@openvtc/trust-tasks 0.12.16 → 0.13.0

package/dist/_runtime/index.d.ts

@@ -12,5 +12,8 @@
 export { TRUST_TASK_ERROR_TYPE_URI, enforceAudienceBinding, enforceSpecPolicy, rejectWith, rejectWithRecipient, respondWith, toErrorPayload, validateBasic, type ErrorPayload, type ErrorResponse, type InResponseTo, type Proof, type RejectReason, type SpecPolicy, type TrustTaskDocument, } from "./document.js";
 export { STANDARD_CODES, extendedCode, familyCode, isStandardCode, normalizeCode, slugFromTypeUri, type StandardCode, } from "./codes.js";
 export { StaticTransport, UnauthenticatedTransport, identityMismatchReason, reject, resolveParties, type ConsistencyError, type ResolvedParties, type TransportContext, type TransportHandler, } from "./transport.js";
-export { PROOF_NOT_ACCEPTED_BY_POLICY, consumeInbound, refuse, type ConsumeOptions, type ConsumeOutcome, type PayloadPolicy, type PayloadValidator, type ProofPolicy, type ProofVerifier, } from "./consume.js";
+export { ID_CONFLICT_WIRE_MESSAGE, PROOF_INVALID_WIRE_MESSAGE, PROOF_NOT_ACCEPTED_BY_POLICY, REPLAY_RECORD_UNAVAILABLE, consequentialChecks, consumeInbound, notConsequentialChecks, refuse, type ConsumeChecks, type ConsumeOptions, type ConsumeOutcome, type PayloadPolicy, type PayloadValidator, type ProofPolicy, type ProofVerifier, } from "./consume.js";
+export { canonicalJson, sha256Hex } from "./canonical.js";
+export { CONSEQUENTIAL_FRESHNESS, DEFAULT_FRESHNESS, DEFAULT_MAX_AGE_MS, DEFAULT_SKEW_MS, EXPIRY_NOT_AFTER_ISSUANCE, FUTURE_ISSUED_AT, ISSUED_AT_REQUIRED, STALE_WIRE_MESSAGE, recordExpiry, validateFreshness, type FreshnessPolicy, } from "./freshness.js";
+export { InMemoryReplayGuard, documentDigest, type ReplayGuard, type ReplayPolicy, type ReplayVerdict, } from "./replay.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/_runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}

package/dist/_runtime/index.js

@@ -12,5 +12,8 @@
 export { TRUST_TASK_ERROR_TYPE_URI, enforceAudienceBinding, enforceSpecPolicy, rejectWith, rejectWithRecipient, respondWith, toErrorPayload, validateBasic, } from "./document.js";
 export { STANDARD_CODES, extendedCode, familyCode, isStandardCode, normalizeCode, slugFromTypeUri, } from "./codes.js";
 export { StaticTransport, UnauthenticatedTransport, identityMismatchReason, reject, resolveParties, } from "./transport.js";
-export { PROOF_NOT_ACCEPTED_BY_POLICY, consumeInbound, refuse, } from "./consume.js";
+export { ID_CONFLICT_WIRE_MESSAGE, PROOF_INVALID_WIRE_MESSAGE, PROOF_NOT_ACCEPTED_BY_POLICY, REPLAY_RECORD_UNAVAILABLE, consequentialChecks, consumeInbound, notConsequentialChecks, refuse, } from "./consume.js";
+export { canonicalJson, sha256Hex } from "./canonical.js";
+export { CONSEQUENTIAL_FRESHNESS, DEFAULT_FRESHNESS, DEFAULT_MAX_AGE_MS, DEFAULT_SKEW_MS, EXPIRY_NOT_AFTER_ISSUANCE, FUTURE_ISSUED_AT, ISSUED_AT_REQUIRED, STALE_WIRE_MESSAGE, recordExpiry, validateFreshness, } from "./freshness.js";
+export { InMemoryReplayGuard, documentDigest, } from "./replay.js";
 //# sourceMappingURL=index.js.map

package/dist/_runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,MAAM,GAOP,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,GAQP,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,aAAa,CAAC"}

package/dist/_runtime/replay.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Duplicate-execution protection — SPEC §7.2 item 11, §8.4, §10.1.
+ *
+ * Mirrors `replay.rs` in trust-tasks-rs, check for check.
+ *
+ * # The rule
+ *
+ * §7.2 item 11 is normative and unconditional for a *consequential Trust
+ * Task*: once a consumer has accepted a document with a given `id` for
+ * execution, receiving that same document again **MUST NOT** cause the
+ * consequential effect a second time, and receiving a *different* document
+ * under the same `id` **MUST** be rejected with `idConflict`.
+ *
+ * §8.4 is the same mechanism from the producer's end: a retry is a bit-for-bit
+ * identical resend, and it is safe *precisely because* item 11 obliges the
+ * consumer to absorb it. Every transport binding in this repo delegates replay
+ * defence to the consumer — `bindings/https/0.2` §5 says "Freshness / replay:
+ * None", and the DIDComm and TSP bindings say the same — so if the consumer
+ * does not do it, nobody does, and an ordinary mediator redelivery grants an
+ * ACL entry twice by accident. §10.1: "The rule deliberately does not
+ * distinguish a hostile replay from a legitimate transport retry, because at
+ * the document layer the two are indistinguishable."
+ *
+ * # The key
+ *
+ * The `id` **alone** — "Transport request identifiers, transport message
+ * identifiers, and execution handles **MUST NOT** substitute" — plus a digest
+ * of the canonical serialization, because "an `id` alone cannot distinguish
+ * the retry it must absorb from the conflict it must reject".
+ *
+ * {@link documentDigest} hashes {@link canonicalJson} of the whole document
+ * rather than the octets as received: a re-indented body or a member order
+ * chosen by an intermediary would otherwise make a legitimate §8.4 retry look
+ * like a *different* document.
+ *
+ * The digest covers the **entire** document, `proof` included. That differs
+ * deliberately from the §4.9.3 *task digest*, computed over
+ * `JCS(document ∖ proof)`, and the spec spells the distinction out: "Item 11
+ * and §8.4 ask *which serialization arrived*, so a re-signed `proof` over
+ * identical content makes a different document — that is the `idConflict`
+ * case, and the distinction is the whole point of the rule."
+ */
+import type { TrustTaskDocument } from "./document.js";
+/**
+ * The content identity of a document, per SPEC §7.2's keying paragraph:
+ * SHA-256 over the canonical serialization of the whole document, as hex.
+ *
+ * Consumer-local. Never on the wire, and **not** the §4.9.3 task digest.
+ */
+export declare function documentDigest<P>(doc: TrustTaskDocument<P>): string;
+/** What a {@link ReplayGuard} says about a document offered for execution. */
+export type ReplayVerdict = 
+/** Not seen before. The caller may execute. */
+{
+    kind: "fresh";
+}
+/**
+ * Already accepted under the *same* digest — a §8.4 retry, or a replay. The
+ * caller **MUST NOT** execute again.
+ */
+ | {
+    kind: "duplicate";
+    /** The response the first execution produced, where one was retained. */
+    priorResponse?: unknown;
+    /** Whether that first execution is still running. */
+    inFlight: boolean;
+}
+/**
+ * Already accepted under a *different* digest. §7.2 item 11 requires
+ * `idConflict`, and requires that this not be treated as a retry.
+ */
+ | {
+    kind: "conflict";
+};
+/**
+ * The consumer-side record that makes SPEC §7.2 item 11 true.
+ *
+ * An interface, so a deployment can back it with Redis, Postgres, or anything
+ * that survives a process restart. {@link InMemoryReplayGuard} is the default
+ * and is correct for a single-process consumer; it is **not** correct behind a
+ * load balancer, where two replicas would each accept the same document once.
+ */
+export interface ReplayGuard {
+    /**
+     * Claim `id` for execution on behalf of a document with identity `digest`.
+     *
+     * `retainUntil` is the instant past which the record may be dropped —
+     * {@link recordExpiry}, which SPEC §7.2 makes the same instant as the end of
+     * the consumer's willingness to execute the document. An implementation
+     * SHOULD treat a record whose `retainUntil` has passed as absent, so the key
+     * is released rather than conflicting forever with a document nobody would
+     * execute.
+     *
+     * Implementations **MUST** make claim-and-record atomic with respect to
+     * concurrent calls: two simultaneous deliveries of the same document must
+     * not both receive `fresh`. That is the whole guarantee.
+     *
+     * Throwing means the record could not be consulted. {@link consumeInbound}
+     * fails closed on that, mapping it to `unavailable` with `retryable: true` —
+     * a consumer that cannot establish whether a document is a duplicate has not
+     * satisfied item 11, and executing anyway is the double execution the rule
+     * forbids.
+     */
+    claim(id: string, digest: string, retainUntil: number | undefined, now: number): Promise<ReplayVerdict> | ReplayVerdict;
+    /**
+     * Attach the response a completed execution produced, so a later duplicate
+     * can be answered with it per §7.2 (*Disposition of a duplicate*) rather
+     * than merely absorbed in silence.
+     *
+     * Optional: a guard that records nothing still satisfies item 11 — the
+     * effect does not happen twice — and is the right shape for a
+     * fire-and-forget specification, which has no response to return.
+     */
+    recordResponse?(id: string, response: unknown): Promise<void> | void;
+    /**
+     * Release a claim whose execution is not to stand — for example a refusal
+     * the consumer marked `retryable`, where §8.4 has just invited the producer
+     * to re-send the same bytes. Without this, that invited retry would come
+     * back as an absorbed duplicate carrying the same failure forever.
+     */
+    release?(id: string, digest: string): Promise<void> | void;
+}
+/** How a consumer applies SPEC §7.2 item 11 in {@link consumeInbound}. */
+export type ReplayPolicy = 
+/** Apply item 11 using this guard. Correct for any consequential spec. */
+{
+    kind: "guard";
+    guard: ReplayGuard;
+}
+/**
+ * Keep no duplicate-execution record. Conformant **only** where the task is
+ * not consequential (§2), or where the specification "explicitly declares
+ * repeated execution safe and intended" — a property of the operation, not
+ * of the consumer's convenience.
+ */
+ | {
+    kind: "notConsequential";
+};
+/**
+ * A bounded, in-process {@link ReplayGuard}: an LRU map from `id` to the
+ * digest accepted under it, its retention deadline, and the response it
+ * produced.
+ *
+ * **Suitable when** one process is the sole consumer for the `recipient` VID
+ * it serves and losing the record on restart is acceptable.
+ *
+ * **Not suitable when** the consumer is replicated: two replicas hold separate
+ * maps, so a document accepted by replica A is `fresh` at replica B and the
+ * effect happens twice — the exact failure item 11 exists to prevent.
+ * Replicated deployments MUST back the guard with a shared store.
+ *
+ * Eviction is by capacity as well as by `retainUntil`: a burst of distinct
+ * documents can push an older record out before its deadline, and a replay
+ * arriving after that would be accepted. Size the capacity above the number of
+ * distinct documents the widest acceptance window can hold.
+ *
+ * `Map` preserves insertion order, which is what makes the LRU a delete-then-
+ * reinsert rather than a second index.
+ */
+export declare class InMemoryReplayGuard implements ReplayGuard {
+    #private;
+    /**
+     * @param capacity Maximum records retained. Must be positive: a guard that
+     * retains nothing answers `fresh` to everything, which is a silent total
+     * defeat of item 11 rather than a visible misconfiguration.
+     */
+    constructor(capacity?: number);
+    /** Number of records currently retained. For tests and metrics. */
+    get size(): number;
+    /** Drop every record whose `retainUntil` has passed. */
+    purgeExpired(now: number): void;
+    claim(id: string, digest: string, retainUntil: number | undefined, now: number): ReplayVerdict;
+    recordResponse(id: string, response: unknown): void;
+    release(id: string, digest: string): void;
+}
+//# sourceMappingURL=replay.d.ts.map

package/dist/_runtime/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/_runtime/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAEnE;AAED,8EAA8E;AAC9E,MAAM,MAAM,aAAa;AACvB,+CAA+C;AAC7C;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE;AACnB;;;GAGG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;CACnB;AACH;;;GAGG;GACD;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACH,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;IAE1C;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAErE;;;;;OAKG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,0EAA0E;AAC1E,MAAM,MAAM,YAAY;AACtB,0EAA0E;AACxE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE;AACvC;;;;;GAKG;GACD;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,CAAC;AASjC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD;;;;OAIG;gBACS,QAAQ,SAAS;IAO7B,mEAAmE;IACnE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,wDAAwD;IACxD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM/B,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa;IAgC9F,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAOnD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAS1C"}

package/dist/_runtime/replay.js

@@ -0,0 +1,147 @@
+/**
+ * Duplicate-execution protection — SPEC §7.2 item 11, §8.4, §10.1.
+ *
+ * Mirrors `replay.rs` in trust-tasks-rs, check for check.
+ *
+ * # The rule
+ *
+ * §7.2 item 11 is normative and unconditional for a *consequential Trust
+ * Task*: once a consumer has accepted a document with a given `id` for
+ * execution, receiving that same document again **MUST NOT** cause the
+ * consequential effect a second time, and receiving a *different* document
+ * under the same `id` **MUST** be rejected with `idConflict`.
+ *
+ * §8.4 is the same mechanism from the producer's end: a retry is a bit-for-bit
+ * identical resend, and it is safe *precisely because* item 11 obliges the
+ * consumer to absorb it. Every transport binding in this repo delegates replay
+ * defence to the consumer — `bindings/https/0.2` §5 says "Freshness / replay:
+ * None", and the DIDComm and TSP bindings say the same — so if the consumer
+ * does not do it, nobody does, and an ordinary mediator redelivery grants an
+ * ACL entry twice by accident. §10.1: "The rule deliberately does not
+ * distinguish a hostile replay from a legitimate transport retry, because at
+ * the document layer the two are indistinguishable."
+ *
+ * # The key
+ *
+ * The `id` **alone** — "Transport request identifiers, transport message
+ * identifiers, and execution handles **MUST NOT** substitute" — plus a digest
+ * of the canonical serialization, because "an `id` alone cannot distinguish
+ * the retry it must absorb from the conflict it must reject".
+ *
+ * {@link documentDigest} hashes {@link canonicalJson} of the whole document
+ * rather than the octets as received: a re-indented body or a member order
+ * chosen by an intermediary would otherwise make a legitimate §8.4 retry look
+ * like a *different* document.
+ *
+ * The digest covers the **entire** document, `proof` included. That differs
+ * deliberately from the §4.9.3 *task digest*, computed over
+ * `JCS(document ∖ proof)`, and the spec spells the distinction out: "Item 11
+ * and §8.4 ask *which serialization arrived*, so a re-signed `proof` over
+ * identical content makes a different document — that is the `idConflict`
+ * case, and the distinction is the whole point of the rule."
+ */
+import { canonicalJson, sha256Hex } from "./canonical.js";
+/**
+ * The content identity of a document, per SPEC §7.2's keying paragraph:
+ * SHA-256 over the canonical serialization of the whole document, as hex.
+ *
+ * Consumer-local. Never on the wire, and **not** the §4.9.3 task digest.
+ */
+export function documentDigest(doc) {
+    return sha256Hex(canonicalJson(doc));
+}
+/**
+ * A bounded, in-process {@link ReplayGuard}: an LRU map from `id` to the
+ * digest accepted under it, its retention deadline, and the response it
+ * produced.
+ *
+ * **Suitable when** one process is the sole consumer for the `recipient` VID
+ * it serves and losing the record on restart is acceptable.
+ *
+ * **Not suitable when** the consumer is replicated: two replicas hold separate
+ * maps, so a document accepted by replica A is `fresh` at replica B and the
+ * effect happens twice — the exact failure item 11 exists to prevent.
+ * Replicated deployments MUST back the guard with a shared store.
+ *
+ * Eviction is by capacity as well as by `retainUntil`: a burst of distinct
+ * documents can push an older record out before its deadline, and a replay
+ * arriving after that would be accepted. Size the capacity above the number of
+ * distinct documents the widest acceptance window can hold.
+ *
+ * `Map` preserves insertion order, which is what makes the LRU a delete-then-
+ * reinsert rather than a second index.
+ */
+export class InMemoryReplayGuard {
+    #entries = new Map();
+    #capacity;
+    /**
+     * @param capacity Maximum records retained. Must be positive: a guard that
+     * retains nothing answers `fresh` to everything, which is a silent total
+     * defeat of item 11 rather than a visible misconfiguration.
+     */
+    constructor(capacity = 10_000) {
+        if (!Number.isInteger(capacity) || capacity < 1) {
+            throw new RangeError("InMemoryReplayGuard capacity must be a positive integer");
+        }
+        this.#capacity = capacity;
+    }
+    /** Number of records currently retained. For tests and metrics. */
+    get size() {
+        return this.#entries.size;
+    }
+    /** Drop every record whose `retainUntil` has passed. */
+    purgeExpired(now) {
+        for (const [id, entry] of this.#entries) {
+            if (entry.retainUntil !== undefined && entry.retainUntil <= now)
+                this.#entries.delete(id);
+        }
+    }
+    claim(id, digest, retainUntil, now) {
+        const existing = this.#entries.get(id);
+        // An expired record is treated as absent: the consumer would refuse the
+        // document under §7.2 item 4 or the acceptance window anyway, so holding
+        // the key would only manufacture a permanent `idConflict` for an `id`
+        // nobody can use.
+        if (existing !== undefined && existing.retainUntil !== undefined && existing.retainUntil <= now) {
+            this.#entries.delete(id);
+        }
+        else if (existing !== undefined) {
+            if (existing.digest !== digest) {
+                // A conflicting document is not a *use* of the record, so it does not
+                // refresh recency — otherwise a flood of conflicts could pin an entry
+                // and evict live ones.
+                return { kind: "conflict" };
+            }
+            this.#entries.delete(id);
+            this.#entries.set(id, existing);
+            return existing.response === undefined
+                ? { kind: "duplicate", inFlight: !existing.completed }
+                : { kind: "duplicate", priorResponse: existing.response, inFlight: !existing.completed };
+        }
+        this.#entries.set(id, { digest, retainUntil, response: undefined, completed: false });
+        while (this.#entries.size > this.#capacity) {
+            const oldest = this.#entries.keys().next();
+            if (oldest.done === true)
+                break;
+            this.#entries.delete(oldest.value);
+        }
+        return { kind: "fresh" };
+    }
+    recordResponse(id, response) {
+        const entry = this.#entries.get(id);
+        if (entry === undefined)
+            return;
+        entry.response = response;
+        entry.completed = true;
+    }
+    release(id, digest) {
+        const entry = this.#entries.get(id);
+        // Only release the claim this digest made, and only while it is
+        // unfinished: a concurrent arrival that legitimately holds the key must
+        // not have it taken away by another document's cleanup.
+        if (entry !== undefined && entry.digest === digest && !entry.completed) {
+            this.#entries.delete(id);
+        }
+    }
+}
+//# sourceMappingURL=replay.js.map

package/dist/_runtime/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../src/_runtime/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG1D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAI,GAAyB;IACzD,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAkGD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,SAAS,CAAS;IAE3B;;;;OAIG;IACH,YAAY,QAAQ,GAAG,MAAM;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,UAAU,CAAC,yDAAyD,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,GAAW;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,MAAc,EAAE,WAA+B,EAAE,GAAW;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEvC,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,kBAAkB;QAClB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;YAChG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,sEAAsE;gBACtE,sEAAsE;gBACtE,uBAAuB;gBACvB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC,QAAQ,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE;gBACtD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,EAAU,EAAE,QAAiB;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,MAAc;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,gEAAgE;QAChE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/keys/create/0.1/payload.d.ts

@@ -15,15 +15,21 @@ export type KeyType1 = "ed25519" | "x25519" | "p256";
  */
 export type KeyStatus = "active" | "revoked";
 /**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
  */
-export type KeyOrigin = "derived" | "imported";
+export type KeyOrigin = "derived" | "imported" | "internal";
 export interface KeysCreatePayload {
     keyType: KeyType;
     /**
-     * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian.
+     * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.
      */
     derivationPath?: string;
+    /**
+     * Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.
+     *
+     * A maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal.
+     */
+    internal?: boolean;
     /**
      * BIP-39 phrase to derive from instead of the custodian's own seed. Supplying it makes this an import of externally-generated seed material wearing create's clothes: the phrase reconstitutes the key anywhere, so it is secret-bearing in exactly the way the rest of this payload is not. A custodian MUST refuse it on any transport that is not end-to-end confidential, for the reason `keys/import` refuses its cleartext carrier, and MUST NOT log or echo it.
      */
@@ -129,7 +135,11 @@ export declare const PAYLOAD_SCHEMA: {
         };
         readonly derivationPath: {
             readonly type: "string";
-            readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian.";
+            readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.";
+        };
+        readonly internal: {
+            readonly type: "boolean";
+            readonly description: "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal.";
         };
         readonly mnemonic: {
             readonly type: "string";
@@ -236,8 +246,8 @@ export declare const PAYLOAD_SCHEMA: {
         readonly KeyOrigin: {
             readonly title: "KeyOrigin";
             readonly type: "string";
-            readonly enum: readonly ["derived", "imported"];
-            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
             readonly default: "derived";
         };
         readonly KeyStatus: {
@@ -346,8 +356,8 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
         readonly KeyOrigin: {
             readonly title: "KeyOrigin";
             readonly type: "string";
-            readonly enum: readonly ["derived", "imported"];
-            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
             readonly default: "derived";
         };
         readonly KeyStatus: {
@@ -389,7 +399,11 @@ export declare const SPEC: {
             };
             readonly derivationPath: {
                 readonly type: "string";
-                readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian.";
+                readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.";
+            };
+            readonly internal: {
+                readonly type: "boolean";
+                readonly description: "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal.";
             };
             readonly mnemonic: {
                 readonly type: "string";
@@ -496,8 +510,8 @@ export declare const SPEC: {
             readonly KeyOrigin: {
                 readonly title: "KeyOrigin";
                 readonly type: "string";
-                readonly enum: readonly ["derived", "imported"];
-                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
                 readonly default: "derived";
             };
             readonly KeyStatus: {
@@ -616,8 +630,8 @@ export declare const RESPONSE_SPEC: {
             readonly KeyOrigin: {
                 readonly title: "KeyOrigin";
                 readonly type: "string";
-                readonly enum: readonly ["derived", "imported"];
-                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
                 readonly default: "derived";
             };
             readonly KeyStatus: {

package/dist/keys/create/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8JjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmKjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}

package/dist/keys/create/0.1/payload.js

@@ -31,7 +31,11 @@ export const PAYLOAD_SCHEMA = {
         },
         "derivationPath": {
             "type": "string",
-            "description": "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian."
+            "description": "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it."
+        },
+        "internal": {
+            "type": "boolean",
+            "description": "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal."
         },
         "mnemonic": {
             "type": "string",
@@ -148,9 +152,10 @@ export const PAYLOAD_SCHEMA = {
             "type": "string",
             "enum": [
                 "derived",
-                "imported"
+                "imported",
+                "internal"
             ],
-            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.",
+            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.",
             "default": "derived"
         },
         "KeyStatus": {
@@ -276,9 +281,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "type": "string",
             "enum": [
                 "derived",
-                "imported"
+                "imported",
+                "internal"
             ],
-            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.",
+            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.",
             "default": "derived"
         },
         "KeyStatus": {

package/dist/keys/create/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAK/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC;AAKjG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6CAA6C;IACpD,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;KACV;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB;YACzB,aAAa,EAAE,wBAAwB;SACxC;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,sMAAsM;SACtN;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,scAAsc;SACtd;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,yDAAyD;SACzE;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iHAAiH;SACjI;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;aACX;YACD,aAAa,EAAE,kXAAkX;YACjY,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;aACX;YACD,aAAa,EAAE,kXAAkX;YACjY,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAK/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC;AAKjG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6CAA6C;IACpD,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;KACV;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB;YACzB,aAAa,EAAE,wBAAwB;SACxC;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iXAAiX;SACjY;QACD,UAAU,EAAE;YACV,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,ssCAAssC;SACttC;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,scAAsc;SACtd;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,yDAAyD;SACzE;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iHAAiH;SACjI;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}