@interop/wallet-core 0.66.0 → 0.68.0

package/README.md

@@ -27,11 +27,12 @@ The subpaths:
 
 - **`@interop/wallet-core/sync`** -- the Wallet Attached Storage (WAS)
   replication engine core: the `SyncEngine` orchestration (single-flight,
-  migrate-once, backoff), the `runPull` / `runPush` algorithms, the replica-side
-  `SyncStore` seam, and the generic `SyncedCollectionSpec` shape. The wire
-  contract and port (`WasSyncPort`, `WireDoc`, `DocCipher`, ...) are re-exported
-  from [`@interop/was-client`](https://npm.im/@interop/was-client) so an engine
-  consumer imports one package.
+  migrate-once, memoized provisioning invalidated on demand via
+  `invalidateProvisioning`, backoff), the `runPull` / `runPush` algorithms, the
+  replica-side `SyncStore` seam, and the generic `SyncedCollectionSpec` shape.
+  The wire contract and port (`WasSyncPort`, `WireDoc`, `DocCipher`, ...) are
+  re-exported from [`@interop/was-client`](https://npm.im/@interop/was-client)
+  so an engine consumer imports one package.
 
 - **`@interop/wallet-core/space`** -- the wallet Space layout contract: the
   shared collection ids and descriptive specs (`private-credentials`,
@@ -109,7 +110,9 @@ The subpaths:
   the account document no longer keys. Also `ensureWalletSpaceEpochs`, the
   provision-time install of each encrypted wallet collection's key epoch[0] (a
   fresh random epoch key wrapped to the user key) -- the EDV-bearing second step
-  of `provisionWalletSpace`. Also the enrolled-client display labels
+  of `provisionWalletSpace`. Also `walletSpaceProvisioner`, which builds the
+  sync engine's `ensureProvisioned` closure over both steps, single-flight
+  across concurrent callers. Also the enrolled-client display labels
   (`key-map/client-labels.json`) and their WAS-backed store. Also the client-key
   record codec: the contents and strict validation of the local record each
   wallet client keeps its own key material in (storage and wrapping stay
@@ -124,8 +127,9 @@ The subpaths:
 
 - **`@interop/wallet-core/descriptors`** -- collection encryption-descriptor
   acquisition (fetch / cache / offline fallback), the log-governed descriptor
-  source (every read re-verifies the governing resource log), and the
-  unknown-epoch refresh policy, including a self-refreshing EDV document cipher.
+  source (every read re-verifies the governing resource log, keyed per
+  collection by `collectionDescriptorLogPinId`), and the unknown-epoch refresh
+  policy, including a self-refreshing EDV document cipher.
 
 - **`@interop/wallet-core/keyring`** -- the unlock layer: the unlock derivation,
   the signed `{ version, encryption, wrapped, proof }` account-pointer record

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts

@@ -41,10 +41,11 @@
  *    installing epoch[0] under it on a collection the earlier run never
  *    reached would key that collection to nothing, permanently, since the
  *    install is create-if-absent and every later ensure adopts it. So the
- *    stage is skipped whole and reported on `epochsSkipped`; the caller
- *    that recovers the roster's real key is the one installer. With both
- *    gates the tear heal is always clean: no roster means no epochs, and a
- *    fresh user key re-runs both.
+ *    stage is refused whole by `ensureWalletSpaceEpochs`'s mint gate (the
+ *    roster descriptor is handed to it) and reported on `epochsSkipped`;
+ *    the caller that recovers the roster's real key is the one installer.
+ *    With both gates the tear heal is always clean: no roster means no
+ *    epochs, and a fresh user key re-runs both.
  * 6. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
@@ -59,7 +60,6 @@ import type { DIDLog } from '@interop/did-method-webvh';
 import type { KmsAuthenticationBinding, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
 import type { UnlockKeyAgreementPublication } from '../unlock/standingWebvh.js';
 import { type UserKey } from '../keys/index.js';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type AccountGenesisResult } from '../genesis/accountGenesis.js';
 import { type StageNotifier } from '../log.js';
 /**
@@ -121,9 +121,6 @@ export declare function mintCredentialAnchoredAccountKeySet(): Promise<{
  * @param [options.expectedDid] {string}   the account DID, when the caller
  *   holds a pointer that already names one (a heal re-run); a fresh signup
  *   and a fresh-terminal heal legitimately hold none
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   the chain-head
- *   pins the genesis read and create ride (a transient signup passes the
- *   visit's in-memory store)
  * @param [options.onDidPublished] {Function}   `({ did }) => Promise<void>`
  * @param [options.promoteController] {boolean}   default `true`; an app whose
  *   account pointer must durably name the DID first (freewallet's record
@@ -139,7 +136,7 @@ export declare function mintCredentialAnchoredAccountKeySet(): Promise<{
  *   stage adopted or minted, and which of the two it was -- the head is only
  *   safely reusable downstream when this run minted it
  */
-export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController, onStage }: {
+export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
     was: WasClient;
     wasServerUrl: string;
     spaceId: string;
@@ -156,7 +153,6 @@ export declare function ensureCredentialAnchoredAccountGenesis({ was, wasServerU
         spaceReady: Promise<unknown>;
     }) => Promise<KmsAuthenticationBinding | undefined>;
     expectedDid?: string;
-    accountLogPinStore?: ResourceLogPinStore;
     onDidPublished?: (published: {
         did: string;
     }) => Promise<void>;

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAM7D;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CACT,oBAAoB,GAAG;IAAE,SAAS,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAC5E,CAwJA"}
+{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAM7D;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CACT,oBAAoB,GAAG;IAAE,SAAS,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAC5E,CAqIA"}

package/dist/clientAnnex/credentialAnchoredGenesis.js

@@ -41,10 +41,11 @@
  *    installing epoch[0] under it on a collection the earlier run never
  *    reached would key that collection to nothing, permanently, since the
  *    install is create-if-absent and every later ensure adopts it. So the
- *    stage is skipped whole and reported on `epochsSkipped`; the caller
- *    that recovers the roster's real key is the one installer. With both
- *    gates the tear heal is always clean: no roster means no epochs, and a
- *    fresh user key re-runs both.
+ *    stage is refused whole by `ensureWalletSpaceEpochs`'s mint gate (the
+ *    roster descriptor is handed to it) and reported on `epochsSkipped`;
+ *    the caller that recovers the roster's real key is the one installer.
+ *    With both gates the tear heal is always clean: no roster means no
+ *    epochs, and a fresh user key re-runs both.
  * 6. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
@@ -58,6 +59,7 @@ import { ladderVmAgent } from './zcap.js';
 import { ensureLadderAnchoredDidWebvh } from './ladderAnchored.js';
 import { ensureWalletSpaceEpochs, mintUserKey } from '../keys/index.js';
 import { AccountGenesisSpaceError, ensurePromotedSpaceController, mintSpaceId } from '../genesis/accountGenesis.js';
+import { startKmsAuthentication } from '../genesis/kmsAuthentication.js';
 import { stageNotifier } from '../log.js';
 import { CONTROLLER_PROMOTION_STAGE } from './stages.js';
 /**
@@ -118,9 +120,6 @@ export async function mintCredentialAnchoredAccountKeySet() {
  * @param [options.expectedDid] {string}   the account DID, when the caller
  *   holds a pointer that already names one (a heal re-run); a fresh signup
  *   and a fresh-terminal heal legitimately hold none
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   the chain-head
- *   pins the genesis read and create ride (a transient signup passes the
- *   visit's in-memory store)
  * @param [options.onDidPublished] {Function}   `({ did }) => Promise<void>`
  * @param [options.promoteController] {boolean}   default `true`; an app whose
  *   account pointer must durably name the DID first (freewallet's record
@@ -136,7 +135,7 @@ export async function mintCredentialAnchoredAccountKeySet() {
  *   stage adopted or minted, and which of the two it was -- the head is only
  *   safely reusable downstream when this run minted it
  */
-export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController = true, onStage }) {
+export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl, spaceId, ladderSeed, keyAgreement, standingRecipient, userKey, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
     const failed = [];
     const stage = stageNotifier(onStage);
     const bootstrap = await ladderVmAgent({ ladderSeed });
@@ -156,24 +155,10 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
     // the ladder-and-credential-only genesis rather than aborting: every later
     // ceremony anchors in the ladder, and the document simply publishes no
     // `authentication` relation.
-    // Started inside the same guard the join uses, so a thunk that throws
-    // synchronously is collected like one that rejects.
-    let kmsRun;
-    // The flag rather than the value decides whether the stage is reported, so
-    // a thunk rejecting with `undefined` is still a collected failure.
-    let kmsFailed = false;
-    let kmsFailure;
-    try {
-        kmsRun = provideKmsAuthentication?.({ spaceReady });
-    }
-    catch (err) {
-        kmsFailed = true;
-        kmsFailure = err;
-    }
-    // A Space that never came up returns below while the thunk is still in
-    // flight, so its rejection is claimed here rather than surfacing as an
-    // unhandled one.
-    kmsRun?.catch(() => { });
+    const kms = startKmsAuthentication({
+        ...(provideKmsAuthentication ? { provideKmsAuthentication } : {}),
+        spaceReady
+    });
     try {
         await spaceReady;
     }
@@ -183,21 +168,12 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
     stage('space-provisioning');
     // The join: the genesis entry carries the KMS binding, so it waits on the
     // whole stage even though the Space no longer does.
-    let kmsAuthentication;
-    if (kmsRun) {
-        try {
-            kmsAuthentication = await kmsRun;
-        }
-        catch (err) {
-            kmsFailed = true;
-            kmsFailure = err;
-        }
-    }
-    if (kmsFailed) {
-        failed.push({ stage: 'kmsAuthentication', error: kmsFailure });
+    const kmsAuthentication = await kms.join();
+    if (kmsAuthentication.failed) {
+        failed.push({ stage: 'kmsAuthentication', error: kmsAuthentication.error });
     }
     stage('kms-authentication');
-    const didWebKeys = kmsAuthentication?.keys;
+    const didWebKeys = kmsAuthentication.binding?.keys;
     // 3. The ladder-anchored did:webvh genesis -- probe, adopt
     // (ladder-attributed), or create-and-publish. Fatal on failure, like the
     // enrolled-client stage.
@@ -206,13 +182,12 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
         wasServerUrl,
         spaceId,
         ...(didWebKeys ? { didWebKeys } : {}),
-        ...(kmsAuthentication?.etag !== undefined && {
-            keysJsonEtag: kmsAuthentication.etag
+        ...(kmsAuthentication.binding?.etag !== undefined && {
+            keysJsonEtag: kmsAuthentication.binding.etag
         }),
         ladderSeed,
         keyAgreement,
-        ...(expectedDid !== undefined ? { expectedDid } : {}),
-        ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
+        ...(expectedDid !== undefined ? { expectedDid } : {})
     });
     await onDidPublished?.({ did });
     stage('webvh-genesis');
@@ -237,25 +212,28 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
     }
     stage('roster-genesis');
     // 5. Epoch[0] on every encrypted roster collection, only behind a landed
-    // roster whose current epoch IS this run's user key (see the module doc:
-    // the user key is memory-only here, and an adopted roster keyed to another
-    // run's key would have the collections installed under a throwaway).
+    // roster and through the fan-out's mint gate: the user key is memory-only
+    // here, and an adopted roster keyed to another run's key would otherwise
+    // have the collections installed under a throwaway (see the module doc).
     let epochs;
     let epochsSkipped;
     if (rosterDescriptor) {
-        if (rosterDescriptor.currentEpoch === userKey.id) {
-            try {
-                epochs = await ensureWalletSpaceEpochs({ was, spaceId, userKey });
+        try {
+            const fanOut = await ensureWalletSpaceEpochs({
+                was,
+                spaceId,
+                userKey,
+                rosterDescriptor
+            });
+            if (fanOut.skipped) {
+                epochsSkipped = fanOut.skipped;
             }
-            catch (err) {
-                failed.push({ stage: 'epochs', error: err });
+            else {
+                epochs = fanOut;
             }
         }
-        else {
-            epochsSkipped =
-                rosterDescriptor.currentEpoch !== undefined
-                    ? { rosterEpochId: rosterDescriptor.currentEpoch }
-                    : {};
+        catch (err) {
+            failed.push({ stage: 'epochs', error: err });
         }
     }
     stage('collection-epochs');

package/dist/clientAnnex/credentialAnchoredGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAOzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,0BAA0B,EAE3B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAsBR;IAGC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAiC,OAAO,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,SAAS,CAAC,EAAE;KAC5B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6BAA6B;IAC7B,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,MAAiE,CAAA;IACrE,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,wBAAwB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,GAAG,IAAI,CAAA;QAChB,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEvB,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAE3B,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,iBAAuD,CAAA;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,MAAM,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,IAAI,CAAA;YAChB,UAAU,GAAG,GAAG,CAAA;QAClB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC3B,MAAM,UAAU,GAAG,iBAAiB,EAAE,IAAI,CAAA;IAE1C,2DAA2D;IAC3D,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACvE,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,SAAS,IAAI;YAC3C,YAAY,EAAE,iBAAiB,CAAC,IAAI;SACrC,CAAC;QACF,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/B,KAAK,CAAC,eAAe,CAAC,CAAA;IAEtB,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAEvB,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa;gBACX,gBAAgB,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAE1B,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACnC,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,SAAS;QACT,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAOzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,0BAA0B,EAE3B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAqBR;IAGC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAiC,OAAO,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,SAAS,CAAC,EAAE;KAC5B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAE3B,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,2DAA2D;IAC3D,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACvE,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/B,KAAK,CAAC,eAAe,CAAC,CAAA;IAEtB,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAEvB,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAE1B,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACnC,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,SAAS;QACT,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/clientAnnex/establish.d.ts

@@ -51,17 +51,21 @@
  *    identity, the ladder-VM-signed generation delegation embedded while
  *    the auxiliary Space still answers to the bootstrap did:key, the
  *    Space's controller flipped to the account DID, and the pointer entry
- *    appended -- signed by ladder attribution of the currently revealed
- *    rung, under the caller's chain-head pin. Within THIS ceremony the
+ *    appended -- moved as the ladder (`movePointerAsLadder`): each attempt
+ *    attributes the ladder's current rung, reveals it when only its hash
+ *    stands committed, and signs with it, under the caller's chain-head
+ *    pin, so a sibling self-enrollment that spends the rung mid-run is
+ *    climbed past rather than refused. Within THIS ceremony the
  *    sibling arm never fires: the sibling is only written by stage 4,
  *    strictly after the pointer entry, so a stage-3 tear leaves no
  *    sibling; the arm serves callers holding a standing invocation
  *    authority (the add/change-method fold), and the establishment's own
  *    bootstrap authority falls back to a fresh mint when a sibling-named
  *    Space refuses it.
- *    The revealed-rung attribution runs before this block and strictly
- *    before the re-bind: an account whose document no longer anchors this
- *    ladder refuses while the record is still in its pre-re-bind shape.
+ *    The primitive's pre-mint rung attribution runs before anything is
+ *    minted and strictly before the re-bind: an account whose document no
+ *    longer anchors this ladder refuses while the record is still in its
+ *    pre-re-bind shape.
  * 4. The re-bind, through the same `bindRecord` hook: the full pointer (DID
  *    in), the ladder-VM-signed bridge and annex-Space sibling, and the
  *    management delegation to the account DID -- durably written BEFORE
@@ -91,18 +95,18 @@ import type { DIDLog } from '@interop/did-method-webvh';
 import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
 import type { WasClient } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { ZcapClient } from '@interop/ezcap';
 import { type AccountGenesisResult } from '../genesis/accountGenesis.js';
 import type { ClientWebvhUpdateKeys, KmsAuthenticationBinding, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ICapabilityAgent } from '../webvh/zcap.js';
 import type { AccountPointer } from '../keyring/record.js';
 import { type UserKey } from '../keys/index.js';
+import { type LadderRung } from './ladder.js';
 import { type StageNotifier } from '../log.js';
 /**
  * The standing members an unlock-methods registry entry records for the
  * established credential: its roster kid and key-agreement multibase, the
- * bind-time revealed rung, the standing client's did:key, the bridge and
+ * ladder's standing rung, the standing client's did:key, the bridge and
  * sibling delegations' signer key ids and expiries, and the unlock
  * key-agreement members the re-bind reported. The member names are the ones
  * the registry already records; nothing here mints a new field.
@@ -188,9 +192,15 @@ export type CredentialAnchoredBindRecordHook = (options: {
  * delegation while the Space still answers to its creation controller, flip
  * the Space's controller to the account DID, then append the pointer entry
  * -- strictly last in the block, so pointer-present implies every prior
- * sub-step landed. The pointer entry signs by ladder attribution of the
- * currently revealed rung, and every log touch rides the caller's chain-head
- * pin store.
+ * sub-step landed. The pointer entry signs on the arm the caller states: an
+ * enrolled client's own update keys, or the ladder (attributed, revealed,
+ * and signed per attempt); every log touch rides the caller's chain-head pin
+ * store. On the ladder arm the rung is attributed BEFORE anything is minted,
+ * the pre-flight every pointer-moving arm runs: a ladder the log carries no
+ * rung of, and an ambiguous attribution, throw the ladder's own
+ * `LadderAttributionError` with no Space or generation minted, so a torn
+ * establishment never orphans an annex Space on an account that no longer
+ * anchors this ladder.
  *
  * Two invocation authorities, heal's pattern. A caller holding a standing
  * invocation authority (`invocation`: an enrolled client's storage handle
@@ -215,8 +225,6 @@ export type CredentialAnchoredBindRecordHook = (options: {
  * @param options.account {object}   the VERIFIED account log view
  *   (`{ did, doc, log }`; never re-fetched here)
  * @param options.wasServerUrl {string}   the account pointer's host
- * @param options.accountSpaceId {string}   the ACCOUNT Space's id (the
- *   generation delegation's target subtree, and the account-log pin slot)
  * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
  * @param options.was {WasClient}   the bootstrap storage client (the ladder
  *   VM's bare did:key), used by the fresh-mint arm
@@ -226,9 +234,18 @@ export type CredentialAnchoredBindRecordHook = (options: {
  *   `({ clientAnnexDid }) => Promise<IZcap>` -- the generation-delegation
  *   minter (ladder-VM-signed on a ladder-anchored account)
  * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store
- * @param [options.updateKeys] {ClientWebvhUpdateKeys}   the pointer entry's
- *   signing pair; absent, it is recovered by ladder attribution of the
- *   supplied log's current parameters
+ * @param options.signer {object}   who signs the pointer entry:
+ *   `{ kind: 'client', updateKeys }`, an enrolled client's own update keys
+ *   (freewallet's remembered-login fold), or `{ kind: 'ladder' }`, under
+ *   which the entry is moved as the ladder with the supplied `ladderSeed`
+ *   (`movePointerAsLadder`): every attempt of its conflict retry attributes
+ *   the ladder's current rung from the head it reads, reveals it when only
+ *   its hash stands committed, and signs with it -- so a racing ceremony that
+ *   spends the rung is climbed past. A pair fixed by the caller could not be,
+ *   since the client arm's not-authorized refusal is not a conflict the retry
+ *   re-runs on. Stated explicitly rather than read off `updateKeys`'
+ *   absence, since the ladder arm reveals a rung into the world-readable
+ *   `updateKeys` and an omission must not select it silently
  * @param [options.delegatedClients] {IZcap}   the record's sibling
  *   delegation, for the Space resolution's settled order
  * @param [options.invocation] {object}   a standing invocation authority for
@@ -239,8 +256,6 @@ export type CredentialAnchoredBindRecordHook = (options: {
  * @param [options.logOnly] {boolean}   pointer entries publish the log only
  *   (a bridge-delegated writer has no `did.json` projection rights); the
  *   establishment's root window omits it
- * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins; slot
- *   keys are derived here per log
  * @param [options.published] {PublishedWebvhLog}   the same account head as
  *   `account`, complete with the ETag its read carried, when the caller holds
  *   one. The pointer entry's first attempt then builds on it -- one saved
@@ -248,15 +263,16 @@ export type CredentialAnchoredBindRecordHook = (options: {
  *   compare-and-swap falls through to a fresh pinned read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<object>}   the pointed (or freshly minted) annex DID,
- *   the generation delegation when one was installed here, what ran, and --
- *   on `accountLog` -- the account head this block leaves standing: the
+ *   the generation delegation when one was installed here, what ran, on
+ *   `accountLog` the account head this block leaves standing (the
  *   post-pointer-entry one when it wrote, the supplied `published` verbatim
- *   when the document already pointed at a generation
+ *   when the document already pointed at a generation), and on the ladder
+ *   arm `rung`: the rung the pointer entry was signed with when this call
+ *   wrote one, else the ladder's currently attributed rung
  */
-export declare function ensurePointedClientAnnexGeneration({ account, wasServerUrl, accountSpaceId, ladderSeed, was, mintController, mintGenerationDelegation, idStore, updateKeys, delegatedClients, invocation, logOnly, pinStore, published, now }: {
+export declare function ensurePointedClientAnnexGeneration({ account, wasServerUrl, ladderSeed, was, mintController, mintGenerationDelegation, idStore, signer, delegatedClients, invocation, logOnly, published, now }: {
     account: Pick<PublishedWebvhLog, 'did' | 'doc' | 'log'>;
     wasServerUrl: string;
-    accountSpaceId: string;
     ladderSeed: Uint8Array;
     was: WasClient;
     mintController: string;
@@ -264,14 +280,18 @@ export declare function ensurePointedClientAnnexGeneration({ account, wasServerU
         clientAnnexDid: string;
     }) => Promise<IZcap>;
     idStore: WebvhIdStore;
-    updateKeys?: ClientWebvhUpdateKeys;
+    signer: {
+        kind: 'client';
+        updateKeys: ClientWebvhUpdateKeys;
+    } | {
+        kind: 'ladder';
+    };
     delegatedClients?: IZcap;
     invocation?: {
         was: WasClient;
         capability: IZcap;
     };
     logOnly?: boolean;
-    pinStore?: ResourceLogPinStore;
     published?: PublishedWebvhLog;
     now?: number;
 }): Promise<{
@@ -280,6 +300,7 @@ export declare function ensurePointedClientAnnexGeneration({ account, wasServerU
     generationMinted: boolean;
     spaceMinted: boolean;
     accountLog?: PublishedWebvhLog;
+    rung?: LadderRung;
 }>;
 /**
  * Runs the whole credential-anchored establishment for one unlock credential
@@ -349,9 +370,6 @@ export declare function ensurePointedClientAnnexGeneration({ account, wasServerU
  *   invocation under the bootstrap did:key works (the signup's registry
  *   write). NOT swallowed here: a throw fails the establishment, so a hook
  *   that must be best-effort swallows its own failures
- * @param [options.pinStore] {ResourceLogPinStore}   the chain-head pin store
- *   for every log read here (a transient visit's in-memory handle, or a
- *   client-local one when a remembered caller seeds its own pin)
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @param [options.onStage] {StageNotifier}   observational: called as each
  *   stage finishes, so a caller can time them, in the order of
@@ -406,7 +424,6 @@ export declare function establishCredentialAnchoredAccount(options: {
         userKey: UserKey;
         establishment: CredentialAnchoredEstablishment;
     }) => Promise<void>;
-    pinStore?: ResourceLogPinStore;
     now?: number;
     onStage?: StageNotifier;
 }): Promise<CredentialAnchoredEstablishment>;
@@ -459,7 +476,7 @@ export declare function rebindCredentialAnchoredRecord({ accountDid, pointer, la
  * @param options {object}
  * @param options.standing {object}   the credential's standing client:
  *   `clientDid`, `keyAgreementKeyMultibase`, `recipientKid`
- * @param options.updateKeyMultibase {string}   the attributed revealed rung
+ * @param options.updateKeyMultibase {string}   the ladder's attributed rung
  * @param [options.bridge] {IZcap}   the record's bridge delegation
  * @param [options.sibling] {IZcap}   the record's `delegatedClients` sibling
  * @param [options.unlock] {object}   the unlock key-agreement members, from

package/dist/clientAnnex/establish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"establish.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/establish.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAMrC,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAK1D,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAoB5D,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;OAOG;IACH,UAAU,EAAE,iBAAiB,CAAA;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,cAAc,EAAE,gCAAgC,CAAA;IAChD,aAAa,CAAC,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAA;IACrD,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,mBAAmB,GAAG,mBAAmB,CAAA;QAChD,KAAK,EAAE,OAAO,CAAA;KACf,CAAC,CAAA;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,kCAAkC,CAAC,EACvD,OAAO,EACP,YAAY,EACZ,cAAc,EACd,UAAU,EACV,GAAG,EACH,cAAc,EACd,wBAAwB,EACxB,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,SAAS,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wBAAwB,EAAE,CAAC,OAAO,EAAE;QAClC,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IACpB,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,UAAU,EAAE,KAAK,CAAA;KAAE,CAAA;IAClD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAA;IAC5B,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;IACpB,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B,CAAC,CAsID;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB,EAAE,MAAM,CAAA;QAChC,YAAY,EAAE,MAAM,CAAA;QACpB,eAAe,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,UAAU,EAAE,gCAAgC,CAAA;IAC5C,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAC1B,GAAG,EAAE,SAAS,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,+BAA+B,CAAA;KAC/C,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAuB3C;AA2SD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,UAAU,EACV,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,KAAK,EACL,cAAc,EACd,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,UAAU,EAAE,gCAAgC,CAAA;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,KAAK,CAAA;IACb,OAAO,EAAE,KAAK,CAAA;IACd,MAAM,EAAE,4BAA4B,CAAA;CACrC,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAAC,EAC/C,QAAQ,EACR,kBAAkB,EAClB,MAAM,EACN,OAAO,EACP,MAAM,EACP,EAAE;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB,EAAE,MAAM,CAAA;QAChC,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,MAAM,CAAC,EAAE;QACP,uBAAuB,CAAC,EAAE,MAAM,CAAA;QAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;KACxC,CAAA;CACF,GAAG,gCAAgC,CAmBnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,KAAK,EACN,EAAE;IACD,IAAI,EAAE,4BAA4B,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAgBP"}
+{"version":3,"file":"establish.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/establish.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAMrC,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAK1D,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AAqBlE,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;OAOG;IACH,UAAU,EAAE,iBAAiB,CAAA;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,cAAc,EAAE,gCAAgC,CAAA;IAChD,aAAa,CAAC,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAA;IACrD,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,mBAAmB,GAAG,mBAAmB,CAAA;QAChD,KAAK,EAAE,OAAO,CAAA;KACf,CAAC,CAAA;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,EAAE;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,wBAAsB,kCAAkC,CAAC,EACvD,OAAO,EACP,YAAY,EACZ,UAAU,EACV,GAAG,EACH,cAAc,EACd,wBAAwB,EACxB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,SAAS,EACT,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,SAAS,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wBAAwB,EAAE,CAAC,OAAO,EAAE;QAClC,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IACpB,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EACJ;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,qBAAqB,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAA;IAC5E,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,UAAU,EAAE,KAAK,CAAA;KAAE,CAAA;IAClD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAA;IAC5B,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;IACpB,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAC,CA4JD;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB,EAAE,MAAM,CAAA;QAChC,YAAY,EAAE,MAAM,CAAA;QACpB,eAAe,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,UAAU,EAAE,gCAAgC,CAAA;IAC5C,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QAC1B,GAAG,EAAE,SAAS,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,+BAA+B,CAAA;KAC/C,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAuB3C;AAuSD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,UAAU,EACV,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,KAAK,EACL,cAAc,EACd,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,UAAU,EAAE,gCAAgC,CAAA;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,KAAK,CAAA;IACb,OAAO,EAAE,KAAK,CAAA;IACd,MAAM,EAAE,4BAA4B,CAAA;CACrC,CAAC,CA8BD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAAC,EAC/C,QAAQ,EACR,kBAAkB,EAClB,MAAM,EACN,OAAO,EACP,MAAM,EACP,EAAE;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB,EAAE,MAAM,CAAA;QAChC,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,MAAM,CAAC,EAAE;QACP,uBAAuB,CAAC,EAAE,MAAM,CAAA;QAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;KACxC,CAAA;CACF,GAAG,gCAAgC,CAmBnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,KAAK,EACN,EAAE;IACD,IAAI,EAAE,4BAA4B,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAgBP"}