@interop/wallet-core 0.48.0 → 0.50.0

package/dist/{unlock → clientAnnex}/ladder.d.ts

@@ -1,8 +1,4 @@
-/**
- * The byte length of a ladder seed: 32 random bytes, minted at bind time and
- * carried only inside the unlock record's sealed ladder member.
- */
-export declare const LADDER_SEED_BYTES = 32;
+import type { DIDLog } from '@interop/did-method-webvh';
 /**
  * How many rungs {@link attributeLadderRung} derives before concluding the
  * log commits none of them. Generous: one rung is consumed per
@@ -65,7 +61,7 @@ export declare function ladderRung({ ladderSeed, index }: {
  * published verbatim in the account document (the seed is random, so the
  * hash-commitment rule permits it) and stable across rung spends, so a
  * delegation it signed survives every ladder advance. It carries the
- * client-less window's document-visible authority (`assertionMethod` and
+ * ladder-anchored window's document-visible authority (`assertionMethod` and
  * `capabilityDelegation`), while update authority stays on the rungs -- the
  * two roles never share a key.
  *
@@ -94,43 +90,45 @@ export declare function ladderVmKeyMultibase({ ladderSeed }: {
     ladderSeed: Uint8Array;
 }): Promise<string>;
 /**
- * Derives the 32-byte update-key seed of a companion generation's rung 0 --
- * the credential's STATIC update key on that generation's companion log. The
- * sequence is domain-separated per generation by the collection segment
- * (`<segment>/rung/0` under the one {@link LADDER_SALT}): one shared sequence
- * would hand the storage host, a legitimate reader of the private companion,
+ * Derives the 32-byte update-key seed of an annex generation's rung 0 --
+ * the credential's STATIC update key on that generation's annex log. The
+ * sequence is domain-separated per generation by the generation id
+ * (`<generationId>/rung/0` under the one {@link LADDER_SALT}): one shared
+ * sequence
+ * would hand the storage host, a legitimate reader of the private annex,
  * a revealed key matching the ACCOUNT log's standing commitment, and a fresh
  * per-generation sequence is what makes GC replacement self-healing (no rung
  * index survives the deleted log, and none is needed).
  *
- * The segment is trusted here rather than re-validated -- the companion
- * ceremonies assert the `gen-<random>` shape (`assertGenerationSegment`)
+ * The generation id is trusted here rather than re-validated -- the annex
+ * ceremonies assert the `gen-<random>` shape (`assertGenerationId`)
  * before any derivation, and the label families stay disjoint for any
- * segment regardless (an account-rung label carries exactly one slash).
+ * generation id regardless (an account-rung label carries exactly one
+ * slash).
  *
  * @param options {object}
  * @param options.ladderSeed {Uint8Array}
- * @param options.segment {string}   the generation collection's name
+ * @param options.generationId {string}   the generation collection's name
  * @returns {Uint8Array}
  */
-export declare function companionRungSeed({ ladderSeed, segment }: {
+export declare function clientAnnexRungSeed({ ladderSeed, generationId }: {
     ladderSeed: Uint8Array;
-    segment: string;
+    generationId: string;
 }): Uint8Array;
 /**
- * Derives a companion generation's rung 0 in full: seed and public multibase.
- * Deliberately index-free -- the companion chain has length one, so there is
+ * Derives an annex generation's rung 0 in full: seed and public multibase.
+ * Deliberately index-free -- the annex chain has length one, so there is
  * no rung to advance to and no attribution scan to run (see
- * {@link companionRungSeed}).
+ * {@link clientAnnexRungSeed}).
  *
  * @param options {object}
  * @param options.ladderSeed {Uint8Array}
- * @param options.segment {string}   the generation collection's name
+ * @param options.generationId {string}   the generation collection's name
  * @returns {Promise<{ seed: Uint8Array, keyMultibase: string }>}
  */
-export declare function companionRung({ ladderSeed, segment }: {
+export declare function clientAnnexRung({ ladderSeed, generationId }: {
     ladderSeed: Uint8Array;
-    segment: string;
+    generationId: string;
 }): Promise<{
     seed: Uint8Array;
     keyMultibase: string;
@@ -173,4 +171,82 @@ export declare function attributeLadderRung({ ladderSeed, published, maxScan }:
     rung: LadderRung;
     state: LadderRungState;
 }>;
+/**
+ * Everything of one ladder that currently stands in the published log's
+ * parameters: the revealed rung keys still authorized in `updateKeys` and the
+ * committed hashes the ladder accounts for in `nextKeyHashes` -- including,
+ * for a torn self-enrollment, the hashes the reveal entry committed under the
+ * rung's authority for a client that was never published (its update- and
+ * staged-key hashes), which are as much a latent re-seizure credential as the
+ * rung's own commitment.
+ */
+export interface LadderStandingPosture {
+    revealedKeys: string[];
+    committedHashes: string[];
+}
+/**
+ * Attributes a ladder's FULL standing posture from the log -- the retirement
+ * counterpart of {@link attributeLadderRung}, which recovers only the single
+ * current rung. Retiring a credential must strike every standing artifact its
+ * ladder accounts for, so this walks the log's effective parameters forward
+ * from an anchor (the recorded bind-time rung, however stale) and tracks the
+ * ladder's footprint entry by entry:
+ *
+ * - a newly authorized key whose hash was a known ladder commitment is a rung
+ *   REVEAL; the hashes that entry newly commits are claimed by the ladder,
+ *   as are those of any later entry the ladder itself signed, since the
+ *   rung's authority stood behind them. Hashes an entry signed by some other
+ *   key commits stay OUT, even while the rung sits in `updateKeys`: a rung
+ *   stands revealed indefinitely after a forget (and after a torn
+ *   self-enrollment), and the account's enrolled clients go on extending the
+ *   log the whole time;
+ * - the entry that retires the revealed rung while authorizing a key whose
+ *   hash sits among those claims is the enrollment's COMPLETION: the new
+ *   client's update-key hash and the claim committed immediately after it
+ *   (its staged hash -- a reveal-and-commit entry appends the credential's
+ *   own next commitment LAST among its newly committed hashes, the ordering
+ *   convention in `decisions/0007-ladder-reveal-hash-order.md`) transfer to
+ *   the client and stop being ladder-owned. What the completion did not
+ *   transfer stays ladder-owned only where the ladder can say so POSITIVELY:
+ *   the hash derives from the ladder's own seed (or is the recorded key's),
+ *   or the credential itself survives the completing entry, which is what
+ *   makes the residue its next standing commitment. A SPEND -- the recovery
+ *   continuation, whose one entry retires the code's own posture and
+ *   publishes its successor's -- leaves the replacement credential's
+ *   commitment in that position instead, and striking that would leave the
+ *   replacement unusable and unhealable;
+ * - a claim or revealed key that later leaves the parameters without a
+ *   completion was struck by some other edit and simply stops standing.
+ *
+ * With the ladder seed in hand (`ladderSeed`), every rung's key and hash are
+ * additionally known a priori, so the attribution does not depend on the
+ * anchor being current; without it, the walk is anchored on
+ * `anchorKeyMultibase` and on `credentialVmId` alone, and a residue neither
+ * can attribute is released -- the retirement then strikes what the recorded
+ * posture names and nothing more. More than one ladder reveal standing or
+ * arriving at once matches no legitimate history and fails closed
+ * ({@link LadderAttributionError}).
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   a resolved, caller-verified log
+ * @param options.anchorKeyMultibase {string}   the credential's recorded
+ *   update-key multibase (bind-time rung 0, or a refreshed later rung)
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed,
+ *   when the caller holds it
+ * @param [options.credentialVmId] {string}   the credential's own
+ *   `keyAgreement` verification-method id, which tells a climb (the
+ *   credential stands afterwards) from a spend (its posture goes in the same
+ *   entry)
+ * @param [options.maxScan] {number}   seeded pre-derivation bound; defaults to
+ *   {@link LADDER_MAX_SCAN}
+ * @returns {Promise<LadderStandingPosture>}   what currently stands; both
+ *   arrays empty when the log carries nothing of the ladder any more
+ */
+export declare function attributeLadderPosture({ log, anchorKeyMultibase, ladderSeed, credentialVmId, maxScan }: {
+    log: DIDLog;
+    anchorKeyMultibase: string;
+    ladderSeed?: Uint8Array;
+    credentialVmId?: string;
+    maxScan?: number;
+}): Promise<LadderStandingPosture>;
 //# sourceMappingURL=ladder.d.ts.map

package/dist/clientAnnex/ladder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/ladder.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAwCpE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AA6BD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,UAAU,CAQb;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,UAAU,CAEb;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAElB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,UAAU,EACV,YAAY,EACb,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,UAAU,CAKb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,YAAY,EACb,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAGtD;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAyB,EAC1B,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAmED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,GAAG,EACH,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,OAAyB,EAC1B,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,kBAAkB,EAAE,MAAM,CAAA;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0HjC"}

package/dist/clientAnnex/ladder.js

@@ -0,0 +1,474 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The update-key ladder: a standing unlock credential's latent-and-consumed
+ * did:webvh update authority. Rungs derive deterministically from a random
+ * 32-byte ladder seed carried inside the credential's unlock record -- never
+ * from the unlock secret itself, because a revealed rung lives verbatim in
+ * the world-readable `updateKeys` forever, where no hash commitment can
+ * protect it, so a secret-derived rung would be a standing offline grind
+ * oracle against the credential.
+ *
+ * Between uses only `hash(rung i)` stands in the document's `nextKeyHashes`;
+ * each self-enrollment is one loud reveal-and-commit entry signing with rung
+ * `i` and committing `hash(rung i + 1)`, after which the add entry retires
+ * the spent rung. The credential never holds a standing `updateKeys` member.
+ *
+ * There is no stored counter: which rung is current is recovered by
+ * re-deriving and scanning the published log's standing parameters
+ * ({@link attributeLadderRung}), and ambiguity fails closed rather than
+ * guessing -- the clients-listing attribution precedent. A lost
+ * compare-and-swap race resolves by determinism: the winner's entry commits
+ * `hash(rung i + 1)`, which IS the loser's retry key, so a re-run
+ * re-attributes and climbs one rung.
+ *
+ * The rung derivation is wire-level (both wallet apps must climb the same
+ * ladder from the same seed), so the salt and info labels are permanent.
+ */
+import { deriveNextKeyHash } from '@interop/did-method-webvh';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { effectiveParameters, relationIds, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { LADDER_SEED_BYTES } from '../unlock/unlockRecord.js';
+/**
+ * The HKDF salt for rung derivation and the per-rung info prefix (the rung
+ * index in decimal follows it). Both permanent -- changing either orphans
+ * every bound credential's ladder.
+ */
+const LADDER_SALT = 'freewallet/unlock/update-ladder/v1';
+const LADDER_RUNG_INFO_PREFIX = 'rung/';
+/**
+ * The info label of the ladder VM -- the stable sibling key published in the
+ * account document while the account has no enrolled durable client. One salt
+ * for everything ladder-seed-derived, with the info namespace doing the
+ * separation: `vm` can never collide with a `rung/<n>` label. Permanent.
+ */
+const LADDER_VM_INFO = 'vm';
+/**
+ * The info-label suffix of a client-annex rung: the label is
+ * `<generationId>/rung/<k>` where `<generationId>` is the generation
+ * collection's name
+ * (`gen-<random>`) and `k` is pinned at 0 -- the annex log's update
+ * authority is each standing credential's STATIC rung 0 (chain length one,
+ * never advanced), so only `/rung/0` is ever derived. The three families
+ * under the one salt stay disjoint: `rung/<n>` labels carry exactly one
+ * slash followed by a decimal index, `vm` carries none, and an annex
+ * label always carries two slashes behind its `gen-` generation id.
+ * Permanent.
+ */
+const CLIENT_ANNEX_RUNG_INFO_SUFFIX = '/rung/0';
+/**
+ * How many rungs {@link attributeLadderRung} derives before concluding the
+ * log commits none of them. Generous: one rung is consumed per
+ * self-enrollment, so a real ladder's standing commitment sits at the number
+ * of self-enrollments the credential has ever performed.
+ */
+export const LADDER_MAX_SCAN = 128;
+/**
+ * Thrown when the published log's standing parameters match no derivable rung
+ * -- the credential's posture was revoked (or never published), the ladder
+ * seed does not belong to this account, or the scan bound was exceeded -- or
+ * when they match more than one rung in the same role, which no legitimate
+ * history produces. Self-enrollment refuses loudly rather than guessing.
+ */
+export class LadderAttributionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LadderAttributionError';
+    }
+}
+/**
+ * Generates a fresh random ladder seed.
+ *
+ * @returns {Uint8Array}
+ */
+export function generateLadderSeed() {
+    return crypto.getRandomValues(new Uint8Array(LADDER_SEED_BYTES));
+}
+/**
+ * The one HKDF invocation of the ladder derivation family. Every
+ * ladder-seed-derived key (rungs, the ladder VM) comes through here, so the
+ * permanent wire-level triple -- SHA-256, {@link LADDER_SALT}, 32 bytes --
+ * lives in exactly one place and only the info label varies.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.info {string}
+ * @returns {Uint8Array}
+ */
+function ladderDerive({ ladderSeed, info }) {
+    return hkdf(sha256, ladderSeed, new TextEncoder().encode(LADDER_SALT), new TextEncoder().encode(info), 32);
+}
+/**
+ * Derives the 32-byte update-key seed of rung `index`.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Uint8Array}
+ */
+export function ladderRungSeed({ ladderSeed, index }) {
+    if (!Number.isInteger(index) || index < 0) {
+        throw new Error(`Invalid ladder rung index "${String(index)}".`);
+    }
+    return ladderDerive({
+        ladderSeed,
+        info: `${LADDER_RUNG_INFO_PREFIX}${index}`
+    });
+}
+/**
+ * Derives rung `index` in full: seed and public multibase.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Promise<LadderRung>}
+ */
+export async function ladderRung({ ladderSeed, index }) {
+    const seed = ladderRungSeed({ ladderSeed, index });
+    return { index, seed, keyMultibase: await updateKeyMultibase({ seed }) };
+}
+/**
+ * Derives the 32-byte Ed25519 seed of the ladder VM -- the STABLE SIBLING: a
+ * dedicated key derived once from the ladder seed, distinct from every rung,
+ * published verbatim in the account document (the seed is random, so the
+ * hash-commitment rule permits it) and stable across rung spends, so a
+ * delegation it signed survives every ladder advance. It carries the
+ * ladder-anchored window's document-visible authority (`assertionMethod` and
+ * `capabilityDelegation`), while update authority stays on the rungs -- the
+ * two roles never share a key.
+ *
+ * Because the key is derived, removing its verification method is never the
+ * terminal remedy: a later reinstall republishes the same key under the same
+ * id, and any still-unexpired delegation it signed resumes verifying the
+ * moment the method returns. Revoking the delegations themselves (and,
+ * ultimately, rotating the credential) is what actually ends its authority.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Uint8Array}
+ */
+export function ladderVmSeed({ ladderSeed }) {
+    return ladderDerive({ ladderSeed, info: LADDER_VM_INFO });
+}
+/**
+ * The ladder VM's public key multibase, as the document publishes it (see
+ * {@link ladderVmSeed} for what the key is).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Promise<string>}
+ */
+export async function ladderVmKeyMultibase({ ladderSeed }) {
+    return updateKeyMultibase({ seed: ladderVmSeed({ ladderSeed }) });
+}
+/**
+ * Derives the 32-byte update-key seed of an annex generation's rung 0 --
+ * the credential's STATIC update key on that generation's annex log. The
+ * sequence is domain-separated per generation by the generation id
+ * (`<generationId>/rung/0` under the one {@link LADDER_SALT}): one shared
+ * sequence
+ * would hand the storage host, a legitimate reader of the private annex,
+ * a revealed key matching the ACCOUNT log's standing commitment, and a fresh
+ * per-generation sequence is what makes GC replacement self-healing (no rung
+ * index survives the deleted log, and none is needed).
+ *
+ * The generation id is trusted here rather than re-validated -- the annex
+ * ceremonies assert the `gen-<random>` shape (`assertGenerationId`)
+ * before any derivation, and the label families stay disjoint for any
+ * generation id regardless (an account-rung label carries exactly one
+ * slash).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.generationId {string}   the generation collection's name
+ * @returns {Uint8Array}
+ */
+export function clientAnnexRungSeed({ ladderSeed, generationId }) {
+    return ladderDerive({
+        ladderSeed,
+        info: `${generationId}${CLIENT_ANNEX_RUNG_INFO_SUFFIX}`
+    });
+}
+/**
+ * Derives an annex generation's rung 0 in full: seed and public multibase.
+ * Deliberately index-free -- the annex chain has length one, so there is
+ * no rung to advance to and no attribution scan to run (see
+ * {@link clientAnnexRungSeed}).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.generationId {string}   the generation collection's name
+ * @returns {Promise<{ seed: Uint8Array, keyMultibase: string }>}
+ */
+export async function clientAnnexRung({ ladderSeed, generationId }) {
+    const seed = clientAnnexRungSeed({ ladderSeed, generationId });
+    return { seed, keyMultibase: await updateKeyMultibase({ seed }) };
+}
+/**
+ * Recovers the ladder's current rung from the published log's standing
+ * parameters -- the counter recovery that replaces any stored counter. Scans
+ * rungs `0..maxScan - 1`; a rung whose key stands in `updateKeys` is a torn
+ * self-enrollment to resume (`'revealed'`), else a rung whose hash stands in
+ * `nextKeyHashes` is the standing commitment (`'committed'`). Exactly one
+ * revealed rung, or exactly one committed rung beside it, is legitimate --
+ * the reveal entry keeps the spent rung's hash committed so a resumed run can
+ * re-state it, which is why a revealed rung wins over a committed one.
+ * Anything else fails closed with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.published {object}   the resolved log's standing parameters
+ * @param options.published.updateKeys {string[]}
+ * @param options.published.nextKeyHashes {string[]}
+ * @param [options.maxScan] {number}   how many rungs to derive before giving
+ *   up; defaults to {@link LADDER_MAX_SCAN}
+ * @returns {Promise<{ rung: LadderRung, state: LadderRungState }>}
+ */
+export async function attributeLadderRung({ ladderSeed, published, maxScan = LADDER_MAX_SCAN }) {
+    const revealed = [];
+    const committed = [];
+    for (let index = 0; index < maxScan; index++) {
+        const rung = await ladderRung({ ladderSeed, index });
+        if (published.updateKeys.includes(rung.keyMultibase)) {
+            revealed.push(rung);
+        }
+        else if (published.nextKeyHashes.includes(await deriveNextKeyHash(rung.keyMultibase))) {
+            committed.push(rung);
+        }
+    }
+    if (revealed.length > 1 || committed.length > 1) {
+        throw new LadderAttributionError('The published log commits more than one rung of this ladder in the ' +
+            'same role; refusing to self-enroll on an ambiguous attribution.');
+    }
+    if (revealed.length === 1) {
+        return { rung: revealed[0], state: 'revealed' };
+    }
+    if (committed.length === 1) {
+        return { rung: committed[0], state: 'committed' };
+    }
+    throw new LadderAttributionError('The published log commits no rung of this ladder; the credential has ' +
+        'been revoked, was never published, or does not belong to this account.');
+}
+/**
+ * Whether a log entry was signed by a key this ladder accounts for. A
+ * did:webvh entry proof names its key as `did:key:<multibase>#<multibase>`
+ * -- the id form the resolver matches against the entry's authorized
+ * `updateKeys` -- so the fragment IS the update-key multibase. The log is
+ * caller-verified, so a proof standing here has already been checked against
+ * the authorized set; this only asks whose it was.
+ *
+ * @param options {object}
+ * @param options.entry {DIDLogEntry | undefined}
+ * @param options.ladderKeys {Set<string>}   the rung keys known so far
+ * @returns {boolean}
+ */
+function ladderSigned({ entry, ladderKeys }) {
+    return (entry?.proof ?? []).some(proof => {
+        const keyMultibase = proof.verificationMethod?.split('#')[1];
+        return keyMultibase !== undefined && ladderKeys.has(keyMultibase);
+    });
+}
+/**
+ * Whether the document an entry publishes still carries the retiring
+ * credential's own `keyAgreement` verification method -- asked at the entry
+ * that completes an enrollment the ladder's rung revealed, where it is the
+ * test of whether the CREDENTIAL survives its own ceremony. A self-enrollment
+ * leaves the credential's posture untouched (it climbs to the next rung),
+ * while a spend -- the recovery continuation, whose add-and-retire entry
+ * strikes the code's posture and publishes its successor's -- ends it.
+ *
+ * With no id supplied the question cannot be asked, so the answer is a
+ * conservative `false`: a claim the ladder cannot attribute is released rather
+ * than struck.
+ *
+ * @param options {object}
+ * @param options.entry {DIDLogEntry | undefined}
+ * @param options.vmId {string | undefined}   the credential's key-agreement
+ *   verification-method id, where the caller supplied one
+ * @returns {boolean}
+ */
+function credentialSurvives({ entry, vmId }) {
+    if (vmId === undefined || !entry?.state) {
+        return false;
+    }
+    // The `keyAgreement` RELATION alone, rather than the bare
+    // `verificationMethod` array: an entry that dereferences the method while
+    // leaving its object behind has ended the credential's posture, and reading
+    // that as a climb would claim -- and strike -- a successor credential's
+    // commitment.
+    return relationIds(entry.state.keyAgreement).includes(vmId);
+}
+/**
+ * Attributes a ladder's FULL standing posture from the log -- the retirement
+ * counterpart of {@link attributeLadderRung}, which recovers only the single
+ * current rung. Retiring a credential must strike every standing artifact its
+ * ladder accounts for, so this walks the log's effective parameters forward
+ * from an anchor (the recorded bind-time rung, however stale) and tracks the
+ * ladder's footprint entry by entry:
+ *
+ * - a newly authorized key whose hash was a known ladder commitment is a rung
+ *   REVEAL; the hashes that entry newly commits are claimed by the ladder,
+ *   as are those of any later entry the ladder itself signed, since the
+ *   rung's authority stood behind them. Hashes an entry signed by some other
+ *   key commits stay OUT, even while the rung sits in `updateKeys`: a rung
+ *   stands revealed indefinitely after a forget (and after a torn
+ *   self-enrollment), and the account's enrolled clients go on extending the
+ *   log the whole time;
+ * - the entry that retires the revealed rung while authorizing a key whose
+ *   hash sits among those claims is the enrollment's COMPLETION: the new
+ *   client's update-key hash and the claim committed immediately after it
+ *   (its staged hash -- a reveal-and-commit entry appends the credential's
+ *   own next commitment LAST among its newly committed hashes, the ordering
+ *   convention in `decisions/0007-ladder-reveal-hash-order.md`) transfer to
+ *   the client and stop being ladder-owned. What the completion did not
+ *   transfer stays ladder-owned only where the ladder can say so POSITIVELY:
+ *   the hash derives from the ladder's own seed (or is the recorded key's),
+ *   or the credential itself survives the completing entry, which is what
+ *   makes the residue its next standing commitment. A SPEND -- the recovery
+ *   continuation, whose one entry retires the code's own posture and
+ *   publishes its successor's -- leaves the replacement credential's
+ *   commitment in that position instead, and striking that would leave the
+ *   replacement unusable and unhealable;
+ * - a claim or revealed key that later leaves the parameters without a
+ *   completion was struck by some other edit and simply stops standing.
+ *
+ * With the ladder seed in hand (`ladderSeed`), every rung's key and hash are
+ * additionally known a priori, so the attribution does not depend on the
+ * anchor being current; without it, the walk is anchored on
+ * `anchorKeyMultibase` and on `credentialVmId` alone, and a residue neither
+ * can attribute is released -- the retirement then strikes what the recorded
+ * posture names and nothing more. More than one ladder reveal standing or
+ * arriving at once matches no legitimate history and fails closed
+ * ({@link LadderAttributionError}).
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   a resolved, caller-verified log
+ * @param options.anchorKeyMultibase {string}   the credential's recorded
+ *   update-key multibase (bind-time rung 0, or a refreshed later rung)
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed,
+ *   when the caller holds it
+ * @param [options.credentialVmId] {string}   the credential's own
+ *   `keyAgreement` verification-method id, which tells a climb (the
+ *   credential stands afterwards) from a spend (its posture goes in the same
+ *   entry)
+ * @param [options.maxScan] {number}   seeded pre-derivation bound; defaults to
+ *   {@link LADDER_MAX_SCAN}
+ * @returns {Promise<LadderStandingPosture>}   what currently stands; both
+ *   arrays empty when the log carries nothing of the ladder any more
+ */
+export async function attributeLadderPosture({ log, anchorKeyMultibase, ladderSeed, credentialVmId, maxScan = LADDER_MAX_SCAN }) {
+    const anchorHash = await deriveNextKeyHash(anchorKeyMultibase);
+    const ladderKeys = new Set([anchorKeyMultibase]);
+    // What the ladder knows a priori: the recorded key's hash and, with the
+    // seed in hand, every rung's. A claim outside this set is held on the
+    // evidence of the entry that committed it, and released again when a
+    // completion shows it was never the ladder's.
+    const derivedHashes = new Set([anchorHash]);
+    const ladderHashes = new Set([anchorHash]);
+    if (ladderSeed) {
+        for (let index = 0; index < maxScan; index++) {
+            const rung = await ladderRung({ ladderSeed, index });
+            ladderKeys.add(rung.keyMultibase);
+            const rungHash = await deriveNextKeyHash(rung.keyMultibase);
+            derivedHashes.add(rungHash);
+            ladderHashes.add(rungHash);
+        }
+    }
+    const params = effectiveParameters(log);
+    let pending;
+    let prevUpdateKeys = new Set();
+    let prevHashes = new Set();
+    for (const [index, entry] of params.entries()) {
+        const currentUpdateKeys = new Set(entry.updateKeys);
+        const addedKeys = entry.updateKeys.filter(key => !prevUpdateKeys.has(key));
+        // Order-preserving on purpose: the completion transfer below reads the
+        // claim committed immediately after the client's update-key hash as its
+        // staged hash (the reveal entry's append order, a ratified convention).
+        const addedHashes = entry.nextKeyHashes.filter(hash => !prevHashes.has(hash));
+        // Completion first: the pending revealed rung left `updateKeys`. When the
+        // same entry authorizes a key whose hash sits among the reveal's claims,
+        // the enrollment completed -- that hash and its successor (the client's
+        // staged hash) transfer to the client. A rung leaving any other way was
+        // struck, and its claims simply stop standing.
+        if (pending && !currentUpdateKeys.has(pending.key)) {
+            const transferred = new Set();
+            for (const key of addedKeys) {
+                const at = pending.claims.indexOf(await deriveNextKeyHash(key));
+                if (at === -1) {
+                    continue;
+                }
+                transferred.add(pending.claims[at]);
+                const staged = pending.claims[at + 1];
+                if (staged !== undefined) {
+                    transferred.add(staged);
+                }
+                break;
+            }
+            // What the reveal committed and the completion did not transfer is
+            // ladder-owned only on positive attribution -- a hash the ladder
+            // derives itself, or any residue of a ceremony the credential came out
+            // of still standing (a climb, whose residue really is its next rung's
+            // commitment). A spend's residue is its SUCCESSOR's commitment, and
+            // striking that is silent, unhealable damage: the replacement keeps its
+            // verification method and its roster wrap, and only fails when someone
+            // finally types it.
+            const stands = credentialSurvives({
+                entry: log[index],
+                vmId: credentialVmId
+            });
+            for (const hash of pending.claims) {
+                if (transferred.has(hash) || !(stands || derivedHashes.has(hash))) {
+                    ladderHashes.delete(hash);
+                }
+            }
+            pending = undefined;
+        }
+        // A newly authorized key matching a known ladder commitment is a reveal.
+        const reveals = [];
+        for (const key of addedKeys) {
+            if (ladderKeys.has(key) ||
+                ladderHashes.has(await deriveNextKeyHash(key))) {
+                reveals.push(key);
+            }
+        }
+        if (reveals.length > 1 || (reveals.length === 1 && pending)) {
+            throw new LadderAttributionError('The published log reveals more than one rung of this ladder at ' +
+                'once; refusing to attribute an ambiguous history.');
+        }
+        if (reveals.length === 1) {
+            const key = reveals[0];
+            ladderKeys.add(key);
+            pending = { key, claims: [...addedHashes] };
+            for (const hash of addedHashes) {
+                ladderHashes.add(hash);
+            }
+        }
+        else if (pending && ladderSigned({ entry: log[index], ladderKeys })) {
+            // The rung is still revealed AND signed this entry, so the hashes it
+            // commits were committed under the rung's authority (the
+            // ladder-anchored window's separate commit entry) and join its claims.
+            // Signature, not mere presence in `updateKeys`, is what attributes
+            // them: the rung's reveal outlives the ceremony that revealed it, so
+            // claiming everything committed afterwards would sweep up hashes of
+            // other credentials and of racing enrollments -- and striking those on
+            // retirement is silent, unhealable damage.
+            pending.claims.push(...addedHashes);
+            for (const hash of addedHashes) {
+                ladderHashes.add(hash);
+            }
+        }
+        prevUpdateKeys = currentUpdateKeys;
+        prevHashes = new Set(entry.nextKeyHashes);
+    }
+    const final = params[params.length - 1] ?? {
+        updateKeys: [],
+        nextKeyHashes: []
+    };
+    return {
+        revealedKeys: final.updateKeys.filter(key => ladderKeys.has(key)),
+        committedHashes: final.nextKeyHashes.filter(hash => ladderHashes.has(hash))
+    };
+}
+//# sourceMappingURL=ladder.js.map

package/dist/clientAnnex/ladder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.js","sourceRoot":"","sources":["../../src/clientAnnex/ladder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D;;;;GAIG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAA;AACxD,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAG,SAAS,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,EACpB,UAAU,EACV,IAAI,EAIL;IACC,OAAO,IAAI,CACT,MAAM,EACN,UAAU,EACV,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACrC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,EAAE,CACH,CAAA;AACH,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,UAAU;QACV,IAAI,EAAE,GAAG,uBAAuB,GAAG,KAAK,EAAE;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EAIN;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,UAAU,EAGX;IACC,OAAO,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,UAAU,EAGX;IACC,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,UAAU,EACV,YAAY,EAIb;IACC,OAAO,YAAY,CAAC;QAClB,UAAU;QACV,IAAI,EAAE,GAAG,YAAY,GAAG,6BAA6B,EAAE;KACxD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,YAAY,EAIb;IACC,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACnE,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAO,GAAG,eAAe,EAK1B;IACC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAiB,EAAE,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;aAAM,IACL,SAAS,CAAC,aAAa,CAAC,QAAQ,CAC9B,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAC3C,EACD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE;YACnE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;QACrE,wEAAwE,CAC3E,CAAA;AACH,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;IACC,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvC,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5D,OAAO,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,kBAAkB,CAAC,EAC1B,KAAK,EACL,IAAI,EAIL;IACC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,0DAA0D;IAC1D,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,cAAc;IACd,OAAO,WAAW,CAChB,KAAK,CAAC,KAAK,CAAC,YAA2D,CACxE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,GAAG,EACH,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,OAAO,GAAG,eAAe,EAO1B;IACC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,kBAAkB,CAAC,CAAC,CAAA;IACxD,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,8CAA8C;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3D,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC3B,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,OAAsD,CAAA;IAC1D,IAAI,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,IAAI,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAC5C,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAC9B,CAAA;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;YACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC/D,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACd,SAAQ;gBACV,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;gBACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACzB,CAAC;gBACD,MAAK;YACP,CAAC;YACD,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,oBAAoB;YACpB,MAAM,MAAM,GAAG,kBAAkB,CAAC;gBAChC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,cAAc;aACrB,CAAC,CAAA;YACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAClE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,GAAG,SAAS,CAAA;QACrB,CAAC;QAED,yEAAyE;QACzE,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IACE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnB,YAAY,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,sBAAsB,CAC9B,iEAAiE;gBAC/D,mDAAmD,CACtD,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;YACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACnB,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAA;YAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACtE,qEAAqE;YACrE,yDAAyD;YACzD,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,2CAA2C;YAC3C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;YACnC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,cAAc,GAAG,iBAAiB,CAAA;QAClC,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI;QACzC,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,EAAE;KAClB,CAAA;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjE,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC5E,CAAA;AACH,CAAC"}