@interop/wallet-core 0.49.0 → 0.51.0

package/dist/clientAnnex/forgetLast.js

@@ -0,0 +1,408 @@
+import { readPublishedLog, relationIds } from '../webvh/didWebvh.js';
+import { clientRemovalTarget } from '../webvh/revokeClient.js';
+import { delegationProofKeyId } from '../webvh/standingZcap.js';
+import { vmFragmentOf } from '../resourceLog/index.js';
+import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
+import { readLogOrThrow } from '../unlock/standingWebvh.js';
+import { recordSignerFromAgent } from '../keyring/record.js';
+import { remintRecoveryDelegations } from '../recovery/recoveryDelegation.js';
+import { ladderVmKeyMultibase } from './ladder.js';
+import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+import { forgetLastWebvhClient, installLadderVmWebvh } from './ladderAnchored.js';
+import { clientAnnexDidParts, clientAnnexLogPinId, delegatedClientsDelegationMinter, delegatedClientsPointer, ensureGenerationDelegationCurrent, generationDelegationHistory, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess } from './log.js';
+/**
+ * The record re-mint stage could not reach every other unlock method's
+ * record, so the removal entry was refused: `failed` names the entries whose
+ * re-mint threw (each carrying its cause), and `unlockMethods` is the whole
+ * stage report. The forgotten client is still enrolled and every stage
+ * before this one has landed, so a re-run resumes at the re-mint. Matched
+ * on `name` (the errors cross app-injected seams that may resolve to another
+ * copy of this package).
+ */
+export class RecordRemintFailedError extends Error {
+    failed;
+    unlockMethods;
+    constructor({ unlockMethods }) {
+        const failed = unlockMethods.outcomes.filter(outcome => outcome.outcome === 'failed');
+        super('did:webvh: the last-client forget could not re-mint the record of ' +
+            `${failed.length} other unlock method(s) (` +
+            failed.map(outcome => `"${outcome.label}"`).join(', ') +
+            '); the removal entry was not published. The client stays enrolled; ' +
+            'run the forget again.');
+        this.name = 'RecordRemintFailedError';
+        this.failed = failed;
+        this.unlockMethods = unlockMethods;
+    }
+}
+/**
+ * Forgets the account's LAST enrolled durable client -- this browser's own
+ * -- transitioning the account to the client-less, ladder-anchored state.
+ * See the module doc for the stage order and the torn-state map. The caller
+ * runs the local wipe only after this resolves. An account with another
+ * enrolled durable client refuses: that forget is the ordinary ceremony
+ * (`forgetDurableClient`), reached first, whose `LastDurableClientForgetError`
+ * is what routes callers here.
+ *
+ * @param options {object}
+ * @param options.logStore {UnlockLogStore}   the credential's delegated
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
+ *   caller is expected to have verified the account log under its own
+ *   chain-head pins in the same session (the ceremony re-reads through the
+ *   seam and checks `expectedDid`, but carries no account-log pin store
+ *   itself)
+ * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
+ * @param options.forgottenClient {RevokedClientKeys}   this client's public
+ *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
+ *   staged key) is re-derived from the log
+ * @param options.forgottenKeyAgreementKeyMultibase {string}   this client's
+ *   identity key-agreement key (the X25519 twin), naming its roster wrap
+ * @param [options.knownLatentHashes] {string[]}   standing latent commitments
+ *   the caller vouches for (the recovery registry's update-key hashes),
+ *   excluded from the staged-hash attribution
+ * @param options.expectedDid {string}   the account DID from the caller's
+ *   stored account pointer
+ * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
+ *   builds the `key-map/user-key.jsonl` roster store whose appends are
+ *   SIGNED BY THE LADDER VM and whose controller view resolves from the
+ *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   license admits), while its HTTP requests invoke under the still-standing
+ *   client
+ * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
+ *   credential's key-agreement key -- the recipient whose wrap survives the
+ *   rotation, reading the fresh key back and unwrapping the generations for
+ *   the fan-out
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster
+ *   read and BEFORE the fan-out
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param options.annex {object}   the generation stage's reach:
+ * @param options.annex.storeFor {Function}
+ *   `({ spaceId, generationId }) => ClientAnnexWriteStore` -- the pointed
+ *   generation's log store, reading and writing under the still-standing
+ *   client's authority
+ * @param options.annex.revoke {Function}   `(delegation) => Promise<void>`
+ *   -- POSTs a revocation (was-client's `WasClient#revoke`, bound by the
+ *   caller; the invocation signs as the still-standing client)
+ * @param options.annex.wasServerUrl {string}   the ACCOUNT Space's storage
+ *   server (the fresh generation delegation's target host)
+ * @param options.annex.accountSpaceId {string}   the ACCOUNT Space's id (the
+ *   fresh delegation's target subtree)
+ * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
+ *   for the pointed generation's read
+ * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
+ *   unlock methods' record re-mint reach (stage 5): the registry entries
+ *   whose bridge (and sibling) the ladder VM re-signs and whose records it
+ *   re-seals through their management zcaps, invoked as the still-standing
+ *   client. Omitted, the stage is skipped and the result carries no
+ *   `unlockMethods` report -- the residue decision 0004's amendment stated.
+ *   Supplied, an entry the pass could not re-mint refuses the removal entry
+ *   (`RecordRemintFailedError`)
+ * @param [options.onBeforeRemoval] {Function}
+ *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
+ *   after the record re-mint stage, immediately before the removal entry,
+ *   with the post-install published state. The caller re-signs the login
+ *   credential's bridge and `delegatedClients` sibling with the ladder VM
+ *   and re-seals its unlock record here. Must be idempotent (a resumed run
+ *   invokes it again)
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<LastDurableClientForgetResult>}
+ */
+export async function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
+    // The pre-install read and the two guards: a client with no remaining
+    // presence means the removal entry already landed (the finish-the-wipe
+    // state the app's next login maps -- nothing here can still invoke), and
+    // an account with another enrolled durable client belongs to the ordinary
+    // forget ceremony.
+    const before = await readLogOrThrow({ store: logStore, expectedDid });
+    const preTarget = await clientRemovalTarget({
+        published: before,
+        client: forgottenClient
+    });
+    if (!preTarget.present) {
+        return {
+            installed: false,
+            rotated: false,
+            collections: { outcomes: {}, failed: [] },
+            generation: { revoked: [], replaced: false, skipped: 'already-removed' },
+            did: before.did,
+            document: before.doc
+        };
+    }
+    const signingVmId = `${before.did}#${forgottenClient.signingKeyMultibase}`;
+    const invocationIds = relationIds(before.doc.capabilityInvocation);
+    if (invocationIds.some(id => id !== signingVmId)) {
+        throw new Error('did:webvh: another enrolled durable client remains; the last-client ' +
+            'transition ceremony does not apply -- run the ordinary forget.');
+    }
+    // Stage 1: the install entry -- the ladder VM in, the client untouched.
+    const install = await installLadderVmWebvh({
+        store: logStore,
+        ladderSeed,
+        expectedDid
+    });
+    // Stage 2: the roster rotation off this client's wrap, ladder-signed and
+    // anchored at the install entry, then stage 3, the collection fan-out --
+    // both HTTP-invoked under this client's still-standing authority. An
+    // already-rotated roster skips the append entirely, so the one-shot
+    // license is never asked for a second append at the same anchor.
+    let rotated = false;
+    let read;
+    let cascade = { outcomes: {}, failed: [] };
+    const rosterStore = rosterStoreFor({ did: install.did, log: install.log });
+    const current = await rosterStore.read();
+    if (current !== null) {
+        const forgottenKid = rosterRecipientKid({
+            signingKeyMultibase: forgottenClient.signingKeyMultibase,
+            keyAgreementKeyMultibase: forgottenKeyAgreementKeyMultibase
+        });
+        let descriptor = current.descriptor;
+        const currentEpoch = (descriptor.epochs ?? []).find(epoch => epoch.id === descriptor.currentEpoch);
+        const wrapped = currentEpoch?.recipients.some(entry => entry.header.kid === forgottenKid);
+        if (wrapped) {
+            descriptor = await rotateUserKeyRoster({
+                store: rosterStore,
+                document: install.doc,
+                retireRecipientId: forgottenKid
+            });
+            rotated = true;
+        }
+        // The fresh key comes back through the credential's standing wrap -- this
+        // client's own is gone from the current epoch -- with the continuity and
+        // possession checks still running on the threaded descriptor.
+        const adopted = await readUserKeyRoster({
+            store: rosterStore,
+            descriptor,
+            ...(userKey ? { userKey } : {}),
+            clientKeyAgreementKey: credentialKeyAgreementKey,
+            pinnedEpochId
+        });
+        if (adopted.rotated) {
+            await onUserKeyAdopted?.({
+                userKey: adopted.userKey,
+                latestEpochId: adopted.latestEpochId,
+                descriptor: adopted.descriptor
+            });
+        }
+        read = { userKey: adopted.userKey, descriptor: adopted.descriptor };
+        cascade = await cascadeCollectionsToUserKey({
+            collectionIds: typeof collections.collectionIds === 'function'
+                ? await collections.collectionIds()
+                : collections.collectionIds,
+            storeFor: collections.storeFor,
+            ...(collections.isEncrypted
+                ? { isEncrypted: collections.isEncrypted }
+                : {}),
+            rosterDescriptor: adopted.descriptor,
+            clientKeyAgreementKey: credentialKeyAgreementKey,
+            userKey: adopted.userKey
+        });
+    }
+    // Stage 4: the generation-delegation replacement and revocations.
+    const generation = await retireLadderGenerationDelegations({
+        doc: install.doc,
+        accountDid: install.did,
+        ladderSeed,
+        annex,
+        now
+    });
+    // Stage 5: the other unlock methods' record re-mint, ladder-signed, with
+    // the forgotten client named as retiring -- the post-install document
+    // still lists it, so without that axis every bridge it signed would read
+    // as standing and be left to rot at the removal entry.
+    let remint;
+    if (unlockMethods !== undefined) {
+        remint = await remintUnlockMethodRecordsAsLadder({
+            doc: install.doc,
+            accountDid: install.did,
+            ladderSeed,
+            retiringSigningKeyMultibase: forgottenClient.signingKeyMultibase,
+            reach: unlockMethods,
+            now
+        });
+        // The one pass that will ever reach these records on a client-less
+        // account: a record it could not re-seal would be left with a bridge the
+        // removal entry rots for good, so the removal is refused instead. The
+        // stages already landed are idempotent and the client still stands, so
+        // the re-run resumes here.
+        if (remint.outcomes.some(outcome => outcome.outcome === 'failed')) {
+            throw new RecordRemintFailedError({ unlockMethods: remint });
+        }
+    }
+    // Stage 6: the record re-bind seam, while the removal has not landed (a
+    // ladder-VM-signed bridge verifies from the install entry on, and the old
+    // client-signed one keeps verifying until the removal -- so a tear on
+    // either side of this callback leaves a working login).
+    await onBeforeRemoval?.({
+        did: install.did,
+        doc: install.doc,
+        log: install.log
+    });
+    // Stage 7: the removal entry -- the client's whole footprint out, the
+    // installed ladder VM keeping the account anchored.
+    const removed = await forgetLastWebvhClient({
+        store: logStore,
+        ladderSeed,
+        forgottenClient,
+        ...(knownLatentHashes ? { knownLatentHashes } : {}),
+        expectedDid
+    });
+    return {
+        installed: install.installed,
+        rotated,
+        collections: cascade,
+        generation,
+        ...(remint ? { unlockMethods: remint } : {}),
+        did: removed.did,
+        document: removed.doc,
+        ...(read
+            ? { userKey: read.userKey, rosterDescriptor: read.descriptor }
+            : {})
+    };
+}
+/**
+ * The generation stage: reads the pointed generation's log, force-replaces
+ * the embedded delegation with a fresh ladder-signed one (so the account
+ * stays transient-login-reachable), then revokes every still-unexpired
+ * delegation the log's history embedded that this credential's ladder VM
+ * signed. Replace-before-revoke is the tear-safety order: the fresh
+ * delegation is never in the pre-replacement history, so the revocation loop
+ * cannot touch it, and a run torn between the two leaves the generation with
+ * a live delegation either way.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the post-install account document
+ * @param options.accountDid {string}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.annex {object}   see {@link forgetLastDurableClient}
+ * @param options.now {number}
+ * @returns {Promise<GenerationDelegationRetirement>}
+ */
+async function retireLadderGenerationDelegations({ doc, accountDid, ladderSeed, annex, now }) {
+    const pointedDid = delegatedClientsPointer({ doc });
+    if (pointedDid === undefined) {
+        return { revoked: [], replaced: false, skipped: 'no-pointer' };
+    }
+    const parts = clientAnnexDidParts({ did: pointedDid });
+    const store = annex.storeFor(parts);
+    const logId = clientAnnexLogPinId(parts);
+    // readPublishedLog only calls getIdResourceRaw, so the narrow seam is safe.
+    const published = await readPublishedLog({
+        idStore: store,
+        expectedDid: pointedDid,
+        ...(annex.pinStore !== undefined ? { pinStore: annex.pinStore, logId } : {})
+    });
+    if (published === undefined) {
+        return { revoked: [], replaced: false, skipped: 'log-unreadable' };
+    }
+    // The doomed set, collected BEFORE the replacement so the fresh delegation
+    // can never join it: every delegation the history embedded whose proof key
+    // is this credential's ladder VM and whose expiry has not passed. An
+    // unparseable or absent expiry counts as unexpired -- fail-safe, since an
+    // unbounded delegation is the worst resurrection credential.
+    const ladderVmKey = await ladderVmKeyMultibase({ ladderSeed });
+    const doomed = generationDelegationHistory({ log: published.log }).filter(delegation => {
+        const proofKeyId = delegationProofKeyId(delegation);
+        const fragment = proofKeyId === undefined ? null : vmFragmentOf(proofKeyId);
+        if (fragment !== ladderVmKey) {
+            return false;
+        }
+        const expires = Date.parse(delegation.expires ?? '');
+        return Number.isNaN(expires) || expires > now;
+    });
+    // The forced replacement first: a ladder-signed fresh delegation under the
+    // reinstalled VM, the annex entry signed by this credential's committed
+    // annex rung. A credential the generation does not commit cannot write the
+    // entry -- the honest skip, leaving the generation delegation-less once
+    // the doomed set is revoked below.
+    let replaced = false;
+    const ladderClient = await ladderVmZcapClient({ accountDid, ladderSeed });
+    try {
+        await ensureGenerationDelegationCurrent({
+            store,
+            ladderSeed,
+            generationId: parts.generationId,
+            mintGenerationDelegation: async ({ clientAnnexDid }) => mintGenerationDelegation({
+                zcapClient: ladderClient,
+                wasServerUrl: annex.wasServerUrl,
+                spaceId: annex.accountSpaceId,
+                clientAnnexDid,
+                now
+            }),
+            expectedDid: pointedDid,
+            force: true,
+            ...(annex.pinStore !== undefined
+                ? { pinStore: annex.pinStore, logId }
+                : {}),
+            now
+        });
+        replaced = true;
+    }
+    catch (err) {
+        if (err.name !== 'ClientAnnexRungUncommittedError') {
+            throw err;
+        }
+    }
+    // The revocations, blind and resumable (400 already-revoked as success).
+    const revoked = [];
+    for (const delegation of doomed) {
+        await revokeTreatingAlreadyRevokedAsSuccess({
+            revoke: annex.revoke,
+            delegation
+        });
+        const id = delegation.id;
+        if (typeof id === 'string') {
+            revoked.push(id);
+        }
+    }
+    return replaced
+        ? { revoked, replaced }
+        : { revoked, replaced, skipped: 'rung-uncommitted' };
+}
+/**
+ * The record re-mint stage: the revocation cascade's re-mint pass over the
+ * other unlock methods' registry entries, with the ladder VM as both the
+ * delegating key (the fresh bridge and sibling) and the record-frame signer
+ * (`ladderVmAgent`'s did:key form, whose multibase the post-install document
+ * lists, so a reader settling the mixed-signer proof against the account
+ * document accepts it after the removal too -- `currentAccountRecordSigners`
+ * is that allowlist), and the forgotten client named as retiring. The sibling
+ * minter reads the annex pointer off the post-install document. The HTTP
+ * side rides the caller's management-zcap clients, still invocable here.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the post-install account document
+ * @param options.accountDid {string}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.retiringSigningKeyMultibase {string}   the forgotten
+ *   client's signing key
+ * @param options.reach {UnlockMethodsRemintReach}
+ * @param options.now {number}
+ * @returns {Promise<object>}   the pass's counts and per-entry outcomes
+ */
+async function remintUnlockMethodRecordsAsLadder({ doc, accountDid, ladderSeed, retiringSigningKeyMultibase, reach, now }) {
+    const ladderClient = await ladderVmZcapClient({ accountDid, ladderSeed });
+    const recordSigner = recordSignerFromAgent({
+        keyAgent: await ladderVmAgent({ ladderSeed })
+    });
+    return remintRecoveryDelegations({
+        doc,
+        entries: reach.entries,
+        pointer: reach.pointer,
+        storageServerUrl: reach.storageServerUrl,
+        zcapClient: ladderClient,
+        recordSigner,
+        managementZcapClient: reach.managementZcapClient,
+        recordEntry: reach.recordEntry,
+        mintDelegatedClientsDelegation: delegatedClientsDelegationMinter({
+            doc,
+            zcapClient: ladderClient,
+            wasServerUrl: reach.pointer.host
+        }),
+        retiringKeyMultibases: [retiringSigningKeyMultibase],
+        now
+    });
+}
+//# sourceMappingURL=forgetLast.js.map

package/dist/clientAnnex/forgetLast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgetLast.js","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AA0FA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EAEpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EACL,yBAAyB,EAG1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,iCAAiC,EACjC,2BAA2B,EAC3B,wBAAwB,EACxB,qCAAqC,EAEtC,MAAM,UAAU,CAAA;AAmEjB;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,MAAM,CAAuB;IAC7B,aAAa,CAErB;IAED,YAAY,EACV,aAAa,EAGd;QACC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAC1C,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CACxC,CAAA;QACD,KAAK,CACH,oEAAoE;YAClE,GAAG,MAAM,CAAC,MAAM,2BAA2B;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,qEAAqE;YACrE,uBAAuB,CAC1B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAsCjB;IACC,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;QAC1C,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,GAAG;SACrB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC1E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,gEAAgE,CACnE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,WAAW;KACZ,CAAC,CAAA;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,WAAW,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;QACzD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;QACV,KAAK;QACL,GAAG;KACJ,CAAC,CAAA;IAEF,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,MAAsD,CAAA;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,MAAM,iCAAiC,CAAC;YAC/C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,UAAU;YACV,2BAA2B,EAAE,eAAe,CAAC,mBAAmB;YAChE,KAAK,EAAE,aAAa;YACpB,GAAG;SACJ,CAAC,CAAA;QACF,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,uBAAuB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,eAAe,EAAE,CAAC;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAA;IAEF,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,KAAK,EACL,GAAG,EAgBJ;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACxC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;IACpE,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CACvE,UAAU,CAAC,EAAE;QACX,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACvB,UAAmC,CAAC,OAAO,IAAI,EAAE,CACnD,CAAA;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG,CAAA;IAC/C,CAAC,CACF,CAAA;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC;QACH,MAAM,iCAAiC,CAAC;YACtC,KAAK;YACL,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,wBAAwB,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CACrD,wBAAwB,CAAC;gBACvB,UAAU,EAAE,YAAY;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,cAAc;gBACd,GAAG;aACJ,CAAC;YACJ,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG;SACJ,CAAC,CAAA;QACF,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,qCAAqC,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;SACX,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,UAA8B,CAAC,EAAE,CAAA;QAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,2BAA2B,EAC3B,KAAK,EACL,GAAG,EAQJ;IACC,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,QAAQ,EAAE,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,GAAG;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,YAAY;QACxB,YAAY;QACZ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,8BAA8B,EAAE,gCAAgC,CAAC;YAC/D,GAAG;YACH,UAAU,EAAE,YAAY;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SACjC,CAAC;QACF,qBAAqB,EAAE,CAAC,2BAA2B,CAAC;QACpD,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC"}

package/dist/{webvh/companionGc.d.ts → clientAnnex/gc.d.ts}

@@ -2,7 +2,7 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * Companion GC: the quarterly wholesale replacement of the companion
+ * Client-annex GC: the quarterly wholesale replacement of the annex
  * generation, and the collection of everything it leaves behind.
  *
  * The ceremony has two halves with different rhythms:
@@ -54,7 +54,7 @@ import type { DIDLog } from '@interop/did-method-webvh';
 import type { ZcapClient } from '@interop/ezcap';
 import type { WasClient } from '@interop/was-client';
 import type { ResourceLogPinStore } from '../resourceLog/pin.js';
-import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from './didWebvh.js';
+import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
 /**
  * The fixed GC cadence: a generation is replaced at the first durable login
  * 90 days after the current pointer value was established. Wallet GC policy
@@ -82,7 +82,7 @@ export declare const GENERATION_QUIET_GRACE_MS: number;
 /**
  * The `versionTime` of the account-log entry that established the CURRENT
  * `#DelegatedClients` pointer value: the newest entry whose state names a
- * different companion DID than the entry before it (or the first entry, when
+ * different annex DID than the entry before it (or the first entry, when
  * the pointer has been there since genesis). This is the cadence's clock --
  * "the pointer-update entry is the record" -- and it is read off the log a
  * durable login has already verified, so the cadence costs no extra fetch
@@ -106,7 +106,7 @@ export declare function delegatedClientsPointerEstablishedAt({ log }: {
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
  */
-export declare function companionGcDue({ log, now }: {
+export declare function clientAnnexGcDue({ log, now }: {
     log: DIDLog;
     now?: number;
 }): boolean;
@@ -119,7 +119,7 @@ export declare function companionGcDue({ log, now }: {
  * swap defers rather than abandoning a possibly-live visit.
  *
  * @param options {object}
- * @param options.log {DIDLog}   the pointed generation's VERIFIED companion
+ * @param options.log {DIDLog}   the pointed generation's VERIFIED annex
  *   log
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
@@ -131,23 +131,23 @@ export declare function generationQuiet({ log, now }: {
 /**
  * What the swap half of one GC pass did. `replaced` is the successful swap;
  * `not-due` and `deferred-live` are the two healthy skips (cadence and quiet
- * bound); `no-pointer` means the account has no companion posture (the whole
+ * bound); `no-pointer` means the account has no annex posture (the whole
  * pass no-ops -- without a pointer there is no auxiliary Space to list);
  * `no-ladder-seed` means the swap was due but the login held no ladder seed
  * to mint with (a non-standing record); `failed` means a swap stage threw --
  * reported in `failed` under the pointed generation's id, with the collect
  * fan-out still run.
  */
-export type CompanionGcSwapOutcome = 'replaced' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
+export type ClientAnnexGcSwapOutcome = 'replaced' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
 /**
- * One GC pass's report: the swap outcome, the companion DID the account
+ * One GC pass's report: the swap outcome, the annex DID the account
  * points at after the pass, the generation ids collected (revoked, digested,
  * deleted), and the per-generation failures. A report with `failed` entries
  * is a resumable success -- the next durable login's pass picks up exactly
  * the generations still listed.
  */
-export interface CompanionGcReport {
-    swap: CompanionGcSwapOutcome;
+export interface ClientAnnexGcReport {
+    swap: ClientAnnexGcSwapOutcome;
     pointedDid?: string;
     collected: string[];
     failed: Array<{
@@ -156,7 +156,7 @@ export interface CompanionGcReport {
     }>;
 }
 /**
- * One companion GC pass: the quarterly swap when due and quiet, then the
+ * One annex GC pass: the quarterly swap when due and quiet, then the
  * predicate-driven collect fan-out over every non-pointed `gen-` collection.
  * See the module header for the stage order and its load-bearing constraints.
  *
@@ -190,14 +190,14 @@ export interface CompanionGcReport {
  *   delete, and a throw keeps the generation for the next pass
  * @param [options.onCollected] {Function}
  *   `({ generationId }) => Promise<void>` -- local cleanup after a
- *   generation's delete (the caller's companion pin-slot drop); a throw is
+ *   generation's delete (the caller's annex pin-slot drop); a throw is
  *   reported but cannot be retried (the collection is already gone)
  * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins for the
  *   account-log re-point and the pointed generation's read
  * @param [options.now] {number}   epoch milliseconds, for tests
- * @returns {Promise<CompanionGcReport>}
+ * @returns {Promise<ClientAnnexGcReport>}
  */
-export declare function runCompanionGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now }: {
+export declare function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now }: {
     was: WasClient;
     wasServerUrl: string;
     accountSpaceId: string;
@@ -217,5 +217,39 @@ export declare function runCompanionGc({ was, wasServerUrl, accountSpaceId, acco
     }) => Promise<void>;
     pinStore?: ResourceLogPinStore;
     now?: number;
-}): Promise<CompanionGcReport>;
-//# sourceMappingURL=companionGc.d.ts.map
+}): Promise<ClientAnnexGcReport>;
+/**
+ * AN OFF-CADENCE GENERATION SWAP: replaces the pointed annex generation
+ * outside the quarterly rhythm -- the credential-rotation ceremony's
+ * fallback when no distinct committed rung can sign a strike entry
+ * (`retireClientAnnexRung`): a fresh generation minted from a SURVIVING
+ * credential's seed commits only that credential's rung-0 hash, so the
+ * retired credential's annex posture dies with the whole generation the
+ * moment the re-point lands. The abandoned generation is an ordinary
+ * non-pointed `gen-` collection the standing collect fan-out picks up at the
+ * next durable login.
+ *
+ * Same four swap stages and ordering as the quarterly GC swap, minus the
+ * cadence and quiet gates (the caller's reason for swapping is authority
+ * removal, not hygiene). The pointed generation's log is read for the revoke
+ * stage's delegation bytes; unreadable, the revoke is skipped and pointer
+ * equality retires the old delegation on a conforming server.
+ *
+ * @param options {object}   see {@link runClientAnnexGc} for the shared
+ *   members ({ was, wasServerUrl, accountSpaceId, account, idStore,
+ *   updateKeys, zcapClient, pinStore }); `ladderSeed` here is the SURVIVING
+ *   credential's seed the fresh generation is minted from
+ * @returns {Promise<string>}   the fresh annex DID
+ */
+export declare function swapClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, pinStore }: {
+    was: WasClient;
+    wasServerUrl: string;
+    accountSpaceId: string;
+    account: Pick<PublishedWebvhLog, 'did' | 'doc'>;
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    zcapClient: ZcapClient;
+    ladderSeed: Uint8Array;
+    pinStore?: ResourceLogPinStore;
+}): Promise<string>;
+//# sourceMappingURL=gc.d.ts.map

package/dist/clientAnnex/gc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAehE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAA2B,CAAA;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,SAAS,GACT,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAA;AAEZ;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmG/B;AA2JD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,CAAA;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BlB"}