@interop/wallet-core 0.62.0 → 0.66.0

package/dist/resourceLog/controller.js

@@ -1,55 +1,22 @@
 import { ResourceLogIntegrityError } from '@interop/vh-resource-log';
+import { credentialKeyAgreementMethods, ladderVmMethods, resolvedRelationMethods } from './document.js';
+import { attributeLadderRungsPerVersion, entrySignerKeysOf } from './ladderRungs.js';
 import { assertLadderAppendLicensed } from './license.js';
 /**
- * Resolves one relation entry: an embedded verification method verbatim, a
- * string reference through the given `verificationMethod` index.
+ * Collects a document's `assertionMethod` key multibases, over the shared
+ * relation reader (embedded verification methods verbatim, string references
+ * resolved against `verificationMethod`).
  *
- * @param entry {string | ControllerVerificationMethod}
- * @param byId {Map<string, ControllerVerificationMethod>}
- * @returns {ControllerVerificationMethod | undefined}
- */
-function resolveMethod(entry, byId) {
-    return typeof entry === 'string' ? byId.get(entry) : entry;
-}
-/**
- * Indexes a document's `verificationMethod` array by id.
- *
- * @param doc {ControllerDocument}
- * @returns {Map<string, ControllerVerificationMethod>}
- */
-function methodsById(doc) {
-    const byId = new Map();
-    for (const method of doc.verificationMethod ?? []) {
-        if (typeof method?.id === 'string') {
-            byId.set(method.id, method);
-        }
-    }
-    return byId;
-}
-/**
- * A relation entry's verification-method id: the string reference itself, or
- * an embedded method's `id`.
- *
- * @param entry {string | ControllerVerificationMethod}
- * @returns {string | undefined}
- */
-function relationIdOf(entry) {
-    return typeof entry === 'string' ? entry : entry?.id;
-}
-/**
- * Collects a document's `assertionMethod` key multibases: embedded
- * verification methods verbatim, string references resolved against
- * `verificationMethod`.
- *
- * @param doc {ControllerDocument}
+ * @param doc {AccountDocument}
  * @returns {Set<string>}
  */
 function assertionKeysOf(doc) {
-    const byId = methodsById(doc);
     const keys = new Set();
-    for (const entry of doc.assertionMethod ?? []) {
-        const method = resolveMethod(entry, byId);
-        if (method && typeof method.publicKeyMultibase === 'string') {
+    for (const method of resolvedRelationMethods({
+        doc,
+        relation: 'assertionMethod'
+    })) {
+        if (typeof method.publicKeyMultibase === 'string') {
             keys.add(method.publicKeyMultibase);
         }
     }
@@ -57,45 +24,41 @@ function assertionKeysOf(doc) {
 }
 /**
  * Collects a document's credential-inventory view (see
- * {@link ControllerInventory}): the ladder VMs by relation asymmetry
- * (`capabilityDelegation` members absent from `capabilityInvocation`,
- * compared by verification-method id), and S(V) as the account-controlled
- * `keyAgreement` methods' key material -- `publicKeyCommitment` where the
- * entry is a commitment, `publicKeyMultibase` where it is verbatim (the two
- * value spaces are disjoint) -- union the ladder keys. A `keyAgreement`
- * method carrying neither is skipped: an unidentifiable entry must not make
- * two distinct inventories compare equal.
+ * {@link ControllerInventory}) over the shared account-document readers, so
+ * ladder recognition and the credential class have one definition here and in
+ * every other reader: `ladderVmMethods` names the ladder VMs by relation
+ * asymmetry, and `credentialKeyAgreementMethods` names the account-controlled
+ * `keyAgreement` methods. S(V) is those methods' key material --
+ * `publicKeyCommitment` where the entry is a commitment,
+ * `publicKeyMultibase` where it is verbatim (the two value spaces are
+ * disjoint) -- union the ladder keys. A `keyAgreement` method carrying
+ * neither is skipped: an unidentifiable entry must not make two distinct
+ * inventories compare equal.
  *
- * @param doc {ControllerDocument}
- * @param did {string}   the account DID inventory entries are controlled by
- * @returns {ControllerInventory}
+ * The enrolled-client set the license's third shape compares across versions
+ * is read from the same document in the same pass: the `capabilityInvocation`
+ * methods' key multibases. That relation is the client census by definition --
+ * a ladder VM is absent from it by the recognition asymmetry, and a
+ * credential's `keyAgreement` entry was never in it -- so the two sets this
+ * function returns cannot overlap by construction.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}
+ * @param options.did {string}   the account DID inventory entries are
+ *   controlled by
+ * @param options.entry {DIDLogEntry}   the version's own log entry, read for
+ *   the update keys that signed it
+ * @returns {Omit<ControllerInventory, 'ladderRungKeys'>}
  */
-function inventoryOf(doc, did) {
-    const byId = methodsById(doc);
-    const invocable = new Set();
-    for (const entry of doc.capabilityInvocation ?? []) {
-        const id = relationIdOf(entry);
-        if (id !== undefined) {
-            invocable.add(id);
-        }
-    }
+function inventoryOf({ doc, did, entry }) {
     const ladderKeys = new Set();
-    for (const entry of doc.capabilityDelegation ?? []) {
-        const id = relationIdOf(entry);
-        if (id !== undefined && invocable.has(id)) {
-            continue;
-        }
-        const method = resolveMethod(entry, byId);
-        if (method && typeof method.publicKeyMultibase === 'string') {
+    for (const method of ladderVmMethods({ doc })) {
+        if (typeof method.publicKeyMultibase === 'string') {
             ladderKeys.add(method.publicKeyMultibase);
         }
     }
     const inventoryKeys = new Set(ladderKeys);
-    for (const entry of doc.keyAgreement ?? []) {
-        const method = resolveMethod(entry, byId);
-        if (!method || method.controller !== did) {
-            continue;
-        }
+    for (const method of credentialKeyAgreementMethods({ doc, did })) {
         if (typeof method.publicKeyCommitment === 'string') {
             inventoryKeys.add(method.publicKeyCommitment);
         }
@@ -103,7 +66,21 @@ function inventoryOf(doc, did) {
             inventoryKeys.add(method.publicKeyMultibase);
         }
     }
-    return { ladderKeys, inventoryKeys };
+    const enrolledClientKeys = new Set();
+    for (const method of resolvedRelationMethods({
+        doc,
+        relation: 'capabilityInvocation'
+    })) {
+        if (typeof method.publicKeyMultibase === 'string') {
+            enrolledClientKeys.add(method.publicKeyMultibase);
+        }
+    }
+    return {
+        ladderKeys,
+        inventoryKeys,
+        enrolledClientKeys,
+        entrySignerKeys: entrySignerKeysOf(entry)
+    };
 }
 /**
  * Builds the controller view over an already-verified did:webvh account log
@@ -132,11 +109,18 @@ export function webvhResourceLogController({ did, log }) {
     const versionIds = log.map(entry => entry.versionId);
     const keysByVersion = new Map();
     const inventoryByVersion = new Map();
-    for (const entry of log) {
+    const positionByVersion = new Map();
+    for (const [position, entry] of log.entries()) {
         const doc = entry.state;
         keysByVersion.set(entry.versionId, assertionKeysOf(doc));
-        inventoryByVersion.set(entry.versionId, inventoryOf(doc, did));
+        inventoryByVersion.set(entry.versionId, inventoryOf({ doc, did, entry }));
+        positionByVersion.set(entry.versionId, position);
     }
+    // The rung attribution hashes committed keys, so it cannot run in the sync
+    // pass above. It is computed once on the first inventory read and shared by
+    // every later one: the walk is a pure function of the log, and a log is read
+    // fresh and never mutated in place.
+    let rungSnapshots;
     const head = log.length === 0 ? undefined : log[log.length - 1];
     function versionRefusal(versionId) {
         return new ResourceLogIntegrityError(`The controller document did not resolve at version ` +
@@ -154,14 +138,23 @@ export function webvhResourceLogController({ did, log }) {
             }
             return Promise.resolve(resolved);
         },
-        inventoryAt(versionId) {
-            const resolved = versionId === undefined
-                ? head && inventoryByVersion.get(head.versionId)
-                : inventoryByVersion.get(versionId);
-            if (!resolved) {
-                return Promise.reject(versionRefusal(versionId));
+        async inventoryAt(versionId) {
+            const resolvedVersionId = versionId === undefined ? head?.versionId : versionId;
+            const resolved = resolvedVersionId === undefined
+                ? undefined
+                : inventoryByVersion.get(resolvedVersionId);
+            const position = resolvedVersionId === undefined
+                ? undefined
+                : positionByVersion.get(resolvedVersionId);
+            if (!resolved || position === undefined) {
+                throw versionRefusal(versionId);
             }
-            return Promise.resolve(resolved);
+            rungSnapshots ??= attributeLadderRungsPerVersion(log);
+            const snapshots = await rungSnapshots;
+            return {
+                ...resolved,
+                ladderRungKeys: snapshots[position] ?? new Map()
+            };
         },
         async admitAppend({ keyMultibase, controllerVersionId, controllerVersionIndex, headControllerVersionIndex, proofKeys }) {
             const inventory = await view.inventoryAt(controllerVersionId);

package/dist/resourceLog/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAyEzD;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,KAA4C,EAC5C,IAA+C;IAE/C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,KAA4C;IAE5C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW,CAClB,GAAuB,EACvB,GAAW;IAEX,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACzC,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YACnD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC/C,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACzD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA+B,CAAA;IACjE,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAA2B,CAAA;QAC7C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,SAAS,cAAc,CAAC,SAAkB;QACxC,OAAO,IAAI,yBAAyB,CAClC,qDAAqD;YACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA+B;QACvC,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,WAAW,CAAC,SAAkB;YAC5B,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACV;YACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;YAC7D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,0BAA0B,CAAC;oBAC/B,UAAU,EAAE,IAAI;oBAChB,sBAAsB;oBACtB,0BAA0B;oBAC1B,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,uBAAuB,EAExB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EAElB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAkEzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,WAAW,CAAC,EACnB,GAAG,EACH,GAAG,EACH,KAAK,EAKN;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YACnD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC/C,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACzD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC5C,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU;QACV,aAAa;QACb,kBAAkB;QAClB,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC;KAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAA;IACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAwB,CAAA;QAC1C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACzE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClD,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,oCAAoC;IACpC,IAAI,aAAoD,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,SAAS,cAAc,CAAC,SAAkB;QACxC,OAAO,IAAI,yBAAyB,CAClC,qDAAqD;YACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA+B;QACvC,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAkB;YAClC,MAAM,iBAAiB,GACrB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACvD,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC/C,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;YACD,aAAa,KAAK,8BAA8B,CAAC,GAAG,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAA;YACrC,OAAO;gBACL,GAAG,QAAQ;gBACX,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE;aACjD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACV;YACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;YAC7D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,0BAA0B,CAAC;oBAC/B,UAAU,EAAE,IAAI;oBAChB,sBAAsB;oBACtB,0BAA0B;oBAC1B,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/resourceLog/document.d.ts

@@ -0,0 +1,182 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The account-document reading conventions every reader shares, in one place:
+ * how a verification relation resolves (string references into
+ * `verificationMethod`, embedded methods verbatim), which
+ * `capabilityDelegation` members are ladder VMs, and which `keyAgreement`
+ * methods are the account's credential inventory.
+ *
+ * Each of those rules is a wire-level convention of the account document, so
+ * a second implementation of one is a place the readers can disagree: the
+ * ceremony-tail license's inventory comparison and the client listing's
+ * ladder-VM recognition must answer identically over the same document, and
+ * so must the roster's recipient resolver and the client listing's marker
+ * filter. They are consumers of the readers here rather than re-readings of
+ * the document.
+ *
+ * Deliberately dependency-light -- it imports nothing at all -- so both the
+ * layer-0 controller adapter beside it and the `webvh` and `keys` layers
+ * above can share the readers without pulling the ceremony or signing graph.
+ * Its public home is `@interop/wallet-core/webvh`, which re-exports the
+ * `keyAgreement` readers and the ladder recognition; this subpath exports
+ * none of them, so each name has one owner.
+ */
+/**
+ * The materialized shape the relation readers return: a verification method
+ * carrying either the key itself (`publicKeyMultibase`) or, for a
+ * low-entropy-derived standing unlock credential, its hash commitment
+ * (`publicKeyCommitment`). The `type` rides along so a consumer can tell the
+ * two published flavors apart (`Multikey` vs `MultikeyCommitment`) instead of
+ * inferring the flavor from which property happens to be present.
+ */
+export interface ResolvedKeyAgreementMethod {
+    id?: string;
+    type?: string;
+    controller?: string;
+    publicKeyMultibase?: string;
+    publicKeyCommitment?: string;
+}
+/**
+ * A locally verified did:webvh document, read for the verification relations
+ * it publishes and the methods they resolve to. Structural on purpose: a
+ * resolved `DIDDoc` satisfies it, and so does any narrower document shape a
+ * wallet already holds.
+ */
+export interface AccountDocument {
+    verificationMethod?: ResolvedKeyAgreementMethod[];
+    assertionMethod?: Array<string | ResolvedKeyAgreementMethod>;
+    keyAgreement?: Array<string | ResolvedKeyAgreementMethod>;
+    capabilityInvocation?: Array<string | ResolvedKeyAgreementMethod>;
+    capabilityDelegation?: Array<string | ResolvedKeyAgreementMethod>;
+}
+/**
+ * The document shape the `keyAgreement` readers take, kept as the published
+ * name the `webvh` and `keys` subpaths surface. It is {@link AccountDocument}
+ * itself: every member is optional, so a caller holding only the
+ * `keyAgreement` half satisfies it unchanged.
+ */
+export type KeyAgreementDocument = AccountDocument;
+/**
+ * The verification relations a document reader may resolve.
+ */
+export type DocumentRelation = Exclude<keyof AccountDocument, 'verificationMethod'>;
+/**
+ * The relationship references of a resolved document as verification-method
+ * ids, tolerating embedded objects beside string references.
+ *
+ * @param relation {Array}   the relationship array, when present
+ * @returns {string[]}
+ */
+export declare function relationIds(relation: Array<string | {
+    id?: string;
+}> | undefined): string[];
+/**
+ * The verification methods one relation publishes, materialized: string
+ * references resolved against `verificationMethod` (a reference nothing backs
+ * is dropped), embedded methods taken verbatim. Document order is preserved,
+ * and nothing is filtered -- deciding which of these methods belongs to whom
+ * is each caller's own rule.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @param options.relation {DocumentRelation}   the relation to resolve
+ * @returns {ResolvedKeyAgreementMethod[]}
+ */
+export declare function resolvedRelationMethods({ doc, relation }: {
+    doc: AccountDocument;
+    relation: DocumentRelation;
+}): ResolvedKeyAgreementMethod[];
+/**
+ * The `keyAgreement` verification methods a document publishes, materialized:
+ * string references resolved against `verificationMethod` (a reference nothing
+ * backs is dropped), embedded methods taken verbatim. Document order is
+ * preserved, and nothing is filtered -- deciding which of these methods belongs
+ * to whom is each caller's own rule.
+ *
+ * @param options {object}
+ * @param options.doc {KeyAgreementDocument}   a locally verified document
+ * @returns {ResolvedKeyAgreementMethod[]}
+ */
+export declare function resolvedKeyAgreementMethods({ doc }: {
+    doc: KeyAgreementDocument;
+}): ResolvedKeyAgreementMethod[];
+/**
+ * The CREDENTIAL-CLASS `keyAgreement` methods a document publishes: those the
+ * account DID itself controls. The rule is structural, and it is the exact
+ * complement of the client marker: an enrolled client's key-agreement method
+ * carries `controller: did:key:<its signing multibase>`
+ * (`clientKeyAgreementController`), while a standing unlock credential's
+ * carries the account DID. Both published flavors match -- a passphrase's
+ * `MultikeyCommitment` and the verbatim `Multikey` a passkey or a recovery
+ * code publishes -- because the class is decided by the controller alone.
+ *
+ * Nothing here tells one credential from another. A recovery code's entry is
+ * indistinguishable from a passkey's by construction (both are unmarked and
+ * verbatim), so a caller retiring this class retires every credential the
+ * account stands on, which is what the transient and remembered recovery
+ * continuations want.
+ *
+ * @param options {object}
+ * @param options.doc {KeyAgreementDocument}   a locally verified document
+ * @param options.did {string}   the account DID the document resolves to
+ * @returns {ResolvedKeyAgreementMethod[]}   in document order
+ */
+export declare function credentialKeyAgreementMethods({ doc, did }: {
+    doc: KeyAgreementDocument;
+    did: string;
+}): ResolvedKeyAgreementMethod[];
+/**
+ * The ladder-VM recognition convention: a `capabilityDelegation` member
+ * absent from `capabilityInvocation` is a ladder VM -- the stable sibling key
+ * a standing credential publishes for as long as it stands
+ * (`ladderVerificationMethod` is the one write-side builder). The
+ * asymmetry is the convention rather than a marker property because it is
+ * what actually carries the authority: zcap's `delegator.id` cannot identify
+ * the signer, so a verifier classifies the VM from the resolved document it
+ * already holds -- a zero-I/O read -- and the same asymmetry is what keeps
+ * the VM structurally out of every client listing (those key on
+ * `capabilityInvocation`). An enrolled client publishes its signing key under
+ * both relations, so it can never match.
+ *
+ * Returns every matching verification-method id, in document order. A ladder
+ * VM's life is keyed to its credential rather than to the account's client
+ * census: the standing establishment installs it, the credential's retirement
+ * strikes it, and enrollment leaves it alone. So the count is one per
+ * standing credential, co-resident with however many clients the account has
+ * enrolled, and a stale third-party VM can stand beside them.
+ *
+ * @param options {object}
+ * @param options.doc {object}   a locally verified document
+ * @returns {string[]}   the ladder VMs' verification-method ids
+ */
+export declare function ladderVmIds({ doc }: {
+    doc: {
+        capabilityInvocation?: Array<string | {
+            id?: string;
+        }>;
+        capabilityDelegation?: Array<string | {
+            id?: string;
+        }>;
+    };
+}): string[];
+/**
+ * The ladder VMs' verification methods, materialized: the
+ * `capabilityDelegation` methods {@link ladderVmIds} names, resolved the way
+ * every other relation read resolves. Recognition therefore has exactly one
+ * definition -- a reader needing the ladder keys themselves (their
+ * `publicKeyMultibase`) asks here rather than re-deriving the asymmetry.
+ *
+ * A method the recognition cannot name -- an embedded `capabilityDelegation`
+ * entry carrying no `id`, or a reference nothing backs -- is not a ladder VM
+ * here, the same refuse-not-guess answer the id-keyed recognition gives.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @returns {ResolvedKeyAgreementMethod[]}   in document order
+ */
+export declare function ladderVmMethods({ doc }: {
+    doc: AccountDocument;
+}): ResolvedKeyAgreementMethod[];
+//# sourceMappingURL=document.d.ts.map

package/dist/resourceLog/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACzD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACjE,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;CAClE;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAElD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,MAAM,eAAe,EACrB,oBAAoB,CACrB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACpD,MAAM,EAAE,CASV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,GAAG,EACH,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;IACpB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,0BAA0B,EAAE,CAe/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAE/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,EAAE,CAI/B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,EAC1B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE;QACH,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACtD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvD,CAAA;CACF,GAAG,MAAM,EAAE,CAGX;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,0BAA0B,EAAE,CAM/B"}

package/dist/resourceLog/document.js

@@ -0,0 +1,159 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The account-document reading conventions every reader shares, in one place:
+ * how a verification relation resolves (string references into
+ * `verificationMethod`, embedded methods verbatim), which
+ * `capabilityDelegation` members are ladder VMs, and which `keyAgreement`
+ * methods are the account's credential inventory.
+ *
+ * Each of those rules is a wire-level convention of the account document, so
+ * a second implementation of one is a place the readers can disagree: the
+ * ceremony-tail license's inventory comparison and the client listing's
+ * ladder-VM recognition must answer identically over the same document, and
+ * so must the roster's recipient resolver and the client listing's marker
+ * filter. They are consumers of the readers here rather than re-readings of
+ * the document.
+ *
+ * Deliberately dependency-light -- it imports nothing at all -- so both the
+ * layer-0 controller adapter beside it and the `webvh` and `keys` layers
+ * above can share the readers without pulling the ceremony or signing graph.
+ * Its public home is `@interop/wallet-core/webvh`, which re-exports the
+ * `keyAgreement` readers and the ladder recognition; this subpath exports
+ * none of them, so each name has one owner.
+ */
+/**
+ * The relationship references of a resolved document as verification-method
+ * ids, tolerating embedded objects beside string references.
+ *
+ * @param relation {Array}   the relationship array, when present
+ * @returns {string[]}
+ */
+export function relationIds(relation) {
+    const ids = [];
+    for (const entry of relation ?? []) {
+        const id = typeof entry === 'string' ? entry : entry?.id;
+        if (id) {
+            ids.push(id);
+        }
+    }
+    return ids;
+}
+/**
+ * The verification methods one relation publishes, materialized: string
+ * references resolved against `verificationMethod` (a reference nothing backs
+ * is dropped), embedded methods taken verbatim. Document order is preserved,
+ * and nothing is filtered -- deciding which of these methods belongs to whom
+ * is each caller's own rule.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @param options.relation {DocumentRelation}   the relation to resolve
+ * @returns {ResolvedKeyAgreementMethod[]}
+ */
+export function resolvedRelationMethods({ doc, relation }) {
+    const byId = new Map();
+    for (const method of doc.verificationMethod ?? []) {
+        if (typeof method?.id === 'string') {
+            byId.set(method.id, method);
+        }
+    }
+    const methods = [];
+    for (const entry of doc[relation] ?? []) {
+        const method = typeof entry === 'string' ? byId.get(entry) : entry;
+        if (method) {
+            methods.push(method);
+        }
+    }
+    return methods;
+}
+/**
+ * The `keyAgreement` verification methods a document publishes, materialized:
+ * string references resolved against `verificationMethod` (a reference nothing
+ * backs is dropped), embedded methods taken verbatim. Document order is
+ * preserved, and nothing is filtered -- deciding which of these methods belongs
+ * to whom is each caller's own rule.
+ *
+ * @param options {object}
+ * @param options.doc {KeyAgreementDocument}   a locally verified document
+ * @returns {ResolvedKeyAgreementMethod[]}
+ */
+export function resolvedKeyAgreementMethods({ doc }) {
+    return resolvedRelationMethods({ doc, relation: 'keyAgreement' });
+}
+/**
+ * The CREDENTIAL-CLASS `keyAgreement` methods a document publishes: those the
+ * account DID itself controls. The rule is structural, and it is the exact
+ * complement of the client marker: an enrolled client's key-agreement method
+ * carries `controller: did:key:<its signing multibase>`
+ * (`clientKeyAgreementController`), while a standing unlock credential's
+ * carries the account DID. Both published flavors match -- a passphrase's
+ * `MultikeyCommitment` and the verbatim `Multikey` a passkey or a recovery
+ * code publishes -- because the class is decided by the controller alone.
+ *
+ * Nothing here tells one credential from another. A recovery code's entry is
+ * indistinguishable from a passkey's by construction (both are unmarked and
+ * verbatim), so a caller retiring this class retires every credential the
+ * account stands on, which is what the transient and remembered recovery
+ * continuations want.
+ *
+ * @param options {object}
+ * @param options.doc {KeyAgreementDocument}   a locally verified document
+ * @param options.did {string}   the account DID the document resolves to
+ * @returns {ResolvedKeyAgreementMethod[]}   in document order
+ */
+export function credentialKeyAgreementMethods({ doc, did }) {
+    return resolvedKeyAgreementMethods({ doc }).filter(method => method.controller === did);
+}
+/**
+ * The ladder-VM recognition convention: a `capabilityDelegation` member
+ * absent from `capabilityInvocation` is a ladder VM -- the stable sibling key
+ * a standing credential publishes for as long as it stands
+ * (`ladderVerificationMethod` is the one write-side builder). The
+ * asymmetry is the convention rather than a marker property because it is
+ * what actually carries the authority: zcap's `delegator.id` cannot identify
+ * the signer, so a verifier classifies the VM from the resolved document it
+ * already holds -- a zero-I/O read -- and the same asymmetry is what keeps
+ * the VM structurally out of every client listing (those key on
+ * `capabilityInvocation`). An enrolled client publishes its signing key under
+ * both relations, so it can never match.
+ *
+ * Returns every matching verification-method id, in document order. A ladder
+ * VM's life is keyed to its credential rather than to the account's client
+ * census: the standing establishment installs it, the credential's retirement
+ * strikes it, and enrollment leaves it alone. So the count is one per
+ * standing credential, co-resident with however many clients the account has
+ * enrolled, and a stale third-party VM can stand beside them.
+ *
+ * @param options {object}
+ * @param options.doc {object}   a locally verified document
+ * @returns {string[]}   the ladder VMs' verification-method ids
+ */
+export function ladderVmIds({ doc }) {
+    const invocable = new Set(relationIds(doc.capabilityInvocation));
+    return relationIds(doc.capabilityDelegation).filter(id => !invocable.has(id));
+}
+/**
+ * The ladder VMs' verification methods, materialized: the
+ * `capabilityDelegation` methods {@link ladderVmIds} names, resolved the way
+ * every other relation read resolves. Recognition therefore has exactly one
+ * definition -- a reader needing the ladder keys themselves (their
+ * `publicKeyMultibase`) asks here rather than re-deriving the asymmetry.
+ *
+ * A method the recognition cannot name -- an embedded `capabilityDelegation`
+ * entry carrying no `id`, or a reference nothing backs -- is not a ladder VM
+ * here, the same refuse-not-guess answer the id-keyed recognition gives.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @returns {ResolvedKeyAgreementMethod[]}   in document order
+ */
+export function ladderVmMethods({ doc }) {
+    const ids = new Set(ladderVmIds({ doc }));
+    return resolvedRelationMethods({
+        doc,
+        relation: 'capabilityDelegation'
+    }).filter(method => typeof method.id === 'string' && ids.has(method.id));
+}
+//# sourceMappingURL=document.js.map

package/dist/resourceLog/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAgDH;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,QAAqD;IAErD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;QACxD,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,GAAG,EACH,QAAQ,EAIT;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EAGJ;IACC,OAAO,uBAAuB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EAIJ;IACC,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAChD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,GAAG,EAMJ;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;IAChE,OAAO,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EAGJ;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACzC,OAAO,uBAAuB,CAAC;QAC7B,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC"}