@interop/wallet-core 0.61.0 → 0.65.0

package/dist/clientAnnex/forgetLast.d.ts

@@ -2,9 +2,9 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The LAST enrolled client's forget: the two-entry transition ceremony that
- * takes an account from one enrolled client to the client-less,
- * ladder-anchored state -- the same state a credential-anchored signup and a
+ * The LAST enrolled client's forget: the transition ceremony that takes an
+ * account from one enrolled client to the client-less, ladder-anchored
+ * state -- the same state a credential-anchored signup and a
  * transient recovery produce. Decision 0004's 2026-08-19 amendment fixes the
  * entry order, and it is forced twice over: the server's revocation endpoint
  * verifies a to-be-revoked capability's chain against the CURRENTLY resolved
@@ -13,11 +13,39 @@
  * the client's verification method is gone, nothing can sign the revocation
  * POST at all). So:
  *
- * 1. **The install entry** ({@link installLadderVmWebvh}): the ladder VM
- *    joins the document while the client's whole inventory stays -- the
- *    both-present transitional state. This is the ceremony's
- *    inventory-changing document version under the ceremony-tail license.
- * 2. **The roster rotation**, ladder-signed, anchored at the install entry,
+ * 1. **The strike-and-reinstall pair**
+ *    ({@link strikeLadderVmWebvh}, then {@link installLadderVmWebvh}): this
+ *    credential's own ladder VM leaves the document and returns in the next
+ *    entry, the client's whole inventory standing throughout. A ladder VM's
+ *    life is keyed to its credential rather than to the account's client
+ *    census, so the VM already stands when the transition starts and a bare
+ *    install would publish nothing; the reinstall is what carries the
+ *    ceremony's inventory-changing document version under the ceremony-tail
+ *    license. The strike reaches one credential's VM -- the id derives from
+ *    the ladder seed -- so another standing credential's VM is untouched.
+ *    The pair republishes the identical key under the identical id and
+ *    revokes nothing, so the revocation stage below is undisturbed by it and
+ *    every unexpired ladder-signed delegation keeps verifying. Its costs are
+ *    stated rather than hidden: the reinstall reveals a rung that stands in
+ *    `updateKeys`, as the single install already did, now over two entries;
+ *    and a run torn between the two leaves the account with no ladder VM
+ *    while the client still stands, which a re-run mends (the strike no-ops,
+ *    the install reinstalls). The pair runs only when the rotation is still
+ *    owed or the VM is missing, so a resumed run past the rotation publishes
+ *    neither entry.
+ *
+ *    Both entries publish through `clientLogStore`, the store invoked under
+ *    the ENROLLED client's root authority, and not through the credential's
+ *    bridge delegation. The bridge is often signed by the very VM the strike
+ *    removes -- the readiness stage's renewal mints it as the ladder, and
+ *    stage 6 re-signs it as the ladder again -- so a bridge-invoked reinstall
+ *    would be authorized against the post-strike document under the
+ *    current-key-set rule and refused, leaving the account VM-less with every
+ *    ladder-signed delegation rotted and a re-run failing identically. The
+ *    client stands until stage 7 and holds root authority on the Space, so
+ *    its store is the one that carries the pair. Only the HTTP invocation
+ *    changes: both entries stay ladder-SIGNED.
+ * 2. **The roster rotation**, ladder-signed, anchored at the reinstall entry,
  *    HTTP-invoked under the still-standing client: the user key rotates off
  *    this client's wrap in ONE append (the license's one-shot shape), read
  *    back through the credential's standing wrap. Because the append's
@@ -27,15 +55,19 @@
  * 3. **The collection fan-out**, still under this client's invocation
  *    authority: every encrypted collection re-epochs onto the fresh key.
  * 4. **The generation-delegation replacement and revocations**: a fresh
- *    ladder-signed generation delegation replaces the embedded one
- *    unconditionally (the forced renewal), and then EVERY still-unexpired
- *    delegation the annex log's history ever embedded that this
- *    credential's ladder VM signed is revoked at the server (a renewal
- *    inside the 30-day window can leave two) -- closing the resurrection
- *    window a reinstalled derived-key VM would otherwise reopen. The
- *    replacement is what keeps the account transient-login-reachable after
- *    the transition; replace-before-revoke is what keeps a torn run from
- *    stranding the generation delegation-less.
+ *    ladder-signed generation delegation replaces the embedded one when the
+ *    house staleness policy, read against a projected post-edit document,
+ *    says it is owed -- this credential's ladder VM and the forgotten client
+ *    are both named retiring, which is every key this ceremony ends. Then
+ *    EVERY still-unexpired delegation the annex log's history ever embedded
+ *    that this credential's ladder VM signed is revoked at the server (a
+ *    renewal inside the 30-day window can leave two) -- closing the
+ *    resurrection window a reinstalled derived-key VM would otherwise
+ *    reopen. The replacement is what keeps the account
+ *    transient-login-reachable after the transition; replace-before-revoke
+ *    is what keeps a torn run from stranding the generation delegation-less.
+ *    A delegation a surviving sibling credential's ladder signed is left
+ *    standing, since the revocation loop never reaches it either.
  * 5. **The other unlock methods' record re-mint** (`unlockMethods`): every
  *    other standing credential's and recovery code's bridge (and
  *    `delegatedClients` sibling, where the record carries one) is re-signed
@@ -69,19 +101,34 @@
  *    client -- an account nothing can write to -- which is why a call that
  *    omits the seam is refused before any read.
  * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
- *    whole document inventory out while the installed ladder VM keeps the
- *    account anchored. The app's local wipe runs after this ceremony
- *    returns.
+ *    whole document inventory out while the reinstalled ladder VM keeps the
+ *    account anchored. The post-removal `did:web` projection is PUT through
+ *    `clientLogStore` immediately BEFORE that entry, since the entry itself
+ *    is ladder-signed and writes `did.jsonl` alone while the client's root
+ *    authority ends at it -- without that the account would land client-less
+ *    with `did.json` still publishing the forgotten client's keys and nothing
+ *    left able to rewrite it. A run torn between the PUT and the entry leaves
+ *    `did.json` omitting a client the log still lists, which is fail-closed
+ *    for a `did:web` verifier and re-PUT by the re-run. The app's local wipe
+ *    runs after this ceremony returns.
  *
  * Torn-state map: every stage detects completion from durable state, so a
  * run torn anywhere before the removal entry reads as "not forgotten" and a
- * re-run converges -- the install entry is idempotent, an already-rotated
+ * re-run converges. A tear BETWEEN the pair's two entries is the one worth
+ * stating in full: it leaves the account with no ladder VM while the client
+ * still stands, and the re-run's reinstall converges because it rides the
+ * client's root authority rather than the credential's bridge -- the bridge
+ * the strike may itself have rotted cannot authorize that write, and nothing
+ * else on a one-client account could. Both entries of the pair are
+ * idempotent and the pair is
+ * skipped once the rotation has landed, an already-rotated
  * roster skips the append (no second ladder-signed append is ever
  * attempted), the fan-out is staleness-driven, a re-POSTed revocation's 400
  * already-revoked answer reads as success (decision 0006's resume contract),
- * and the forced replacement re-mints (the prior run's fresh delegation is
- * then revoked as history, so a re-run churns one delegation and strands
- * nothing), and the record re-mint re-checks staleness per entry (a record
+ * the generation stage re-asks the same staleness policy (a prior run's own
+ * fresh delegation reads as retiring, so a re-run churns one delegation and
+ * strands nothing, while a sibling-signed one churns none), and the record
+ * re-mint re-checks staleness per entry (a record
  * already ladder-signed reads as current, one whose re-mint failed is still
  * rotted and is re-minted). Torn after the removal entry is the
  * finish-the-wipe state the app's next login maps.
@@ -90,11 +137,12 @@
  * browser already fetched stays forensically recoverable from its storage,
  * and old epochs stay open to keys it already held.
  */
-import type { DIDLog } from '@interop/did-method-webvh';
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
 import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
 import type { ZcapClient } from '@interop/ezcap';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
@@ -104,7 +152,9 @@ import { type RecordRemintOutcome, type RecoveryDelegationEntry } from '../recov
 import { type ClientAnnexWriteStore } from './log.js';
 /**
  * What the ceremony's generation stage did: the revoked delegation ids, and
- * whether the forced replacement landed. A `skipped` reason names the stage
+ * whether it wrote a replacement -- `false` with no `skipped` reason means
+ * nothing was owed, the standing delegation being one a surviving sibling
+ * credential's ladder signed. A `skipped` reason names the stage
  * that could not run -- `no-pointer` (the account points at no generation:
  * nothing to revoke or replace), `log-unreadable` (the pointed generation's
  * `did.jsonl` is gone; the delegation bytes are unrecoverable, decision
@@ -140,8 +190,10 @@ export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry
     }) => Promise<void>;
 }
 /**
- * What a completed last-client forget reports: whether the install entry ran
- * on this call (`false` on a resumed run), whether the roster's wrap for the
+ * What a completed last-client forget reports: whether the reinstall half of
+ * the strike-and-reinstall pair ran on this call (`false` on a resumed run
+ * that owed no rotation, so neither entry was published), whether the
+ * roster's wrap for the
  * forgotten client was retired on this run, the per-collection fan-out
  * result, the generation stage's report, the other unlock methods' record
  * re-mint report (present when the caller supplied the reach: the counts and
@@ -151,7 +203,7 @@ export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry
  * the roster descriptor it was read from.
  */
 export interface LastEnrolledClientForgetResult {
-    installed: boolean;
+    reinstalled: boolean;
     rotated: boolean;
     collections: UserKeyCascadeResult;
     generation: GenerationDelegationRetirement;
@@ -199,10 +251,20 @@ export declare class RecordRemintFailedError extends Error {
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ * @param options.clientLogStore {UnlockLogStore}   the account-log store
+ *   invoked under the STILL-STANDING enrolled client's root authority (an
+ *   app's `wasWebvhIdStore` satisfies the narrower shape). The
+ *   strike-and-reinstall pair publishes through it, because the bridge
+ *   `logStore` is often signed by the ladder VM the strike removes and the
+ *   reinstall would then be refused under the current-key-set rule. Both
+ *   entries stay ladder-signed; only the HTTP invocation differs. It also
+ *   carries the removal entry's pre-entry `did:web` projection PUT (stage 7),
+ *   the one write the bridge store cannot make. Required: a call without it
+ *   throws a `TypeError` before any read
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
- *   account-log read the ceremony makes -- the pre-install read, and the
- *   install and removal entries' own reads inside their conflict-retry
+ *   account-log read the ceremony makes -- the opening read, and the strike,
+ *   reinstall, and removal entries' own reads inside their conflict-retry
  *   loops -- is checked against the pinned head, so a served truncated
  *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
  *   roster append or log publish, and each entry advances the pin to the
@@ -221,8 +283,9 @@ export declare class RecordRemintFailedError extends Error {
  * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
  *   builds the `key-map/user-key.jsonl` roster store whose appends are
  *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied post-install log (the inventory-changing anchor the ceremony-tail
- *   license admits), while its HTTP requests invoke under the still-standing
+ *   supplied log -- the pre-transition head for the opening read, the
+ *   post-reinstall head for the rotation (the inventory-changing anchor the
+ *   ceremony-tail license admits), while its HTTP requests invoke under the still-standing
  *   client
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
  *   credential's key-agreement key -- the recipient whose wrap survives the
@@ -261,7 +324,7 @@ export declare class RecordRemintFailedError extends Error {
  * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
  *   after the record re-mint stage, immediately before the removal entry,
- *   with the post-install published state. The caller re-signs the login
+ *   with the post-reinstall published state. The caller re-signs the login
  *   credential's bridge and `delegatedClients` sibling with the ladder VM
  *   and re-seals its unlock record here -- the only stage that reaches the
  *   login credential's record, which the `unlockMethods` pass skips. Must
@@ -270,8 +333,9 @@ export declare class RecordRemintFailedError extends Error {
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastEnrolledClientForgetResult>}
  */
-export declare function forgetLastEnrolledClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
+    clientLogStore: UnlockLogStore;
     pinStore?: ResourceLogPinStore;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
@@ -309,4 +373,31 @@ export declare function forgetLastEnrolledClient({ logStore, pinStore, ladderSee
     }) => Promise<void>;
     now?: number;
 }): Promise<LastEnrolledClientForgetResult>;
+/**
+ * THE LAST-CLIENT REMOVAL ENTRY (stage 7, the transition's own removal): the
+ * plain forget's removal shape (`clientForgetEntryOnce`) with this ceremony's
+ * removability invariant injected instead of the plain forget's last-client
+ * refusal -- the forgotten client IS the last enrolled client, and the
+ * account stays invocable because the ladder VM the reinstall entry published
+ * remains in the document. Run only from {@link forgetLastEnrolledClient},
+ * which sequences the strike-and-reinstall pair, the rotation, and the
+ * revocations before it.
+ *
+ * @param options {object}   see `forgetWebvhClient` in `ladderAnchored.ts`
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}
+ */
+export declare function forgetLastWebvhClient(options: {
+    store: UnlockLogStore;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+    ladderSeed: Uint8Array;
+    forgottenClient: RevokedClientKeys;
+    knownLatentHashes?: string[];
+    expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
+}): Promise<{
+    did: string;
+    doc: DIDDoc;
+    log: DIDLog;
+}>;
 //# sourceMappingURL=forgetLast.d.ts.map

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAgM1C"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuIG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAMxE,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAU1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAkR1C;AAkND;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}