@interop/was-client 0.13.3 → 0.14.1

package/dist/edv/WasTransport.js

@@ -26,11 +26,16 @@
  *   server that does not will reject it with 415). Pass `contentType:
  *   JOSE_CONTENT_TYPE` to opt into it where the server supports it.
  *
- * Scope: documents only (`insert` / `update` / `get`). Blinded `find` / `count`
- * / `updateIndex` and chunked streams (`storeChunk` / `getChunk`) require
- * server-side EDV affordances (blinded `/query`, the `/{id}/chunks/{n}`
- * sub-segment) that a plaintext WAS server does not yet provide, so they throw
- * here. `insert` uses an atomic `If-None-Match: *` create when the backend
+ * Scope: documents (`insert` / `update` / `get`) plus blinded-index content
+ * query (`find`, the `blinded-index` profile of the reserved Collection
+ * `POST .../query` endpoint -- the server's `blinded-index-query` backend
+ * feature). `updateIndex` throws: in this profile the `indexed` array rides
+ * inside the stored document envelope, so `update()` IS the re-index
+ * operation and no separate index endpoint exists. Chunked streams
+ * (`storeChunk` / `getChunk`) still require the server's `chunked-streams`
+ * affordance (the reserved `/{id}/chunks/{n}` sub-segment), which neither
+ * reference backend provides, so they throw.
+ * `insert` uses an atomic `If-None-Match: *` create when the backend
  * advertises the optional `conditional-writes` feature; otherwise (and for
  * `update`) writes are advisory -- the EDV `sequence` is not enforced
  * (last-writer-wins on `update`).
@@ -38,9 +43,20 @@
 import { Transport } from '@interop/edv-client';
 import { httpStatus } from '../errors.js';
 import { readJsonData } from '../internal/content.js';
-import { collectionBackend, resourcePath } from '../internal/paths.js';
+import { collectionBackend, collectionQuery, resourcePath } from '../internal/paths.js';
 import { DEFAULT_CONTENT_TYPE, envelopeBytes, JOSE_CONTENT_TYPE } from './constants.js';
 export { JOSE_CONTENT_TYPE };
+/**
+ * HTTP statuses that mean the backend-descriptor endpoint is legitimately
+ * absent (or explicitly unimplemented), as opposed to transiently failing:
+ * `404` (no such endpoint), `405` (endpoint does not answer `GET`), `501`
+ * (not implemented). These are a definitive "this server advertises no
+ * backend features" answer and are safe to cache -- every affordance gate
+ * then falls closed against a server that has no backend descriptors. Any
+ * other failure (network error, timeout, `401`, `429`, other `5xx`) is
+ * transient/ambiguous and is re-probed instead of cached.
+ */
+const DESCRIPTOR_ABSENT_STATUSES = new Set([404, 405, 501]);
 /**
  * Builds an `Error` carrying the `name` that `EdvClientCore` (and the reference
  * `HttpsTransport`) dispatch on -- `DuplicateError`, `InvalidStateError`,
@@ -65,7 +81,7 @@ export class WasTransport extends Transport {
     collectionId;
     contentType;
     _was;
-    _conditionalWritesPromise;
+    _backendFeaturesPromise;
     /**
      * @param options {object}
      * @param options.was {WasClient}          a WAS client holding the signer
@@ -116,30 +132,66 @@ export class WasTransport extends Transport {
         });
     }
     /**
-     * Whether the collection's backend advertises the `conditional-writes`
-     * feature. Read once from the "Collection Backend Selected" descriptor and
-     * memoized for the transport's lifetime; any failure to read the descriptor
-     * (404, 501 on a server without backend support, network error) resolves
-     * `false`, so the caller falls back to the advisory path.
+     * The feature tokens the collection's backend advertises in its "Collection
+     * Backend Selected" descriptor (e.g. `conditional-writes`,
+     * `blinded-index-query`). Memoized once it produces a definitive answer: a
+     * successful read (including one that lists no features) and a definitive
+     * "endpoint absent" (`404` / `405` / `501`) both resolve to a cached feature
+     * list, so every affordance gate falls closed against a server that has no
+     * backend descriptors.
      *
-     * @returns {Promise<boolean>}
+     * A transient/ambiguous failure (network error, timeout, `401`, `429`, other
+     * `5xx`) is NOT cached: the memo is cleared so the next call re-probes, and
+     * the error is rethrown so the caller fails loud rather than silently
+     * degrading atomicity against a server that may well be capable. (A single
+     * transient failure must not poison the transport for its lifetime.)
+     *
+     * @returns {Promise<string[]>}
      */
-    _conditionalWrites() {
-        this._conditionalWritesPromise ??= (async () => {
-            try {
-                const response = await this._was.request({
-                    path: collectionBackend(this.spaceId, this.collectionId),
-                    method: 'GET'
-                });
-                const descriptor = (await readJsonData(response));
-                return (Array.isArray(descriptor?.features) &&
-                    descriptor.features.includes('conditional-writes'));
-            }
-            catch {
-                return false;
+    _backendFeatures() {
+        this._backendFeaturesPromise ??= this._probeBackendFeatures();
+        return this._backendFeaturesPromise;
+    }
+    /**
+     * Reads and parses the backend descriptor once. On a definitive answer
+     * (success, or a `404` / `405` / `501` that means the endpoint is legitimately
+     * absent) resolves the feature list, which `_backendFeatures` then caches. On
+     * a transient failure, clears the memo (so the next call re-probes) and
+     * rethrows.
+     *
+     * @returns {Promise<string[]>}
+     */
+    async _probeBackendFeatures() {
+        try {
+            const response = await this._was.request({
+                path: collectionBackend(this.spaceId, this.collectionId),
+                method: 'GET'
+            });
+            const descriptor = (await readJsonData(response));
+            return Array.isArray(descriptor?.features)
+                ? descriptor.features.filter((feature) => typeof feature === 'string')
+                : [];
+        }
+        catch (err) {
+            const status = httpStatus(err);
+            if (status !== undefined && DESCRIPTOR_ABSENT_STATUSES.has(status)) {
+                return [];
             }
-        })();
-        return this._conditionalWritesPromise;
+            // Transient/ambiguous: do not cache this failure -- drop the memo so the
+            // next call re-probes -- and rethrow.
+            this._backendFeaturesPromise = undefined;
+            throw err;
+        }
+    }
+    /**
+     * Whether the collection's backend advertises the optional
+     * `conditional-writes` feature, so `insert` can use an atomic
+     * `If-None-Match: *` create instead of the advisory existence-check path.
+     *
+     * @returns {Promise<boolean>}
+     */
+    async _conditionalWrites() {
+        return (await this._backendFeatures()).includes('conditional-writes');
     }
     /**
      * @inheritdoc
@@ -150,7 +202,9 @@ export class WasTransport extends Transport {
      * `PUT` with `If-None-Match: *`, and the server's 412 maps to
      * `DuplicateError`. Otherwise it degrades to a bodiless existence check
      * (`HEAD`) before the `PUT` -- advisory and non-atomic, but no longer
-     * downloading the whole stored envelope just to discard it.
+     * downloading the whole stored envelope just to discard it. In either path a
+     * 409 (a `unique: true` blinded attribute already held by another document)
+     * likewise maps to `DuplicateError`.
      *
      * @param options {object}
      * @param options.encrypted {IEncryptedDocument}   the document to insert
@@ -172,6 +226,14 @@ export class WasTransport extends Transport {
                         cause: err
                     });
                 }
+                if (httpStatus(err) === 409) {
+                    throw namedError({
+                        name: 'DuplicateError',
+                        message: 'A unique indexed attribute value is already held by another ' +
+                            'document in this collection.',
+                        cause: err
+                    });
+                }
                 throw err;
             }
             return;
@@ -182,7 +244,20 @@ export class WasTransport extends Transport {
                 message: `A document with id "${encrypted.id}" already exists.`
             });
         }
-        await this._put(encrypted.id, encrypted);
+        try {
+            await this._put(encrypted.id, encrypted);
+        }
+        catch (err) {
+            if (httpStatus(err) === 409) {
+                throw namedError({
+                    name: 'DuplicateError',
+                    message: 'A unique indexed attribute value is already held by another ' +
+                        'document in this collection.',
+                    cause: err
+                });
+            }
+            throw err;
+        }
     }
     /**
      * @inheritdoc
@@ -191,6 +266,14 @@ export class WasTransport extends Transport {
      * here -- without server-side conditional writes, a stale write is not
      * rejected (last-writer-wins).
      *
+     * Two write-time conflicts are mapped to the names `EdvClientCore` dispatches
+     * on. A server enforcing conditional writes rejects a stale/sequence
+     * conflict with 412 (precondition-failed), which surfaces as
+     * `InvalidStateError` -- the recoverable case, by re-fetching the current
+     * document and retrying. A 409 is the EDV unique-attribute collision (a
+     * `unique: true` blinded attribute already held by another document), which
+     * is NOT recoverable by re-fetch-and-retry; it surfaces as `DuplicateError`.
+     *
      * @param options {object}
      * @param options.encrypted {IEncryptedDocument}   the document to update
      * @returns {Promise<void>}
@@ -203,12 +286,19 @@ export class WasTransport extends Transport {
             await this._put(encrypted.id, encrypted);
         }
         catch (err) {
-            // A server that DOES enforce conditional writes signals a stale update
-            // with 409; surface it the way `EdvClientCore` expects.
-            if (httpStatus(err) === 409) {
+            if (httpStatus(err) === 412) {
                 throw namedError({
                     name: 'InvalidStateError',
-                    message: 'Conflict error.',
+                    message: 'Document update conflict: the stored document changed since it ' +
+                        'was read. Re-fetch the current document and retry.',
+                    cause: err
+                });
+            }
+            if (httpStatus(err) === 409) {
+                throw namedError({
+                    name: 'DuplicateError',
+                    message: 'A unique indexed attribute value is already held by another ' +
+                        'document in this collection.',
                     cause: err
                 });
             }
@@ -271,19 +361,81 @@ export class WasTransport extends Transport {
     /**
      * @inheritdoc
      *
-     * Blinded-index query is not part of the documents-only EDV-over-WAS profile;
-     * it needs the server's `/query` affordance.
+     * Runs a blinded-index content query: a signed `POST` of
+     * `{ profile: 'blinded-index', ...query }` to the Collection's reserved
+     * `/query` endpoint. Requires the backend's `blinded-index-query` affordance
+     * (throws `NotSupportedError` when it is absent). The server evaluates the
+     * blinded `equals` / `has` filters against the `indexed` entries of stored
+     * documents (opaque string comparison -- it does no crypto) and returns
+     * `{ documents, hasMore, cursor? }` (the encrypted envelopes verbatim, in
+     * ascending resource-id order, with `cursor` present iff `hasMore`), or a
+     * bare `{ count }` when `query.count` is `true`. The body is returned
+     * untouched: `EdvClientCore.find` decrypts `documents` and passes
+     * `hasMore` / `cursor` through.
+     *
+     * @param options {object}
+     * @param options.query {IEDVQuery}   the blinded query (`index` plus one of
+     *   `equals` / `has`, and optional `count` / `limit` / `cursor`), as built
+     *   by `EdvClientCore`'s `IndexHelper.buildQuery`
+     * @returns {Promise<object>}   the server's response body verbatim
      */
-    async find() {
-        return this._unsupported('find (blinded-index query)');
+    async find({ query } = {}) {
+        if (!query) {
+            throw new TypeError('"query" is required.');
+        }
+        if (!(await this._backendFeatures()).includes('blinded-index-query')) {
+            throw namedError({
+                name: 'NotSupportedError',
+                message: "Blinded-index query is not supported: the collection's backend " +
+                    'does not advertise the "blinded-index-query" affordance.'
+            });
+        }
+        // `returnDocuments` is a first-class `IEDVQuery` field, but the WAS profile
+        // has no ids-only mode, so it is dropped (whatever its value) and full
+        // documents come back -- the best-effort degradation `EdvClientCore.find`
+        // documents for this option.
+        const { returnDocuments: _returnDocuments, ...blindedQuery } = query;
+        let response;
+        try {
+            response = await this._was.request({
+                path: collectionQuery(this.spaceId, this.collectionId),
+                method: 'POST',
+                json: { profile: 'blinded-index', ...blindedQuery }
+            });
+        }
+        catch (err) {
+            if (httpStatus(err) === 404) {
+                throw namedError({
+                    name: 'NotFoundError',
+                    message: 'Collection not found.',
+                    cause: err
+                });
+            }
+            throw err;
+        }
+        const result = await readJsonData(response);
+        if (result === null || typeof result !== 'object') {
+            throw new Error('Malformed blinded-index query response.');
+        }
+        return result;
     }
     /**
      * @inheritdoc
      *
-     * Index updates need the server's `/{id}/index` affordance.
+     * Not supported, deliberately: in the EDV-over-WAS profile, index entries
+     * are not a separate server-side resource -- the `indexed` array rides
+     * inside the stored document envelope, and every `insert` / `update`
+     * already carries it. Re-indexing a document is therefore an ordinary
+     * `update()` of the full envelope; there is no `/{id}/index` endpoint to
+     * bind this to.
      */
     async updateIndex() {
-        return this._unsupported('updateIndex');
+        throw namedError({
+            name: 'NotSupportedError',
+            message: '"updateIndex" is not supported by the EDV-over-WAS profile: index ' +
+                'entries ride inside the stored document envelope, so re-index a ' +
+                'document with an ordinary "update()" of the full document.'
+        });
     }
     /**
      * @inheritdoc
@@ -302,8 +454,10 @@ export class WasTransport extends Transport {
         return this._unsupported('getChunk (chunked streams)');
     }
     /**
-     * Throws a uniform "not supported in this profile" error for EDV operations
-     * that depend on server-side affordances absent from a plaintext WAS server.
+     * Throws a uniform "not supported in this profile" error for the chunked-
+     * stream operations, which depend on a server-side affordance (the reserved
+     * `/{id}/chunks/{n}` sub-segment, the `chunked-streams` backend feature)
+     * that neither reference backend provides yet.
      *
      * @param operation {string}
      * @returns {never}
@@ -311,8 +465,8 @@ export class WasTransport extends Transport {
     _unsupported(operation) {
         throw namedError({
             name: 'NotSupportedError',
-            message: `"${operation}" is not supported by the documents-only ` +
-                'EDV-over-WAS profile (requires server-side EDV affordances).'
+            message: `"${operation}" is not supported by the EDV-over-WAS profile ` +
+                '(requires the server\'s "chunked-streams" affordance).'
         });
     }
 }

package/dist/edv/WasTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"WasTransport.js","sourceRoot":"","sources":["../../src/edv/WasTransport.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAI/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAQ5B;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,EAClB,IAAI,EACJ,OAAO,EACP,KAAK,EAKN;IACC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACf,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,SAAS;IAChC,OAAO,CAAQ;IACf,YAAY,CAAQ;IACpB,WAAW,CAAQ;IAEX,IAAI,CAAc;IAC3B,yBAAyB,CAAmB;IAEpD;;;;;;;;;OASG;IACH,YAAY,EACV,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAMnC;QACC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,EAAU;QAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,IAAI,CAChB,EAAU,EACV,SAA6B,EAC7B,UAAkC,EAAE;QAEpC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,KAAK;YACb,IAAI;YACJ,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,EAAE;SAC1D,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB;QACxB,IAAI,CAAC,yBAAyB,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;oBACxD,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAExC,CAAA;gBACR,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;oBACnC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACnD,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,IAAI,CAAC,yBAAyB,CAAA;IACvC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACM,KAAK,CAAC,MAAM,CAAC,EACpB,SAAS,KAC6B,EAAE;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC;wBACf,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,uBAAuB,SAAS,CAAC,EAAE,mBAAmB;wBAC/D,KAAK,EAAE,GAAG;qBACX,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,CAAC;gBACf,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,uBAAuB,SAAS,CAAC,EAAE,mBAAmB;aAChE,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;;;;;;OAUG;IACM,KAAK,CAAC,MAAM,CAAC,EACpB,SAAS,KAC6B,EAAE;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,iBAAiB;oBAC1B,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,GAAG,CAAC,EACjB,EAAE,KACiB,EAAE;QACrB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAC1C,CAAC;QACD,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5B,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAuB,CAAA;IAC7D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACzE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACM,KAAK,CAAC,IAAI;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;IACxD,CAAC;IAED;;;;OAIG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;IACzC,CAAC;IAED;;;;OAIG;IACM,KAAK,CAAC,UAAU;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAA;IAC1D,CAAC;IAED;;;;OAIG;IACM,KAAK,CAAC,QAAQ;QACrB,OAAO,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;IACxD,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,SAAiB;QACpC,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,IAAI,SAAS,2CAA2C;gBACxD,8DAA8D;SACjE,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"WasTransport.js","sourceRoot":"","sources":["../../src/edv/WasTransport.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAO/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B;;;;;;;;;GASG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAQ3D;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,EAClB,IAAI,EACJ,OAAO,EACP,KAAK,EAKN;IACC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACf,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,SAAS;IAChC,OAAO,CAAQ;IACf,YAAY,CAAQ;IACpB,WAAW,CAAQ;IAEX,IAAI,CAAc;IAC3B,uBAAuB,CAAoB;IAEnD;;;;;;;;;OASG;IACH,YAAY,EACV,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAMnC;QACC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,EAAU;QAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,IAAI,CAChB,EAAU,EACV,SAA6B,EAC7B,UAAkC,EAAE;QAEpC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,KAAK;YACb,IAAI;YACJ,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,EAAE;SAC1D,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,gBAAgB;QACtB,IAAI,CAAC,uBAAuB,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAA;IACrC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBACvC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;gBACxD,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAExC,CAAA;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACxC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CACxB,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAC5D;gBACH,CAAC,CAAC,EAAE,CAAA;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAA;YACX,CAAC;YACD,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAA;YACxC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB;QAC9B,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACM,KAAK,CAAC,MAAM,CAAC,EACpB,SAAS,KAC6B,EAAE;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC;wBACf,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,uBAAuB,SAAS,CAAC,EAAE,mBAAmB;wBAC/D,KAAK,EAAE,GAAG;qBACX,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC;wBACf,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EACL,8DAA8D;4BAC9D,8BAA8B;wBAChC,KAAK,EAAE,GAAG;qBACX,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,CAAC;gBACf,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,uBAAuB,SAAS,CAAC,EAAE,mBAAmB;aAChE,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EACL,8DAA8D;wBAC9D,8BAA8B;oBAChC,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACM,KAAK,CAAC,MAAM,CAAC,EACpB,SAAS,KAC6B,EAAE;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EACL,iEAAiE;wBACjE,oDAAoD;oBACtD,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EACL,8DAA8D;wBAC9D,8BAA8B;oBAChC,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,GAAG,CAAC,EACjB,EAAE,KACiB,EAAE;QACrB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAC1C,CAAC;QACD,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5B,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAuB,CAAA;IAC7D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACzE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,KAA4B,EAAE;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACrE,MAAM,UAAU,CAAC;gBACf,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,iEAAiE;oBACjE,0DAA0D;aAC7D,CAAC,CAAA;QACJ,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,6BAA6B;QAC7B,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAA;QACpE,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;gBACtD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,YAAY,EAAE;aACpD,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC;oBACf,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,uBAAuB;oBAChC,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,WAAW;QACxB,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,oEAAoE;gBACpE,kEAAkE;gBAClE,4DAA4D;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACM,KAAK,CAAC,UAAU;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAA;IAC1D,CAAC;IAED;;;;OAIG;IACM,KAAK,CAAC,QAAQ;QACrB,OAAO,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;IACxD,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,SAAiB;QACpC,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,IAAI,SAAS,iDAAiD;gBAC9D,wDAAwD;SAC3D,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/edv/epochCrypto.d.ts

@@ -0,0 +1,101 @@
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { CollectionEncryptionRecipient } from '../types.js';
+/**
+ * The JOSE key-management algorithm for every epoch/recipient wrap.
+ */
+export declare const KEY_WRAP_ALG = "ECDH-ES+A256KW";
+/**
+ * A reader's public key-agreement key, as needed to wrap an epoch key to it:
+ * the recipient `id` (`kid`, which the reader's own key-agreement key must also
+ * report) and its `publicKeyMultibase`.
+ */
+export interface RecipientPublicKey {
+    id: string;
+    publicKeyMultibase: string;
+    type?: string;
+}
+/**
+ * Wraps a 32-byte epoch secret to one recipient's X25519 key-agreement key,
+ * producing the JWE `recipients` entry stored on the marker. Generates a fresh
+ * ephemeral key per call (ECDH-ES), so each wrap carries its own `epk`.
+ *
+ * @param options {object}
+ * @param options.epochSecret {Uint8Array}       the 32-byte epoch key to wrap
+ * @param options.recipient {RecipientPublicKey}   the reader's public KAK
+ * @returns {Promise<CollectionEncryptionRecipient>}
+ */
+export declare function wrapEpochSecret({ epochSecret, recipient }: {
+    epochSecret: Uint8Array;
+    recipient: RecipientPublicKey;
+}): Promise<CollectionEncryptionRecipient>;
+/**
+ * Unwraps an epoch secret from a marker `recipients` entry using the reader's
+ * own key-agreement key. Returns `null` when this key does not match the entry
+ * (the wrong recipient, or a corrupt entry) -- never treat `null` as a key; try
+ * the next candidate entry or epoch, and fail with a typed error when nothing
+ * unwraps.
+ *
+ * @param options {object}
+ * @param options.entry {CollectionEncryptionRecipient}   the marker entry
+ * @param options.keyAgreementKey {IKeyAgreementKey}      the reader's own KAK
+ *   (its `id` must equal `entry.header.kid` for the derivation to match)
+ * @returns {Promise<Uint8Array | null>}
+ */
+export declare function unwrapEpochSecret({ entry, keyAgreementKey }: {
+    entry: CollectionEncryptionRecipient;
+    keyAgreementKey: IKeyAgreementKey;
+}): Promise<Uint8Array | null>;
+/**
+ * Mints a fresh key epoch: a new random X25519 key pair whose `did:key` is the
+ * epoch id. Returns the id and the raw 32-byte secret (to wrap to recipients);
+ * `resolveEpochKeys` reconstructs the epoch key pair from the id and secret when
+ * a resource must be encrypted or decrypted under the epoch.
+ *
+ * @returns {Promise<{ epochId: string, secret: Uint8Array }>}
+ */
+export declare function mintEpoch(): Promise<{
+    epochId: string;
+    secret: Uint8Array;
+}>;
+/**
+ * Reconstructs an epoch key pair from its id (a `did:key`, which carries the
+ * public key) and the unwrapped 32-byte secret, ready to hand to the EDV
+ * `documentCipher` as its `keyAgreementKey`.
+ *
+ * @param options {object}
+ * @param options.epochId {string}      the epoch's `did:key`
+ * @param options.secret {Uint8Array}   the unwrapped 32-byte epoch secret
+ * @returns {X25519KeyAgreementKey2020}
+ */
+export declare function reconstructEpochKeyPair({ epochId, secret }: {
+    epochId: string;
+    secret: Uint8Array;
+}): IKeyAgreementKey;
+/**
+ * The verification-method id of an epoch key: `<did:key>#<fingerprint>`. This is
+ * the `kid` the EDV `documentCipher` stamps on a resource encrypted under the
+ * epoch; a reader maps it back to the epoch by taking the `did:key` portion
+ * before the `#` fragment.
+ *
+ * @param epochId {string}   the epoch's `did:key`
+ * @returns {string}
+ */
+export declare function epochKeyIdFor(epochId: string): string;
+/**
+ * A `did:key` key resolver for X25519 key-agreement keys: resolves a
+ * `did:key:z...#z...` id (an epoch key, or any self-describing X25519 key) to
+ * its public verification method. The public key is the fragment, so no network
+ * or registry lookup is needed.
+ *
+ * @param options {object}
+ * @param options.id {string}   the key id to resolve
+ * @returns {Promise<{ id: string, type: string, publicKeyMultibase: string }>}
+ */
+export declare function didKeyResolver({ id }: {
+    id?: string;
+}): Promise<{
+    id: string;
+    type: string;
+    publicKeyMultibase: string;
+}>;
+//# sourceMappingURL=epochCrypto.d.ts.map

package/dist/edv/epochCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epochCrypto.d.ts","sourceRoot":"","sources":["../../src/edv/epochCrypto.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,YAAY,mBAAmB,CAAA;AAS5C;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,WAAW,EACX,SAAS,EACV,EAAE;IACD,WAAW,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,kBAAkB,CAAA;CAC9B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,6BAA6B,CAAA;IACpC,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyB7B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,CAAC,CAQD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,gBAAgB,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAkBD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,EAAE,EACH,EAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBpE"}