@interop/wallet-core 0.55.0 → 0.57.0

package/dist/clientAnnex/establish.d.ts

@@ -0,0 +1,401 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The credential-anchored establishment: everything between a derived unlock
+ * credential and an account a transient login can enter, with no durable
+ * client minted anywhere. One orchestrator serves the fresh signup and the
+ * login-time re-run alike -- every stage is an ensure, so a run torn at any
+ * point converges by running the whole thing again (the account log is
+ * adopted by ladder attribution, never re-created: `createDID` timestamps
+ * the genesis entry, so a naive re-create would mint a different SCID).
+ *
+ * The stage order, with the load-bearing ordering rules folded in:
+ *
+ * 1. The interim bridge and the FIRST bind, through the required
+ *    `bindRecord` hook: the standing-layout unlock record -- ladder seed
+ *    sealed in, pointer still DID-less, the bridge delegated by the ladder
+ *    VM's bare did:key (functional until promotion; superseded by the
+ *    re-bind) -- is durably written BEFORE the Space is created and before
+ *    the genesis entry publishes rung 0 (the transposed
+ *    persist-before-publish rule: a published rung nobody can re-derive is
+ *    the orphan brick). CONDITIONAL: skipped when the caller passed
+ *    `priorCreatedAt` from a standing keyring hit -- the record already
+ *    carries the ladder seed, and re-writing it DID-less would let a
+ *    concurrent heal downgrade a sibling browser's completed re-bind
+ *    moments before dying on the promoted Space, a permanent lockout.
+ * 2. `ensureCredentialAnchoredAccountGenesis` under the ladder VM's bare
+ *    did:key as bootstrap controller, promotion deferred
+ *    (`promoteController: false`): Space + collections, the optional KMS key
+ *    map (`provideDidWebKeys`, an opaque best-effort thunk the caller owns),
+ *    the one-entry ladder-anchored did:webvh genesis with the credential's
+ *    `keyAgreement` publication folded in, the roster's epoch[0] wrapped to
+ *    the credential's standing key-agreement key with a ladder-signed entry
+ *    proof, and the collection epochs. The ceremony installs collection
+ *    epochs only when the roster's current epoch IS the candidate key it was
+ *    handed (`epochsSkipped` otherwise); its roster and epoch failures are
+ *    FATAL here, before anything names the DID, so the tear is the heal-able
+ *    kind (a DID-less record) rather than a registry sealed under a key only
+ *    this tab ever held.
+ *    2c. The adopted-roster arm: a re-run that adopted an earlier run's
+ *    roster recovers the real user key from the credential's standing wrap
+ *    and completes the collection epochs under it -- the one installer,
+ *    through the shared mint-policy stage (`ensureRosterDeliveredEpochs`):
+ *    epochs install under the key the roster DELIVERS, never the minted
+ *    candidate.
+ * 3. The annex generation block (`ensurePointedClientAnnexGeneration`),
+ *    gated on no `#DelegatedClients` pointer: the annex Space resolved in
+ *    the settled order (document pointer, else the record's sibling's
+ *    target, else mint fresh), the generation minted under the bootstrap
+ *    identity, the ladder-VM-signed generation delegation embedded while
+ *    the auxiliary Space still answers to the bootstrap did:key, the
+ *    Space's controller flipped to the account DID, and the pointer entry
+ *    appended -- signed by ladder attribution of the currently revealed
+ *    rung, under the caller's chain-head pin. Within THIS ceremony the
+ *    sibling arm never fires: the sibling is only written by stage 4,
+ *    strictly after the pointer entry, so a stage-3 tear leaves no
+ *    sibling; the arm serves callers holding a standing invocation
+ *    authority (the add/change-method fold), and the establishment's own
+ *    bootstrap authority falls back to a fresh mint when a sibling-named
+ *    Space refuses it.
+ *    The revealed-rung attribution runs before this block and strictly
+ *    before the re-bind: an account whose document no longer anchors this
+ *    ladder refuses while the record is still in its pre-re-bind shape.
+ * 4. The re-bind, through the same `bindRecord` hook: the full pointer (DID
+ *    in), the ladder-VM-signed bridge and annex-Space sibling, and the
+ *    management delegation to the account DID -- durably written BEFORE
+ *    promotion, so the next login signs under the promoted controller only
+ *    once the record says to.
+ * 5. The caller's `beforePromotion` hook (freewallet: the unlock-methods
+ *    registry write), run under the bootstrap did:key -- the last window
+ *    where a root invocation works. NOT swallowed here: a throw fails the
+ *    establishment; a hook that must be best-effort swallows its own
+ *    failures.
+ * 6. The Space-controller promotion onto the account DID, last -- and, when
+ *    the caller's KMS stage bound a keystore this run, the best-effort
+ *    keystore-controller promotion beside it (`promoteKeystore`).
+ *
+ * The caller (the signup, or a login-time heal) then enters the account
+ * through its ordinary transient composition. Known residue: a tear inside
+ * stage 3 before the pointer entry can orphan a live annex Space nothing
+ * enumerates (the annex Space id is a random mint nothing re-derives), and
+ * within this ceremony each torn attempt orphans one -- no record names the
+ * Space until stage 4's sibling, so an establishment re-run cannot converge
+ * onto it and mints another. And a tear between the re-bind and the promotion
+ * on a KMS deployment strands the keystore's controller on the ladder's
+ * bare did:key -- outside the current-key-set rule -- with no mender here;
+ * an open gap owned by the did:web-stage collapse.
+ */
+import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
+import type { WasClient } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import type { ZcapClient } from '@interop/ezcap';
+import { type AccountGenesisResult } from '../genesis/accountGenesis.js';
+import type { ClientWebvhUpdateKeys, DidWebKeyMapV2, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ICapabilityAgent } from '../webvh/zcap.js';
+import type { AccountPointer } from '../keyring/record.js';
+import { type UserKey } from '../keys/index.js';
+/**
+ * The standing members an unlock-methods registry entry records for the
+ * established credential: its roster kid and key-agreement multibase, the
+ * bind-time revealed rung, the standing client's did:key, the bridge and
+ * sibling delegations' signer key ids and expiries, and the unlock
+ * key-agreement members the re-bind reported. The member names are the ones
+ * the registry already records; nothing here mints a new field.
+ */
+export interface CredentialAnchoredStandingFields {
+    rosterKid: string;
+    keyAgreementKeyMultibase: string;
+    updateKeyMultibase: string;
+    unlockClientDid: string;
+    delegationKeyId?: string;
+    delegationExpires?: string;
+    delegatedClientsKeyId?: string;
+    delegatedClientsExpires?: string;
+    unlockKeyAgreementKeyId?: string;
+    unlockKeyAgreementKeyMultibase?: string;
+}
+/**
+ * What the establishment hands back for the callers' tails: the published
+ * DID, the record's unlock Space id and management zcap, the standing fields
+ * a registry entry records, and the report members -- the genesis's
+ * `epochsSkipped` marker and the best-effort stages' collected failures
+ * (`didWebKeys`, `keystorePromotion`).
+ */
+export interface CredentialAnchoredEstablishment {
+    did: string;
+    unlockSpaceId: string;
+    manageCapability?: IZcap;
+    standingFields: CredentialAnchoredStandingFields;
+    epochsSkipped?: AccountGenesisResult['epochsSkipped'];
+    failed: Array<{
+        stage: 'didWebKeys' | 'keystorePromotion';
+        error: unknown;
+    }>;
+}
+/**
+ * What the `bindRecord` hook must return: the bind's freshness stamp (the
+ * re-bind's `priorCreatedAt` thread), and -- the standing-layout assertion's
+ * observable half -- the record's unlock Space id, with the management zcap
+ * and unlock key-agreement members when the bind minted them.
+ */
+export interface CredentialAnchoredBindResult {
+    createdAt: string;
+    unlockSpaceId: string;
+    manageCapability?: IZcap;
+    unlockKeyAgreementKeyId?: string;
+    unlockKeyAgreementKeyMultibase?: string;
+}
+/**
+ * The unlock-record codec closure the caller supplies (freewallet:
+ * `bindCredentialAnchoredUnlockSecret`), called at most twice -- the first
+ * bind and the re-bind -- with the ceremony supplying the pointer shape, the
+ * delegations, and `priorCreatedAt`. Its obligations, uncheckable here once
+ * the codec is caller-supplied: the record it writes MUST carry the standing
+ * layout (ladder seed, bridge, binding MAC -- no plain bind), and the
+ * caller's local keyring-freshness pin floor is consumed INSIDE this closure
+ * (advance-past stamping), so a durable caller must wire it there.
+ */
+export type CredentialAnchoredBindRecordHook = (options: {
+    controller: string;
+    pointer: AccountPointer;
+    delegation: IZcap;
+    delegatedClients?: IZcap;
+    delegateManagementTo?: string;
+    priorCreatedAt?: string;
+}) => Promise<CredentialAnchoredBindResult>;
+/**
+ * The stage-3 primitive: ensure the account document points at a client-annex
+ * generation, minting and pointing one when it does not. Gated on the
+ * pointer: a document already carrying `#DelegatedClients` is returned
+ * as-is (`generationMinted: false`). Otherwise the annex Space resolves in
+ * the settled order ({@link resolveClientAnnexSpaceId}: the sibling
+ * delegation's target, else a fresh Space minted here), and the fold runs in
+ * the standing sub-step order: mint the generation, embed the generation
+ * delegation while the Space still answers to its creation controller, flip
+ * the Space's controller to the account DID, then append the pointer entry
+ * -- strictly last in the block, so pointer-present implies every prior
+ * sub-step landed. The pointer entry signs by ladder attribution of the
+ * currently revealed rung, and every log touch rides the caller's chain-head
+ * pin store.
+ *
+ * Two invocation authorities, heal's pattern. A caller holding a standing
+ * invocation authority (`invocation`: an enrolled client's storage handle
+ * plus the sibling capability its annex writes ride) converges onto the
+ * sibling-named Space as-is -- the Space is already account-controlled, so
+ * no flip runs. The bootstrap-only caller (the establishment) can write a
+ * sibling-named Space only while it still answers to the bootstrap did:key
+ * (a tear before the flip); one an earlier run already flipped refuses its
+ * writes, and that authorization refusal falls back to the fresh-mint arm
+ * rather than failing the run. The bootstrap arm's own controller flip
+ * swallows ONLY an authorization-class refusal (a concurrent run flipped
+ * first); a transport failure there aborts BEFORE the pointer entry, since
+ * a document pointing at a generation whose Space still answers to the bare
+ * ladder did:key would be unreachable forever.
+ *
+ * The fold shape is fixed (a separate pointer entry); a ceremony whose
+ * pointer move must ride another log entry atomically (the transient
+ * recovery's add-and-retire) keeps its own inline fold rather than
+ * parameterizing this one.
+ *
+ * @param options {object}
+ * @param options.account {object}   the VERIFIED account log view
+ *   (`{ did, doc, log }`; never re-fetched here)
+ * @param options.wasServerUrl {string}   the account pointer's host
+ * @param options.accountSpaceId {string}   the ACCOUNT Space's id (the
+ *   generation delegation's target subtree, and the account-log pin slot)
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
+ * @param options.was {WasClient}   the bootstrap storage client (the ladder
+ *   VM's bare did:key), used by the fresh-mint arm
+ * @param options.mintController {string}   the annex Space's creation
+ *   controller (a did:key; the ladder VM's bare did:key here)
+ * @param options.mintGenerationDelegation {Function}
+ *   `({ clientAnnexDid }) => Promise<IZcap>` -- the generation-delegation
+ *   minter (ladder-VM-signed on a ladder-anchored account)
+ * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store
+ * @param [options.updateKeys] {ClientWebvhUpdateKeys}   the pointer entry's
+ *   signing pair; absent, it is recovered by ladder attribution of the
+ *   supplied log's current parameters
+ * @param [options.delegatedClients] {IZcap}   the record's sibling
+ *   delegation, for the Space resolution's settled order
+ * @param [options.invocation] {object}   a standing invocation authority for
+ *   the sibling-named Space's writes: `was` (the standing client's storage
+ *   handle) and `capability` (the sibling delegation the annex writes ride).
+ *   Absent, the sibling-named Space is attempted under the bootstrap client
+ *   and an authorization refusal falls back to a fresh mint
+ * @param [options.logOnly] {boolean}   pointer entries publish the log only
+ *   (a bridge-delegated writer has no `did.json` projection rights); the
+ *   establishment's root window omits it
+ * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins; slot
+ *   keys are derived here per log
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<object>}   the pointed (or freshly minted) annex DID,
+ *   the generation delegation when one was installed here, and what ran
+ */
+export declare function ensurePointedClientAnnexGeneration({ account, wasServerUrl, accountSpaceId, ladderSeed, was, mintController, mintGenerationDelegation, idStore, updateKeys, delegatedClients, invocation, logOnly, pinStore, now }: {
+    account: Pick<PublishedWebvhLog, 'did' | 'doc' | 'log'>;
+    wasServerUrl: string;
+    accountSpaceId: string;
+    ladderSeed: Uint8Array;
+    was: WasClient;
+    mintController: string;
+    mintGenerationDelegation: (options: {
+        clientAnnexDid: string;
+    }) => Promise<IZcap>;
+    idStore: WebvhIdStore;
+    updateKeys?: ClientWebvhUpdateKeys;
+    delegatedClients?: IZcap;
+    invocation?: {
+        was: WasClient;
+        capability: IZcap;
+    };
+    logOnly?: boolean;
+    pinStore?: ResourceLogPinStore;
+    now?: number;
+}): Promise<{
+    clientAnnexDid: string;
+    generationDelegation?: IZcap;
+    generationMinted: boolean;
+    spaceMinted: boolean;
+}>;
+/**
+ * Runs the whole credential-anchored establishment for one unlock credential
+ * (see the module doc for the stage order and its whys). Idempotent under
+ * re-run from durable state alone; a torn run converges by running again.
+ *
+ * @param options {object}
+ * @param options.wasServerUrl {string}   the account pointer's host
+ * @param options.spaceId {string}   the ACCOUNT Space's id, minted by the
+ *   caller and carried in the account pointer (never minted here)
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed --
+ *   freshly minted on a signup, recovered from the record on a heal re-run
+ * @param options.standing {object}   the credential's standing client
+ *   identity, from a BINDING-VERIFIED record or a fresh derivation:
+ *   `clientDid`, `keyAgreementKeyMultibase`, `recipientKid`, and
+ *   `keyAgreementKey` (the private-half key-agreement key, for the
+ *   adopted-roster read-back)
+ * @param options.bindRecord {CredentialAnchoredBindRecordHook}   REQUIRED:
+ *   the unlock-record codec closure (see its type doc for the hook's
+ *   standing-layout and freshness-floor obligations)
+ * @param options.rosterStoreFor {Function}   REQUIRED: `({ did }) =>
+ *   EncryptionDescriptorStore` -- the user-key roster's store, with a
+ *   LADDER-signed log signer (the ceremony-tail license's first-entry
+ *   shape), invoked as the bootstrap did:key
+ * @param options.bootstrapWasFor {Function}   REQUIRED:
+ *   `({ keyAgent }) => WasClient` -- the storage client wiring, signing as
+ *   the ladder VM's bare did:key (the agent is derived here from the seed)
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection
+ *   store, signing as the same bootstrap did:key
+ * @param [options.expectedDid] {string}   the account DID, when the caller's
+ *   pointer already names one (a heal re-run)
+ * @param options.lowEntropy {boolean}   whether the credential is
+ *   low-entropy. REQUIRED (the compiler backstop at the passkey call site,
+ *   where dropping it would publish the commitment and break the verbatim
+ *   published key that call site's readers trigger on), and it still FAILS
+ *   SAFE at runtime: the `keyAgreement` key publishes as a hash commitment
+ *   unless the value is exactly `false` -- a verbatim KDF-derived key in
+ *   the world-readable document is a standing offline-grind oracle
+ *   removable only by credential rotation
+ * @param [options.email] {string}   -- not taken here; carried inside the
+ *   caller's `bindRecord` closure
+ * @param [options.priorCreatedAt] {string}   the previous bind's freshness
+ *   stamp, from a standing keyring hit. Its presence SKIPS stage 1: the
+ *   record already carries the ladder seed, and a DID-less re-write could
+ *   downgrade a sibling browser's completed re-bind
+ * @param [options.delegatedClients] {IZcap}   the record's sibling
+ *   delegation, when the caller holds one -- threaded into stage 3's Space
+ *   resolution; under this ceremony's bootstrap-only authority a
+ *   sibling-named Space it can no longer write falls back to a fresh mint
+ * @param [options.provideDidWebKeys] {Function}   `() =>
+ *   Promise<DidWebKeyMapV2 | undefined>` -- the caller's opaque best-effort
+ *   KMS/did:web thunk, run inside stage 2 (the caller owns its body and its
+ *   timeout); a throw is the collected non-fatal `didWebKeys` failure
+ * @param [options.promoteKeystore] {Function}   `({ did }) => Promise<void>`
+ *   -- the best-effort keystore-controller promotion, called after the
+ *   Space's own promotion; the caller's closure no-ops when its KMS stage
+ *   bound no keystore this run. A throw is collected, never fatal
+ * @param [options.beforePromotion] {Function}   runs after the re-bind and
+ *   BEFORE the controller promotion -- the last window where a root
+ *   invocation under the bootstrap did:key works (the signup's registry
+ *   write). NOT swallowed here: a throw fails the establishment, so a hook
+ *   that must be best-effort swallows its own failures
+ * @param [options.pinStore] {ResourceLogPinStore}   the chain-head pin store
+ *   for every log read here (a transient visit's in-memory handle, or a
+ *   durable one when a remembered caller seeds its own pin)
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<CredentialAnchoredEstablishment>}
+ * @throws {TypeError}   synchronously, when a required hook is missing
+ * @throws {Error}   when the genesis's roster or epoch stage did not land
+ *   (the underlying failure as `cause`); the record stays DID-less, so the
+ *   next login's heal re-runs the establishment
+ */
+export declare function establishCredentialAnchoredAccount(options: {
+    wasServerUrl: string;
+    spaceId: string;
+    ladderSeed: Uint8Array;
+    standing: {
+        clientDid: string;
+        keyAgreementKeyMultibase: string;
+        recipientKid: string;
+        keyAgreementKey: IKeyAgreementKey;
+    };
+    bindRecord: CredentialAnchoredBindRecordHook;
+    rosterStoreFor: (options: {
+        did: string;
+    }) => EncryptionDescriptorStore;
+    bootstrapWasFor: (options: {
+        keyAgent: ICapabilityAgent;
+    }) => WasClient;
+    idStore: WebvhIdStore;
+    expectedDid?: string;
+    lowEntropy: boolean;
+    priorCreatedAt?: string;
+    delegatedClients?: IZcap;
+    provideDidWebKeys?: () => Promise<DidWebKeyMapV2 | undefined>;
+    promoteKeystore?: (options: {
+        did: string;
+    }) => Promise<void>;
+    beforePromotion?: (context: {
+        was: WasClient;
+        zcapClient: ZcapClient;
+        did: string;
+        userKey: UserKey;
+        establishment: CredentialAnchoredEstablishment;
+    }) => Promise<void>;
+    pinStore?: ResourceLogPinStore;
+    now?: number;
+}): Promise<CredentialAnchoredEstablishment>;
+/**
+ * The current `updateKeys` / `nextKeyHashes` view of a published log, for
+ * the bind-time rung attribution.
+ *
+ * @param published {PublishedWebvhLog}
+ * @returns {object}
+ */
+export declare function currentLogParameters(published: Pick<PublishedWebvhLog, 'log'>): {
+    updateKeys: string[];
+    nextKeyHashes: string[];
+};
+/**
+ * A delegation's `expires` caveat, when it carries one.
+ *
+ * @param zcap {IZcap}
+ * @returns {string | undefined}
+ */
+export declare function zcapExpires(zcap: IZcap): string | undefined;
+/**
+ * Asserts a `bindRecord` result carries the members the ceremony reads --
+ * the observable half of the hook's standing-layout obligation (the sealed
+ * members are the codec's own duty and cannot be checked from here).
+ *
+ * @param options {object}
+ * @param options.bind {CredentialAnchoredBindResult}
+ * @param options.stage {string}
+ * @throws {TypeError}
+ */
+export declare function assertBindResult({ bind, stage }: {
+    bind: CredentialAnchoredBindResult;
+    stage: string;
+}): void;
+//# sourceMappingURL=establish.d.ts.map

package/dist/clientAnnex/establish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"establish.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/establish.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAMrC,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAK1D,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAoB5D;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,cAAc,EAAE,gCAAgC,CAAA;IAChD,aAAa,CAAC,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAA;IACrD,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,YAAY,GAAG,mBAAmB,CAAA;QACzC,KAAK,EAAE,OAAO,CAAA;KACf,CAAC,CAAA;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAsB,kCAAkC,CAAC,EACvD,OAAO,EACP,YAAY,EACZ,cAAc,EACd,UAAU,EACV,GAAG,EACH,cAAc,EACd,wBAAwB,EACxB,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,SAAS,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wBAAwB,EAAE,CAAC,OAAO,EAAE;QAClC,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IACpB,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,UAAU,EAAE,KAAK,CAAA;KAAE,CAAA;IAClD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAA;IAC5B,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;CACrB,CAAC,CAuJD;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB,EAAE,MAAM,CAAA;QAChC,YAAY,EAAE,MAAM,CAAA;QACpB,eAAe,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,UAAU,EAAE,gCAAgC,CAAA;IAC5C,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAC1B,GAAG,EAAE,SAAS,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,+BAA+B,CAAA;KAC/C,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAuB3C;AAoSD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GACxC;IACD,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAGA;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAE3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,KAAK,EACN,EAAE;IACD,IAAI,EAAE,4BAA4B,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAgBP"}