@interop/wallet-core 0.62.0 → 0.66.0

package/dist/resourceLog/errors.d.ts

@@ -3,14 +3,18 @@
  */
 /**
  * The one refusal class the resource-log layer still owns after the generic
- * client side moved to `@interop/vh-resource-log`: the ceremony-tail license
- * refusal. The generic taxonomy (`ResourceLogIntegrityError`,
- * `ResourceLogContinuityError`, `ResourceLogClosedError`,
- * `LogNotConfirmedError`, and the store port's `ResourceLogConflictError`)
- * is the library's; wallet-core re-exports none of it -- one owner per name.
- * Like every class in that taxonomy, this one assigns its `name` string
- * explicitly and is matched by `err.name` across package boundaries (the
- * WC-64 rule; minified class names do not survive bundling).
+ * client side moved to `@interop/vh-resource-log` -- the ceremony-tail
+ * license refusal -- and the shared read-side classification of that
+ * library's taxonomy ({@link isResourceLogRefusal}: which refusals a caller
+ * must not paper over with a cached copy). The generic taxonomy
+ * (`ResourceLogIntegrityError`, `ResourceLogContinuityError`,
+ * `ResourceLogClosedError`, `LogNotConfirmedError`, and the store port's
+ * `ResourceLogConflictError`) is the library's; wallet-core re-exports none
+ * of it -- one owner per name. Like every class in that taxonomy, this one
+ * assigns its `name` string explicitly and is matched by `err.name` across
+ * package boundaries (the WC-64 rule; minified class names do not survive
+ * bundling), which is also why the predicate compares names rather than
+ * constructors and why this file stays import-free.
  */
 /**
  * A ladder-signed append outside the ceremony-tail license: it is not the
@@ -27,4 +31,39 @@ export declare class ResourceLogLicenseError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * Whether a resource-log refusal is one a caller must NOT paper over with a
+ * cached copy: a fabricated log (`ResourceLogIntegrityError`), or a log that
+ * is not the continuation of the pinned history
+ * (`ResourceLogContinuityError`) -- EXCEPT continuity reason `rollback`.
+ *
+ * This is the one implementation of the rollback carve-out ARCHITECTURE.md
+ * states once as policy. A rollback is reconcilable divergence, possibly
+ * nothing worse than replication lag: the pin is never regressed and nothing
+ * rolled back is adopted, so serving the cached copy while a lagging replica
+ * catches up is exactly the offline case, and refusing there would lock a
+ * healthy account out of its own start. A `fork` or an SCID/method switch is
+ * a refusal like fabrication.
+ *
+ * `ResourceLogLicenseError` is deliberately absent, so a license refusal on a
+ * READ lands in the soft transport class (warn, serve cached). Ratified
+ * behavior, not omission: the log is not corrupt and the signer genuinely
+ * holds the credential, so the append is unlicensed rather than forged. The
+ * two shapes that argues against -- a compromised still-listed key holder,
+ * and a genuine unlicensed entry N masking a forged entry N+1 under whole-log
+ * first-failure semantics -- were weighed and accepted (WC-149). The
+ * pre-write half of the license is where the class does its work: a
+ * conformant writer is refused before an unlicensed entry can land.
+ *
+ * Matched on `err.name` rather than `instanceof`: these errors are raised
+ * inside app-injected seams that can resolve to a different copy of this
+ * package (linked, or duplicated through a dependency tree), and an
+ * `instanceof` miss would drop a security refusal into a caller's
+ * warn-and-proceed branch. Callers add only the names the generic taxonomy
+ * does not carry.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isResourceLogRefusal(err: unknown): boolean;
 //# sourceMappingURL=errors.d.ts.map

package/dist/resourceLog/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAS1D"}

package/dist/resourceLog/errors.js

@@ -3,14 +3,18 @@
  */
 /**
  * The one refusal class the resource-log layer still owns after the generic
- * client side moved to `@interop/vh-resource-log`: the ceremony-tail license
- * refusal. The generic taxonomy (`ResourceLogIntegrityError`,
- * `ResourceLogContinuityError`, `ResourceLogClosedError`,
- * `LogNotConfirmedError`, and the store port's `ResourceLogConflictError`)
- * is the library's; wallet-core re-exports none of it -- one owner per name.
- * Like every class in that taxonomy, this one assigns its `name` string
- * explicitly and is matched by `err.name` across package boundaries (the
- * WC-64 rule; minified class names do not survive bundling).
+ * client side moved to `@interop/vh-resource-log` -- the ceremony-tail
+ * license refusal -- and the shared read-side classification of that
+ * library's taxonomy ({@link isResourceLogRefusal}: which refusals a caller
+ * must not paper over with a cached copy). The generic taxonomy
+ * (`ResourceLogIntegrityError`, `ResourceLogContinuityError`,
+ * `ResourceLogClosedError`, `LogNotConfirmedError`, and the store port's
+ * `ResourceLogConflictError`) is the library's; wallet-core re-exports none
+ * of it -- one owner per name. Like every class in that taxonomy, this one
+ * assigns its `name` string explicitly and is matched by `err.name` across
+ * package boundaries (the WC-64 rule; minified class names do not survive
+ * bundling), which is also why the predicate compares names rather than
+ * constructors and why this file stays import-free.
  */
 /**
  * A ladder-signed append outside the ceremony-tail license: it is not the
@@ -28,4 +32,46 @@ export class ResourceLogLicenseError extends Error {
         this.name = 'ResourceLogLicenseError';
     }
 }
+/**
+ * Whether a resource-log refusal is one a caller must NOT paper over with a
+ * cached copy: a fabricated log (`ResourceLogIntegrityError`), or a log that
+ * is not the continuation of the pinned history
+ * (`ResourceLogContinuityError`) -- EXCEPT continuity reason `rollback`.
+ *
+ * This is the one implementation of the rollback carve-out ARCHITECTURE.md
+ * states once as policy. A rollback is reconcilable divergence, possibly
+ * nothing worse than replication lag: the pin is never regressed and nothing
+ * rolled back is adopted, so serving the cached copy while a lagging replica
+ * catches up is exactly the offline case, and refusing there would lock a
+ * healthy account out of its own start. A `fork` or an SCID/method switch is
+ * a refusal like fabrication.
+ *
+ * `ResourceLogLicenseError` is deliberately absent, so a license refusal on a
+ * READ lands in the soft transport class (warn, serve cached). Ratified
+ * behavior, not omission: the log is not corrupt and the signer genuinely
+ * holds the credential, so the append is unlicensed rather than forged. The
+ * two shapes that argues against -- a compromised still-listed key holder,
+ * and a genuine unlicensed entry N masking a forged entry N+1 under whole-log
+ * first-failure semantics -- were weighed and accepted (WC-149). The
+ * pre-write half of the license is where the class does its work: a
+ * conformant writer is refused before an unlicensed entry can land.
+ *
+ * Matched on `err.name` rather than `instanceof`: these errors are raised
+ * inside app-injected seams that can resolve to a different copy of this
+ * package (linked, or duplicated through a dependency tree), and an
+ * `instanceof` miss would drop a security refusal into a caller's
+ * warn-and-proceed branch. Callers add only the names the generic taxonomy
+ * does not carry.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isResourceLogRefusal(err) {
+    const candidate = err;
+    if (candidate?.name === 'ResourceLogIntegrityError') {
+        return true;
+    }
+    return (candidate?.name === 'ResourceLogContinuityError' &&
+        candidate.reason !== 'rollback');
+}
 //# sourceMappingURL=errors.js.map

package/dist/resourceLog/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,SAAS,GAAG,GAAkD,CAAA;IACpE,IAAI,SAAS,EAAE,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,SAAS,EAAE,IAAI,KAAK,4BAA4B;QAChD,SAAS,CAAC,MAAM,KAAK,UAAU,CAChC,CAAA;AACH,CAAC"}

package/dist/resourceLog/index.d.ts

@@ -7,8 +7,11 @@
  * `@interop/vh-resource-log` -- the did:webvh controller adapter (the
  * library's controller port extended with the per-version
  * credential-inventory view, supplying the mandatory `admitAppend` admission
- * hook), and the ceremony-tail license the hook carries
- * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`).
+ * hook), the ceremony-tail license the hook carries
+ * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`),
+ * and the import-free account-document leaf both are built on (`document.ts`
+ * -- relation resolution, ladder-VM recognition, the credential class),
+ * whose public home is `webvh`, which re-exports it.
  * Everything generic -- the JSON Lines codec, the store port and
  * `confirmAppend`, chain verification, the chain-head pin
  * (`ResourceLogPinStore` and `resourceLogPinId`; the named slot-key builders
@@ -19,6 +22,7 @@
  * export: this subpath pulls the did:webvh and ed25519 dependency graph.
  */
 export { webvhResourceLogController, type ControllerInventory, type WebvhResourceLogController } from './controller.js';
-export { ResourceLogLicenseError } from './errors.js';
+export { isResourceLogRefusal, ResourceLogLicenseError } from './errors.js';
+export { attributeLadderRungsPerVersion, type LadderRungKeys } from './ladderRungs.js';
 export { assertLadderAppendLicensed } from './license.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAChC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAChC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAC9B,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}

package/dist/resourceLog/index.js

@@ -7,8 +7,11 @@
  * `@interop/vh-resource-log` -- the did:webvh controller adapter (the
  * library's controller port extended with the per-version
  * credential-inventory view, supplying the mandatory `admitAppend` admission
- * hook), and the ceremony-tail license the hook carries
- * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`).
+ * hook), the ceremony-tail license the hook carries
+ * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`),
+ * and the import-free account-document leaf both are built on (`document.ts`
+ * -- relation resolution, ladder-VM recognition, the credential class),
+ * whose public home is `webvh`, which re-exports it.
  * Everything generic -- the JSON Lines codec, the store port and
  * `confirmAppend`, chain verification, the chain-head pin
  * (`ResourceLogPinStore` and `resourceLogPinId`; the named slot-key builders
@@ -19,6 +22,7 @@
  * export: this subpath pulls the did:webvh and ed25519 dependency graph.
  */
 export { webvhResourceLogController } from './controller.js';
-export { ResourceLogLicenseError } from './errors.js';
+export { isResourceLogRefusal, ResourceLogLicenseError } from './errors.js';
+export { attributeLadderRungsPerVersion } from './ladderRungs.js';
 export { assertLadderAppendLicensed } from './license.js';
 //# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAE/B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}

package/dist/resourceLog/ladderRungs.d.ts

@@ -0,0 +1,35 @@
+import type { DIDLog, DIDLogEntry } from '@interop/did-method-webvh';
+/**
+ * The rung keys attributed to each standing ladder VM, keyed by the ladder
+ * VM's own `publicKeyMultibase`. A ladder the walk could not attribute
+ * carries no entry at all, which is what makes an unattributed ladder refuse.
+ */
+export type LadderRungKeys = Map<string, Set<string>>;
+/**
+ * The update-key multibases that signed one log entry: the fragment of each
+ * proof's `did:key:<multibase>#<multibase>` verification method.
+ *
+ * @param entry {DIDLogEntry | undefined}
+ * @returns {Set<string>}
+ */
+export declare function entrySignerKeysOf(entry: DIDLogEntry | undefined): Set<string>;
+/**
+ * Attributes each standing ladder VM's rung keys, one snapshot per log entry:
+ * the returned array is indexed by entry position, and each snapshot names
+ * what the log attributes as of that version and no later one. A ladder is
+ * anchored at the entry introducing its VM and climbs from there by the
+ * last-position rule (the module header states both).
+ *
+ * A snapshot names a ladder's rungs that the version still authorizes in
+ * `updateKeys`, plus any rung that signed the version's own entry -- the one
+ * question the ceremony-tail license asks of this map, so a rung retired by
+ * the very entry it signed still answers it. A ladder left with no such rung
+ * is absent from that snapshot rather than present and empty, as is a ladder
+ * the walk refuses, so a caller cannot mistake "no rung attributed" for "this
+ * key signed nothing".
+ *
+ * @param log {DIDLog}   a resolved, caller-verified account log
+ * @returns {Promise<LadderRungKeys[]>}   one snapshot per entry, in log order
+ */
+export declare function attributeLadderRungsPerVersion(log: DIDLog): Promise<LadderRungKeys[]>;
+//# sourceMappingURL=ladderRungs.d.ts.map

package/dist/resourceLog/ladderRungs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladderRungs.d.ts","sourceRoot":"","sources":["../../src/resourceLog/ladderRungs.ts"],"names":[],"mappings":"AA8DA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAQpE;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAU7E;AAgGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,cAAc,EAAE,CAAC,CA+L3B"}

package/dist/resourceLog/ladderRungs.js

@@ -0,0 +1,352 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Seedless ladder-rung attribution over a verified account log: which update
+ * keys are rungs of which standing ladder, read from the log alone. The
+ * ceremony-tail license's third shape needs it -- shape 3 admits a
+ * ladder-signed roster append only when the document version it anchors at was
+ * itself signed by a rung of the SAME ladder that signs the append, and a
+ * reader on the verify side holds no ladder seed to answer that with.
+ *
+ * The walk is deliberately narrow and fails closed. A ladder is anchored at
+ * the entry that introduces its verification method, in the two shapes that
+ * entry can take: the ladder-anchored genesis, where the entry authorizes
+ * exactly one update key and that key signed it (rung 0 revealed outright);
+ * and the bind another signer publishes, where rung 0 arrives as the one hash
+ * the entry newly commits, revealed by whichever later entry authorizes its
+ * pre-image. Anything else leaves the ladder unattributed, and an
+ * unattributed ladder never satisfies shape 3.
+ *
+ * Which of the two an entry is takes one question first: whose the key it
+ * reveals already is. An entry authorizing exactly one self-signing key is
+ * the genesis shape only when no ladder already holds that key and the entry
+ * publishes no enrolled client. A ladder-branch bind is the counterexample --
+ * the ACTING credential's rung reveals itself in the very entry that
+ * introduces another credential's ladder VM and commits its rung-0 hash -- so
+ * the newcomer anchors on that commitment and the acting ladder climbs onto
+ * the rung it just revealed. Reading it the other way would anchor the
+ * newcomer on a key it does not hold and hand the acting ladder a shot at a
+ * version the newcomer's bind minted. The remembered recovery spend's
+ * add-and-retire entry is the enrolled-client counterexample: it introduces
+ * the replacement code's ladder VM while the one key it authorizes is the new
+ * CLIENT's update key.
+ *
+ * An anchored ladder then CLIMBS with the log, by the last-position rule of
+ * `decisions/0007-ladder-reveal-hash-order.md` read forward. An entry that
+ * authorizes exactly one new update key and was signed by that key is a
+ * prerotation reveal; when the key's hash was committed LAST among some
+ * earlier entry's additions, and that earlier entry itself authorized exactly
+ * one key and was signed by it, the committer was committing for itself, so
+ * the revealed key is the next rung of the ladder that earlier key belongs
+ * to. The step is taken only while the ladder's own VM still stands in the
+ * revealing entry's document. Without the climb a self-enrollment would end
+ * the attribution outright -- it retires the spent rung, so the ladder would
+ * be frozen at a key the account no longer authorizes -- and a passkey
+ * account, which self-enrolls by construction, could never satisfy shape 3.
+ *
+ * Two states stay out of reach on purpose, and both refuse rather than guess.
+ * An entry introducing more than one ladder VM names no rung for any of them.
+ * And a hash committed anywhere but last is never climbed: an enrollment
+ * approval reuses its rung, so its commit entry authorizes no key at all and
+ * the client update key its add entry authorizes sits in the commit's first
+ * position rather than its last. Under-attributing costs a refused append,
+ * which the ceremony surfaces and a retry cannot mend; over-attributing would
+ * hand a ladder a shot minted by an enrolled client's own entry, which is the
+ * class the license exists to exclude.
+ *
+ * The parameter carry-forward here is the did:webvh log format's own rule (an
+ * entry that omits `updateKeys` or `nextKeyHashes` keeps the previous entry's)
+ * read at layer 0, where the `webvh` layer's reader cannot be imported.
+ */
+import { deriveNextKeyHash } from '@interop/did-method-webvh';
+import { vmFragmentOf } from '@interop/vh-resource-log';
+import { ladderVmMethods, resolvedRelationMethods } from './document.js';
+/**
+ * The update-key multibases that signed one log entry: the fragment of each
+ * proof's `did:key:<multibase>#<multibase>` verification method.
+ *
+ * @param entry {DIDLogEntry | undefined}
+ * @returns {Set<string>}
+ */
+export function entrySignerKeysOf(entry) {
+    const keys = new Set();
+    for (const proof of entry?.proof ?? []) {
+        const id = proof.verificationMethod;
+        const keyMultibase = id === undefined ? undefined : vmFragmentOf(id);
+        if (keyMultibase !== undefined) {
+            keys.add(keyMultibase);
+        }
+    }
+    return keys;
+}
+/**
+ * The ladder VMs' key multibases in one entry's document.
+ *
+ * @param doc {AccountDocument | undefined}
+ * @returns {Set<string>}
+ */
+function ladderKeysOf(doc) {
+    const keys = new Set();
+    if (!doc) {
+        return keys;
+    }
+    for (const method of ladderVmMethods({ doc })) {
+        if (typeof method.publicKeyMultibase === 'string') {
+            keys.add(method.publicKeyMultibase);
+        }
+    }
+    return keys;
+}
+/**
+ * The enrolled clients' signing-key multibases in one entry's document: the
+ * `capabilityInvocation` methods, which is what an enrolled client publishes
+ * and a ladder VM deliberately does not. Only the SET matters here -- an
+ * entry that grows it published a client, and the update key such an entry
+ * authorizes is that client's rather than any ladder's rung.
+ *
+ * @param doc {AccountDocument | undefined}
+ * @returns {Set<string>}
+ */
+function enrolledClientKeysOf(doc) {
+    const keys = new Set();
+    if (!doc) {
+        return keys;
+    }
+    for (const method of resolvedRelationMethods({
+        doc,
+        relation: 'capabilityInvocation'
+    })) {
+        if (typeof method.publicKeyMultibase === 'string') {
+            keys.add(method.publicKeyMultibase);
+        }
+    }
+    return keys;
+}
+/**
+ * The ladder a key is already a rung of, or `undefined` when no ladder holds
+ * it. Asked of the revealed key before the anchoring branch runs, since a key
+ * another ladder owns can anchor nothing.
+ *
+ * @param options {object}
+ * @param options.rungsByLadder {LadderRungKeys}
+ * @param options.key {string}
+ * @returns {string | undefined}
+ */
+function ownerOfRung({ rungsByLadder, key }) {
+    for (const [ladderKey, rungs] of rungsByLadder) {
+        if (rungs.has(key)) {
+            return ladderKey;
+        }
+    }
+    return undefined;
+}
+/**
+ * Members of `next` that `previous` does not carry, in order.
+ *
+ * @param options {object}
+ * @param options.next {Iterable<string>}
+ * @param options.previous {Set<string>}
+ * @returns {string[]}
+ */
+function addedMembers({ next, previous }) {
+    const added = [];
+    for (const member of next) {
+        if (!previous.has(member) && !added.includes(member)) {
+            added.push(member);
+        }
+    }
+    return added;
+}
+/**
+ * Attributes each standing ladder VM's rung keys, one snapshot per log entry:
+ * the returned array is indexed by entry position, and each snapshot names
+ * what the log attributes as of that version and no later one. A ladder is
+ * anchored at the entry introducing its VM and climbs from there by the
+ * last-position rule (the module header states both).
+ *
+ * A snapshot names a ladder's rungs that the version still authorizes in
+ * `updateKeys`, plus any rung that signed the version's own entry -- the one
+ * question the ceremony-tail license asks of this map, so a rung retired by
+ * the very entry it signed still answers it. A ladder left with no such rung
+ * is absent from that snapshot rather than present and empty, as is a ladder
+ * the walk refuses, so a caller cannot mistake "no rung attributed" for "this
+ * key signed nothing".
+ *
+ * @param log {DIDLog}   a resolved, caller-verified account log
+ * @returns {Promise<LadderRungKeys[]>}   one snapshot per entry, in log order
+ */
+export async function attributeLadderRungsPerVersion(log) {
+    const snapshots = [];
+    const rungsByLadder = new Map();
+    // A rung-0 hash a bind entry committed, awaiting the entry that authorizes
+    // its pre-image. One owner per hash: a second claimant retires the claim,
+    // since neither ladder can then be told from the other.
+    const claims = new Map();
+    // Ladder VMs the walk refused, so a later snapshot cannot resurrect one.
+    const refused = new Set();
+    // A hash an entry committed LAST among its additions, mapped to the ladder
+    // whose rung both authorized and signed that entry: the pre-image, when a
+    // later entry reveals it, is that ladder's next rung. Spent on sight.
+    const climbs = new Map();
+    let previousLadderKeys = new Set();
+    let previousClientKeys = new Set();
+    let previousUpdateKeys = new Set();
+    let previousNextKeyHashes = new Set();
+    let updateKeys = [];
+    let nextKeyHashes = [];
+    for (const entry of log) {
+        if (entry.parameters?.updateKeys) {
+            updateKeys = entry.parameters.updateKeys;
+        }
+        if (entry.parameters?.nextKeyHashes) {
+            nextKeyHashes = entry.parameters.nextKeyHashes;
+        }
+        const doc = entry.state;
+        const ladderKeys = ladderKeysOf(doc);
+        const introduced = addedMembers({
+            next: ladderKeys,
+            previous: previousLadderKeys
+        });
+        const addedKeys = addedMembers({
+            next: updateKeys,
+            previous: previousUpdateKeys
+        });
+        const addedHashes = addedMembers({
+            next: nextKeyHashes,
+            previous: previousNextKeyHashes
+        });
+        const signers = entrySignerKeysOf(entry);
+        // A committed rung-0 hash whose pre-image this entry authorizes: the bind
+        // shape's second half. The claim is spent whether or not it names a
+        // ladder, so a retired claim can never be picked up later.
+        for (const key of addedKeys) {
+            const hash = await deriveNextKeyHash(key);
+            if (!claims.has(hash)) {
+                continue;
+            }
+            const owner = claims.get(hash);
+            claims.delete(hash);
+            if (owner !== null && owner !== undefined && !refused.has(owner)) {
+                rungsByLadder.set(owner, (rungsByLadder.get(owner) ?? new Set()).add(key));
+            }
+        }
+        // The CLIMB: this entry authorizes exactly one new key and that key
+        // signed it (a prerotation reveal), and an earlier entry committed the
+        // key's hash in last position under a rung of a known ladder. The
+        // candidate is spent whether or not the guard below admits it, so a
+        // released hash can never be climbed later.
+        const revealedRung = addedKeys.length === 1 ? addedKeys[0] : undefined;
+        if (revealedRung !== undefined && signers.has(revealedRung)) {
+            const hash = await deriveNextKeyHash(revealedRung);
+            const owner = climbs.get(hash);
+            climbs.delete(hash);
+            // The ladder's own VM must still stand in THIS entry's document. That
+            // is what keeps a recovery spend out: the spent credential's
+            // reveal-and-commit entry commits the REPLACEMENT credential's hash
+            // last, and the entry revealing that hash is the one that strikes the
+            // spent credential's ladder VM.
+            if (owner !== undefined &&
+                !refused.has(owner) &&
+                ladderKeys.has(owner) &&
+                rungsByLadder.has(owner)) {
+                rungsByLadder.set(owner, (rungsByLadder.get(owner) ?? new Set()).add(revealedRung));
+            }
+        }
+        // WHOSE the revealed key already is, resolved BEFORE the anchoring
+        // branch: the claim resolution and the climb above have just credited it
+        // where it belongs, so a hit here names a ladder that already holds it.
+        // A ladder-branch bind entry is the shape this orders: the ACTING
+        // credential's rung reveals itself in the very entry that introduces
+        // another credential's ladder VM, and reading that rung as the newcomer's
+        // rung 0 would anchor the newcomer on a key it does not hold AND credit
+        // the acting ladder with the newcomer's rung-0 commitment below.
+        const revealedOwner = revealedRung === undefined
+            ? undefined
+            : ownerOfRung({ rungsByLadder, key: revealedRung });
+        // Whether this entry also published an enrolled client. The one key such
+        // an entry authorizes is that client's update key (the remembered
+        // recovery spend's add-and-retire entry, which introduces the replacement
+        // code's ladder VM beside the new client), so it anchors no ladder.
+        const introducedClients = addedMembers({
+            next: enrolledClientKeysOf(doc),
+            previous: previousClientKeys
+        });
+        // The introduction, the one place a ladder is anchored. A VM introduced
+        // beside another names no rung for either.
+        let claimedHere;
+        if (introduced.length > 1) {
+            for (const ladderKey of introduced) {
+                refused.add(ladderKey);
+                rungsByLadder.delete(ladderKey);
+            }
+        }
+        else if (introduced.length === 1) {
+            const ladderKey = introduced[0];
+            refused.delete(ladderKey);
+            rungsByLadder.delete(ladderKey);
+            const revealed = addedKeys[0];
+            // Rung 0 revealed outright, the ladder-anchored genesis shape: one key
+            // authorized, signing its own entry, owned by no other ladder and not a
+            // client's.
+            const revealsOwnRungZero = addedKeys.length === 1 &&
+                revealed !== undefined &&
+                signers.has(revealed) &&
+                revealedOwner === undefined &&
+                introducedClients.length === 0;
+            // The commitment arm: the bind another signer publishes, where rung 0
+            // arrives as a commitment and is picked up when a later entry reveals
+            // its pre-image. It covers the bind an enrolled client signs (which
+            // authorizes no key of its own) and the ladder-branch bind another
+            // credential's rung signs (which authorizes that rung and nothing
+            // else), both of which commit exactly the newcomer's rung-0 hash.
+            const commitsRungZero = addedHashes.length === 1 &&
+                (addedKeys.length === 0 || revealedOwner !== undefined);
+            if (revealsOwnRungZero) {
+                rungsByLadder.set(ladderKey, new Set([revealed]));
+            }
+            else if (commitsRungZero) {
+                const hash = addedHashes[0];
+                // A hash two binds commit is nobody's: retire the claim outright.
+                claims.set(hash, claims.has(hash) ? null : ladderKey);
+                claimedHere = hash;
+            }
+            else {
+                refused.add(ladderKey);
+            }
+        }
+        // What this entry committed for ITSELF: the last of its newly committed
+        // hashes, recorded against the ladder whose rung authorized and signed
+        // the entry. Recorded after the introduction branch, so a ladder-anchored
+        // genesis stages its own rung 1. An entry that reuses its rung authorizes
+        // no key of its own and so records nothing, and a hash the introduction
+        // above claimed for the ladder this entry BINDS is that ladder's rung 0
+        // rather than the signer's next rung.
+        const committedLast = addedHashes[addedHashes.length - 1];
+        const signingLadder = revealedRung === undefined
+            ? undefined
+            : ownerOfRung({ rungsByLadder, key: revealedRung });
+        if (revealedRung !== undefined &&
+            signers.has(revealedRung) &&
+            signingLadder !== undefined &&
+            committedLast !== undefined &&
+            committedLast !== claimedHere) {
+            climbs.set(committedLast, signingLadder);
+        }
+        const authorized = new Set(updateKeys);
+        const snapshot = new Map();
+        for (const [ladderKey, rungs] of rungsByLadder) {
+            const standing = [...rungs].filter(rung => authorized.has(rung) || signers.has(rung));
+            if (standing.length > 0) {
+                snapshot.set(ladderKey, new Set(standing));
+            }
+        }
+        snapshots.push(snapshot);
+        previousLadderKeys = ladderKeys;
+        previousClientKeys = enrolledClientKeysOf(doc);
+        previousUpdateKeys = new Set(updateKeys);
+        previousNextKeyHashes = new Set(nextKeyHashes);
+    }
+    return snapshots;
+}
+//# sourceMappingURL=ladderRungs.js.map

package/dist/resourceLog/ladderRungs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladderRungs.js","sourceRoot":"","sources":["../../src/resourceLog/ladderRungs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,eAAe,EACf,uBAAuB,EAExB,MAAM,eAAe,CAAA;AAStB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA8B;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAA;QACnC,MAAM,YAAY,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACpE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAgC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAgC;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,EACnB,aAAa,EACb,GAAG,EAIJ;IACC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EACpB,IAAI,EACJ,QAAQ,EAIT;IACC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAW;IAEX,MAAM,SAAS,GAAqB,EAAE,CAAA;IACtC,MAAM,aAAa,GAAmB,IAAI,GAAG,EAAE,CAAA;IAC/C,2EAA2E;IAC3E,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC/C,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,IAAI,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,IAAI,UAAU,GAAa,EAAE,CAAA;IAC7B,IAAI,aAAa,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;YACjC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAA;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;YACpC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAA;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAoC,CAAA;QACtD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,UAAU,GAAG,YAAY,CAAC;YAC9B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,YAAY,CAAC;YAC7B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,YAAY,CAAC;YAC/B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,qBAAqB;SAChC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAExC,0EAA0E;QAC1E,oEAAoE;QACpE,2DAA2D;QAC3D,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,SAAQ;YACV,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,aAAa,CAAC,GAAG,CACf,KAAK,EACL,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CACjD,CAAA;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,oEAAoE;QACpE,4CAA4C;QAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtE,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAA;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnB,sEAAsE;YACtE,6DAA6D;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,gCAAgC;YAChC,IACE,KAAK,KAAK,SAAS;gBACnB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBACnB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBACrB,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EACxB,CAAC;gBACD,aAAa,CAAC,GAAG,CACf,KAAK,EACL,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAC1D,CAAA;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAA;QACvD,yEAAyE;QACzE,kEAAkE;QAClE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,iBAAiB,GAAG,YAAY,CAAC;YACrC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC;YAC/B,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QAEF,wEAAwE;QACxE,2CAA2C;QAC3C,IAAI,WAA+B,CAAA;QACnC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACtB,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAA;YAChC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACzB,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;YAC7B,uEAAuE;YACvE,wEAAwE;YACxE,YAAY;YACZ,MAAM,kBAAkB,GACtB,SAAS,CAAC,MAAM,KAAK,CAAC;gBACtB,QAAQ,KAAK,SAAS;gBACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACrB,aAAa,KAAK,SAAS;gBAC3B,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAA;YAChC,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,eAAe,GACnB,WAAW,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,SAAS,CAAC,CAAA;YACzD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,CAAA;YACpD,CAAC;iBAAM,IAAI,eAAe,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAC5B,kEAAkE;gBAClE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBACrD,WAAW,GAAG,IAAI,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACzD,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAA;QACvD,IACE,YAAY,KAAK,SAAS;YAC1B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YACzB,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,WAAW,EAC7B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;QAC1C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAmB,IAAI,GAAG,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAClD,CAAA;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxB,kBAAkB,GAAG,UAAU,CAAA;QAC/B,kBAAkB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QAC9C,kBAAkB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;QACxC,qBAAqB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}