@interop/wallet-core 0.53.0 → 0.55.0

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts

@@ -12,19 +12,24 @@
  *    resolution of the orphan-Space tear): re-derivable from the unlock
  *    record's ladder seed, so a tab death here strands nothing a later
  *    login cannot finish or unwind.
- * 2. The ladder-anchored did:webvh genesis
+ * 2. The optional KMS key map (`provideDidWebKeys`), acquired only once the
+ *    Space exists -- the durable ceremony's stage, verbatim: a KMS-keeping
+ *    wallet creates the keystore under the ladder VM's bare did:key and
+ *    writes keys.json and did.json into the Space here. Best-effort: a throw
+ *    is collected and the genesis proceeds keystore-less; a later login's
+ *    heal supplies the missing convenience key.
+ * 3. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
- *    stage: the keystore is DEFERRED to the first durable enrollment (a
- *    ladder-anchored account has no consumer for the convenience VM, and a
- *    keystore under an evaporating identity would orphan).
- * 3. The user-key roster genesis, wrapped to the CREDENTIAL's standing
+ *    `keyAgreement` inventory folded in -- plus, when stage 2 delivered a key
+ *    map, the KMS-held authentication VM under `authentication` only --
+ *    `portable` unchanged.
+ * 4. The user-key roster genesis, wrapped to the CREDENTIAL's standing
  *    key-agreement key -- the only recipient a ladder-anchored account has
  *    -- with the entry proof signed by the ladder VM (the ceremony-tail
  *    license's first-entry shape). The account is credential-recoverable
  *    from the moment this lands.
- * 4. Epoch[0] on every encrypted roster collection -- gated twice, unlike
+ * 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike
  *    the durable flow. The roster stage must have landed, AND the roster's
  *    current epoch must BE the `userKey` this run was handed: the user key
  *    here exists only in this tab's memory, so installing collection epochs
@@ -39,7 +44,7 @@
  *    that recovers the roster's real key is the one installer. With both
  *    gates the tear heal is always clean: no roster means no epochs, and a
  *    fresh user key re-runs both.
- * 5. Space-controller promotion, last -- every earlier stage ran under the
+ * 6. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
  * Idempotent end to end on the durable flow's convention; the did:webvh
@@ -49,7 +54,7 @@
 import { type RecipientPublicKey } from '@interop/was-client/edv';
 import type { WasClient } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
-import type { WebvhIdStore } from '../webvh/didWebvh.js';
+import type { DidWebKeyMapV2, WebvhIdStore } from '../webvh/didWebvh.js';
 import type { UnlockKeyAgreementPublication } from '../unlock/standingWebvh.js';
 import { type UserKey } from '../keys/index.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
@@ -93,6 +98,14 @@ export declare function mintCredentialAnchoredAccountKeySet(): Promise<{
  * @param options.rosterStoreFor {Function}   `({ did }) =>
  *   EncryptionDescriptorStore` -- the user-key roster's store once the DID is
  *   known, with a LADDER-signed `ResourceLogSigner` (the first-entry shape)
+ * @param [options.provideDidWebKeys] {Function}   `() =>
+ *   Promise<DidWebKeyMapV2 | undefined>` -- the KMS key-map acquisition (a
+ *   wallet that keeps a KMS runs its did:web provisioning here, after the
+ *   Space exists, under the ladder VM's bare did:key); absent or resolving
+ *   `undefined`, the genesis is ladder-and-credential-only and no `keys.json`
+ *   is ever written. A throw is collected, not fatal: the genesis proceeds
+ *   keystore-less and a later login heals the document with the convenience
+ *   key
  * @param [options.expectedDid] {string}   the account DID, when the caller
  *   holds a pointer that already names one (a heal re-run); a fresh signup
  *   and a fresh-terminal heal legitimately hold none
@@ -105,7 +118,7 @@ export declare function mintCredentialAnchoredAccountKeySet(): Promise<{
  *   re-bind) passes `false` and promotes after that write
  * @returns {Promise<AccountGenesisResult>}
  */
-export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, expectedDid, accountLogPinStore, onDidPublished, promoteController }: {
+export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideDidWebKeys, expectedDid, accountLogPinStore, onDidPublished, promoteController }: {
     was: WasClient;
     wasServerUrl: string;
     spaceId: string;
@@ -117,6 +130,7 @@ export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerU
     rosterStoreFor: (options: {
         did: string;
     }) => EncryptionDescriptorStore;
+    provideDidWebKeys?: () => Promise<DidWebKeyMapV2 | undefined>;
     expectedDid?: string;
     accountLogPinStore?: ResourceLogPinStore;
     onDidPublished?: (published: {

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0FhC"}
+{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}

package/dist/clientAnnex/credentialAnchoredGenesis.js

@@ -12,19 +12,24 @@
  *    resolution of the orphan-Space tear): re-derivable from the unlock
  *    record's ladder seed, so a tab death here strands nothing a later
  *    login cannot finish or unwind.
- * 2. The ladder-anchored did:webvh genesis
+ * 2. The optional KMS key map (`provideDidWebKeys`), acquired only once the
+ *    Space exists -- the durable ceremony's stage, verbatim: a KMS-keeping
+ *    wallet creates the keystore under the ladder VM's bare did:key and
+ *    writes keys.json and did.json into the Space here. Best-effort: a throw
+ *    is collected and the genesis proceeds keystore-less; a later login's
+ *    heal supplies the missing convenience key.
+ * 3. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
- *    stage: the keystore is DEFERRED to the first durable enrollment (a
- *    ladder-anchored account has no consumer for the convenience VM, and a
- *    keystore under an evaporating identity would orphan).
- * 3. The user-key roster genesis, wrapped to the CREDENTIAL's standing
+ *    `keyAgreement` inventory folded in -- plus, when stage 2 delivered a key
+ *    map, the KMS-held authentication VM under `authentication` only --
+ *    `portable` unchanged.
+ * 4. The user-key roster genesis, wrapped to the CREDENTIAL's standing
  *    key-agreement key -- the only recipient a ladder-anchored account has
  *    -- with the entry proof signed by the ladder VM (the ceremony-tail
  *    license's first-entry shape). The account is credential-recoverable
  *    from the moment this lands.
- * 4. Epoch[0] on every encrypted roster collection -- gated twice, unlike
+ * 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike
  *    the durable flow. The roster stage must have landed, AND the roster's
  *    current epoch must BE the `userKey` this run was handed: the user key
  *    here exists only in this tab's memory, so installing collection epochs
@@ -39,7 +44,7 @@
  *    that recovers the roster's real key is the one installer. With both
  *    gates the tear heal is always clean: no roster means no epochs, and a
  *    fresh user key re-runs both.
- * 5. Space-controller promotion, last -- every earlier stage ran under the
+ * 6. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
  * Idempotent end to end on the durable flow's convention; the did:webvh
@@ -90,6 +95,14 @@ export async function mintCredentialAnchoredAccountKeySet() {
  * @param options.rosterStoreFor {Function}   `({ did }) =>
  *   EncryptionDescriptorStore` -- the user-key roster's store once the DID is
  *   known, with a LADDER-signed `ResourceLogSigner` (the first-entry shape)
+ * @param [options.provideDidWebKeys] {Function}   `() =>
+ *   Promise<DidWebKeyMapV2 | undefined>` -- the KMS key-map acquisition (a
+ *   wallet that keeps a KMS runs its did:web provisioning here, after the
+ *   Space exists, under the ladder VM's bare did:key); absent or resolving
+ *   `undefined`, the genesis is ladder-and-credential-only and no `keys.json`
+ *   is ever written. A throw is collected, not fatal: the genesis proceeds
+ *   keystore-less and a later login heals the document with the convenience
+ *   key
  * @param [options.expectedDid] {string}   the account DID, when the caller
  *   holds a pointer that already names one (a heal re-run); a fresh signup
  *   and a fresh-terminal heal legitimately hold none
@@ -102,7 +115,7 @@ export async function mintCredentialAnchoredAccountKeySet() {
  *   re-bind) passes `false` and promotes after that write
  * @returns {Promise<AccountGenesisResult>}
  */
-export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, expectedDid, accountLogPinStore, onDidPublished, promoteController = true }) {
+export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideDidWebKeys, expectedDid, accountLogPinStore, onDidPublished, promoteController = true }) {
     const failed = [];
     const bootstrap = await ladderVmAgent({ ladderSeed });
     // 1. The Space and its collection roster, create-if-absent under the
@@ -114,19 +127,35 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
     catch (err) {
         throw new AccountGenesisSpaceError({ spaceId, cause: err });
     }
-    // 2. The ladder-anchored did:webvh genesis -- probe, adopt
+    // 2. The optional KMS key map, acquired only once the Space exists (a
+    // KMS-keeping wallet creates the keystore under the ladder VM's bare
+    // did:key and writes keys.json and did.json into the Space here). A throw
+    // degrades to the ladder-and-credential-only genesis rather than aborting:
+    // every later ceremony anchors in the ladder, and a later login heals the
+    // document with the convenience key.
+    let didWebKeys;
+    if (provideDidWebKeys) {
+        try {
+            didWebKeys = await provideDidWebKeys();
+        }
+        catch (err) {
+            failed.push({ stage: 'didWebKeys', error: err });
+        }
+    }
+    // 3. The ladder-anchored did:webvh genesis -- probe, adopt
     // (ladder-attributed), or create-and-publish. Fatal on failure, like the durable stage.
     const { did } = await ensureLadderAnchoredDidWebvh({
         idStore,
         wasServerUrl,
         spaceId,
+        ...(didWebKeys ? { didWebKeys } : {}),
         ladderSeed,
         keyAgreement,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
     });
     await onDidPublished?.({ did });
-    // 3. The roster genesis: epoch[0] IS the user key, wrapped once, to the
+    // 4. The roster genesis: epoch[0] IS the user key, wrapped once, to the
     // credential's standing key-agreement key. The store's ladder-signed
     // genesis append is the ceremony-tail license's first-entry shape.
     let rosterDescriptor;
@@ -145,7 +174,7 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
     catch (err) {
         failed.push({ stage: 'roster', error: err });
     }
-    // 4. Epoch[0] on every encrypted roster collection, only behind a landed
+    // 5. Epoch[0] on every encrypted roster collection, only behind a landed
     // roster whose current epoch IS this run's user key (see the module doc:
     // the user key is memory-only here, and an adopted roster keyed to another
     // run's key would have the collections installed under a throwaway).
@@ -167,7 +196,7 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
                     : {};
         }
     }
-    // 5. The controller promotion, last. The bootstrap client IS the bare
+    // 6. The controller promotion, last. The bootstrap client IS the bare
     // did:key client, so it serves the heal branch too.
     let promotion;
     if (promoteController) {

package/dist/clientAnnex/credentialAnchoredGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAezB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,2DAA2D;IAC3D,wFAAwF;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO;QACP,YAAY;QACZ,OAAO;QACP,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa;gBACX,gBAAgB,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAgBzB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,UAAsC,CAAA;IAC1C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,wFAAwF;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa;gBACX,gBAAgB,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/clientAnnex/heal.d.ts

@@ -0,0 +1,199 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The client-annex generation ensure a TRANSIENT visit runs -- a session
+ * holding nothing but a standing unlock credential (its ladder seed, its
+ * `delegatedClients` sibling delegation, and the standing-client identity
+ * derived from the typed secret). Four durable states make the annex
+ * unreachable from such a visit: the account document carries no
+ * `#DelegatedClients` pointer; the pointed generation's log is gone (GC'd,
+ * or never minted); the embedded generation delegation is expired, inside
+ * its renewal window, or signed by a key the document no longer lists; the
+ * record carries no sibling delegation, or its sibling targets another
+ * Space. On a ladder-anchored account -- the ladder VM a document
+ * verification method, the ladder's rungs the log's update keys -- the visit
+ * itself can mend all four, and this module is the orchestrator: a
+ * converging ensure that detects each state from durable state, mends it
+ * with the existing annex primitives, and reports what ran.
+ *
+ * The ordering rules are the established ones, composed rather than
+ * re-decided:
+ *
+ * - RENEW PRECEDES MINT: a live, verifiable pointed generation is renewed in
+ *   place (`ensureGenerationDelegationCurrent`, the ladder-signed minter);
+ *   only a dead generation -- or one whose log does not commit this
+ *   credential's annex rung (`ClientAnnexRungUncommittedError`, the same
+ *   escape the GC swap's no-committed-survivor arm takes) -- gets a fresh
+ *   mint.
+ * - The PRE-FLIGHT RUNG ATTRIBUTION precedes any mint that will need a
+ *   pointer entry: when no current account-log update key is a rung of this
+ *   ladder, nothing is minted at all -- a generation the pointer entry could
+ *   not then name would only widen the orphan window.
+ * - A fresh generation in an EXISTING Space mirrors the GC swap's stage
+ *   order minus its revoke stage (mint, install the delegation, re-point --
+ *   no transient reach could invoke the old delegation's revocation; the
+ *   pointer move retires it on a conforming server and it otherwise rots on
+ *   its TTL); a fresh SPACE mirrors the credential-anchored genesis
+ *   ordering exactly (Space under the ladder VM's bare did:key, mint
+ *   controller-tier, delegation embed while the Space still answers to the
+ *   bootstrap key, controller flip, then the pointer entry).
+ * - Pointer entries go through the caller's account-log store with
+ *   `logOnly: true`: a bridge-delegated writer has no `did.json` projection
+ *   rights, and the log is the source of truth.
+ *
+ * A fresh sibling delegation (minted when the record carries none, or one
+ * targeting another Space) is handed back through the REQUIRED
+ * `onRebindRecord` seam after the generation and pointer are durable -- the
+ * caller re-seals the unlock record with it, and a run torn before that
+ * re-seal re-derives everything from the ladder seed at the next visit.
+ */
+import type { IZcap } from '@interop/data-integrity-core';
+import type { ZcapClient } from '@interop/ezcap';
+import { WasClient } from '@interop/was-client';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import type { PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ICapabilityAgent } from '../webvh/zcap.js';
+/**
+ * Why the visit cannot mend the annex.
+ *
+ * `'ladder-vm-not-anchored'`: this credential's ladder VM is not a
+ * verification method of the account document, so nothing ladder-signed can
+ * verify. Two distinct states land here: an account with enrolled durable
+ * clients and no ladder VM at all (the self-enrollment's add entry removes
+ * them; the mender there is the step-up ceremony, not this ensure), and a
+ * client-less account anchored on ANOTHER standing credential's ladder --
+ * e.g. a passkey visiting an account the passphrase's ladder anchors, whose
+ * own VM no ceremony has published.
+ *
+ * `'update-key-not-attributable'`: a pointer entry is needed, but no current
+ * account-log update key is a rung derivable from this ladder seed, so the
+ * entry could not be signed.
+ */
+export type ClientAnnexGenerationUnavailableReason = 'ladder-vm-not-anchored' | 'update-key-not-attributable';
+/**
+ * The typed refusal of {@link ensureCredentialClientAnnexGeneration}: the
+ * account is not in a shape this visit can mend, and nothing was written.
+ * Matched on `name` -- error classes do not survive crossing package copies.
+ */
+export declare class ClientAnnexGenerationUnavailableError extends Error {
+    readonly reason: ClientAnnexGenerationUnavailableReason;
+    constructor({ reason, message }: {
+        reason: ClientAnnexGenerationUnavailableReason;
+        message: string;
+    });
+}
+/**
+ * The ladder-signed generation-delegation minter: the
+ * `mintGenerationDelegation` closure shape `ensureGenerationDelegationCurrent`
+ * takes, signing with the credential's ladder VM (`ladderVmZcapClient`) --
+ * the renewal must not depend on the very delegation it replaces, and on a
+ * ladder-anchored account the ladder VM is the one licensed delegator.
+ * Exported on its own: the transient App Connect approval's blocking renewal
+ * stage consumes the same closure.
+ *
+ * @param options {object}
+ * @param options.accountDid {string}   the account did:webvh
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed, from
+ *   its unlock record
+ * @param options.wasServerUrl {string}   the ACCOUNT Space's storage server
+ * @param options.spaceId {string}   the ACCOUNT Space's id (the delegation's
+ *   target subtree)
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Function}   `({ clientAnnexDid }) => Promise<IZcap>`
+ */
+export declare function ladderSignedGenerationDelegationMinter({ accountDid, ladderSeed, wasServerUrl, spaceId, now }: {
+    accountDid: string;
+    ladderSeed: Uint8Array;
+    wasServerUrl: string;
+    spaceId: string;
+    now?: number;
+}): (options: {
+    clientAnnexDid: string;
+}) => Promise<IZcap>;
+/**
+ * What one ensure pass did. Honest skips never throw: a `false` member means
+ * the durable state was already current, not that a stage failed. A
+ * superseded generation's own delegation is never revoked here (no transient
+ * reach could invoke the revocation); the pointer move retires it on a
+ * conforming server, and it otherwise rots on its TTL.
+ */
+export interface ClientAnnexGenerationEnsureOutcome {
+    clientAnnexDid: string;
+    generationDelegation: IZcap;
+    /**
+     * The usable sibling delegation -- the record's own, or the fresh one
+     * `onRebindRecord` was handed.
+     */
+    delegatedClients: IZcap;
+    generationMinted: boolean;
+    spaceMinted: boolean;
+    delegationRenewed: boolean;
+    siblingReminted: boolean;
+}
+/**
+ * Ensures a transient visit can reach a live client-annex generation with a
+ * current generation delegation and a usable sibling delegation, mending
+ * from durable state alone (see the module doc for the states and the stage
+ * orders). A healthy account is a pure no-op report.
+ *
+ * Known residue: the pre-flight rung attribution runs against the SUPPLIED
+ * account view, while the pointer entry's own publish re-reads the log. The
+ * no-orphan guarantee therefore holds against that view; a concurrent
+ * ceremony advancing the rung between the two makes the pointer entry fail
+ * loudly AFTER the mint, leaving an inert unpointed generation this ensure
+ * does not reuse -- the next run converges on a fresh generation, and the
+ * orphan is the standing collect fan-out's to pick up.
+ *
+ * @param options {object}
+ * @param options.wasServerUrl {string}   the account pointer's host
+ * @param options.spaceId {string}   the ACCOUNT Space's id
+ * @param options.account {object}   the VERIFIED account log view
+ *   (`{ did, doc, log }` -- the caller's `verifyAccountLog` read; never
+ *   re-fetched here)
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed, from
+ *   its unlock record
+ * @param options.standingClient {object}   the standing-client identity
+ *   derived from the typed secret: `did` (the sibling delegation's
+ *   controller) and `zcapClient` (its signer, which invokes annex requests
+ *   under the sibling capability)
+ * @param options.bootstrapWasFor {Function}   `({ keyAgent }) => WasClient`
+ *   -- the storage client for the fresh-Space arm, signing as the ladder
+ *   VM's bare did:key (the caller wires the transport; the agent is derived
+ *   here from the ladder seed)
+ * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store (a
+ *   bridge-delegated one suffices: pointer entries publish with
+ *   `logOnly: true`)
+ * @param options.onRebindRecord {Function}
+ *   `({ delegatedClients }) => Promise<void>` -- REQUIRED: re-seals the
+ *   unlock record with the fresh sibling delegation; called whenever one was
+ *   minted, after the generation and pointer are durable
+ * @param [options.delegatedClients] {IZcap}   the record's sibling
+ *   delegation, when the record carries one
+ * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins (a
+ *   transient session passes an in-memory store); slot keys are derived here
+ *   per log
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<ClientAnnexGenerationEnsureOutcome>}
+ */
+export declare function ensureCredentialClientAnnexGeneration(options: {
+    wasServerUrl: string;
+    spaceId: string;
+    account: Pick<PublishedWebvhLog, 'did' | 'doc' | 'log'>;
+    ladderSeed: Uint8Array;
+    standingClient: {
+        did: string;
+        zcapClient: ZcapClient;
+    };
+    bootstrapWasFor: (options: {
+        keyAgent: ICapabilityAgent;
+    }) => WasClient;
+    idStore: WebvhIdStore;
+    onRebindRecord: (options: {
+        delegatedClients: IZcap;
+    }) => Promise<void>;
+    delegatedClients?: IZcap;
+    pinStore?: ResourceLogPinStore;
+    now?: number;
+}): Promise<ClientAnnexGenerationEnsureOutcome>;
+//# sourceMappingURL=heal.d.ts.map

package/dist/clientAnnex/heal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heal.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/heal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAEV,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAoBxD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,sCAAsC,GAChD,wBAAwB,GAAG,6BAA6B,CAAA;AAE1D;;;;GAIG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAA;gBAE3C,EACV,MAAM,EACN,OAAO,EACR,EAAE;QACD,MAAM,EAAE,sCAAsC,CAAA;QAC9C,OAAO,EAAE,MAAM,CAAA;KAChB;CAKF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sCAAsC,CAAC,EACrD,UAAU,EACV,UAAU,EACV,YAAY,EACZ,OAAO,EACP,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,CAAC,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAW1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,EAAE,KAAK,CAAA;IAC3B;;;OAGG;IACH,gBAAgB,EAAE,KAAK,CAAA;IACvB,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;IACpB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,qCAAqC,CAAC,OAAO,EAAE;IAC7D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,UAAU,EAAE,UAAU,CAAA;IACtB,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACvD,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,gBAAgB,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAU9C"}