@interop/wallet-core 0.66.0 → 0.67.0

package/dist/recovery/recoveryWebvh.js

@@ -1,117 +1,9 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The did:webvh half of recovery-code lifecycle: the split configuration a
- * code holds as a standing unlock credential that retires on spend. At
- * issuance the document gains the code's `keyAgreement` verification method
- * (an ordinary Multikey entry -- deliberately unmarked; a recovery key is
- * distinguishable structurally, since it appears under `keyAgreement` and
- * `assertionMethod`/`capabilityDelegation` while every enrolled client also
- * publishes an invocation relationship, so client listings key on
- * `capabilityInvocation` and never see it), the code's ladder VM, and its
- * rung-0 hash in `nextKeyHashes` -- decryption and delegation standing,
- * update authority latent: rung 0 joins `updateKeys` nowhere, and every key
- * of the set exists nowhere until the code is typed.
- *
- * At recovery time the pre-committed rung 0 reveals itself to sign the
- * self-enrolling continuation, two entries:
- *
- * 1. **Reveal + commit**: rung 0 joins `updateKeys` (its hash stands
- *    committed since issuance, which is what makes the entry verify -- the
- *    ordinary ladder reveal) and `nextKeyHashes` extends with the NEW
- *    ordinary client's update- and staged-key hashes plus the replacement
- *    code's rung-0 hash.
- * 2. **Add + retire**: signed by the new client's update key (revealed from
- *    the commit), this entry publishes the new client's verification methods
- *    and update key, removes the spent code's `keyAgreement` VM and its
- *    ladder VM (with every other standing credential's, by the relation
- *    asymmetry), publishes the replacement code's inventory, and drops the
- *    spent code's revealed rung and its hash -- so no recovery authority
- *    stands afterwards.
- *
- * Both entries are written through the caller's store seam; the recovery
- * continuation publishes ONLY `did.jsonl` (the delegation the record carries
- * covers nothing else -- narrow scope preserves loudness), and hands back the
- * final `webDoc` so the recovered session can republish `did.json` once it is
- * the authorized controller. Every step is idempotent/resumable: re-running
- * with the same key material converges without forking the log.
- */
-import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
-import { assertCanonicalClientKeys, assertCarryOverCommitments, effectiveParameters, ladderVerificationMethod, markedVerificationMethodPair, MULTIKEY_VM_TYPE, publishEntryPinned, readPublishedLogOrThrow, servedHead, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { assertCanonicalClientKeys, markedVerificationMethodPair, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { publishUnlockKey, removeUnlockKey } from '../unlock/standingWebvh.js';
-import { credentialKeyAgreementMethods, ladderVmIds, relationIds } from '../resourceLog/document.js';
-// The base-side dependency the lint config pins: the ladder ATTRIBUTION
-// helpers only, never the annex log machinery. The add-and-retire entry
-// resolves each retired credential's standing rungs from the log with them.
-import { assertNextKeyHashesRemain, attributeRetiredCredentialRungs, retiredCredentialRungsBeforeKey } from '../clientAnnex/ladder.js';
-/**
- * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
- * spend's answer to the same question the live run answers from the document
- * it is editing. A run torn after that entry but before the caller's registry
- * and unlock-Space teardown resumes into the already-complete branch, and
- * without this it would be told nothing was retired and leave every other
- * credential's registry entry standing.
- *
- * The entry is located by its own signature on the log: it is the first entry
- * whose effective `updateKeys` authorize the successor key (the fresh
- * ladder's rung 0 on the transient continuation, the new client's update key
- * on the remembered one), which only that entry writes. What it retired is
- * then the credential-class `keyAgreement` ids its predecessor published and
- * it does not, less the spent code's own id -- the same exclusion the live
- * branch makes, since the caller retires that one by name.
- *
- * @param options {object}
- * @param options.log {DIDLog}   the verified account log
- * @param options.did {string}   the account DID the log resolves to
- * @param options.successorKeyMultibase {string}   the update key only the
- *   add-and-retire entry authorizes
- * @param options.spentVmId {string}   the spent code's key-agreement
- *   verification-method id, excluded from the result
- * @returns {string[]}   the retired credentials' key-agreement ids, empty
- *   when no entry authorizes the successor key or it is the genesis entry
- */
-export function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }) {
-    const params = effectiveParameters(log);
-    const index = params.findIndex(entry => (entry.updateKeys ?? []).includes(successorKeyMultibase));
-    const previous = index > 0 ? log[index - 1]?.state : undefined;
-    const entryDoc = index > 0 ? log[index]?.state : undefined;
-    if (previous === undefined || entryDoc === undefined) {
-        return [];
-    }
-    const standing = new Set(credentialKeyAgreementMethods({ doc: entryDoc, did }).map(method => method.id));
-    return credentialKeyAgreementMethods({ doc: previous, did })
-        .map(method => method.id)
-        .filter((id) => typeof id === 'string')
-        .filter(id => !standing.has(id) && id !== spentVmId);
-}
-/**
- * The verification-method id a code's key-agreement key publishes under --
- * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
- * other keyAgreement entry. Consumers that must exclude recovery entries do
- * it structurally (an enrolled client is a `capabilityInvocation` entry; a
- * recovery key never has one) or by the registry's recorded multibase.
- *
- * @param options {object}
- * @param options.did {string}   the account's did:webvh
- * @param options.keyAgreementKeyMultibase {string}
- * @returns {string}
- */
-export function recoveryVmId({ did, keyAgreementKeyMultibase }) {
-    return `${did}#${keyAgreementKeyMultibase}`;
-}
-/**
- * Thrown by the recovery continuation when the log carries neither the code's
- * update key nor its committed hash -- the code was revoked (or never
- * issued), so no continuation can verify.
- */
-export class RecoveryKeyNotCommittedError extends Error {
-    constructor(message = 'The account log no longer commits this recovery code; the ' +
-        'code has been revoked or was never issued.') {
-        super(message);
-        this.name = 'RecoveryKeyNotCommittedError';
-    }
-}
+import { recoveryContinuationOnce } from './continuation.js';
+// The continuation's shared core and the names both variants read live in
+// `continuation.ts`; this module stays their public home.
+export { RecoveryCredentialStandingError, RecoveryKeyNotCommittedError, recoveryVmId, retiredCredentialVmIdsFromLog } from './continuation.js';
 /**
  * ISSUANCE: publishes a recovery code's split configuration into the
  * document -- the code's `keyAgreement` verification method (an ordinary,
@@ -213,7 +105,6 @@ export async function removeRecoveryKey({ idStore, signer, recovery, ladderSeed,
         },
         ...(ladderSeed ? { ladderSeed } : {}),
         ...(projectionStore ? { projectionStore } : {}),
-        requireLadderVmClaim: true,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(pinStore ? { pinStore } : {}),
         ...(logId !== undefined ? { logId } : {}),
@@ -318,273 +209,46 @@ export async function recoverWebvhClient(options) {
         signingKeyMultibase: options.newClientKeys.signingKeyMultibase,
         keyAgreementKeyMultibase: options.newClientKeys.keyAgreementKeyMultibase
     });
-    return withLogConflictRetry(() => recoverWebvhClientOnce(options));
-}
-/**
- * One attempt of {@link recoverWebvhClient}, re-invoked by the conflict retry.
- *
- * @param options {object}   see {@link recoverWebvhClient}
- * @returns {Promise<object>}   see {@link recoverWebvhClient}
- */
-async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClientUpdateSeeds, replacement, onCommitted, expectedDid, pinStore, logId }) {
-    // Each attempt's own read is what the CAS publish is built on, so the
-    // continuity check runs here -- and again on a conflict-retry re-run -- not
-    // only on the verify that follows both entries.
-    const pinned = {
+    const { newClientKeys, newClientUpdateSeeds, onCommitted, expectedDid, pinStore, logId, ...shared } = options;
+    const outcome = await withLogConflictRetry(() => recoveryContinuationOnce({
+        ...shared,
+        successor: {
+            updateKeyMultibase: newClientKeys.updateKeyMultibase,
+            updateSeed: newClientUpdateSeeds.updateSeed,
+            stagedKeyMultibase: newClientKeys.stagedUpdateKeyMultibase
+        },
+        onCommitted,
+        // The new client's verification methods and update key in. A three-way
+        // controller split: the new client's signing method and the replacement
+        // code's key-agreement method are controlled by the account; the new
+        // client's key-agreement method alone carries the controller marker
+        // (see clientKeyAgreementController) -- which is exactly what tells the
+        // two simultaneously published keyAgreement methods apart. The marked
+        // pair goes through the shared builder, which refuses a new client
+        // whose key-agreement key is not its signing key's canonical twin; the
+        // core appends the replacement code's unmarked method after it.
+        added: ({ did }) => {
+            const signingVmId = `${did}#${newClientKeys.signingKeyMultibase}`;
+            return {
+                methods: markedVerificationMethodPair({
+                    controller: did,
+                    signingKeyMultibase: newClientKeys.signingKeyMultibase,
+                    keyAgreementKeyMultibase: newClientKeys.keyAgreementKeyMultibase
+                }),
+                authentication: [signingVmId],
+                assertionMethod: [signingVmId],
+                keyAgreement: [`${did}#${newClientKeys.keyAgreementKeyMultibase}`],
+                capabilityInvocation: [signingVmId],
+                capabilityDelegation: [signingVmId]
+            };
+        },
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(pinStore ? { pinStore } : {}),
         ...(logId !== undefined ? { logId } : {})
-    };
-    let published = await readPublishedLogOrThrow({
-        idStore: store,
-        ...(expectedDid !== undefined ? { expectedDid } : {}),
-        ...pinned,
-        missingMessage: 'did:webvh: did.jsonl is missing; nothing to recover.'
-    });
-    // Derived before the completion check, because a resume recomputes the
-    // strike with the same protected sets the first run used.
-    const recoveryHash = await deriveNextKeyHash(recovery.updateKeyMultibase);
-    const newUpdateHash = await deriveNextKeyHash(newClientKeys.updateKeyMultibase);
-    const newStagedHash = await deriveNextKeyHash(newClientKeys.stagedUpdateKeyMultibase);
-    const replacementHash = await deriveNextKeyHash(replacement.updateKeyMultibase);
-    // Already complete (a torn earlier run finished the add entry): the new
-    // client's update key is authorized, which only the add entry writes. The
-    // seam is deliberately NOT entered here -- nothing is about to be
-    // published, so there is no pivot to persist ahead of.
-    if (published.updateKeys.includes(newClientKeys.updateKeyMultibase)) {
-        // The add entry already struck the pre-recovery credentials, so the
-        // document names none of them any more. The report is derived from the
-        // log instead ({@link retiredCredentialVmIdsFromLog}), so a resume tells
-        // the caller exactly what the first run told it.
-        const retired = retiredCredentialVmIdsFromLog({
-            log: published.log,
-            did: published.did,
-            successorKeyMultibase: newClientKeys.updateKeyMultibase,
-            spentVmId: recoveryVmId({
-                did: published.did,
-                keyAgreementKeyMultibase: recovery.keyAgreementKeyMultibase
-            })
-        });
-        // The strike is recomputed by re-running it over the log as it stood just
-        // before the add entry, with the same protected sets, so a resume reports
-        // exactly what the first run reported rather than a second definition of
-        // the same question.
-        const strike = await retiredCredentialRungsBeforeKey({
-            log: published.log,
-            authorizedKeyMultibase: newClientKeys.updateKeyMultibase,
-            credentialVmIds: retired,
-            protectedHashes: [newUpdateHash, newStagedHash, replacementHash],
-            protectedKeys: [newClientKeys.updateKeyMultibase]
-        });
-        return {
-            did: published.did,
-            committed: false,
-            retiredCredentialVmIds: retired,
-            struckRungHashes: strike.struckHashes,
-            unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
-        };
-    }
-    // The reveal-and-commit entry, skipped when a torn earlier run already
-    // published it (the revealed key authorized AND every needed hash
-    // committed).
-    const revealed = published.updateKeys.includes(recovery.updateKeyMultibase);
-    const committed = [newUpdateHash, newStagedHash, replacementHash].every(hash => published.nextKeyHashes.includes(hash));
-    if (!revealed || !committed) {
-        if (!revealed && !published.nextKeyHashes.includes(recoveryHash)) {
-            throw new RecoveryKeyNotCommittedError();
-        }
-        await assertCarryOverCommitments({ published });
-        const signer = await updateKeySigner({ seed: recovery.updateSeed });
-        const updated = await updateDID({
-            log: published.log,
-            signer,
-            alsoKnownAsWeb: true,
-            updateKeys: [
-                ...new Set([...published.updateKeys, recovery.updateKeyMultibase])
-            ],
-            // The spent code's own hash is kept through this entry (so a resumed
-            // commit can re-state the revealed key); the add entry drops it.
-            nextKeyHashes: [
-                ...new Set([
-                    ...published.nextKeyHashes,
-                    recoveryHash,
-                    newUpdateHash,
-                    newStagedHash,
-                    replacementHash
-                ])
-            ]
-        });
-        // The pin advances with the publish, so the re-read below (and any read
-        // after a tear here) refuses a host that rolls the log back behind the
-        // reveal entry.
-        await publishEntryPinned({
-            store,
-            log: updated.log,
-            ifMatch: published.etag,
-            ...pinned
-        });
-        // The same account the reveal entry just extended, under the same pin.
-        published = await readPublishedLogOrThrow({
-            idStore: store,
-            expectedDid: published.did,
-            ...pinned,
-            missingMessage: 'did:webvh: did.jsonl is missing; nothing to recover.'
-        });
-    }
-    // The persist-before-publish seam: the successor material is persisted
-    // HERE, on the head the add-and-retire entry is about to be built on,
-    // before that entry -- the ceremony's pivot -- retires the spent code.
-    // Reached on both paths into the add entry: the reveal entry just published
-    // above, or a torn earlier run's reveal entry standing already.
-    await onCommitted({ builtOnHead: servedHead(published.log) });
-    // The add-and-retire entry: the new client's verification methods and
-    // update key in; the replacement code's VM in; every pre-recovery standing
-    // credential fully retired -- the spent code by name, and every other one
-    // by the same structural rule the transient continuation uses (its ladder
-    // VM by the relation asymmetry, its keyAgreement member by the account-DID
-    // controller). Signed by the new client's update key, whose hash the commit
-    // entry just committed.
-    const { did, doc } = published;
-    const vmId = (publicKeyMultibase) => `${did}#${publicKeyMultibase}`;
-    const spentVmId = recoveryVmId({
-        did,
-        keyAgreementKeyMultibase: recovery.keyAgreementKeyMultibase
-    });
-    const replacementVmId = recoveryVmId({
-        did,
-        keyAgreementKeyMultibase: replacement.keyAgreementKeyMultibase
-    });
-    // A three-way controller split. The new client's signing method and the
-    // replacement code's key-agreement method are controlled by the account;
-    // the new client's key-agreement method alone carries the controller marker
-    // (see clientKeyAgreementController) -- which is exactly what tells the two
-    // simultaneously published keyAgreement methods apart. The marked pair goes
-    // through the shared builder, which refuses a new client whose key-agreement
-    // key is not its signing key's canonical twin; the replacement code's
-    // unmarked method is appended after it.
-    // The replacement code's ladder VM, published in the same entry as its
-    // key-agreement member: a code is a standing credential with a ladder, and
-    // its own bridge delegation is signed by this VM, so a replacement without
-    // it could never spend (`decisions/0019`, `decisions/0020`). Its rung-0
-    // hash needs nothing here -- the reveal-and-commit entry committed it, and
-    // this entry carries it through.
-    const replacementLadderVmId = vmId(replacement.ladderVmKeyMultibase);
-    const addedMethods = [
-        ...markedVerificationMethodPair({
-            controller: did,
-            signingKeyMultibase: newClientKeys.signingKeyMultibase,
-            keyAgreementKeyMultibase: newClientKeys.keyAgreementKeyMultibase
-        }),
-        {
-            id: replacementVmId,
-            type: MULTIKEY_VM_TYPE,
-            controller: did,
-            publicKeyMultibase: replacement.keyAgreementKeyMultibase
-        },
-        ladderVerificationMethod({
-            controller: did,
-            publicKeyMultibase: replacement.ladderVmKeyMultibase
-        })
-    ];
-    // The full retirement, recognized structurally rather than from a list the
-    // caller supplies: every standing ladder VM, and every keyAgreement member
-    // the account DID controls, less the ids this entry itself adds. Other
-    // unspent recovery codes retire with the rest -- a code's member is
-    // unmarked and verbatim, indistinguishable from a passkey's. Each retired
-    // credential's committed rungs and revealed rungs go in the same entry (see
-    // the strike below and `decisions/0014`), because striking the VM rots only
-    // a ladder-signed bridge and a bridge an enrolled client minted outlives
-    // this entry. The bridge itself stays live but inert; nothing revokes it.
-    // The new client's marked pair and the KMS
-    // convenience key are untouched -- neither is account-DID-controlled
-    // keyAgreement.
-    const ladderVms = ladderVmIds({ doc });
-    const addedVmIds = addedMethods
-        .map(method => method.id)
-        .filter((id) => typeof id === 'string');
-    const struckCredentialVmIds = credentialKeyAgreementMethods({ doc, did })
-        .map(method => method.id)
-        .filter((id) => typeof id === 'string')
-        .filter(id => !addedVmIds.includes(id));
-    const retiredCredentialVmIds = struckCredentialVmIds.filter(id => id !== spentVmId);
-    // Each retired credential's committed rungs and any revealed rung of its own
-    // go in the SAME entry. Striking the ladder VM rots only a ladder-signed
-    // bridge; a bridge an enrolled client minted outlives the strike, and that
-    // client survives this entry, so a committed rung left standing is a reveal
-    // the retired credential could still perform. Anchored from the log alone,
-    // and an unanchorable credential is reported rather than struck.
-    const strike = await attributeRetiredCredentialRungs({
-        log: published.log,
-        credentialVmIds: retiredCredentialVmIds,
-        protectedHashes: [newUpdateHash, newStagedHash, replacementHash],
-        protectedKeys: [newClientKeys.updateKeyMultibase]
-    });
-    const struck = (id) => id !== undefined &&
-        (id === spentVmId ||
-            ladderVms.includes(id) ||
-            struckCredentialVmIds.includes(id));
-    const existingMethods = (doc.verificationMethod ?? []);
-    const verificationMethods = [
-        ...existingMethods.filter(method => !struck(method.id) &&
-            !addedMethods.some(added => added.id === method.id)),
-        ...addedMethods
-    ];
-    const withReference = (relation, ...ids) => [
-        ...new Set([
-            ...relationIds(relation).filter(referencedId => !struck(referencedId)),
-            ...ids
-        ])
-    ];
-    const signingVmId = vmId(newClientKeys.signingKeyMultibase);
-    const signer = await updateKeySigner({
-        seed: newClientUpdateSeeds.updateSeed
-    });
-    const updated = await updateDID({
-        log: published.log,
-        signer,
-        alsoKnownAsWeb: true,
-        updateKeys: [
-            ...new Set([
-                ...published.updateKeys.filter(key => key !== recovery.updateKeyMultibase &&
-                    !strike.struckKeys.includes(key)),
-                newClientKeys.updateKeyMultibase
-            ])
-        ],
-        nextKeyHashes: assertNextKeyHashesRemain({
-            nextKeyHashes: published.nextKeyHashes.filter(hash => hash !== recoveryHash && !strike.struckHashes.includes(hash)),
-            ceremony: 'the recovery add-and-retire entry'
-        }),
-        verificationMethods,
-        authentication: withReference(doc.authentication, signingVmId),
-        // The ladder VM's relation asymmetry: `assertionMethod` and
-        // `capabilityDelegation` only, so it never reads as an enrolled client.
-        assertionMethod: withReference(doc.assertionMethod, signingVmId, replacementLadderVmId),
-        keyAgreement: [
-            ...new Set([
-                ...relationIds(doc.keyAgreement).filter(id => !struck(id)),
-                vmId(newClientKeys.keyAgreementKeyMultibase),
-                replacementVmId
-            ])
-        ],
-        capabilityInvocation: withReference(doc.capabilityInvocation, signingVmId),
-        capabilityDelegation: withReference(doc.capabilityDelegation, signingVmId, replacementLadderVmId)
-    });
-    // Conditional on the read this entry was built on: the re-read above when
-    // the commit entry ran here, the first read when it was skipped. The pin
-    // advances with the publish, so a host rolling the log back straight
-    // afterwards is refused on the next read.
-    await publishEntryPinned({
-        store,
-        log: updated.log,
-        ifMatch: published.etag,
-        ...pinned
-    });
-    return {
-        did: updated.did,
-        webDoc: updated.webDoc,
-        committed: true,
-        retiredCredentialVmIds,
-        struckRungHashes: strike.struckHashes,
-        unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
-    };
+    }));
+    // The document and log stay inside: the remembered session re-verifies
+    // the log for itself once it is the controller.
+    const { doc: _doc, log: _log, ...rest } = outcome;
+    return rest;
 }
 //# sourceMappingURL=recoveryWebvh.js.map

package/dist/recovery/recoveryWebvh.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG9E,OAAO,EACL,6BAA6B,EAC7B,WAAW,EACX,WAAW,EACZ,MAAM,4BAA4B,CAAA;AACnC,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EAMV;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACrC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CACzD,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,6BAA6B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CACvD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CACpB,CACF,CAAA;IACD,OAAO,6BAA6B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;SACzD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAyBD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EAUN;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,MAAM;QACN,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,yEAAyE;QACzE,iDAAiD;QACjD,UAAU;QACV,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EAUN;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,MAAM;QACN,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,oBAAoB,EAAE,IAAI;QAC1B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAYxC;IAQC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,uEAAuE;YACrE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,yBAAyB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAC9D,wBAAwB,EAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB;KACzE,CAAC,CAAA;IACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAaN;IAQC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,uBAAuB,CAAC;QAC5C,OAAO,EAAE,KAAK;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;QACT,cAAc,EAAE,sDAAsD;KACvE,CAAC,CAAA;IAEF,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,qBAAqB,EAAE,aAAa,CAAC,kBAAkB;YACvD,SAAS,EAAE,YAAY,CAAC;gBACtB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC5D,CAAC;SACH,CAAC,CAAA;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;YACnD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,aAAa,CAAC,kBAAkB;YACxD,eAAe,EAAE,OAAO;YACxB,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC;YAChE,aAAa,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC;SAClD,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE,KAAK;YAChB,sBAAsB,EAAE,OAAO;YAC/B,gBAAgB,EAAE,MAAM,CAAC,YAAY;YACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;SAC1D,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,wEAAwE;QACxE,uEAAuE;QACvE,gBAAgB;QAChB,MAAM,kBAAkB,CAAC;YACvB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;YACvB,GAAG,MAAM;SACV,CAAC,CAAA;QACF,uEAAuE;QACvE,SAAS,GAAG,MAAM,uBAAuB,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;YACT,cAAc,EAAE,sDAAsD;SACvE,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE7D,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,qBAAqB,GAAG,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;IACpE,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;QACD,wBAAwB,CAAC;YACvB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,oBAAoB;SACrD,CAAC;KACH,CAAA;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,2CAA2C;IAC3C,qEAAqE;IACrE,gBAAgB;IAChB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,YAAY;SAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAA;IACvD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACzD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,eAAe,EAAE,sBAAsB;QACvC,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC;QAChE,aAAa,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC;KAClD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,CAAC,EAAsB,EAAW,EAAE,CACjD,EAAE,KAAK,SAAS;QAChB,CAAC,EAAE,KAAK,SAAS;YACf,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACvC,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,GAAG,GAAa,EAChB,EAAE,CAAC;QACH,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,GAAG,GAAG;SACP,CAAC;KACH,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,yBAAyB,CAAC;YACvC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;YACD,QAAQ,EAAE,mCAAmC;SAC9C,CAAC;QACF,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,4DAA4D;QAC5D,wEAAwE;QACxE,eAAe,EAAE,aAAa,CAC5B,GAAG,CAAC,eAAe,EACnB,WAAW,EACX,qBAAqB,CACtB;QACD,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CACjC,GAAG,CAAC,oBAAoB,EACxB,WAAW,EACX,qBAAqB,CACtB;KACF,CAAC,CAAA;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,0CAA0C;IAC1C,MAAM,kBAAkB,CAAC;QACvB,KAAK;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,SAAS,CAAC,IAAI;QACvB,GAAG,MAAM;KACV,CAAC,CAAA;IACF,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;QACf,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAO5D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAO1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EAUN;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,MAAM;QACN,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,yEAAyE;QACzE,iDAAiD;QACjD,UAAU;QACV,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EAUN;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,MAAM;QACN,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAYxC;IAQC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,uEAAuE;YACrE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,yBAAyB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAC9D,wBAAwB,EAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB;KACzE,CAAC,CAAA;IACF,MAAM,EACJ,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EACL,GAAG,MAAM,EACV,GAAG,OAAO,CAAA;IACX,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAC9C,wBAAwB,CAAC;QACvB,GAAG,MAAM;QACT,SAAS,EAAE;YACT,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;YACpD,UAAU,EAAE,oBAAoB,CAAC,UAAU;YAC3C,kBAAkB,EAAE,aAAa,CAAC,wBAAwB;SAC3D;QACD,WAAW;QACX,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,gEAAgE;QAChE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACjB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,aAAa,CAAC,mBAAmB,EAAE,CAAA;YACjE,OAAO;gBACL,OAAO,EAAE,4BAA4B,CAAC;oBACpC,UAAU,EAAE,GAAG;oBACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;oBACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;iBACjE,CAAC;gBACF,cAAc,EAAE,CAAC,WAAW,CAAC;gBAC7B,eAAe,EAAE,CAAC,WAAW,CAAC;gBAC9B,YAAY,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,CAAC,wBAAwB,EAAE,CAAC;gBAClE,oBAAoB,EAAE,CAAC,WAAW,CAAC;gBACnC,oBAAoB,EAAE,CAAC,WAAW,CAAC;aACpC,CAAA;QACH,CAAC;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CACH,CAAA;IACD,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/request/classify.d.ts

@@ -13,8 +13,10 @@
  * `AppConnectQuery` extension (`appConnectRequestOf`), whose `app` block is
  * validated here against the attested requesting origin.
  */
-import type { CHAPIStoreEvent, IAppConnectRequest, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, IZcapQuery, WalletRequestProfile } from './types.js';
+import type { CHAPIStoreEvent, IAppConnectRequest, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, WalletRequestProfile } from './types.js';
 import type { CHAPIGetEvent } from './types.js';
+import { isZcapQuery } from './queryPredicates.js';
+export { isZcapQuery };
 /**
  * The VC data model version a presentation carrying the given credentials must
  * use, so its `@context` stays coherent with what it carries: `2.0` when any
@@ -78,19 +80,6 @@ export declare function queriesOf(request: IVPRDetails): IVPRQuery[];
  * @returns {ICredentialQuery[]}
  */
 export declare function credentialQueriesOf(query: IQueryByExample): ICredentialQuery[];
-/**
- * Whether a query is a standalone capability query, under either type string:
- * `AuthorizationCapabilityQuery` (the canonical VCALM spelling) or the legacy
- * `ZcapQuery`.
- *
- * The one reader of that alias pair. Both exclusivity checks and both
- * capability extractors ask through here, so retiring or extending the pair
- * is one edit rather than four.
- *
- * @param query {IVPRQuery}
- * @returns {boolean}
- */
-export declare function isZcapQuery(query: IVPRQuery): query is IZcapQuery;
 /**
  * Collects the requested capabilities from a query set: filters the two zcap
  * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`

package/dist/request/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,eAAe,EAGf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAoB/C;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,qBAAqB,EAAE,GACnC,MAAM,CAOR;AA0DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,UAAU,CAIjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAc5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CA4BT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,kBAAkB,GAAG,IAAI,CAmD5B;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAoBtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kBAAmB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,EAAE,EACpB,kBAAkB,GAAE,SAAS,MAAM,EAAoC,GACtE,OAAO,CAWT"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,eAAe,EAGf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAGL,WAAW,EAGZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,CAAA;AAmBtB;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,qBAAqB,EAAE,GACnC,MAAM,CAOR;AA0DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAc5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAmBT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,kBAAkB,GAAG,IAAI,CA2C5B;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAoBtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kBAAmB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,EAAE,EACpB,kBAAkB,GAAE,SAAS,MAAM,EAAoC,GACtE,OAAO,CAWT"}

package/dist/request/classify.js

@@ -1,4 +1,6 @@
 import { typeArray } from '@interop/data-integrity-core/guards';
+import { isAppConnectQuery, isWalletOnboardingQuery, isZcapQuery, parsedAbsoluteUrl, singletonQueryOf } from './queryPredicates.js';
+export { isZcapQuery };
 const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
 const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
 /**
@@ -164,21 +166,6 @@ export function credentialQueriesOf(query) {
     }
     return Array.isArray(credentialQuery) ? credentialQuery : [credentialQuery];
 }
-/**
- * Whether a query is a standalone capability query, under either type string:
- * `AuthorizationCapabilityQuery` (the canonical VCALM spelling) or the legacy
- * `ZcapQuery`.
- *
- * The one reader of that alias pair. Both exclusivity checks and both
- * capability extractors ask through here, so retiring or extending the pair
- * is one edit rather than four.
- *
- * @param query {IVPRQuery}
- * @returns {boolean}
- */
-export function isZcapQuery(query) {
-    return (query.type === 'AuthorizationCapabilityQuery' || query.type === 'ZcapQuery');
-}
 /**
  * Collects the requested capabilities from a query set: filters the two zcap
  * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
@@ -223,16 +210,11 @@ export function zcapQueriesOf(queries) {
  * @returns {string} The parsed URL's serialization.
  */
 export function serializedAppUrl({ appUrl, origin }) {
-    let url;
-    try {
-        url = new URL(appUrl);
-    }
-    catch (err) {
-        throw new Error(`An AppConnectQuery "appUrl" must be an absolute URL (got "${appUrl}").`, { cause: err });
-    }
-    if (url.href.includes('#')) {
-        throw new Error(`An AppConnectQuery "appUrl" must not carry a fragment (got "${appUrl}").`);
-    }
+    const url = parsedAbsoluteUrl({
+        value: appUrl,
+        notAbsoluteMessage: `An AppConnectQuery "appUrl" must be an absolute URL (got "${appUrl}").`,
+        fragmentMessage: `An AppConnectQuery "appUrl" must not carry a fragment (got "${appUrl}").`
+    });
     let attestedOrigin;
     try {
         attestedOrigin = new URL(origin).origin;
@@ -271,23 +253,20 @@ export function serializedAppUrl({ appUrl, origin }) {
  * @returns {IAppConnectRequest | null}
  */
 export function appConnectRequestOf({ queries, origin }) {
-    // `AppConnectQuery` extends the spec query union, so it is matched by its
-    // `type` string and upcast rather than narrowed via a type predicate.
-    const appConnectQueries = queries.filter(query => query.type === 'AppConnectQuery');
-    if (appConnectQueries.length === 0) {
+    const appConnectQuery = singletonQueryOf({
+        queries,
+        isSingleton: isAppConnectQuery,
+        isExcluded: query => query.type === 'QueryByExample' ||
+            isZcapQuery(query) ||
+            isWalletOnboardingQuery(query),
+        typeName: 'AppConnectQuery',
+        mixedMessage: 'An AppConnectQuery cannot be combined with QueryByExample, ' +
+            'standalone capability queries, or a WalletOnboardingQuery.'
+    });
+    if (appConnectQuery === null) {
         return null;
     }
-    if (appConnectQueries.length > 1) {
-        throw new Error('More than one AppConnectQuery found, exiting.');
-    }
-    const mixed = queries.some(query => query.type === 'QueryByExample' ||
-        isZcapQuery(query) ||
-        query.type === 'WalletOnboardingQuery');
-    if (mixed) {
-        throw new Error('An AppConnectQuery cannot be combined with QueryByExample, ' +
-            'standalone capability queries, or a WalletOnboardingQuery.');
-    }
-    const { app, capabilityQuery } = appConnectQueries[0];
+    const { app, capabilityQuery } = appConnectQuery;
     if (!app || typeof app.name !== 'string' || typeof app.appUrl !== 'string') {
         throw new Error('An AppConnectQuery is missing its app name / appUrl.');
     }