@openvtc/trust-tasks 0.26.14 → 0.26.16

package/dist/rooms/revocations/put/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/rooms/revocations/put/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG/M;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,YAAY,EAAE,qBAAqB,CAAC;IACpC;;OAEG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAEtK,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAEjD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0RjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6P1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/rooms/revocations/put/0.1/payload.js

@@ -0,0 +1,583 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/revocations/put/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/revocations/put/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/revocations/put/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/rooms/revocations/put/0.1",
+    "title": "Rooms Revocations Put — payload",
+    "description": "An administrator of a room delivers the room's signed RevocationList to its host, which refuses every withdrawn credential from the moment it accepts the list.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "roomId",
+        "presentation",
+        "list"
+    ],
+    "properties": {
+        "roomId": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 512,
+            "description": "The room. MUST equal `list.roomId`."
+        },
+        "presentation": {
+            "$ref": "#/$defs/AuthorityPresentation",
+            "description": "Must confer the `admin` action at this room's scope, verified against the list the host already holds — not against the list being delivered. The list's authority is the room's signature on it; the presentation decides only who may make a host process one."
+        },
+        "list": {
+            "$ref": "#/$defs/RevocationList",
+            "description": "The room's signed, cumulative list. A host accepts it only under the rules of `RevocationList`: the room's own key, a higher sequence, and every live entry of the list it holds still present."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Rooms Revocations Put — response payload",
+            "description": "Success response to rooms/revocations/put. Type https://trusttasks.org/spec/rooms/revocations/put/0.1#response. The list the host now holds and enforces, and the moment from which it does.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "roomId",
+                "head",
+                "inForceAt"
+            ],
+            "properties": {
+                "roomId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                },
+                "head": {
+                    "$ref": "#/$defs/RevocationHead",
+                    "description": "The list the host holds after this request. Equal to the delivered list's head when it was accepted or was a repeat."
+                },
+                "inForceAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the host began refusing what the list withdraws. On a repeat, when it began refusing it the first time."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RevocationHead": {
+            "title": "RevocationHead",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "sequence",
+                "digest"
+            ],
+            "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+            "properties": {
+                "sequence": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "The list's `sequence`."
+                },
+                "digest": {
+                    "$ref": "#/$defs/DigestMultibase",
+                    "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+                }
+            }
+        },
+        "DigestMultibase": {
+            "title": "DigestMultibase",
+            "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+            "type": "string",
+            "minLength": 16,
+            "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+            "examples": [
+                "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+            ]
+        },
+        "RevocationList": {
+            "title": "RevocationList",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "roomId",
+                "sequence",
+                "issuedAt",
+                "entries",
+                "proof"
+            ],
+            "description": "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.",
+            "properties": {
+                "roomId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room."
+                },
+                "sequence": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room signed this list."
+                },
+                "entries": {
+                    "type": "array",
+                    "maxItems": 4096,
+                    "items": {
+                        "$ref": "#/$defs/RevocationEntry"
+                    },
+                    "description": "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence."
+                },
+                "proof": {
+                    "type": "object",
+                    "description": "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`."
+                }
+            }
+        },
+        "RevocationEntry": {
+            "title": "RevocationEntry",
+            "description": "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.",
+            "oneOf": [
+                {
+                    "$ref": "#/$defs/CredentialRevocation"
+                },
+                {
+                    "$ref": "#/$defs/SubjectRevocation"
+                },
+                {
+                    "$ref": "#/$defs/RoomRevocation"
+                }
+            ]
+        },
+        "RoomRevocation": {
+            "title": "RoomRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "revokedAt"
+            ],
+            "description": "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.",
+            "properties": {
+                "kind": {
+                    "const": "room"
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "SubjectRevocation": {
+            "title": "SubjectRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "subject",
+                "revokedAt"
+            ],
+            "description": "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.",
+            "properties": {
+                "kind": {
+                    "const": "subject"
+                },
+                "subject": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The party withdrawn. Never the room itself."
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "CredentialRevocation": {
+            "title": "CredentialRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "credentialId",
+                "revokedAt"
+            ],
+            "description": "Withdraws one credential — a membership credential or any authority link — by its `id`.",
+            "properties": {
+                "kind": {
+                    "const": "credential"
+                },
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 2048,
+                    "description": "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it."
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "AuthorityPresentation": {
+            "title": "AuthorityPresentation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "membership",
+                "authority"
+            ],
+            "description": "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.",
+            "properties": {
+                "membership": {
+                    "type": "string",
+                    "description": "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile."
+                },
+                "authority": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 8,
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent."
+                },
+                "subjectBinding": {
+                    "type": "string",
+                    "description": "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this."
+                }
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Rooms Revocations Put — response payload",
+            "description": "Success response to rooms/revocations/put. Type https://trusttasks.org/spec/rooms/revocations/put/0.1#response. The list the host now holds and enforces, and the moment from which it does.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "roomId",
+                "head",
+                "inForceAt"
+            ],
+            "properties": {
+                "roomId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                },
+                "head": {
+                    "$ref": "#/$defs/RevocationHead",
+                    "description": "The list the host holds after this request. Equal to the delivered list's head when it was accepted or was a repeat."
+                },
+                "inForceAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the host began refusing what the list withdraws. On a repeat, when it began refusing it the first time."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RevocationHead": {
+            "title": "RevocationHead",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "sequence",
+                "digest"
+            ],
+            "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+            "properties": {
+                "sequence": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "The list's `sequence`."
+                },
+                "digest": {
+                    "$ref": "#/$defs/DigestMultibase",
+                    "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+                }
+            }
+        },
+        "DigestMultibase": {
+            "title": "DigestMultibase",
+            "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+            "type": "string",
+            "minLength": 16,
+            "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+            "examples": [
+                "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+            ]
+        },
+        "RevocationList": {
+            "title": "RevocationList",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "roomId",
+                "sequence",
+                "issuedAt",
+                "entries",
+                "proof"
+            ],
+            "description": "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.",
+            "properties": {
+                "roomId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room."
+                },
+                "sequence": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back."
+                },
+                "issuedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room signed this list."
+                },
+                "entries": {
+                    "type": "array",
+                    "maxItems": 4096,
+                    "items": {
+                        "$ref": "#/$defs/RevocationEntry"
+                    },
+                    "description": "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence."
+                },
+                "proof": {
+                    "type": "object",
+                    "description": "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`."
+                }
+            }
+        },
+        "RevocationEntry": {
+            "title": "RevocationEntry",
+            "description": "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.",
+            "oneOf": [
+                {
+                    "$ref": "#/$defs/CredentialRevocation"
+                },
+                {
+                    "$ref": "#/$defs/SubjectRevocation"
+                },
+                {
+                    "$ref": "#/$defs/RoomRevocation"
+                }
+            ]
+        },
+        "RoomRevocation": {
+            "title": "RoomRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "revokedAt"
+            ],
+            "description": "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.",
+            "properties": {
+                "kind": {
+                    "const": "room"
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "SubjectRevocation": {
+            "title": "SubjectRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "subject",
+                "revokedAt"
+            ],
+            "description": "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.",
+            "properties": {
+                "kind": {
+                    "const": "subject"
+                },
+                "subject": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The party withdrawn. Never the room itself."
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "CredentialRevocation": {
+            "title": "CredentialRevocation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "credentialId",
+                "revokedAt"
+            ],
+            "description": "Withdraws one credential — a membership credential or any authority link — by its `id`.",
+            "properties": {
+                "kind": {
+                    "const": "credential"
+                },
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 2048,
+                    "description": "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it."
+                },
+                "revokedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the room made this withdrawal."
+                },
+                "until": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+                }
+            }
+        },
+        "AuthorityPresentation": {
+            "title": "AuthorityPresentation",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "membership",
+                "authority"
+            ],
+            "description": "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.",
+            "properties": {
+                "membership": {
+                    "type": "string",
+                    "description": "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile."
+                },
+                "authority": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 8,
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent."
+                },
+                "subjectBinding": {
+                    "type": "string",
+                    "description": "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this."
+                }
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/rooms/revocations/put/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/rooms/revocations/put/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6CH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,uDAAuD;IAC9D,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,iKAAiK;IAChL,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,QAAQ;QACR,cAAc;QACd,MAAM;KACP;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,qCAAqC;SACrD;QACD,cAAc,EAAE;YACd,MAAM,EAAE,+BAA+B;YACvC,aAAa,EAAE,kQAAkQ;SAClR;QACD,MAAM,EAAE;YACN,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,iMAAiM;SACjN;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,8LAA8L;YAC7M,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;gBACR,MAAM;gBACN,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,wBAAwB;oBAChC,aAAa,EAAE,sHAAsH;iBACtI;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8GAA8G;iBAC9H;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,mLAAmL;YAClM,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,wBAAwB;iBACxC;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,uMAAuM;iBACvN;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,SAAS;gBACT,OAAO;aACR;YACD,aAAa,EAAE,i7EAAi7E;YACh8E,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oIAAoI;iBACpJ;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6RAA6R;iBAC7S;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iCAAiC;iBACjD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE;wBACP,MAAM,EAAE,yBAAyB;qBAClC;oBACD,aAAa,EAAE,mLAAmL;iBACnM;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,+HAA+H;iBAC/I;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,grDAAgrD;YAC/rD,OAAO,EAAE;gBACP;oBACE,MAAM,EAAE,8BAA8B;iBACvC;gBACD;oBACE,MAAM,EAAE,2BAA2B;iBACpC;gBACD;oBACE,MAAM,EAAE,wBAAwB;iBACjC;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,WAAW;aACZ;YACD,aAAa,EAAE,6FAA6F;YAC5G,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM;iBAChB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,SAAS;gBACT,WAAW;aACZ;YACD,aAAa,EAAE,qHAAqH;YACpI,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,SAAS;iBACnB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6CAA6C;iBAC7D;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,cAAc;gBACd,WAAW;aACZ;YACD,aAAa,EAAE,yFAAyF;YACxG,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,iKAAiK;iBACjL;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,uBAAuB,EAAE;YACvB,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;gBACZ,WAAW;aACZ;YACD,aAAa,EAAE,giEAAgiE;YAC/iE,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;oBACD,aAAa,EAAE,odAAod;iBACpe;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mYAAmY;iBACnZ;aACF;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,8LAA8L;YAC7M,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;gBACR,MAAM;gBACN,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,wBAAwB;oBAChC,aAAa,EAAE,sHAAsH;iBACtI;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8GAA8G;iBAC9H;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,mLAAmL;YAClM,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,wBAAwB;iBACxC;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,uMAAuM;iBACvN;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,SAAS;gBACT,OAAO;aACR;YACD,aAAa,EAAE,i7EAAi7E;YACh8E,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,oIAAoI;iBACpJ;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6RAA6R;iBAC7S;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iCAAiC;iBACjD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE;wBACP,MAAM,EAAE,yBAAyB;qBAClC;oBACD,aAAa,EAAE,mLAAmL;iBACnM;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,+HAA+H;iBAC/I;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,grDAAgrD;YAC/rD,OAAO,EAAE;gBACP;oBACE,MAAM,EAAE,8BAA8B;iBACvC;gBACD;oBACE,MAAM,EAAE,2BAA2B;iBACpC;gBACD;oBACE,MAAM,EAAE,wBAAwB;iBACjC;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,WAAW;aACZ;YACD,aAAa,EAAE,6FAA6F;YAC5G,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM;iBAChB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,SAAS;gBACT,WAAW;aACZ;YACD,aAAa,EAAE,qHAAqH;YACpI,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,SAAS;iBACnB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,6CAA6C;iBAC7D;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,cAAc;gBACd,WAAW;aACZ;YACD,aAAa,EAAE,yFAAyF;YACxG,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,iKAAiK;iBACjL;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qCAAqC;iBACrD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,qOAAqO;iBACrP;aACF;SACF;QACD,uBAAuB,EAAE;YACvB,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;gBACZ,WAAW;aACZ;YACD,aAAa,EAAE,giEAAgiE;YAC/iE,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;oBACD,aAAa,EAAE,odAAod;iBACpe;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mYAAmY;iBACnZ;aACF;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}