@interop/wallet-core 0.62.0 → 0.66.0

package/dist/webvh/didWebProjection.d.ts

@@ -0,0 +1,164 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `did:web` projection of the account log: `id/did.json`, the document
+ * `generateParallelDidWeb` derives from the resolved `did.jsonl`. The log is
+ * the source of truth and the projection a derived cache, so this module owns
+ * the two ways that cache is written -- the unconditional PUT every publish
+ * tail makes ({@link putDidWebProjection}) and the read-then-write freshness
+ * ensure a caller with no controller authority makes
+ * ({@link ensureDidWebProjection}).
+ *
+ * The ensure exists because the projection is NOT republished by every entry.
+ * A ladder-signed entry publishes through `publishEntryPinned`, which writes
+ * `did.jsonl` alone: the bridge delegation a standing unlock credential
+ * carries is a PUT on exactly that resource. So after a ladder-signed removal
+ * or retirement (the last-client transition, a transient recovery) the served
+ * projection can still publish a verification method the log has struck, and
+ * a `did:web` resolver reading it accepts a key the account revoked. The
+ * account's own WAS authorization is unaffected -- the server resolves the
+ * controller out of `did.jsonl` and never reads `did.json` -- so this is a
+ * `did:web` verifier concern rather than a storage one, but it is a
+ * revocation bypass all the same.
+ *
+ * A transient visit closes it with no server change and no widened bridge:
+ * its generation delegation targets the account Space's items subtree, which
+ * covers `id/did.json`, so the visit invokes as its annex verification method
+ * and republishes the projection itself. The ensure is deliberately a
+ * compare-then-write rather than the publish tails' unconditional PUT,
+ * because it runs on every visit rather than behind a won log
+ * compare-and-swap: a healthy account must cost one GET and no write.
+ *
+ * The compare's input is a document the caller resolved earlier, so a
+ * difference alone does not say which side is stale. Another client may have
+ * published an inventory-removing entry and its correct projection in the
+ * meantime, and writing the caller's older derivation over it would restore a
+ * key the account just struck. Two guards keep that from happening. The
+ * caller may hand in a `refresh` that re-resolves the log, and the write runs
+ * only when the refreshed derivation still differs. And the PUT is a
+ * compare-and-swap on the ETag of the read it was based on, so a projection
+ * written between that read and the PUT stands and the ensure reports
+ * `conflict` instead. The next visit is the mender in both cases.
+ *
+ * No wire artifact of its own: the resource id, the content type, and the
+ * document shape are the ones `publishWebvhLog` already writes.
+ */
+import type { DIDDoc, UpdateDIDResult } from '@interop/did-method-webvh';
+import type { WebvhIdStore } from './didWebvh.js';
+/**
+ * Writes the `did:web` projection into the `id` collection: `did.json`, under
+ * the `application/did+json` content type. The single PUT site, so the
+ * resource id and content type cannot drift between the publish tails and the
+ * freshness ensure.
+ *
+ * Unconditional by design at every publish-tail caller: the write is
+ * serialized behind a won `did.jsonl` compare-and-swap, and the projection is
+ * a derived cache of a log that is itself the source of truth.
+ *
+ * @param options {object}
+ * @param options.store {object}   anything with the seam's `putIdResource`
+ * @param options.webDoc {object}   the projection to publish, from
+ *   `generateParallelDidWeb` (or `updateDID`'s `webDoc`, which is the same
+ *   document)
+ * @returns {Promise<void>}
+ */
+export declare function putDidWebProjection({ store, webDoc }: {
+    store: Pick<WebvhIdStore, 'putIdResource'>;
+    webDoc: object;
+}): Promise<void>;
+/**
+ * The pre-entry projection publisher: a `beforePublish` hook for
+ * `signAccountEntry`, which PUTs the post-entry `did:web` projection through
+ * the caller's store immediately before the entry itself publishes.
+ *
+ * A strike entry (a client revocation, a credential retirement, a recovery
+ * code's removal) signed by a standing credential's ladder writes `did.jsonl`
+ * alone, the bridge delegation's whole reach, so nothing in that ceremony
+ * republishes `did.json` and the served projection keeps naming the struck
+ * client or credential. A caller holding a store that may write the `id`
+ * collection -- a transient session under its generation delegation, an
+ * enrolled client under its own root authority -- hands one in and the
+ * projection lands with the entry.
+ *
+ * BEST-EFFORT, and the direction is deliberate. A failed PUT is warned and
+ * the entry publishes anyway: the residue is a projection this account's next
+ * visit mends through {@link ensureDidWebProjection}, where withholding the
+ * strike would leave the struck key standing in the log itself. Between the
+ * two write orders the same reasoning picks this one: a projection published
+ * before an entry that then fails under-lists a key the log still carries,
+ * which a `did:web` verifier reads as less authority rather than more.
+ *
+ * @param options {object}
+ * @param options.store {object}   the narrow id-collection seam
+ *   (`Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>`), the type
+ *   the forget ceremony's `clientLogStore` already takes
+ * @returns {Function}   `({ updated }) => Promise<void>`, the
+ *   `signAccountEntry` hook
+ */
+export declare function preEntryProjectionPublisher({ store }: {
+    store: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+}): (built: {
+    updated: UpdateDIDResult;
+}) => Promise<void>;
+/**
+ * THE PROJECTION FRESHNESS ENSURE: re-derives `did.json` from a resolved log's
+ * DID and document, compares it against what the host serves, and republishes
+ * only on a difference. The credential-only mender for a projection a
+ * ladder-signed entry left behind (see the module doc): a transient visit runs
+ * it through a store bound to its generation delegation, which covers the
+ * account Space's items subtree and so may write `id/did.json` with no
+ * widened bridge and no server change.
+ *
+ * The served document is compared as parsed JSON, key-order-insensitively, so
+ * a host (or an earlier writer) that reserialized the same document does not
+ * provoke a write. Absent, unparsable, and different all reach the write; only
+ * an equal document is left alone.
+ *
+ * A difference is not by itself evidence that the served projection is the
+ * stale side. The caller's `doc` was resolved at some earlier point, and a
+ * concurrent writer may have published a newer log entry with its matching
+ * projection since. Two guards keep this call from undoing that writer's work:
+ *
+ * 1. `refresh`, when supplied, re-resolves the log on the difference path.
+ *    The write runs only when the derivation from the refreshed document
+ *    still differs from what is served, so one extra read buys the ordering
+ *    the plain compare cannot see.
+ * 2. The PUT is conditional on the served read: `If-Match` on its ETag, or
+ *    `If-None-Match: *` when the projection was absent. A projection written
+ *    between the read and the PUT wins, and the outcome is `conflict`.
+ *
+ * Read and write errors PROPAGATE, a failed precondition excepted. The call is
+ * one step of a login or a ceremony that has other work to do, and whether a
+ * stale projection is worth failing that work over is the caller's decision,
+ * not this function's -- every caller today treats it as best-effort.
+ *
+ * @param options {object}
+ * @param options.store {object}   the narrow id-collection seam: the raw read
+ *   plus the write (`Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>`,
+ *   which `wasWebvhIdStore` and `delegatedWebvhLogStore` both satisfy). The
+ *   read may be unauthenticated, the `id` collection being world-readable
+ * @param options.did {string}   the account's did:webvh, from the resolved log
+ * @param options.doc {DIDDoc}   the resolved did:webvh document
+ * @param [options.refresh] {Function}   `() => Promise<{ did, doc }>`, a fresh
+ *   resolution of the same log, called at most once and only on a detected
+ *   difference. Its result replaces `did` / `doc` for the re-compare and for
+ *   the write. Omitted, the caller's snapshot is written on any difference
+ * @returns {Promise<{ outcome: 'current' | 'republished' | 'conflict' }>}
+ *   `current` when the served projection already matched (before or after the
+ *   refresh) and nothing was written; `republished` when the PUT landed;
+ *   `conflict` when it lost its precondition to a concurrent writer, whose
+ *   projection stands and whose successor visit is the mender
+ */
+export declare function ensureDidWebProjection({ store, did, doc, refresh }: {
+    store: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+    did: string;
+    doc: DIDDoc;
+    refresh?: () => Promise<{
+        did: string;
+        doc: DIDDoc;
+    }>;
+}): Promise<{
+    outcome: 'current' | 'republished' | 'conflict';
+}>;
+//# sourceMappingURL=didWebProjection.d.ts.map

package/dist/webvh/didWebProjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"didWebProjection.d.ts","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EACP,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC1C,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,KAAK,EACN,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;CAChE,GAAG,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,eAAe,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAgBzD;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC/D,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,CAAA;CAAE,CAAC,CAyC/D"}

package/dist/webvh/didWebProjection.js

@@ -0,0 +1,230 @@
+import { generateParallelDidWeb } from '@interop/did-method-webvh';
+import { log } from '../log.js';
+import { DID_DOCUMENT_RESOURCE } from '../space/collections.js';
+/**
+ * Writes the `did:web` projection into the `id` collection: `did.json`, under
+ * the `application/did+json` content type. The single PUT site, so the
+ * resource id and content type cannot drift between the publish tails and the
+ * freshness ensure.
+ *
+ * Unconditional by design at every publish-tail caller: the write is
+ * serialized behind a won `did.jsonl` compare-and-swap, and the projection is
+ * a derived cache of a log that is itself the source of truth.
+ *
+ * @param options {object}
+ * @param options.store {object}   anything with the seam's `putIdResource`
+ * @param options.webDoc {object}   the projection to publish, from
+ *   `generateParallelDidWeb` (or `updateDID`'s `webDoc`, which is the same
+ *   document)
+ * @returns {Promise<void>}
+ */
+export async function putDidWebProjection({ store, webDoc }) {
+    await store.putIdResource({
+        resourceId: DID_DOCUMENT_RESOURCE,
+        content: webDoc,
+        contentType: 'application/did+json'
+    });
+}
+/**
+ * The pre-entry projection publisher: a `beforePublish` hook for
+ * `signAccountEntry`, which PUTs the post-entry `did:web` projection through
+ * the caller's store immediately before the entry itself publishes.
+ *
+ * A strike entry (a client revocation, a credential retirement, a recovery
+ * code's removal) signed by a standing credential's ladder writes `did.jsonl`
+ * alone, the bridge delegation's whole reach, so nothing in that ceremony
+ * republishes `did.json` and the served projection keeps naming the struck
+ * client or credential. A caller holding a store that may write the `id`
+ * collection -- a transient session under its generation delegation, an
+ * enrolled client under its own root authority -- hands one in and the
+ * projection lands with the entry.
+ *
+ * BEST-EFFORT, and the direction is deliberate. A failed PUT is warned and
+ * the entry publishes anyway: the residue is a projection this account's next
+ * visit mends through {@link ensureDidWebProjection}, where withholding the
+ * strike would leave the struck key standing in the log itself. Between the
+ * two write orders the same reasoning picks this one: a projection published
+ * before an entry that then fails under-lists a key the log still carries,
+ * which a `did:web` verifier reads as less authority rather than more.
+ *
+ * @param options {object}
+ * @param options.store {object}   the narrow id-collection seam
+ *   (`Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>`), the type
+ *   the forget ceremony's `clientLogStore` already takes
+ * @returns {Function}   `({ updated }) => Promise<void>`, the
+ *   `signAccountEntry` hook
+ */
+export function preEntryProjectionPublisher({ store }) {
+    return async ({ updated }) => {
+        try {
+            if (!updated.webDoc) {
+                // Every entry is built with `alsoKnownAsWeb`, so this is a defect
+                // rather than a state -- reported, and the entry still publishes.
+                log.warn('did:webvh: no did:web projection to publish before an entry.');
+                return;
+            }
+            await putDidWebProjection({ store, webDoc: updated.webDoc });
+        }
+        catch (err) {
+            log.warn('did:webvh: the pre-entry did:web projection PUT failed.', {
+                err
+            });
+        }
+    };
+}
+/**
+ * The error name a lost write precondition surfaces as -- was-client's
+ * `PreconditionFailedError`, and whatever an alternative store implementation
+ * throws under that name (the `WebvhIdStore` seam contract requires it).
+ */
+const PRECONDITION_FAILED_ERROR_NAME = 'PreconditionFailedError';
+/**
+ * THE PROJECTION FRESHNESS ENSURE: re-derives `did.json` from a resolved log's
+ * DID and document, compares it against what the host serves, and republishes
+ * only on a difference. The credential-only mender for a projection a
+ * ladder-signed entry left behind (see the module doc): a transient visit runs
+ * it through a store bound to its generation delegation, which covers the
+ * account Space's items subtree and so may write `id/did.json` with no
+ * widened bridge and no server change.
+ *
+ * The served document is compared as parsed JSON, key-order-insensitively, so
+ * a host (or an earlier writer) that reserialized the same document does not
+ * provoke a write. Absent, unparsable, and different all reach the write; only
+ * an equal document is left alone.
+ *
+ * A difference is not by itself evidence that the served projection is the
+ * stale side. The caller's `doc` was resolved at some earlier point, and a
+ * concurrent writer may have published a newer log entry with its matching
+ * projection since. Two guards keep this call from undoing that writer's work:
+ *
+ * 1. `refresh`, when supplied, re-resolves the log on the difference path.
+ *    The write runs only when the derivation from the refreshed document
+ *    still differs from what is served, so one extra read buys the ordering
+ *    the plain compare cannot see.
+ * 2. The PUT is conditional on the served read: `If-Match` on its ETag, or
+ *    `If-None-Match: *` when the projection was absent. A projection written
+ *    between the read and the PUT wins, and the outcome is `conflict`.
+ *
+ * Read and write errors PROPAGATE, a failed precondition excepted. The call is
+ * one step of a login or a ceremony that has other work to do, and whether a
+ * stale projection is worth failing that work over is the caller's decision,
+ * not this function's -- every caller today treats it as best-effort.
+ *
+ * @param options {object}
+ * @param options.store {object}   the narrow id-collection seam: the raw read
+ *   plus the write (`Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>`,
+ *   which `wasWebvhIdStore` and `delegatedWebvhLogStore` both satisfy). The
+ *   read may be unauthenticated, the `id` collection being world-readable
+ * @param options.did {string}   the account's did:webvh, from the resolved log
+ * @param options.doc {DIDDoc}   the resolved did:webvh document
+ * @param [options.refresh] {Function}   `() => Promise<{ did, doc }>`, a fresh
+ *   resolution of the same log, called at most once and only on a detected
+ *   difference. Its result replaces `did` / `doc` for the re-compare and for
+ *   the write. Omitted, the caller's snapshot is written on any difference
+ * @returns {Promise<{ outcome: 'current' | 'republished' | 'conflict' }>}
+ *   `current` when the served projection already matched (before or after the
+ *   refresh) and nothing was written; `republished` when the PUT landed;
+ *   `conflict` when it lost its precondition to a concurrent writer, whose
+ *   projection stands and whose successor visit is the mender
+ */
+export async function ensureDidWebProjection({ store, did, doc, refresh }) {
+    const served = await store.getIdResourceRaw({
+        resourceId: DID_DOCUMENT_RESOURCE
+    });
+    let expected = generateParallelDidWeb(did, doc);
+    if (served !== undefined && servedMatches({ text: served.text, expected })) {
+        return { outcome: 'current' };
+    }
+    if (refresh) {
+        const fresh = await refresh();
+        expected = generateParallelDidWeb(fresh.did, fresh.doc);
+        if (served !== undefined &&
+            servedMatches({ text: served.text, expected })) {
+            return { outcome: 'current' };
+        }
+    }
+    try {
+        await store.putIdResource({
+            resourceId: DID_DOCUMENT_RESOURCE,
+            content: expected,
+            contentType: 'application/did+json',
+            // Absent, the write is a create; present, an update-if-unchanged. A
+            // backend serving no ETag versions nothing, so that write degrades to
+            // an unconditional one, as every other publish here does.
+            ...(served === undefined
+                ? { ifNoneMatch: true }
+                : served.etag !== undefined
+                    ? { ifMatch: served.etag }
+                    : {})
+        });
+    }
+    catch (err) {
+        // Matched by name: error classes do not survive crossing package copies,
+        // and the seam contract names the `name` rather than the class.
+        if (err?.name !== PRECONDITION_FAILED_ERROR_NAME) {
+            throw err;
+        }
+        return { outcome: 'conflict' };
+    }
+    return { outcome: 'republished' };
+}
+/**
+ * Whether the served projection text is the expected document. An unparsable
+ * body reads as a mismatch rather than an error: whatever it is, it is not the
+ * projection, and republishing is the answer either way.
+ *
+ * The expected document is round-tripped through JSON before the comparison,
+ * so it is compared in the form the PUT would serialize it into -- a member
+ * whose value is `undefined` disappears on both sides rather than reading as a
+ * difference the write could never fix.
+ *
+ * @param options {object}
+ * @param options.text {string}   the served body
+ * @param options.expected {object}   the freshly derived projection
+ * @returns {boolean}
+ */
+function servedMatches({ text, expected }) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    return sameJsonValue(JSON.parse(JSON.stringify(expected)), parsed);
+}
+/**
+ * Structural JSON equality: object key order is immaterial, array order is
+ * not. Used to decide whether the projection needs republishing, so a false
+ * negative costs one idempotent PUT and a false positive would leave a stale
+ * document standing -- which is why it compares recursively rather than by
+ * serialized string.
+ *
+ * @param left {unknown}
+ * @param right {unknown}
+ * @returns {boolean}
+ */
+function sameJsonValue(left, right) {
+    if (left === right) {
+        return true;
+    }
+    if (Array.isArray(left) || Array.isArray(right)) {
+        if (!Array.isArray(left) || !Array.isArray(right)) {
+            return false;
+        }
+        return (left.length === right.length &&
+            left.every((member, index) => sameJsonValue(member, right[index])));
+    }
+    if (typeof left !== 'object' ||
+        typeof right !== 'object' ||
+        left === null ||
+        right === null) {
+        return false;
+    }
+    const leftEntries = Object.entries(left);
+    const rightRecord = right;
+    return (leftEntries.length === Object.keys(rightRecord).length &&
+        leftEntries.every(([key, value]) => Object.prototype.hasOwnProperty.call(rightRecord, key) &&
+            sameJsonValue(value, rightRecord[key])));
+}
+//# sourceMappingURL=didWebProjection.js.map

package/dist/webvh/didWebProjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"didWebProjection.js","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAG/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EAIP;IACC,MAAM,KAAK,CAAC,aAAa,CAAC;QACxB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,sBAAsB;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,KAAK,EAGN;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAgC,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAA;gBACxE,OAAM;YACR,CAAC;YACD,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;gBAClE,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,yBAAyB,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EAMR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC1C,UAAU,EAAE,qBAAqB;KAClC,CAAC,CAAA;IACF,IAAI,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAA;QAC7B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,IACE,MAAM,KAAK,SAAS;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC9C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,sBAAsB;YACnC,oEAAoE;YACpE,sEAAsE;YACtE,0DAA0D;YAC1D,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;gBACvB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;oBAC1B,CAAC,CAAC,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,gEAAgE;QAChE,IAAK,GAAa,EAAE,IAAI,KAAK,8BAA8B,EAAE,CAAC;YAC5D,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,EACrB,IAAI,EACJ,QAAQ,EAIT;IACC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,IAAa,EAAE,KAAc;IAClD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACnE,CAAA;IACH,CAAC;IACD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,KAAK,KAAK,QAAQ;QACzB,IAAI,KAAK,IAAI;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAA;IACnE,MAAM,WAAW,GAAG,KAAgC,CAAA;IACpD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QACtD,WAAW,CAAC,KAAK,CACf,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;YACtD,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CACzC,CACF,CAAA;AACH,CAAC"}