAC9D,0CAA0C,CAC7C,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,EACzB,KAAK,EACL,IAAI,EAIL;IACC,MAAM,MAAM,GAAG,KAA2C,CAAA;IAC1D,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,UAAU,KAAK,IAAI;QAC1B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,MAA4B,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,eAAe,EAIhB;IACC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE,IAA+D;KACtE,CAAC,CAAA;IACF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,MAAM,EACN,eAAe,EACf,WAAW,EAKZ;IACC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAgB,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,SAAS,EAWV;IACC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,aAAa;QACb,UAAU;QACV,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;QAC7B,IAAI,EAAE;YACJ,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB;YACD,SAAS,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC;SAC/C;QACD,eAAe;KAChB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YACvD,eAAe;SAChB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,OAAO,CAAC,MAAM,eAAe,CAAC;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAuB,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EAOd;IAIC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC;QACtD,MAAM;QACN,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAGhD,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4CAA4C,CAC/C,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtE,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE7D,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,kBAAkB,GAAG,KAAM,CAAC,kBAAkB,CAAA;IACpD,MAAM,YAAY,GAAG,uBAAuB,CAAC;QAC3C,kBAAkB;QAClB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,IAAI,UAAU,GAA2B;QACvC,OAAO,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE;KAC9C,CAAA;IACD,IAAI,YAAY,KAAK,oBAAoB,EAAE,CAAC;QAC1C,MAAM,iBAAiB,CAAC;YACtB,MAAM;YACN,oBAAoB,EAAE,oBAAoB;YAC1C,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QACF,UAAU,GAAG,UAAU,CAAA;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC;QAC9B,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;QAC/B,eAAe;QACf,WAAW;KACZ,CAAC,CAKD,CAAA;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,CAAC;QACxC,MAAM,EAAE,MAAM;QACd,eAAe;QACf,WAAW;KACZ,CAAC,CAA6B,CAAA;IAC/B,IACE,eAAe,CAAC,UAAU,KAAK,IAAI;QACnC,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAkC,CAAA;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,CAAC;YACxC,MAAM,EAAE,MAAM;YACd,eAAe;YACf,WAAW;SACZ,CAAC,CAA6B,CAAA;QAC/B,IAAI,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC;YACH,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,EACN,aAAa,EACb,eAAe,CAAC;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CACH,CAAA;IACD,IAAI,SAA4B,CAAA;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAA;IAClB,CAAC;IACD,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,iEAAiE;YAC/D,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE;YACR,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK;gBAChD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACxB,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;YACP,UAAU,EAAE,eAAe,CAAC,UAAmB;YAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,SAAS;SACV;QACD,UAAU;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,MAAM,EACN,UAAU,EACV,eAAe,EACf,MAAM,EAMP;IACC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC;QAC/C,MAAM;QACN,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAA8B,CAAA;IAC5D,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1E,OAAO,CAAC,MAAM,eAAe,CAAC;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,UAAU;QACV,OAAO;QACP,MAAM;QACN,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAuB,CAAA;AAC3B,CAAC"}