@interop/was-react 0.1.0

package/dist/grants.test.js

@@ -0,0 +1,79 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+import { describe, it, expect } from 'vitest';
+import { parseGrants, parseInvocationTarget } from './grants.js';
+/** Minimal delegated-zcap stub carrying just the fields `parseGrants` reads. */
+function grant(invocationTarget) {
+    return {
+        '@context': ['https://w3id.org/zcap/v1'],
+        id: `urn:uuid:${invocationTarget}`,
+        parentCapability: 'urn:zcap:root:x',
+        controller: 'did:key:zApp',
+        invocationTarget,
+        allowedAction: ['GET', 'PUT'],
+        expires: '2099-01-01T00:00:00Z',
+        proof: {}
+    };
+}
+describe('parseInvocationTarget', () => {
+    it('splits a collection target into origin, space, collection', () => {
+        const parsed = parseInvocationTarget('http://localhost:3002/space/abc123/action-items');
+        expect(parsed).toEqual({
+            serverUrl: 'http://localhost:3002',
+            spaceId: 'abc123',
+            collectionId: 'action-items'
+        });
+    });
+    it('tolerates a trailing slash and omits collection on a space target', () => {
+        const parsed = parseInvocationTarget('https://was.example/space/s1/');
+        expect(parsed.serverUrl).toBe('https://was.example');
+        expect(parsed.spaceId).toBe('s1');
+        expect(parsed.collectionId).toBeUndefined();
+    });
+    it('rejects a non-WAS URL', () => {
+        expect(() => parseInvocationTarget('http://x/not-a-space/y')).toThrow();
+        expect(() => parseInvocationTarget('not-a-url')).toThrow();
+    });
+});
+describe('parseGrants', () => {
+    it('routes per-collection grants and derives one server + space', () => {
+        const parsed = parseGrants([
+            grant('http://localhost:3002/space/abc/action-items'),
+            grant('http://localhost:3002/space/abc/projects'),
+            grant('http://localhost:3002/space/abc/current-focus')
+        ]);
+        expect(parsed.serverUrl).toBe('http://localhost:3002');
+        expect(parsed.spaceId).toBe('abc');
+        expect(Object.keys(parsed.byCollectionId).sort()).toEqual([
+            'action-items',
+            'current-focus',
+            'projects'
+        ]);
+        expect(parsed.byCollectionId['action-items']?.invocationTarget).toBe('http://localhost:3002/space/abc/action-items');
+    });
+    it('includes a space-scoped grant in topology but not routing', () => {
+        const parsed = parseGrants([
+            grant('http://localhost:3002/space/abc/'),
+            grant('http://localhost:3002/space/abc/goals')
+        ]);
+        expect(parsed.spaceId).toBe('abc');
+        expect(Object.keys(parsed.byCollectionId)).toEqual(['goals']);
+    });
+    it('rejects grants spanning two servers', () => {
+        expect(() => parseGrants([
+            grant('http://localhost:3002/space/abc/goals'),
+            grant('http://localhost:4000/space/abc/projects')
+        ])).toThrow(/two servers/);
+    });
+    it('rejects grants spanning two spaces', () => {
+        expect(() => parseGrants([
+            grant('http://localhost:3002/space/abc/goals'),
+            grant('http://localhost:3002/space/def/projects')
+        ])).toThrow(/two spaces/);
+    });
+    it('rejects an empty grant set', () => {
+        expect(() => parseGrants([])).toThrow();
+    });
+});
+//# sourceMappingURL=grants.test.js.map

package/dist/grants.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.test.js","sourceRoot":"","sources":["../src/grants.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEhE,gFAAgF;AAChF,SAAS,KAAK,CAAC,gBAAwB;IACrC,OAAO;QACL,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,EAAE,EAAE,YAAY,gBAAgB,EAAE;QAClC,gBAAgB,EAAE,iBAAiB;QACnC,UAAU,EAAE,cAAc;QAC1B,gBAAgB;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7B,OAAO,EAAE,sBAAsB;QAC/B,KAAK,EAAE,EAAE;KACU,CAAA;AACvB,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,qBAAqB,CAClC,iDAAiD,CAClD,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,cAAc;SAC7B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;QACrE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,KAAK,CAAC,8CAA8C,CAAC;YACrD,KAAK,CAAC,0CAA0C,CAAC;YACjD,KAAK,CAAC,+CAA+C,CAAC;SACvD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxD,cAAc;YACd,eAAe;YACf,UAAU;SACX,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAClE,8CAA8C,CAC/C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,KAAK,CAAC,kCAAkC,CAAC;YACzC,KAAK,CAAC,uCAAuC,CAAC;SAC/C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,KAAK,CAAC,uCAAuC,CAAC;YAC9C,KAAK,CAAC,0CAA0C,CAAC;SAClD,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,KAAK,CAAC,uCAAuC,CAAC;YAC9C,KAAK,CAAC,0CAA0C,CAAC;SAClD,CAAC,CACH,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/identity/agents.d.ts

@@ -0,0 +1,99 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity + per-collection vault-key derivation from a 32-byte master seed.
+ *
+ * SEED-DERIVATION CONVENTION (pinned, part of the shared-key contract): the
+ * pinned `@interop/webkms-client` exposes `CapabilityAgent.fromSeed({ seed })`,
+ * which takes the raw 32 bytes AS-IS (no hashing). We use it for BOTH the master
+ * identity and the per-collection key-agreement keys, feeding raw bytes -- never
+ * `fromSecret`, which salt-hashes a STRING and would derive a different key for
+ * a byte array vs its text form.
+ *
+ * WHAT SELECTS THE KEY (verified against `CapabilityAgent.fromSeed`): the key
+ * material is derived from the `seed` bytes (the HMAC key) and the `keyName`
+ * string (the HMAC message) alone. The `handle` is stored on the returned agent
+ * as a cosmetic identifier and does NOT enter key derivation -- nor the derived
+ * did:key id, which is the fingerprint of the seed+keyName key pair. So the
+ * PINNED derivation inputs are the seed bytes and the `keyName` values
+ * (`IDENTITY_KEY_NAME` / `KAK_KEY_NAME` below); changing THOSE after first use
+ * is a data-migration event. The `identityHandle` / `kakHandle` parameters are
+ * safe to change and exist only so an app can supply a label for cosmetic
+ * continuity; they do not affect the identity, keys, or any stored data.
+ *
+ * Per-collection KAKs derive via `HKDF-SHA256(master, info = 'kak:v1:<id>')` to
+ * a 32-byte per-collection seed, then the standard Ed25519-to-X25519 path. HKDF
+ * one-wayness means a shared per-collection key exposes nothing about the master
+ * or sibling collections -- the future multi-app sharing unit.
+ *
+ * Not test-node-safe on React Native, but fine under Node/Vitest: the crypto
+ * stack (`webkms-client`, `x25519-key-agreement-key`) runs on the standard Web
+ * Crypto that Node 24 provides.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * Default cosmetic label for the master identity agent. Local naming only (does
+ * not affect key material or the derived did:key); safe to override.
+ */
+export declare const DEFAULT_IDENTITY_HANDLE = "was-react";
+/**
+ * Default cosmetic label for a per-collection key-agreement agent. Local naming
+ * only (does not affect key material); safe to override.
+ */
+export declare const DEFAULT_KAK_HANDLE = "was-react-kak";
+/**
+ * The agents derived from the master seed: the app's stable did:key controller,
+ * its signing agent, and a ZcapClient for signing storage requests later.
+ */
+export interface IdentityAgents {
+    controllerDid: string;
+    keyAgent: CapabilityAgent;
+    zcapClient: ZcapClient;
+}
+/**
+ * Derives one collection's X25519 key agreement key (KAK) plus its resolver, the
+ * material the doc-cipher needs. The concrete KAK type carries `type` /
+ * `publicKeyMultibase`; it is widened to `IKeyAgreementKey` only at the
+ * boundary.
+ */
+export interface CollectionKeys {
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+}
+/**
+ * Derives the master identity agents from the master seed. The did:key
+ * controller is stable across devices for the same seed.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @param [options.identityHandle] {string}   cosmetic agent label; does not
+ *   affect keys or the derived DID (defaults to `DEFAULT_IDENTITY_HANDLE`)
+ * @returns {Promise<IdentityAgents>}
+ */
+export declare function deriveIdentity({ seed, identityHandle }: {
+    seed: Uint8Array;
+    identityHandle?: string;
+}): Promise<IdentityAgents>;
+/**
+ * Derives one collection's vault key material from the master seed:
+ * `HKDF(master, 'kak:v1:<collectionId>')` to a per-collection seed, then the
+ * Ed25519-to-X25519 (Montgomery-form) key-agreement key. Deterministic, so the
+ * same seed decrypts the same envelopes on any device. Encryption uses these
+ * per-collection KAKs from day one -- never share one KAK across collections.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}       the 32-byte master seed
+ * @param options.collectionId {string}   the WAS collection id (the HKDF label)
+ * @param [options.kakHandle] {string}    cosmetic agent label; does not affect
+ *   keys (defaults to `DEFAULT_KAK_HANDLE`)
+ * @returns {Promise<CollectionKeys>}
+ */
+export declare function deriveCollectionKeys({ seed, collectionId, kakHandle }: {
+    seed: Uint8Array;
+    collectionId: string;
+    kakHandle?: string;
+}): Promise<CollectionKeys>;
+//# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAElD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAiCD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,YAAY,EACZ,SAA8B,EAC/B,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAyB1B"}

package/dist/identity/agents.js

@@ -0,0 +1,132 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity + per-collection vault-key derivation from a 32-byte master seed.
+ *
+ * SEED-DERIVATION CONVENTION (pinned, part of the shared-key contract): the
+ * pinned `@interop/webkms-client` exposes `CapabilityAgent.fromSeed({ seed })`,
+ * which takes the raw 32 bytes AS-IS (no hashing). We use it for BOTH the master
+ * identity and the per-collection key-agreement keys, feeding raw bytes -- never
+ * `fromSecret`, which salt-hashes a STRING and would derive a different key for
+ * a byte array vs its text form.
+ *
+ * WHAT SELECTS THE KEY (verified against `CapabilityAgent.fromSeed`): the key
+ * material is derived from the `seed` bytes (the HMAC key) and the `keyName`
+ * string (the HMAC message) alone. The `handle` is stored on the returned agent
+ * as a cosmetic identifier and does NOT enter key derivation -- nor the derived
+ * did:key id, which is the fingerprint of the seed+keyName key pair. So the
+ * PINNED derivation inputs are the seed bytes and the `keyName` values
+ * (`IDENTITY_KEY_NAME` / `KAK_KEY_NAME` below); changing THOSE after first use
+ * is a data-migration event. The `identityHandle` / `kakHandle` parameters are
+ * safe to change and exist only so an app can supply a label for cosmetic
+ * continuity; they do not affect the identity, keys, or any stored data.
+ *
+ * Per-collection KAKs derive via `HKDF-SHA256(master, info = 'kak:v1:<id>')` to
+ * a 32-byte per-collection seed, then the standard Ed25519-to-X25519 path. HKDF
+ * one-wayness means a shared per-collection key exposes nothing about the master
+ * or sibling collections -- the future multi-app sharing unit.
+ *
+ * Not test-node-safe on React Native, but fine under Node/Vitest: the crypto
+ * stack (`webkms-client`, `x25519-key-agreement-key`) runs on the standard Web
+ * Crypto that Node 24 provides.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { ZcapClient } from '@interop/ezcap';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+/**
+ * Default cosmetic label for the master identity agent. Local naming only (does
+ * not affect key material or the derived did:key); safe to override.
+ */
+export const DEFAULT_IDENTITY_HANDLE = 'was-react';
+/**
+ * Default cosmetic label for a per-collection key-agreement agent. Local naming
+ * only (does not affect key material); safe to override.
+ */
+export const DEFAULT_KAK_HANDLE = 'was-react-kak';
+// PINNED key-derivation inputs (the HMAC message that, with the seed, selects
+// the key). Changing either after first use is a data-migration event.
+const IDENTITY_KEY_NAME = 'app-key';
+const KAK_KEY_NAME = 'kak';
+/**
+ * HKDF-SHA256 expansion of the master seed into a 32-byte per-context seed.
+ *
+ * @param master {Uint8Array}
+ * @param info {string}   the domain-separation label (e.g. `kak:v1:projects`)
+ * @returns {Promise<Uint8Array>}
+ */
+async function hkdfExpand(master, info) {
+    const key = await globalThis.crypto.subtle.importKey('raw', master, 'HKDF', false, ['deriveBits']);
+    const bits = await globalThis.crypto.subtle.deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(info)
+    }, key, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * Derives the master identity agents from the master seed. The did:key
+ * controller is stable across devices for the same seed.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @param [options.identityHandle] {string}   cosmetic agent label; does not
+ *   affect keys or the derived DID (defaults to `DEFAULT_IDENTITY_HANDLE`)
+ * @returns {Promise<IdentityAgents>}
+ */
+export async function deriveIdentity({ seed, identityHandle = DEFAULT_IDENTITY_HANDLE }) {
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: identityHandle,
+        keyName: IDENTITY_KEY_NAME
+    });
+    const signer = keyAgent.getSigner();
+    const zcapClient = new ZcapClient({
+        SuiteClass: Ed25519Signature2020,
+        invocationSigner: signer,
+        delegationSigner: signer
+    });
+    return { controllerDid: keyAgent.id, keyAgent, zcapClient };
+}
+/**
+ * Derives one collection's vault key material from the master seed:
+ * `HKDF(master, 'kak:v1:<collectionId>')` to a per-collection seed, then the
+ * Ed25519-to-X25519 (Montgomery-form) key-agreement key. Deterministic, so the
+ * same seed decrypts the same envelopes on any device. Encryption uses these
+ * per-collection KAKs from day one -- never share one KAK across collections.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}       the 32-byte master seed
+ * @param options.collectionId {string}   the WAS collection id (the HKDF label)
+ * @param [options.kakHandle] {string}    cosmetic agent label; does not affect
+ *   keys (defaults to `DEFAULT_KAK_HANDLE`)
+ * @returns {Promise<CollectionKeys>}
+ */
+export async function deriveCollectionKeys({ seed, collectionId, kakHandle = DEFAULT_KAK_HANDLE }) {
+    const collectionSeed = await hkdfExpand(seed, `kak:v1:${collectionId}`);
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed: collectionSeed,
+        handle: kakHandle,
+        keyName: KAK_KEY_NAME
+    });
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: keyAgent.getVerificationKeyPair()
+    });
+    const keyResolver = async ({ id }) => {
+        if (id !== keyAgreementKey.id) {
+            throw new Error(`Unknown key id "${id}".`);
+        }
+        return {
+            id: keyAgreementKey.id,
+            type: keyAgreementKey.type,
+            publicKeyMultibase: keyAgreementKey.publicKeyMultibase
+        };
+    };
+    return {
+        keyAgreementKey: keyAgreementKey,
+        keyResolver
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAM7E;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAA;AAEjD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AACnC,MAAM,YAAY,GAAG,KAAK,CAAA;AAuB1B;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CACvB,MAAkB,EAClB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,MAAiC,EACjC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;KACrC,EACD,GAAG,EACH,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EACJ,YAAY,EACZ,SAAS,GAAG,kBAAkB,EAK/B;IACC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAA;IACF,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAiB,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QAClE,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;IACD,OAAO;QACL,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/identity/appSession.d.ts

@@ -0,0 +1,78 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The persisted app session: what a reload needs to restore the authenticated
+ * state with ZERO wallet popups, adapted to the RP model where the seed itself
+ * is persisted -- the wallet remains the recovery source of truth, this is only
+ * the hot cache.
+ *
+ * Record: `{ seed, controllerDid, serverUrl, spaceId, grants, expires }`.
+ * `expires` is the earliest `expires` across the granted zcaps; a record past
+ * it is cleared on load and the caller falls through to the returning-login
+ * flow (same seed comes back from the wallet, same DID, same vault keys).
+ *
+ * Persistence rides on a `SeedStore` (see `seedStore.ts`) the caller supplies.
+ */
+import type { IZcap } from '@interop/data-integrity-core';
+import type { SeedStore } from './seedStore.js';
+export interface AppSessionRecord {
+    controllerDid: string;
+    serverUrl: string;
+    spaceId: string;
+    grants: IZcap[];
+    /** ISO timestamp: the earliest expiry across the granted zcaps. */
+    expires: string;
+}
+/** A restored session: the record plus the separately persisted seed. */
+export interface RestoredAppSession extends AppSessionRecord {
+    seed: Uint8Array;
+}
+/** Whether an ISO `expires` timestamp is in the past (or malformed). */
+export declare function isExpired(expires: string, now?: Date): boolean;
+/**
+ * Whether an ISO `expires` timestamp is within `thresholdMs` of now (or already
+ * past, or malformed) -- the signal to surface the reconnect banner proactively,
+ * before a live request fails with 401/403.
+ */
+export declare function isNearExpiry(expires: string, thresholdMs: number, now?: Date): boolean;
+/**
+ * The earliest `expires` across a grant set. Grants without a parseable
+ * `expires` are ignored; returns `null` when none carries one (callers treat
+ * that as not restorable -- wallet grants always carry an expiry).
+ */
+export declare function earliestExpiry(grants: IZcap[]): string | null;
+/**
+ * Persists the session (seed + record) for hot restore.
+ *
+ * @param options {object}
+ * @param options.session {RestoredAppSession}
+ * @param options.store {SeedStore}
+ * @returns {Promise<void>}
+ */
+export declare function persistAppSession({ session, store }: {
+    session: RestoredAppSession;
+    store: SeedStore;
+}): Promise<void>;
+/**
+ * Restores the persisted session, or returns `null` (clearing any stale state)
+ * when it is missing, malformed, or expired.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<RestoredAppSession | null>}
+ */
+export declare function restoreAppSession({ store }: {
+    store: SeedStore;
+}): Promise<RestoredAppSession | null>;
+/**
+ * Wipes the persisted session (seed + record).
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<void>}
+ */
+export declare function clearAppSession({ store }: {
+    store: SeedStore;
+}): Promise<void>;
+//# sourceMappingURL=appSession.d.ts.map

package/dist/identity/appSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appSession.d.ts","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EACN,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAuBrC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB"}

package/dist/identity/appSession.js

@@ -0,0 +1,93 @@
+/** Whether an ISO `expires` timestamp is in the past (or malformed). */
+export function isExpired(expires, now = new Date()) {
+    const at = new Date(expires).getTime();
+    return Number.isNaN(at) || at <= now.getTime();
+}
+/**
+ * Whether an ISO `expires` timestamp is within `thresholdMs` of now (or already
+ * past, or malformed) -- the signal to surface the reconnect banner proactively,
+ * before a live request fails with 401/403.
+ */
+export function isNearExpiry(expires, thresholdMs, now = new Date()) {
+    const at = new Date(expires).getTime();
+    if (Number.isNaN(at)) {
+        return true;
+    }
+    return at - now.getTime() <= thresholdMs;
+}
+/**
+ * The earliest `expires` across a grant set. Grants without a parseable
+ * `expires` are ignored; returns `null` when none carries one (callers treat
+ * that as not restorable -- wallet grants always carry an expiry).
+ */
+export function earliestExpiry(grants) {
+    let earliest = null;
+    for (const grant of grants) {
+        const expires = grant.expires;
+        if (typeof expires !== 'string') {
+            continue;
+        }
+        const at = new Date(expires).getTime();
+        if (Number.isNaN(at)) {
+            continue;
+        }
+        if (earliest === null || at < new Date(earliest).getTime()) {
+            earliest = expires;
+        }
+    }
+    return earliest;
+}
+/**
+ * Persists the session (seed + record) for hot restore.
+ *
+ * @param options {object}
+ * @param options.session {RestoredAppSession}
+ * @param options.store {SeedStore}
+ * @returns {Promise<void>}
+ */
+export async function persistAppSession({ session, store }) {
+    const { seed, ...record } = session;
+    await store.saveSeed(seed);
+    await store.saveRecord(record);
+}
+/**
+ * Restores the persisted session, or returns `null` (clearing any stale state)
+ * when it is missing, malformed, or expired.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<RestoredAppSession | null>}
+ */
+export async function restoreAppSession({ store }) {
+    const [seed, stored] = await Promise.all([
+        store.loadSeed(),
+        store.loadRecord()
+    ]);
+    const record = stored;
+    if (!seed ||
+        !record ||
+        typeof record.controllerDid !== 'string' ||
+        typeof record.serverUrl !== 'string' ||
+        typeof record.spaceId !== 'string' ||
+        !Array.isArray(record.grants) ||
+        record.grants.length === 0 ||
+        typeof record.expires !== 'string') {
+        return null;
+    }
+    if (isExpired(record.expires)) {
+        await clearAppSession({ store });
+        return null;
+    }
+    return { seed, ...record };
+}
+/**
+ * Wipes the persisted session (seed + record).
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<void>}
+ */
+export async function clearAppSession({ store }) {
+    await store.clearSeedStore();
+}
+//# sourceMappingURL=appSession.js.map

package/dist/identity/appSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appSession.js","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAiCA,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,WAAW,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,QAAQ,GAAG,OAAO,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EAIN;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EAGN;IACC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,KAAK,CAAC,QAAQ,EAAE;QAChB,KAAK,CAAC,UAAU,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAiC,CAAA;IAChD,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EAGN;IACC,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;AAC9B,CAAC"}

package/dist/identity/documentLoader.d.ts

@@ -0,0 +1,20 @@
+/** The envelope shape returned for every resolved URL. */
+export type DocumentLoader = (url: string) => Promise<{
+    contextUrl: string | null;
+    document: unknown;
+    documentUrl: string;
+}>;
+/**
+ * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
+ * verifier-core verification. Same envelope shape as the base loader; the http
+ * did:web dev shim activates only when `wasServerUrl` is an http URL.
+ *
+ * @param [options] {object}
+ * @param [options.wasServerUrl] {string}   the configured WAS server URL; when
+ *   it is an http URL, did:web DIDs on that exact host are resolved over http
+ * @returns {DocumentLoader}
+ */
+export declare function createDocumentLoader({ wasServerUrl }?: {
+    wasServerUrl?: string;
+}): DocumentLoader;
+//# sourceMappingURL=documentLoader.d.ts.map

package/dist/identity/documentLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAeA,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AA6CF;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,YAAY,EACb,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CA+CtB"}

package/dist/identity/documentLoader.js

@@ -0,0 +1,99 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The app's one JSON-LD document loader: static security contexts plus did:key
+ * / did:web resolution (`@interop/security-document-loader`).
+ *
+ * Local-dev shim: the did:web method mandates https, but a local WAS server
+ * (which hosts the wallet's did:web documents) may run plain http. When the
+ * configured WAS server URL is http, DIDs on exactly that host are resolved over
+ * it; everything else falls through to the standard loader. In production
+ * (https server, or no server URL) the shim never engages.
+ */
+import { securityLoader } from '@interop/security-document-loader';
+const baseLoader = securityLoader({ fetchRemoteContexts: true }).build();
+/** Per-suite context for a dereferenced verification-method node. */
+const CONTEXT_BY_KEY_TYPE = {
+    Ed25519VerificationKey2020: 'https://w3id.org/security/suites/ed25519-2020/v1',
+    X25519KeyAgreementKey2020: 'https://w3id.org/security/suites/x25519-2020/v1',
+    Multikey: 'https://w3id.org/security/multikey/v1'
+};
+/** Dereferences a `#fragment` subnode the way did-web-resolver's getNode does. */
+function nodeOf(didDocument, id) {
+    const methods = (didDocument.verificationMethod ?? []);
+    let match = methods.find(vm => vm?.id === id);
+    if (!match) {
+        for (const [key, value] of Object.entries(didDocument)) {
+            if (key === '@context' || key === 'verificationMethod') {
+                continue;
+            }
+            if (Array.isArray(value)) {
+                match = value.find(entry => entry?.id === id);
+            }
+            else if (value?.id === id) {
+                match = value;
+            }
+            if (match) {
+                break;
+            }
+        }
+    }
+    if (!match) {
+        throw new Error(`DID document entity with id "${id}" not found.`);
+    }
+    const context = (match.type && CONTEXT_BY_KEY_TYPE[match.type]) ?? didDocument['@context'];
+    return { '@context': context, ...match };
+}
+/**
+ * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
+ * verifier-core verification. Same envelope shape as the base loader; the http
+ * did:web dev shim activates only when `wasServerUrl` is an http URL.
+ *
+ * @param [options] {object}
+ * @param [options.wasServerUrl] {string}   the configured WAS server URL; when
+ *   it is an http URL, did:web DIDs on that exact host are resolved over http
+ * @returns {DocumentLoader}
+ */
+export function createDocumentLoader({ wasServerUrl } = {}) {
+    /**
+     * Maps a did:web DID onto the local http WAS server's URL, or `null` when the
+     * DID does not live on that host (or the shim is not applicable).
+     */
+    function insecureDidWebUrl(didAuthority) {
+        if (!wasServerUrl || !wasServerUrl.startsWith('http://')) {
+            return null;
+        }
+        const server = new URL(wasServerUrl);
+        const segments = didAuthority.split(':');
+        // ['did', 'web', '<encoded host>', ...path]
+        const host = segments[2] ? decodeURIComponent(segments[2]) : '';
+        if (host !== server.host) {
+            return null;
+        }
+        const path = segments.slice(3).map(decodeURIComponent).join('/');
+        return `http://${host}/${path ? `${path}/did.json` : '.well-known/did.json'}`;
+    }
+    return async function documentLoader(url) {
+        if (url.startsWith('did:web:')) {
+            const [didAuthority = ''] = url.split(/[#?]/);
+            const fetchUrl = insecureDidWebUrl(didAuthority);
+            if (fetchUrl) {
+                const response = await fetch(fetchUrl);
+                if (!response.ok) {
+                    throw new Error(`Could not fetch the DID document at "${fetchUrl}" (status ${response.status}).`);
+                }
+                const didDocument = (await response.json());
+                if (didDocument.id !== didAuthority) {
+                    throw new Error(`DID document for "${didAuthority}" not found.`);
+                }
+                const document = url.includes('#')
+                    ? nodeOf(didDocument, url)
+                    : didDocument;
+                return { contextUrl: null, document, documentUrl: url };
+            }
+        }
+        return (await baseLoader(url));
+    };
+}
+//# sourceMappingURL=documentLoader.js.map

package/dist/identity/documentLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AASlE,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;AAExE,qEAAqE;AACrE,MAAM,mBAAmB,GAA2B;IAClD,0BAA0B,EACxB,kDAAkD;IACpD,yBAAyB,EAAE,iDAAiD;IAC5E,QAAQ,EAAE,uCAAuC;CAClD,CAAA;AAQD,kFAAkF;AAClF,SAAS,MAAM,CAAC,WAA4B,EAAE,EAAU;IACtD,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAsB,CAAA;IAC3E,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;gBACvD,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,GAAI,KAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACtE,CAAC;iBAAM,IAAK,KAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,KAAK,GAAG,KAAwB,CAAA;YAClC,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAA;IAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,YAAY,KAGV,EAAE;IACJ;;;OAGG;IACH,SAAS,iBAAiB,CAAC,YAAoB;QAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,4CAA4C;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/D,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChE,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,GAAW;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,CACjF,CAAA;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAA;gBAC9D,IAAI,WAAW,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,cAAc,CAAC,CAAA;gBAClE,CAAC;gBACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAChC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;oBAC1B,CAAC,CAAC,WAAW,CAAA;gBACf,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAA;YACzD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAI5B,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}