@interop/wallet-core 0.61.0 → 0.65.0

package/dist/recovery/index.d.ts

@@ -3,20 +3,24 @@
  */
 /**
  * The `@interop/wallet-core/recovery` subpath: recovery codes on the roster
- * identity model -- a code as a minimal always-enrolled wallet client.
+ * identity model -- a code as a standing unlock credential that retires on
+ * spend.
  *
  * - `generateRecoveryCode` / `formatRecoveryCode` / `normalizeRecoveryCode` /
  *   `decodeRecoveryCode` / `RECOVERY_KDF` -- the format layer and the code's
  *   own unlock-derivation parameter set (its salt distinct from every other
  *   unlock method's).
- * - `recoveryClientFromCode` -- the deterministic client key set:
- *   unlock identity, client seed (signing + key-agreement pair), and the
- *   single did:webvh update key whose hash stands pre-committed.
+ * - `recoveryClientFromCode` -- the deterministic client key set: unlock
+ *   identity, client seed (signing + key-agreement pair), binding MAC key,
+ *   and the update-key ladder seed, whose rung 0 is the did:webvh update key
+ *   whose hash stands pre-committed and whose VM signs the code's own bridge.
  * - The record codec lives in `@interop/wallet-core/unlock` now
  *   (`wrapUnlockRecord` / `unwrapUnlockRecord`, re-exported here): a
- *   recovery record is an unlock record with no ladder member -- the account
- *   pointer plus the pre-minted PUT-on-`did.jsonl` bridge delegation (never
- *   a seed, never a user key wrap), signed under the mixed-signer policy
+ *   recovery record is an unlock record with no ladder member (the code's
+ *   ladder seed derives from the code bytes rather than riding the record) --
+ *   the account pointer plus the pre-minted PUT-on-`did.jsonl` bridge
+ *   delegation (never a seed, never a user key wrap), signed under the
+ *   mixed-signer policy
  *   (the code's unlock key at issuance, an enrolled client's account key on
  *   a re-mint), with the account core authenticated by a MAC under a
  *   code-derived key, so a storage host can never redirect recovery at
@@ -44,5 +48,5 @@ export type { SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState }
 export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
 export type { RecordRemintOutcome, RecoveryDelegationEntry } from './recoveryDelegation.js';
 export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
-export type { RecoveryLogStore, RecoveryPublicKeys } from './recoveryWebvh.js';
+export type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './recoveryWebvh.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/recovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,oBAAoB,CAAA"}

package/dist/recovery/index.js

@@ -3,20 +3,24 @@
  */
 /**
  * The `@interop/wallet-core/recovery` subpath: recovery codes on the roster
- * identity model -- a code as a minimal always-enrolled wallet client.
+ * identity model -- a code as a standing unlock credential that retires on
+ * spend.
  *
  * - `generateRecoveryCode` / `formatRecoveryCode` / `normalizeRecoveryCode` /
  *   `decodeRecoveryCode` / `RECOVERY_KDF` -- the format layer and the code's
  *   own unlock-derivation parameter set (its salt distinct from every other
  *   unlock method's).
- * - `recoveryClientFromCode` -- the deterministic client key set:
- *   unlock identity, client seed (signing + key-agreement pair), and the
- *   single did:webvh update key whose hash stands pre-committed.
+ * - `recoveryClientFromCode` -- the deterministic client key set: unlock
+ *   identity, client seed (signing + key-agreement pair), binding MAC key,
+ *   and the update-key ladder seed, whose rung 0 is the did:webvh update key
+ *   whose hash stands pre-committed and whose VM signs the code's own bridge.
  * - The record codec lives in `@interop/wallet-core/unlock` now
  *   (`wrapUnlockRecord` / `unwrapUnlockRecord`, re-exported here): a
- *   recovery record is an unlock record with no ladder member -- the account
- *   pointer plus the pre-minted PUT-on-`did.jsonl` bridge delegation (never
- *   a seed, never a user key wrap), signed under the mixed-signer policy
+ *   recovery record is an unlock record with no ladder member (the code's
+ *   ladder seed derives from the code bytes rather than riding the record) --
+ *   the account pointer plus the pre-minted PUT-on-`did.jsonl` bridge
+ *   delegation (never a seed, never a user key wrap), signed under the
+ *   mixed-signer policy
  *   (the code's unlock key at issuance, an enrolled client's account key on
  *   a re-mint), with the account core authenticated by a MAC under a
  *   code-derived key, so a storage host can never redirect recovery at

package/dist/recovery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}

package/dist/recovery/recoveryCode.d.ts

@@ -65,16 +65,27 @@ export declare function decodeRecoveryCode({ code }: {
     code: string;
 }): Uint8Array;
 /**
- * The code's full client identity, derived deterministically from
- * its bytes: the 32-byte client seed (behind the code's Ed25519 signing pair
- * and X25519 key-agreement twin), the single did:webvh update-key seed (one
- * key, no staged pair -- a code is spent on use, so it never self-rotates;
- * its recovery continuation commits whatever it needs next), the derived
- * agents, and the public multibases / ids the issuance and recovery flows
- * publish and look up.
+ * The code's full client identity, derived deterministically from its bytes:
+ * the 32-byte client seed (behind the code's Ed25519 signing pair and X25519
+ * key-agreement twin), the ladder seed behind its update authority, the
+ * derived agents, and the public multibases / ids the issuance and recovery
+ * flows publish and look up.
  */
 export interface RecoveryClient extends UnlockClientIdentity {
     codeBytes: Uint8Array;
+    /**
+     * The code's update-key ladder seed. Its VM is what signs the code's own
+     * bridge delegation, and its rung 0 is the code's committed update key, so
+     * the spend's reveal-and-commit entry is the ordinary ladder reveal. A code
+     * is spent on use and never self-rotates, so no rung past 0 is ever
+     * revealed; the ladder is what gives the code a verification method of its
+     * own beside that single rung.
+     */
+    ladderSeed: Uint8Array;
+    /**
+     * Rung 0's 32-byte update-key seed -- the key the code's committed hash
+     * stands for, and the one the reveal-and-commit entry signs with.
+     */
     updateSeed: Uint8Array;
     /**
      * The symmetric key that MACs the recovery record's account binding:
@@ -82,7 +93,16 @@ export interface RecoveryClient extends UnlockClientIdentity {
      * Derived from the code bytes, so the storage host never holds it.
      */
     bindingMacKey: Uint8Array;
+    /**
+     * Rung 0's public multibase: the code's `updateKeyMultibase` as the
+     * registry records it and the document commits its hash.
+     */
     updateKeyMultibase: string;
+    /**
+     * The ladder VM's public multibase, as the account document publishes it
+     * under `assertionMethod` and `capabilityDelegation`.
+     */
+    ladderVmKeyMultibase: string;
 }
 /**
  * Derives the code's whole client identity from a (possibly formatted) code.

package/dist/recovery/recoveryCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryCode.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGvE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAA;AAoBD;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAuC;CAI3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAazE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;OAIG;IACH,aAAa,EAAE,UAAU,CAAA;IACzB,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CAgC1B"}
+{"version":3,"file":"recoveryCode.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAMvE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAA;AAwBD;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAuC;CAI3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAazE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,SAAS,EAAE,UAAU,CAAA;IACrB;;;;;;;OAOG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB;;;OAGG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB;;;;OAIG;IACH,aAAa,EAAE,UAAU,CAAA;IACzB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CAqC1B"}

package/dist/recovery/recoveryCode.js

@@ -21,7 +21,10 @@ import { base58 } from '@scure/base';
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { unlockClientIdentityFromSeed } from '../unlock/standingClient.js';
-import { updateKeyMultibase } from '../webvh/didWebvh.js';
+// The pinned base-side edge onto the ladder derivation helpers: a code's
+// update authority IS a ladder, and re-deriving its rungs here would be a
+// second copy of a permanent wire-level derivation.
+import { ladderRung, ladderVmKeyMultibase } from '../clientAnnex/ladder.js';
 /**
  * The byte length of a recovery code: 16 random bytes is ~128 bits, enough
  * that the unlock derivation is a single expansion rather than a stretched
@@ -45,11 +48,15 @@ export const RECOVERY_KDF = {
 /**
  * The HKDF salt for the code's client-side key set (distinct from the unlock
  * salt above, so the unlock identity and the client identity can never
- * collide), and the per-key expansion labels. All permanent.
+ * collide), and the per-key expansion labels. All permanent. The
+ * `ladder-seed` expansion replaced a standalone `update-key` one, whose label
+ * is retired and never reused: a code's committed update key is rung 0 of the
+ * ladder now, which is a different key, so a code issued under the retired
+ * label commits a rung nothing derives and cannot spend.
  */
 const RECOVERY_CLIENT_SALT = 'freewallet/recovery/client-keys/v1';
 const RECOVERY_CLIENT_SEED_INFO = 'client-seed';
-const RECOVERY_UPDATE_SEED_INFO = 'update-key';
+const RECOVERY_LADDER_SEED_INFO = 'ladder-seed';
 /**
  * The HKDF info string for the code's account-binding MAC key, expanded
  * under the unlock salt beside the unlock-seed expansion above. The key MACs
@@ -141,15 +148,20 @@ export async function recoveryClientFromCode({ code }) {
     const codeBytes = decodeRecoveryCode({ code });
     const salt = new TextEncoder().encode(RECOVERY_CLIENT_SALT);
     const clientSeed = hkdf(sha256, codeBytes, salt, new TextEncoder().encode(RECOVERY_CLIENT_SEED_INFO), 32);
-    const updateSeed = hkdf(sha256, codeBytes, salt, new TextEncoder().encode(RECOVERY_UPDATE_SEED_INFO), 32);
+    const ladderSeed = hkdf(sha256, codeBytes, salt, new TextEncoder().encode(RECOVERY_LADDER_SEED_INFO), 32);
     const bindingMacKey = hkdf(sha256, codeBytes, new TextEncoder().encode(RECOVERY_KDF.salt), new TextEncoder().encode(RECOVERY_BINDING_MAC_INFO), 32);
     const identity = await unlockClientIdentityFromSeed({ clientSeed });
+    // Rung 0 through the shared ladder derivation, so the code's committed
+    // update key is the same key the ladder's own reveal attributes.
+    const rung0 = await ladderRung({ ladderSeed, index: 0 });
     return {
         ...identity,
         codeBytes,
-        updateSeed,
+        ladderSeed,
+        updateSeed: rung0.seed,
         bindingMacKey,
-        updateKeyMultibase: await updateKeyMultibase({ seed: updateSeed })
+        updateKeyMultibase: rung0.keyMultibase,
+        ladderVmKeyMultibase: await ladderVmKeyMultibase({ ladderSeed })
     };
 }
 //# sourceMappingURL=recoveryCode.js.map

package/dist/recovery/recoveryCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO;QACL,GAAG,QAAQ;QACX,SAAS;QACT,UAAU;QACV,aAAa;QACb,kBAAkB,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;KACnE,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA2CD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,OAAO;QACL,GAAG,QAAQ;QACX,SAAS;QACT,UAAU;QACV,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,aAAa;QACb,kBAAkB,EAAE,KAAK,CAAC,YAAY;QACtC,oBAAoB,EAAE,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;KACjE,CAAA;AACH,CAAC"}

package/dist/recovery/recoveryDelegation.d.ts

@@ -30,12 +30,15 @@ export { ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from '../webvh/standingZcap.js';
  *   client's promoted signer)
  * @param options.pointer {AccountPointer}
  * @param options.recoveryClientDid {string}
+ * @param [options.now] {number}   epoch milliseconds the lifetime is measured
+ *   from, for tests
  * @returns {Promise<IZcap>}
  */
-export declare function delegateLogWrite({ zcapClient, pointer, recoveryClientDid }: {
+export declare function delegateLogWrite({ zcapClient, pointer, recoveryClientDid, now }: {
     zcapClient: ZcapClient;
     pointer: AccountPointer;
     recoveryClientDid: string;
+    now?: number;
 }): Promise<IZcap>;
 export { delegationProofKeyId };
 /**

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAMhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CAsMD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CA4LD"}

package/dist/recovery/recoveryDelegation.js

@@ -47,11 +47,9 @@ import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { resourcePath, toUrl } from '@interop/was-client/paths';
 import { log } from '../log.js';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
-import { delegationKeyInDocument } from '../webvh/listClients.js';
-import { vmFragmentOf } from '@interop/vh-resource-log';
 import { getUnlockKeyringWithCapability, putUnlockKeyringWithCapability } from '../keyring/unlockSpace.js';
 import { remintUnlockRecordDelegations, unlockRecordSealedTo } from '../unlock/unlockRecord.js';
-import { delegationProofKeyId, STANDING_ZCAP_TTL_MS, zcapExpiring } from '../webvh/standingZcap.js';
+import { delegationProofKeyId, recordedZcapStale, STANDING_ZCAP_TTL_MS } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
  * ({@link STANDING_ZCAP_TTL_MS} -- one year, per NIST SP 800-57's
@@ -67,7 +65,7 @@ import { delegationProofKeyId, STANDING_ZCAP_TTL_MS, zcapExpiring } from '../web
  * client's verification method leaving the document).
  */
 export const RECOVERY_DELEGATION_TTL_MS = STANDING_ZCAP_TTL_MS;
-// Re-exported from their shared leaf home (`webvh/standingZcap.ts`), so this
+// Re-exported from their shared home (`webvh/standingZcap.ts`), so this
 // module's public surface predating the move is unchanged.
 export { ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from '../webvh/standingZcap.js';
 /**
@@ -99,17 +97,19 @@ function didLogUrl({ pointer }) {
  *   client's promoted signer)
  * @param options.pointer {AccountPointer}
  * @param options.recoveryClientDid {string}
+ * @param [options.now] {number}   epoch milliseconds the lifetime is measured
+ *   from, for tests
  * @returns {Promise<IZcap>}
  */
-export async function delegateLogWrite({ zcapClient, pointer, recoveryClientDid }) {
+export async function delegateLogWrite({ zcapClient, pointer, recoveryClientDid, now = Date.now() }) {
     return zcapClient.delegate({
         invocationTarget: didLogUrl({ pointer }),
         controller: recoveryClientDid,
         allowedActions: ['PUT'],
-        expires: new Date(Date.now() + RECOVERY_DELEGATION_TTL_MS)
+        expires: new Date(now + RECOVERY_DELEGATION_TTL_MS)
     });
 }
-// Re-exported from its shared leaf home (`webvh/standingZcap.ts`), so this
+// Re-exported from its shared home (`webvh/standingZcap.ts`), so this
 // module's public surface is unchanged.
 export { delegationProofKeyId };
 /**
@@ -166,40 +166,29 @@ export async function remintRecoveryDelegations({ doc, entries, pointer, storage
     let reminted = 0;
     let skipped = 0;
     const outcomes = [];
-    // Retiring keys arrive as bare multibases or as verification-method ids;
-    // either way the comparison is on the multibase.
-    const retiring = new Set(retiringKeyMultibases.map(key => vmFragmentOf(key) ?? key));
-    // The current-key-set rule, decided once in `webvh`: a recorded signing key
-    // the document no longer lists under `capabilityDelegation` -- or no
-    // recorded key at all -- is rotted; so is a key the caller names as retiring, which the document
-    // still lists only until the entry that removes it lands.
-    const keyStands = (keyId) => delegationKeyInDocument({
+    // The house staleness policy, decided once in `webvh` and asked here over
+    // the scalars a registry entry records: expiry, the current-key-set rule
+    // (a recorded signing key the document no longer lists under
+    // `capabilityDelegation` -- or no recorded key at all -- has rotted), and
+    // the caller's retiring set, which the document still lists only until the
+    // entry that removes those keys lands.
+    const recordedStale = (delegationKeyId, expires) => recordedZcapStale({
         doc,
-        ...(keyId ? { delegationKeyId: keyId } : {})
-    }) && !(keyId !== undefined && retiring.has(vmFragmentOf(keyId) ?? keyId));
+        ...(delegationKeyId ? { delegationKeyId } : {}),
+        ...(expires ? { expires } : {}),
+        retiringKeyMultibases,
+        now
+    });
     for (const entry of entries) {
-        const stands = keyStands(entry.delegationKeyId);
-        // Expiry is the other staleness axis: a delegation expired or inside the
-        // renewal window (or recording no expiry at all) is re-minted even
-        // though its key still stands.
-        const expiring = zcapExpiring({
-            ...(entry.delegationExpires ? { expires: entry.delegationExpires } : {}),
-            now
-        });
-        // The annex Space sibling, where the entry records one, is checked
-        // on the same two axes; either member going stale re-mints BOTH in one
-        // atomic pass (both resealed, one registry-entry rewrite).
+        const stale = recordedStale(entry.delegationKeyId, entry.delegationExpires);
+        // The annex Space sibling, where the entry records one, is checked on the
+        // same axes; either member going stale re-mints BOTH in one atomic pass
+        // (both resealed, one registry-entry rewrite).
         const siblingRecorded = entry.delegatedClientsKeyId !== undefined ||
             entry.delegatedClientsExpires !== undefined;
         const siblingStale = siblingRecorded &&
-            (!keyStands(entry.delegatedClientsKeyId) ||
-                zcapExpiring({
-                    ...(entry.delegatedClientsExpires
-                        ? { expires: entry.delegatedClientsExpires }
-                        : {}),
-                    now
-                }));
-        if (stands && !expiring && !siblingStale) {
+            recordedStale(entry.delegatedClientsKeyId, entry.delegatedClientsExpires);
+        if (!stale && !siblingStale) {
             outcomes.push({
                 label: entry.label,
                 unlockSpaceId: entry.unlockSpaceId,

package/dist/recovery/recoveryDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACb,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,6EAA6E;AAC7E,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAKlB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAwD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAC3D,CAAA;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,iGAAiG;IACjG,0DAA0D;IAC1D,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAW,EAAE,CACvD,uBAAuB,CAAC;QACtB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QAC/C,yEAAyE;QACzE,mEAAmE;QACnE,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG;SACJ,CAAC,CAAA;QACF,mEAAmE;QACnE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACtC,YAAY,CAAC;oBACX,GAAG,CAAC,KAAK,CAAC,uBAAuB;wBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,uBAAuB,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG;iBACJ,CAAC,CAAC,CAAA;QACP,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,qBAAqB,GAAG,gBAAgB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,uBAAuB,GAAG,gBAAgB;gBAC9C,CAAC,CAAE,gBAAyC,CAAC,OAAO;gBACpD,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAwD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CACpB,eAAmC,EACnC,OAA2B,EAClB,EAAE,CACX,iBAAiB,CAAC;QAChB,GAAG;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,GAAG;KACJ,CAAC,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,qBAAqB,GAAG,gBAAgB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,uBAAuB,GAAG,gBAAgB;gBAC9C,CAAC,CAAE,gBAAyC,CAAC,OAAO;gBACpD,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}