@interop/wallet-core 0.61.0 → 0.65.0

package/dist/recovery/recoveryWebvh.d.ts

@@ -1,6 +1,40 @@
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import type { UnlockInventoryPart } from '../unlock/standingWebvh.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+/**
+ * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
+ * spend's answer to the same question the live run answers from the document
+ * it is editing. A run torn after that entry but before the caller's registry
+ * and unlock-Space teardown resumes into the already-complete branch, and
+ * without this it would be told nothing was retired and leave every other
+ * credential's registry entry standing.
+ *
+ * The entry is located by its own signature on the log: it is the first entry
+ * whose effective `updateKeys` authorize the successor key (the fresh
+ * ladder's rung 0 on the transient continuation, the new client's update key
+ * on the remembered one), which only that entry writes. What it retired is
+ * then the credential-class `keyAgreement` ids its predecessor published and
+ * it does not, less the spent code's own id -- the same exclusion the live
+ * branch makes, since the caller retires that one by name.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified account log
+ * @param options.did {string}   the account DID the log resolves to
+ * @param options.successorKeyMultibase {string}   the update key only the
+ *   add-and-retire entry authorizes
+ * @param options.spentVmId {string}   the spent code's key-agreement
+ *   verification-method id, excluded from the result
+ * @returns {string[]}   the retired credentials' key-agreement ids, empty
+ *   when no entry authorizes the successor key or it is the genesis entry
+ */
+export declare function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }: {
+    log: DIDLog;
+    did: string;
+    successorKeyMultibase: string;
+    spentVmId: string;
+}): string[];
 /**
  * The verification-method id a code's key-agreement key publishes under --
  * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
@@ -26,6 +60,18 @@ export interface RecoveryPublicKeys {
     keyAgreementKeyMultibase: string;
     updateKeyMultibase: string;
 }
+/**
+ * The public halves a SPEND needs of the replacement code it publishes: the
+ * two above plus the code's ladder VM key, which the add-and-retire entry
+ * installs under `assertionMethod` and `capabilityDelegation`. A code is a
+ * standing unlock credential with a ladder (`decisions/0020`) and its bridge
+ * delegation is signed by that ladder's VM (`decisions/0019`), so a
+ * replacement published without the VM could neither sign its own bridge nor
+ * spend. `recoveryClientFromCode` produces all three.
+ */
+export interface ReplacementRecoveryPublicKeys extends RecoveryPublicKeys {
+    ladderVmKeyMultibase: string;
+}
 /**
  * Thrown by the recovery continuation when the log carries neither the code's
  * update key nor its committed hash -- the code was revoked (or never
@@ -41,59 +87,33 @@ export declare class RecoveryKeyNotCommittedError extends Error {
  */
 export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
 /**
- * Reads and resolves the published log through the narrow recovery seam.
+ * ISSUANCE: publishes a recovery code's split configuration into the
+ * document -- the code's `keyAgreement` verification method (an ordinary,
+ * unmarked Multikey entry, the key published verbatim: a code is
+ * high-entropy, so no commitment is needed), its rung-0 hash committed in
+ * `nextKeyHashes`, and its ladder VM. The code's update key joins
+ * `updateKeys` nowhere. A thin wrapper over the
+ * standing unlock-key inventory core ({@link publishUnlockKey}), which owns
+ * idempotence and the conditional publish.
  *
- * @param options {object}
- * @param options.store {RecoveryLogStore}
- * @param [options.expectedDid] {string}   the account DID the log must resolve
- *   to, where the caller holds one
- * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
- *   pins; a served log that is a rollback, a fork, or an identity switch
- *   against the pinned head is refused (`ResourceLogContinuityError`)
- * @param [options.logId] {string}   the account log's pin slot
- *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
- *   supplied
- * @returns {Promise<PublishedWebvhLog>}
- */
-export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }: {
-    store: RecoveryLogStore;
-    expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
-}): Promise<PublishedWebvhLog>;
-/**
- * Publishes `did.jsonl` through the narrow recovery seam -- the log only,
- * never `did.json` (the delegation covers nothing else; the recovered
- * session republishes the projection once it is the controller). The write is
- * conditional on the read the entry was built on, and a lost race surfaces as
- * a `WebvhLogConflictError` (the mapping lives in `putLogResource`).
- *
- * @param options {object}
- * @param options.store {RecoveryLogStore}
- * @param options.log {DIDLog}
- * @param [options.ifMatch] {string}   publish only if `did.jsonl` is unchanged
- * @returns {Promise<void>}
- */
-export declare function publishLogOnly({ store, log, ifMatch }: {
-    store: RecoveryLogStore;
-    log: DIDLog;
-    ifMatch?: string;
-}): Promise<void>;
-/**
- * ISSUANCE (run by an enrolled client, root authority): publishes a recovery
- * code's split configuration into the document -- one entry adding the code's
- * `keyAgreement` verification method (an ordinary, unmarked Multikey entry,
- * the key published verbatim: a code is high-entropy, so no commitment is
- * needed) and committing its update-key hash in `nextKeyHashes`. The code's
- * update key joins `updateKeys` nowhere. A thin wrapper over the standing
- * unlock-key inventory core ({@link publishUnlockKey}), which owns idempotence
- * and the conditional publish.
+ * `part` is how the ladder branch splits the entry so the code's decryption
+ * material precedes its authority: a key entry (`'key'`), then the escrow,
+ * then an authority entry (`'authority'`) carrying the ladder VM and the
+ * rung-0 commitment. An enrolled client's issuance escrows before the entry
+ * and writes the merged `'all'` entry.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the ISSUING client's
- *   own did:webvh update-key seeds
+ * @param options.signer {AccountLogSigner}   who signs the entry: the ISSUING
+ *   client's own did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.recovery {RecoveryPublicKeys}   the code's public halves
+ * @param options.ladderSeed {Uint8Array}   the code's OWN ladder seed,
+ *   derived from the code bytes (`recoveryClientFromCode`). The entry
+ *   installs that ladder's VM, and `recovery.updateKeyMultibase` is its
+ *   rung 0
+ * @param [options.part] {string}   `'all'` (the default), `'key'`, or
+ *   `'authority'` -- see above
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the caller's stored account pointer
  * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
@@ -105,10 +125,12 @@ export declare function publishLogOnly({ store, log, ifMatch }: {
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
  *   DID and the document and log as this call leaves them
  */
-export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }: {
+export declare function publishRecoveryKey({ idStore, signer, recovery, ladderSeed, part, expectedDid, pinStore, logId }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     recovery: RecoveryPublicKeys;
+    ladderSeed: Uint8Array;
+    part?: UnlockInventoryPart;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;
@@ -118,21 +140,41 @@ export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expe
     log: DIDLog;
 }>;
 /**
- * REVOCATION (run by an enrolled client, root authority): removes a recovery
- * code's inventory from the document -- its `keyAgreement` verification method
- * and its committed update-key hash -- in one entry, through the same shared
- * inventory core ({@link removeUnlockKey}). The roster-side half (rotating the
- * user key epoch off the code's wrap) is the caller's, and runs after this so
- * the resolver's document no longer backs the removed entry.
+ * REVOCATION: removes a recovery code's whole inventory from the document --
+ * its `keyAgreement` verification method, its committed rung-0 hash, and its
+ * ladder VM -- in one entry, through the same shared inventory core
+ * ({@link removeUnlockKey}). The roster-side half (rotating the user key
+ * epoch off the code's wrap) is the caller's, and runs after this so the
+ * resolver's document no longer backs the removed entry.
+ *
+ * The revoker holds neither the code bytes nor its ladder seed, so the VM
+ * claim is seedless: the removal attributes it from the log, anchored on the
+ * rung-0 update-key multibase the registry recorded at issuance
+ * (`recovery.updateKeyMultibase`). The claim is required rather than
+ * best-effort. A VM no attribution arm claims refuses the whole revocation
+ * with `UnclaimedLadderVmRetirementError` before anything is written, since a
+ * standing ladder VM whose credential is otherwise retired keeps its
+ * delegation authority -- including the DELETE-only capability on the account
+ * Space that the account-deletion ceremony mints.
  *
- * @param options {object}   see {@link publishRecoveryKey}
+ * @param options {object}   see {@link publishRecoveryKey}, except that
+ *   `ladderSeed` is optional here: a revoking client does not hold it, and
+ *   the code's own holder is the only party who can supply it
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the inventory edit: the
+ *   post-strike `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed revocation does not leave
+ *   `did.json` naming the revoked code. Best-effort, and omitted the
+ *   behavior is unchanged (see `removeUnlockKey`)
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
  *   {@link publishRecoveryKey}
  */
-export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }: {
+export declare function removeRecoveryKey({ idStore, signer, recovery, ladderSeed, projectionStore, expectedDid, pinStore, logId }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     recovery: RecoveryPublicKeys;
+    ladderSeed?: Uint8Array;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;
@@ -167,8 +209,10 @@ export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expec
  * @param options.newClientUpdateSeeds {ClientWebvhUpdateKeys}   the new
  *   client's update-key seeds (minted by the recovery flow, which therefore
  *   holds them and can sign the add entry)
- * @param options.replacement {RecoveryPublicKeys}   the replacement code's
- *   public halves, committed and published in the same continuation
+ * @param options.replacement {ReplacementRecoveryPublicKeys}   the
+ *   replacement code's public halves -- its key-agreement key, its rung-0
+ *   update key, and its ladder VM key -- committed and published in the same
+ *   continuation
  * @param options.onCommitted {function}
  *   `(committed: { builtOnHead: { scid, versionId } }) => Promise<void>` --
  *   the REQUIRED persist-before-publish seam. It runs once per attempt, after
@@ -206,7 +250,7 @@ export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expec
  * @param [options.logId] {string}   the account log's pin slot
  *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
  *   supplied
- * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
+ * @returns {Promise<object>}
  *   the account DID, the final `did.json` projection when the add-and-retire
  *   entry ran here, and `committed` -- whether THIS call published the pivot
  *   entry (`false` exactly on the idempotent completed branch, where a torn
@@ -214,7 +258,12 @@ export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expec
  *   a success flag: a returning call means the continuation stands either
  *   way, so a caller clears its pending state on the RETURN, whatever
  *   `committed` says. Its absence from a return value is a build skew, which
- *   is why it is stated rather than inferred
+ *   is why it is stated rather than inferred.
+ *   `retiredCredentialVmIds` lists the `keyAgreement` verification-method ids
+ *   this entry struck for pre-recovery credentials OTHER than the spent code
+ *   -- what the caller drops registry entries and deletes unlock Spaces for.
+ *   On the completed branch, whose entry already landed, it is derived from
+ *   the log, so a resume reports the same list the first run did
  */
 export declare function recoverWebvhClient(options: {
     store: RecoveryLogStore;
@@ -223,7 +272,7 @@ export declare function recoverWebvhClient(options: {
     };
     newClientKeys: WebvhEnrollmentKeys;
     newClientUpdateSeeds: ClientWebvhUpdateKeys;
-    replacement: RecoveryPublicKeys;
+    replacement: ReplacementRecoveryPublicKeys;
     onCommitted: (committed: {
         builtOnHead: {
             scid: string;
@@ -237,5 +286,8 @@ export declare function recoverWebvhClient(options: {
     did: string;
     webDoc?: object;
     committed: boolean;
+    retiredCredentialVmIds: string[];
+    struckRungHashes: string[];
+    unclaimedCredentialVmIds: string[];
 }>;
 //# sourceMappingURL=recoveryWebvh.d.ts.map

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAmBhE"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAehE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,EAAE,CAmBX;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA8B,SAAQ,kBAAkB;IACvE,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAmBD"}