@interop/wallet-core 0.48.0 → 0.50.0

package/dist/clientAnnex/forgetLast.d.ts

@@ -0,0 +1,267 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The LAST durable client's forget: the two-entry transition ceremony that
+ * takes an account from one enrolled durable client to the client-less,
+ * ladder-anchored state -- the same state a credential-anchored signup and a
+ * transient recovery produce. Decision 0004's 2026-08-19 amendment fixes the
+ * entry order, and it is forced twice over: the server's revocation endpoint
+ * verifies a to-be-revoked capability's chain against the CURRENTLY resolved
+ * document (so a ladder-signed chain revokes only while the ladder VM is
+ * published), and the ladder VM carries no `capabilityInvocation` (so once
+ * the client's verification method is gone, nothing can sign the revocation
+ * POST at all). So:
+ *
+ * 1. **The install entry** ({@link installLadderVmWebvh}): the ladder VM
+ *    joins the document while the client's whole footprint stays -- the
+ *    both-present transitional state. This is the ceremony's
+ *    posture-changing document version under the ceremony-tail license.
+ * 2. **The roster rotation**, ladder-signed, anchored at the install entry,
+ *    HTTP-invoked under the still-standing client: the user key rotates off
+ *    this client's wrap in ONE append (the license's one-shot shape), read
+ *    back through the credential's standing wrap. Because the append's
+ *    signer is the ladder VM -- a key the post-removal document still lists
+ *    -- the roster log needs no seal completer afterwards, which matters on
+ *    an account where no enrolled client's login sweep will ever run again.
+ * 3. **The collection fan-out**, still under this client's invocation
+ *    authority: every encrypted collection re-epochs onto the fresh key.
+ * 4. **The generation-delegation replacement and revocations**: a fresh
+ *    ladder-signed generation delegation replaces the embedded one
+ *    unconditionally (the forced renewal), and then EVERY still-unexpired
+ *    delegation the annex log's history ever embedded that this
+ *    credential's ladder VM signed is revoked at the server (a renewal
+ *    inside the 30-day window can leave two) -- closing the resurrection
+ *    window a reinstalled derived-key VM would otherwise reopen. The
+ *    replacement is what keeps the account transient-login-reachable after
+ *    the transition; replace-before-revoke is what keeps a torn run from
+ *    stranding the generation delegation-less.
+ * 5. **The other unlock methods' record re-mint** (`unlockMethods`): every
+ *    other standing credential's and recovery code's bridge (and
+ *    `delegatedClients` sibling, where the record carries one) is re-signed
+ *    by the ladder VM and its record re-sealed through the entry's
+ *    management zcap -- the revocation cascade's re-mint pass
+ *    (`remintRecoveryDelegations`), run with the ladder VM as the delegating
+ *    and record-signing key and the forgotten client named as retiring, so
+ *    every delegation it signed counts as rotted ahead of the removal entry.
+ *    Delegations the removed client had signed rot at that entry, and on a
+ *    client-less account no durable login's refresh block will ever run
+ *    again to heal them, so this is the one pass that reaches them. The
+ *    HTTP side still invokes under the still-standing client (the
+ *    management zcaps are granted to the account DID, which only an enrolled
+ *    client can invoke) -- which is why the stage must run before the
+ *    removal entry. Best-effort per entry, every entry's fate reported.
+ * 6. **The record re-bind seam** (`onBeforeRemoval`): the caller re-signs
+ *    the LOGIN credential's bridge and `delegatedClients` sibling with the
+ *    ladder VM and re-seals its unlock record with the credential in hand
+ *    (a full re-wrap, proof verified rather than settled) -- the one record
+ *    stage 5 need not reach.
+ * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
+ *    whole document footprint out while the installed ladder VM keeps the
+ *    account anchored. The app's local wipe runs after this ceremony
+ *    returns.
+ *
+ * Torn-state map: every stage detects completion from durable state, so a
+ * run torn anywhere before the removal entry reads as "not forgotten" and a
+ * re-run converges -- the install entry is idempotent, an already-rotated
+ * roster skips the append (no second ladder-signed append is ever
+ * attempted), the fan-out is staleness-driven, a re-POSTed revocation's 400
+ * already-revoked answer reads as success (decision 0006's resume contract),
+ * and the forced replacement re-mints (the prior run's fresh delegation is
+ * then revoked as history, so a re-run churns one delegation and strands
+ * nothing), and the record re-mint re-checks staleness per entry (a record
+ * already ladder-signed reads as current). Torn after the removal entry is
+ * the finish-the-wipe state the app's next login maps.
+ *
+ * The honest limitation is the cascade's, as everywhere: ciphertext this
+ * browser already fetched stays forensically recoverable from its storage,
+ * and old epochs stay open to keys it already held.
+ */
+import type { DIDLog } from '@interop/did-method-webvh';
+import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
+import type { ZcapClient } from '@interop/ezcap';
+import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { type RevokedClientKeys } from '../webvh/revokeClient.js';
+import type { ResourceLogPinStore } from '../resourceLog/index.js';
+import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import type { UnlockLogStore } from '../unlock/standingWebvh.js';
+import type { AccountPointer } from '../keyring/record.js';
+import { type RecordRemintOutcome, type RecoveryDelegationEntry } from '../recovery/recoveryDelegation.js';
+import { type ClientAnnexWriteStore } from './log.js';
+/**
+ * What the ceremony's generation stage did: the revoked delegation ids, and
+ * whether the forced replacement landed. A `skipped` reason names the stage
+ * that could not run -- `no-pointer` (the account points at no generation:
+ * nothing to revoke or replace), `log-unreadable` (the pointed generation's
+ * `did.jsonl` is gone; the delegation bytes are unrecoverable, decision
+ * 0006's honest limit), `rung-uncommitted` (this credential cannot write the
+ * generation's log; the account lands delegation-less until a
+ * fresh-generation heal), `already-removed` (the whole ceremony completed on
+ * an earlier run; nothing here can still invoke) -- and a skip never fails
+ * the ceremony.
+ */
+export interface GenerationDelegationRetirement {
+    revoked: string[];
+    replaced: boolean;
+    skipped?: 'no-pointer' | 'log-unreadable' | 'rung-uncommitted' | 'already-removed';
+}
+/**
+ * The other unlock methods' reach for the record re-mint stage: the registry
+ * entries to walk (the OTHER methods' -- the login credential's own record is
+ * the `onBeforeRemoval` seam's, re-wrapped with the credential in hand; an
+ * entry for it here is harmless but redundant), the unlock Spaces' storage
+ * server, the management-zcap client factory (invoking as the still-standing
+ * client), and the registry record-back seam. The shape is the revocation
+ * cascade's re-mint seams verbatim, so an app binds both from one place.
+ */
+export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry = RecoveryDelegationEntry> {
+    entries: Entry[];
+    pointer: AccountPointer;
+    storageServerUrl: string;
+    managementZcapClient: (options: {
+        capability: IZcap;
+    }) => ZcapClient;
+    recordEntry: (options: {
+        entry: Entry;
+    }) => Promise<void>;
+}
+/**
+ * What a completed last-client forget reports: whether the install entry ran
+ * on this call (`false` on a resumed run), whether the roster's wrap for the
+ * forgotten client was retired on this run, the per-collection fan-out
+ * result, the generation stage's report, the other unlock methods' record
+ * re-mint report (present when the caller supplied the reach: the counts and
+ * every entry's fate, so a record the pass could not reach is named rather
+ * than silently left with a rotted bridge), the document as the removal entry
+ * left it, and -- when the account has a roster -- the rotated key with the
+ * roster descriptor it was read from.
+ */
+export interface LastDurableClientForgetResult {
+    installed: boolean;
+    rotated: boolean;
+    collections: UserKeyCascadeResult;
+    generation: GenerationDelegationRetirement;
+    unlockMethods?: {
+        reminted: number;
+        skipped: number;
+        outcomes: RecordRemintOutcome[];
+    };
+    did: string;
+    document: object;
+    userKey?: UserKey;
+    rosterDescriptor?: CollectionEncryption;
+}
+/**
+ * Forgets the account's LAST enrolled durable client -- this browser's own
+ * -- transitioning the account to the client-less, ladder-anchored state.
+ * See the module doc for the stage order and the torn-state map. The caller
+ * runs the local wipe only after this resolves. An account with another
+ * enrolled durable client refuses: that forget is the ordinary ceremony
+ * (`forgetDurableClient`), reached first, whose `LastDurableClientForgetError`
+ * is what routes callers here.
+ *
+ * @param options {object}
+ * @param options.logStore {UnlockLogStore}   the credential's delegated
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
+ *   caller is expected to have verified the account log under its own
+ *   chain-head pins in the same session (the ceremony re-reads through the
+ *   seam and checks `expectedDid`, but carries no account-log pin store
+ *   itself)
+ * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
+ * @param options.forgottenClient {RevokedClientKeys}   this client's public
+ *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
+ *   staged key) is re-derived from the log
+ * @param options.forgottenKeyAgreementKeyMultibase {string}   this client's
+ *   identity key-agreement key (the X25519 twin), naming its roster wrap
+ * @param [options.knownLatentHashes] {string[]}   standing latent commitments
+ *   the caller vouches for (the recovery registry's update-key hashes),
+ *   excluded from the staged-hash attribution
+ * @param options.expectedDid {string}   the account DID from the caller's
+ *   stored account pointer
+ * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
+ *   builds the `key-map/user-key.jsonl` roster store whose appends are
+ *   SIGNED BY THE LADDER VM and whose controller view resolves from the
+ *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   license admits), while its HTTP requests invoke under the still-standing
+ *   client
+ * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
+ *   credential's key-agreement key -- the recipient whose wrap survives the
+ *   rotation, reading the fresh key back and unwrapping the generations for
+ *   the fan-out
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster
+ *   read and BEFORE the fan-out
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param options.annex {object}   the generation stage's reach:
+ * @param options.annex.storeFor {Function}
+ *   `({ spaceId, generationId }) => ClientAnnexWriteStore` -- the pointed
+ *   generation's log store, reading and writing under the still-standing
+ *   client's authority
+ * @param options.annex.revoke {Function}   `(delegation) => Promise<void>`
+ *   -- POSTs a revocation (was-client's `WasClient#revoke`, bound by the
+ *   caller; the invocation signs as the still-standing client)
+ * @param options.annex.wasServerUrl {string}   the ACCOUNT Space's storage
+ *   server (the fresh generation delegation's target host)
+ * @param options.annex.accountSpaceId {string}   the ACCOUNT Space's id (the
+ *   fresh delegation's target subtree)
+ * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
+ *   for the pointed generation's read
+ * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
+ *   unlock methods' record re-mint reach (stage 5): the registry entries
+ *   whose bridge (and sibling) the ladder VM re-signs and whose records it
+ *   re-seals through their management zcaps, invoked as the still-standing
+ *   client. Omitted, the stage is skipped and the result carries no
+ *   `unlockMethods` report -- the residue decision 0004's amendment stated
+ * @param [options.onBeforeRemoval] {Function}
+ *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
+ *   after the record re-mint stage, immediately before the removal entry,
+ *   with the post-install published state. The caller re-signs the login
+ *   credential's bridge and `delegatedClients` sibling with the ladder VM
+ *   and re-seals its unlock record here. Must be idempotent (a resumed run
+ *   invokes it again)
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<LastDurableClientForgetResult>}
+ */
+export declare function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+    logStore: UnlockLogStore;
+    ladderSeed: Uint8Array;
+    forgottenClient: RevokedClientKeys;
+    forgottenKeyAgreementKeyMultibase: string;
+    knownLatentHashes?: string[];
+    expectedDid: string;
+    rosterStoreFor: (options: {
+        did: string;
+        log: DIDLog;
+    }) => EncryptionDescriptorStore;
+    credentialKeyAgreementKey: IKeyAgreementKey;
+    userKey?: UserKey;
+    pinnedEpochId?: string | null;
+    onUserKeyAdopted?: (adopted: {
+        userKey: UserKey;
+        latestEpochId: string;
+        descriptor: CollectionEncryption;
+    }) => Promise<void>;
+    collections: CascadeCollections;
+    annex: {
+        storeFor: (options: {
+            spaceId: string;
+            generationId: string;
+        }) => ClientAnnexWriteStore;
+        revoke: (delegation: IDelegatedZcap) => Promise<void>;
+        wasServerUrl: string;
+        accountSpaceId: string;
+        pinStore?: ResourceLogPinStore;
+    };
+    unlockMethods?: UnlockMethodsRemintReach;
+    onBeforeRemoval?: (published: {
+        did: string;
+        doc: object;
+        log: DIDLog;
+    }) => Promise<void>;
+    now?: number;
+}): Promise<LastDurableClientForgetResult>;
+//# sourceMappingURL=forgetLast.d.ts.map

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA6JzC"}

package/dist/clientAnnex/forgetLast.js

@@ -0,0 +1,374 @@
+import { readPublishedLog, relationIds } from '../webvh/didWebvh.js';
+import { clientRemovalTarget } from '../webvh/revokeClient.js';
+import { delegationProofKeyId } from '../webvh/standingZcap.js';
+import { vmFragmentOf } from '../resourceLog/index.js';
+import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
+import { readLogOrThrow } from '../unlock/standingWebvh.js';
+import { recordSignerFromAgent } from '../keyring/record.js';
+import { remintRecoveryDelegations } from '../recovery/recoveryDelegation.js';
+import { ladderVmKeyMultibase } from './ladder.js';
+import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+import { forgetLastWebvhClient, installLadderVmWebvh } from './ladderAnchored.js';
+import { clientAnnexDidParts, clientAnnexLogPinId, delegatedClientsDelegationMinter, delegatedClientsPointer, ensureGenerationDelegationCurrent, generationDelegationHistory, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess } from './log.js';
+/**
+ * Forgets the account's LAST enrolled durable client -- this browser's own
+ * -- transitioning the account to the client-less, ladder-anchored state.
+ * See the module doc for the stage order and the torn-state map. The caller
+ * runs the local wipe only after this resolves. An account with another
+ * enrolled durable client refuses: that forget is the ordinary ceremony
+ * (`forgetDurableClient`), reached first, whose `LastDurableClientForgetError`
+ * is what routes callers here.
+ *
+ * @param options {object}
+ * @param options.logStore {UnlockLogStore}   the credential's delegated
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
+ *   caller is expected to have verified the account log under its own
+ *   chain-head pins in the same session (the ceremony re-reads through the
+ *   seam and checks `expectedDid`, but carries no account-log pin store
+ *   itself)
+ * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
+ * @param options.forgottenClient {RevokedClientKeys}   this client's public
+ *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
+ *   staged key) is re-derived from the log
+ * @param options.forgottenKeyAgreementKeyMultibase {string}   this client's
+ *   identity key-agreement key (the X25519 twin), naming its roster wrap
+ * @param [options.knownLatentHashes] {string[]}   standing latent commitments
+ *   the caller vouches for (the recovery registry's update-key hashes),
+ *   excluded from the staged-hash attribution
+ * @param options.expectedDid {string}   the account DID from the caller's
+ *   stored account pointer
+ * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
+ *   builds the `key-map/user-key.jsonl` roster store whose appends are
+ *   SIGNED BY THE LADDER VM and whose controller view resolves from the
+ *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   license admits), while its HTTP requests invoke under the still-standing
+ *   client
+ * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
+ *   credential's key-agreement key -- the recipient whose wrap survives the
+ *   rotation, reading the fresh key back and unwrapping the generations for
+ *   the fan-out
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster
+ *   read and BEFORE the fan-out
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param options.annex {object}   the generation stage's reach:
+ * @param options.annex.storeFor {Function}
+ *   `({ spaceId, generationId }) => ClientAnnexWriteStore` -- the pointed
+ *   generation's log store, reading and writing under the still-standing
+ *   client's authority
+ * @param options.annex.revoke {Function}   `(delegation) => Promise<void>`
+ *   -- POSTs a revocation (was-client's `WasClient#revoke`, bound by the
+ *   caller; the invocation signs as the still-standing client)
+ * @param options.annex.wasServerUrl {string}   the ACCOUNT Space's storage
+ *   server (the fresh generation delegation's target host)
+ * @param options.annex.accountSpaceId {string}   the ACCOUNT Space's id (the
+ *   fresh delegation's target subtree)
+ * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
+ *   for the pointed generation's read
+ * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
+ *   unlock methods' record re-mint reach (stage 5): the registry entries
+ *   whose bridge (and sibling) the ladder VM re-signs and whose records it
+ *   re-seals through their management zcaps, invoked as the still-standing
+ *   client. Omitted, the stage is skipped and the result carries no
+ *   `unlockMethods` report -- the residue decision 0004's amendment stated
+ * @param [options.onBeforeRemoval] {Function}
+ *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
+ *   after the record re-mint stage, immediately before the removal entry,
+ *   with the post-install published state. The caller re-signs the login
+ *   credential's bridge and `delegatedClients` sibling with the ladder VM
+ *   and re-seals its unlock record here. Must be idempotent (a resumed run
+ *   invokes it again)
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<LastDurableClientForgetResult>}
+ */
+export async function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
+    // The pre-install read and the two guards: a client with no remaining
+    // presence means the removal entry already landed (the finish-the-wipe
+    // state the app's next login maps -- nothing here can still invoke), and
+    // an account with another enrolled durable client belongs to the ordinary
+    // forget ceremony.
+    const before = await readLogOrThrow({ store: logStore, expectedDid });
+    const preTarget = await clientRemovalTarget({
+        published: before,
+        client: forgottenClient
+    });
+    if (!preTarget.present) {
+        return {
+            installed: false,
+            rotated: false,
+            collections: { outcomes: {}, failed: [] },
+            generation: { revoked: [], replaced: false, skipped: 'already-removed' },
+            did: before.did,
+            document: before.doc
+        };
+    }
+    const signingVmId = `${before.did}#${forgottenClient.signingKeyMultibase}`;
+    const invocationIds = relationIds(before.doc.capabilityInvocation);
+    if (invocationIds.some(id => id !== signingVmId)) {
+        throw new Error('did:webvh: another enrolled durable client remains; the last-client ' +
+            'transition ceremony does not apply -- run the ordinary forget.');
+    }
+    // Stage 1: the install entry -- the ladder VM in, the client untouched.
+    const install = await installLadderVmWebvh({
+        store: logStore,
+        ladderSeed,
+        expectedDid
+    });
+    // Stage 2: the roster rotation off this client's wrap, ladder-signed and
+    // anchored at the install entry, then stage 3, the collection fan-out --
+    // both HTTP-invoked under this client's still-standing authority. An
+    // already-rotated roster skips the append entirely, so the one-shot
+    // license is never asked for a second append at the same anchor.
+    let rotated = false;
+    let read;
+    let cascade = { outcomes: {}, failed: [] };
+    const rosterStore = rosterStoreFor({ did: install.did, log: install.log });
+    const current = await rosterStore.read();
+    if (current !== null) {
+        const forgottenKid = rosterRecipientKid({
+            signingKeyMultibase: forgottenClient.signingKeyMultibase,
+            keyAgreementKeyMultibase: forgottenKeyAgreementKeyMultibase
+        });
+        let descriptor = current.descriptor;
+        const currentEpoch = (descriptor.epochs ?? []).find(epoch => epoch.id === descriptor.currentEpoch);
+        const wrapped = currentEpoch?.recipients.some(entry => entry.header.kid === forgottenKid);
+        if (wrapped) {
+            descriptor = await rotateUserKeyRoster({
+                store: rosterStore,
+                document: install.doc,
+                retireRecipientId: forgottenKid
+            });
+            rotated = true;
+        }
+        // The fresh key comes back through the credential's standing wrap -- this
+        // client's own is gone from the current epoch -- with the continuity and
+        // possession checks still running on the threaded descriptor.
+        const adopted = await readUserKeyRoster({
+            store: rosterStore,
+            descriptor,
+            ...(userKey ? { userKey } : {}),
+            clientKeyAgreementKey: credentialKeyAgreementKey,
+            pinnedEpochId
+        });
+        if (adopted.rotated) {
+            await onUserKeyAdopted?.({
+                userKey: adopted.userKey,
+                latestEpochId: adopted.latestEpochId,
+                descriptor: adopted.descriptor
+            });
+        }
+        read = { userKey: adopted.userKey, descriptor: adopted.descriptor };
+        cascade = await cascadeCollectionsToUserKey({
+            collectionIds: typeof collections.collectionIds === 'function'
+                ? await collections.collectionIds()
+                : collections.collectionIds,
+            storeFor: collections.storeFor,
+            ...(collections.isEncrypted
+                ? { isEncrypted: collections.isEncrypted }
+                : {}),
+            rosterDescriptor: adopted.descriptor,
+            clientKeyAgreementKey: credentialKeyAgreementKey,
+            userKey: adopted.userKey
+        });
+    }
+    // Stage 4: the generation-delegation replacement and revocations.
+    const generation = await retireLadderGenerationDelegations({
+        doc: install.doc,
+        accountDid: install.did,
+        ladderSeed,
+        annex,
+        now
+    });
+    // Stage 5: the other unlock methods' record re-mint, ladder-signed, with
+    // the forgotten client named as retiring -- the post-install document
+    // still lists it, so without that axis every bridge it signed would read
+    // as standing and be left to rot at the removal entry.
+    let remint;
+    if (unlockMethods !== undefined) {
+        remint = await remintUnlockMethodRecordsAsLadder({
+            doc: install.doc,
+            accountDid: install.did,
+            ladderSeed,
+            retiringSigningKeyMultibase: forgottenClient.signingKeyMultibase,
+            reach: unlockMethods,
+            now
+        });
+    }
+    // Stage 6: the record re-bind seam, while the removal has not landed (a
+    // ladder-VM-signed bridge verifies from the install entry on, and the old
+    // client-signed one keeps verifying until the removal -- so a tear on
+    // either side of this callback leaves a working login).
+    await onBeforeRemoval?.({
+        did: install.did,
+        doc: install.doc,
+        log: install.log
+    });
+    // Stage 7: the removal entry -- the client's whole footprint out, the
+    // installed ladder VM keeping the account anchored.
+    const removed = await forgetLastWebvhClient({
+        store: logStore,
+        ladderSeed,
+        forgottenClient,
+        ...(knownLatentHashes ? { knownLatentHashes } : {}),
+        expectedDid
+    });
+    return {
+        installed: install.installed,
+        rotated,
+        collections: cascade,
+        generation,
+        ...(remint ? { unlockMethods: remint } : {}),
+        did: removed.did,
+        document: removed.doc,
+        ...(read
+            ? { userKey: read.userKey, rosterDescriptor: read.descriptor }
+            : {})
+    };
+}
+/**
+ * The generation stage: reads the pointed generation's log, force-replaces
+ * the embedded delegation with a fresh ladder-signed one (so the account
+ * stays transient-login-reachable), then revokes every still-unexpired
+ * delegation the log's history embedded that this credential's ladder VM
+ * signed. Replace-before-revoke is the tear-safety order: the fresh
+ * delegation is never in the pre-replacement history, so the revocation loop
+ * cannot touch it, and a run torn between the two leaves the generation with
+ * a live delegation either way.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the post-install account document
+ * @param options.accountDid {string}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.annex {object}   see {@link forgetLastDurableClient}
+ * @param options.now {number}
+ * @returns {Promise<GenerationDelegationRetirement>}
+ */
+async function retireLadderGenerationDelegations({ doc, accountDid, ladderSeed, annex, now }) {
+    const pointedDid = delegatedClientsPointer({ doc });
+    if (pointedDid === undefined) {
+        return { revoked: [], replaced: false, skipped: 'no-pointer' };
+    }
+    const parts = clientAnnexDidParts({ did: pointedDid });
+    const store = annex.storeFor(parts);
+    const logId = clientAnnexLogPinId(parts);
+    // readPublishedLog only calls getIdResourceRaw, so the narrow seam is safe.
+    const published = await readPublishedLog({
+        idStore: store,
+        expectedDid: pointedDid,
+        ...(annex.pinStore !== undefined ? { pinStore: annex.pinStore, logId } : {})
+    });
+    if (published === undefined) {
+        return { revoked: [], replaced: false, skipped: 'log-unreadable' };
+    }
+    // The doomed set, collected BEFORE the replacement so the fresh delegation
+    // can never join it: every delegation the history embedded whose proof key
+    // is this credential's ladder VM and whose expiry has not passed. An
+    // unparseable or absent expiry counts as unexpired -- fail-safe, since an
+    // unbounded delegation is the worst resurrection credential.
+    const ladderVmKey = await ladderVmKeyMultibase({ ladderSeed });
+    const doomed = generationDelegationHistory({ log: published.log }).filter(delegation => {
+        const proofKeyId = delegationProofKeyId(delegation);
+        const fragment = proofKeyId === undefined ? null : vmFragmentOf(proofKeyId);
+        if (fragment !== ladderVmKey) {
+            return false;
+        }
+        const expires = Date.parse(delegation.expires ?? '');
+        return Number.isNaN(expires) || expires > now;
+    });
+    // The forced replacement first: a ladder-signed fresh delegation under the
+    // reinstalled VM, the annex entry signed by this credential's committed
+    // annex rung. A credential the generation does not commit cannot write the
+    // entry -- the honest skip, leaving the generation delegation-less once
+    // the doomed set is revoked below.
+    let replaced = false;
+    const ladderClient = await ladderVmZcapClient({ accountDid, ladderSeed });
+    try {
+        await ensureGenerationDelegationCurrent({
+            store,
+            ladderSeed,
+            generationId: parts.generationId,
+            mintGenerationDelegation: async ({ clientAnnexDid }) => mintGenerationDelegation({
+                zcapClient: ladderClient,
+                wasServerUrl: annex.wasServerUrl,
+                spaceId: annex.accountSpaceId,
+                clientAnnexDid,
+                now
+            }),
+            expectedDid: pointedDid,
+            force: true,
+            ...(annex.pinStore !== undefined
+                ? { pinStore: annex.pinStore, logId }
+                : {}),
+            now
+        });
+        replaced = true;
+    }
+    catch (err) {
+        if (err.name !== 'ClientAnnexRungUncommittedError') {
+            throw err;
+        }
+    }
+    // The revocations, blind and resumable (400 already-revoked as success).
+    const revoked = [];
+    for (const delegation of doomed) {
+        await revokeTreatingAlreadyRevokedAsSuccess({
+            revoke: annex.revoke,
+            delegation
+        });
+        const id = delegation.id;
+        if (typeof id === 'string') {
+            revoked.push(id);
+        }
+    }
+    return replaced
+        ? { revoked, replaced }
+        : { revoked, replaced, skipped: 'rung-uncommitted' };
+}
+/**
+ * The record re-mint stage: the revocation cascade's re-mint pass over the
+ * other unlock methods' registry entries, with the ladder VM as both the
+ * delegating key (the fresh bridge and sibling) and the record-frame signer
+ * (`ladderVmAgent`'s did:key form, whose multibase the post-install document
+ * lists, so a reader settling the mixed-signer proof against the account
+ * document accepts it after the removal too -- `currentAccountRecordSigners`
+ * is that allowlist), and the forgotten client named as retiring. The sibling
+ * minter reads the annex pointer off the post-install document. The HTTP
+ * side rides the caller's management-zcap clients, still invocable here.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the post-install account document
+ * @param options.accountDid {string}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.retiringSigningKeyMultibase {string}   the forgotten
+ *   client's signing key
+ * @param options.reach {UnlockMethodsRemintReach}
+ * @param options.now {number}
+ * @returns {Promise<object>}   the pass's counts and per-entry outcomes
+ */
+async function remintUnlockMethodRecordsAsLadder({ doc, accountDid, ladderSeed, retiringSigningKeyMultibase, reach, now }) {
+    const ladderClient = await ladderVmZcapClient({ accountDid, ladderSeed });
+    const recordSigner = recordSignerFromAgent({
+        keyAgent: await ladderVmAgent({ ladderSeed })
+    });
+    return remintRecoveryDelegations({
+        doc,
+        entries: reach.entries,
+        pointer: reach.pointer,
+        storageServerUrl: reach.storageServerUrl,
+        zcapClient: ladderClient,
+        recordSigner,
+        managementZcapClient: reach.managementZcapClient,
+        recordEntry: reach.recordEntry,
+        mintDelegatedClientsDelegation: delegatedClientsDelegationMinter({
+            doc,
+            zcapClient: ladderClient,
+            wasServerUrl: reach.pointer.host
+        }),
+        retiringKeyMultibases: [retiringSigningKeyMultibase],
+        now
+    });
+}
+//# sourceMappingURL=forgetLast.js.map

package/dist/clientAnnex/forgetLast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgetLast.js","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAoFA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EAEpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EACL,yBAAyB,EAG1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,iCAAiC,EACjC,2BAA2B,EAC3B,wBAAwB,EACxB,qCAAqC,EAEtC,MAAM,UAAU,CAAA;AAmEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAsCjB;IACC,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;QAC1C,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,GAAG;SACrB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC1E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,gEAAgE,CACnE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,WAAW;KACZ,CAAC,CAAA;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,WAAW,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;QACzD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;QACV,KAAK;QACL,GAAG;KACJ,CAAC,CAAA;IAEF,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,MAAsD,CAAA;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,MAAM,iCAAiC,CAAC;YAC/C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,UAAU;YACV,2BAA2B,EAAE,eAAe,CAAC,mBAAmB;YAChE,KAAK,EAAE,aAAa;YACpB,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,eAAe,EAAE,CAAC;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAA;IAEF,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,KAAK,EACL,GAAG,EAgBJ;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACxC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;IACpE,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CACvE,UAAU,CAAC,EAAE;QACX,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACvB,UAAmC,CAAC,OAAO,IAAI,EAAE,CACnD,CAAA;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG,CAAA;IAC/C,CAAC,CACF,CAAA;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC;QACH,MAAM,iCAAiC,CAAC;YACtC,KAAK;YACL,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,wBAAwB,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CACrD,wBAAwB,CAAC;gBACvB,UAAU,EAAE,YAAY;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,cAAc;gBACd,GAAG;aACJ,CAAC;YACJ,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG;SACJ,CAAC,CAAA;QACF,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,qCAAqC,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;SACX,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,UAA8B,CAAC,EAAE,CAAA;QAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,2BAA2B,EAC3B,KAAK,EACL,GAAG,EAQJ;IACC,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,QAAQ,EAAE,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,GAAG;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,YAAY;QACxB,YAAY;QACZ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,8BAA8B,EAAE,gCAAgC,CAAC;YAC/D,GAAG;YACH,UAAU,EAAE,YAAY;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SACjC,CAAC;QACF,qBAAqB,EAAE,CAAC,2BAA2B,CAAC;QACpD,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC"}