@openvtc/trust-tasks 0.28.2 → 0.28.4

package/dist/vta/did-templates/list/3.2/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/did-templates/list/3.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,EAAE,yBAAyB,IAAI,iBAAiB,EAAE,GAAG,EAAE,cAAc,IAAI,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,IAAI,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAG7P;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAE9G,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,MAAM,GAAG,IAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,GAAG,IAAW,CAAC;AAE/C,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,iEAA0E,CAAC;AAE5G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8RjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Q1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/vta/did-templates/list/3.2/payload.js

@@ -0,0 +1,619 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/did-templates/list/3.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/list/3.2";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS = "3.1";
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION = null;
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/list/3.2#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vta/did-templates/list/3.2",
+    "title": "VTA DID-Template List — payload",
+    "description": "List the DID templates in one scope on a VTA. Omit `contextId` to list the global templates (any authenticated caller); set it to list the templates scoped to that context (requires access to the context). The success response is the array of persisted DidTemplateRecords for the selected scope.",
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+        "contextId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Scope selector. Absent: the global scope. Present: the context whose templates are listed; the caller MUST have access to that context."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext",
+            "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA DID-Template List — response payload",
+            "description": "Every stored template in the selected scope, in an array.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "templates"
+            ],
+            "properties": {
+                "templates": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidTemplateRecord"
+                    },
+                    "description": "Every stored template in the selected scope, sorted by name; empty when none exist."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext",
+                    "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DidTemplateRecord": {
+            "title": "DidTemplateRecord",
+            "description": "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "schemaVersion",
+                "name",
+                "kind",
+                "document",
+                "scope",
+                "createdAt",
+                "updatedAt",
+                "createdBy"
+            ],
+            "properties": {
+                "schemaVersion": {
+                    "type": "integer",
+                    "enum": [
+                        1,
+                        2,
+                        3
+                    ],
+                    "description": "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others."
+                },
+                "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 64,
+                    "pattern": "^[a-z0-9-]+$"
+                },
+                "kind": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "description": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "maxLength": 1024
+                },
+                "methods": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "requiredVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "optionalVars": {
+                    "type": "object",
+                    "additionalProperties": true
+                },
+                "defaults": {
+                    "type": "object",
+                    "additionalProperties": true
+                },
+                "keys": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "additionalProperties": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "purpose",
+                            "algorithms"
+                        ],
+                        "properties": {
+                            "purpose": {
+                                "type": "string",
+                                "enum": [
+                                    "signing",
+                                    "keyAgreement"
+                                ],
+                                "description": "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree."
+                            },
+                            "algorithms": {
+                                "type": "array",
+                                "minItems": 1,
+                                "items": {
+                                    "type": "string",
+                                    "enum": [
+                                        "ed25519",
+                                        "x25519",
+                                        "p256",
+                                        "mldsa44",
+                                        "mldsa65"
+                                    ]
+                                },
+                                "description": "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to."
+                            }
+                        }
+                    },
+                    "propertyNames": {
+                        "pattern": "^[a-z0-9-]+$"
+                    },
+                    "description": "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal."
+                },
+                "keyRoles": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                        "$ref": "#/$defs/RoleLayout"
+                    },
+                    "description": "The key roles of a key-role identity, one `RoleLayout` per role (vta/dids/_shared/0.1/CONVENTIONS.md §4). REQUIRED for, and only for, `schemaVersion` 3, which then MUST NOT carry `keys`. A v3 template describes only an identity's non-key members: its `document` MUST NOT contain `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement`, `capabilityInvocation`, `capabilityDelegation` or `keyRoles`, and the VTA renders all of them from this layout and the key-role registry — so a template can never place a key in a relationship its role does not own. Each listed algorithm is minted, one key each; unlike v2's `keys`, the list is not a preference order, and a VTA that cannot mint one refuses rather than substitutes. Used by vta/dids/create; a v1 or v2 template cannot create a key-role identity."
+                },
+                "document": {
+                    "type": "object"
+                },
+                "scope": {
+                    "$ref": "#/$defs/Scope",
+                    "description": "Resolved scope of the stored template."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the template was first stored (RFC 3339)."
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the template was last written (RFC 3339)."
+                },
+                "createdBy": {
+                    "type": "string",
+                    "description": "DID of the admin who last wrote the template."
+                }
+            }
+        },
+        "Scope": {
+            "title": "Scope",
+            "description": "Where a stored template lives. Tagged by `type`.",
+            "type": "object",
+            "oneOf": [
+                {
+                    "title": "Builtin",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "builtin"
+                        }
+                    }
+                },
+                {
+                    "title": "Global",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "global"
+                        }
+                    }
+                },
+                {
+                    "title": "Context",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type",
+                        "contextId"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "context"
+                        },
+                        "contextId": {
+                            "type": "string",
+                            "minLength": 1
+                        }
+                    }
+                }
+            ]
+        },
+        "RoleLayout": {
+            "title": "RoleLayout",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "algorithms"
+            ],
+            "description": "The keys an identity is created with in one role (CONVENTIONS.md §4). A key-role DID template carries one per role; a creation request may narrow it but never widen it.",
+            "properties": {
+                "role": {
+                    "$ref": "#/$defs/IdentityKeyRole"
+                },
+                "algorithms": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/KeyType"
+                    },
+                    "description": "The algorithms to mint, one key each, in publication order — `[\"ed25519\", \"mldsa44\"]` mints a classical and a post-quantum attestation key that sign as a proof set. Every entry MUST suit the role (CONVENTIONS.md §2.2). A VTA that cannot mint one of them MUST refuse the creation with `vta/dids:unsupportedKeyType`; it never substitutes an algorithm or omits a key."
+                }
+            }
+        },
+        "IdentityKeyRole": {
+            "title": "IdentityKeyRole",
+            "type": "string",
+            "enum": [
+                "attestation",
+                "operational",
+                "messaging",
+                "update",
+                "authenticator"
+            ],
+            "description": "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074)."
+        },
+        "KeyType": {
+            "title": "KeyType",
+            "type": "string",
+            "enum": [
+                "ed25519",
+                "x25519",
+                "p256",
+                "mldsa44",
+                "mldsa65"
+            ],
+            "description": "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA DID-Template List — response payload",
+            "description": "Every stored template in the selected scope, in an array.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "templates"
+            ],
+            "properties": {
+                "templates": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidTemplateRecord"
+                    },
+                    "description": "Every stored template in the selected scope, sorted by name; empty when none exist."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext",
+                    "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DidTemplateRecord": {
+            "title": "DidTemplateRecord",
+            "description": "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "schemaVersion",
+                "name",
+                "kind",
+                "document",
+                "scope",
+                "createdAt",
+                "updatedAt",
+                "createdBy"
+            ],
+            "properties": {
+                "schemaVersion": {
+                    "type": "integer",
+                    "enum": [
+                        1,
+                        2,
+                        3
+                    ],
+                    "description": "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others."
+                },
+                "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 64,
+                    "pattern": "^[a-z0-9-]+$"
+                },
+                "kind": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "description": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "maxLength": 1024
+                },
+                "methods": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "requiredVars": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "optionalVars": {
+                    "type": "object",
+                    "additionalProperties": true
+                },
+                "defaults": {
+                    "type": "object",
+                    "additionalProperties": true
+                },
+                "keys": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "additionalProperties": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "purpose",
+                            "algorithms"
+                        ],
+                        "properties": {
+                            "purpose": {
+                                "type": "string",
+                                "enum": [
+                                    "signing",
+                                    "keyAgreement"
+                                ],
+                                "description": "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree."
+                            },
+                            "algorithms": {
+                                "type": "array",
+                                "minItems": 1,
+                                "items": {
+                                    "type": "string",
+                                    "enum": [
+                                        "ed25519",
+                                        "x25519",
+                                        "p256",
+                                        "mldsa44",
+                                        "mldsa65"
+                                    ]
+                                },
+                                "description": "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to."
+                            }
+                        }
+                    },
+                    "propertyNames": {
+                        "pattern": "^[a-z0-9-]+$"
+                    },
+                    "description": "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal."
+                },
+                "keyRoles": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                        "$ref": "#/$defs/RoleLayout"
+                    },
+                    "description": "The key roles of a key-role identity, one `RoleLayout` per role (vta/dids/_shared/0.1/CONVENTIONS.md §4). REQUIRED for, and only for, `schemaVersion` 3, which then MUST NOT carry `keys`. A v3 template describes only an identity's non-key members: its `document` MUST NOT contain `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement`, `capabilityInvocation`, `capabilityDelegation` or `keyRoles`, and the VTA renders all of them from this layout and the key-role registry — so a template can never place a key in a relationship its role does not own. Each listed algorithm is minted, one key each; unlike v2's `keys`, the list is not a preference order, and a VTA that cannot mint one refuses rather than substitutes. Used by vta/dids/create; a v1 or v2 template cannot create a key-role identity."
+                },
+                "document": {
+                    "type": "object"
+                },
+                "scope": {
+                    "$ref": "#/$defs/Scope",
+                    "description": "Resolved scope of the stored template."
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the template was first stored (RFC 3339)."
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the template was last written (RFC 3339)."
+                },
+                "createdBy": {
+                    "type": "string",
+                    "description": "DID of the admin who last wrote the template."
+                }
+            }
+        },
+        "Scope": {
+            "title": "Scope",
+            "description": "Where a stored template lives. Tagged by `type`.",
+            "type": "object",
+            "oneOf": [
+                {
+                    "title": "Builtin",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "builtin"
+                        }
+                    }
+                },
+                {
+                    "title": "Global",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "global"
+                        }
+                    }
+                },
+                {
+                    "title": "Context",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "type",
+                        "contextId"
+                    ],
+                    "properties": {
+                        "type": {
+                            "const": "context"
+                        },
+                        "contextId": {
+                            "type": "string",
+                            "minLength": 1
+                        }
+                    }
+                }
+            ]
+        },
+        "RoleLayout": {
+            "title": "RoleLayout",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "algorithms"
+            ],
+            "description": "The keys an identity is created with in one role (CONVENTIONS.md §4). A key-role DID template carries one per role; a creation request may narrow it but never widen it.",
+            "properties": {
+                "role": {
+                    "$ref": "#/$defs/IdentityKeyRole"
+                },
+                "algorithms": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/KeyType"
+                    },
+                    "description": "The algorithms to mint, one key each, in publication order — `[\"ed25519\", \"mldsa44\"]` mints a classical and a post-quantum attestation key that sign as a proof set. Every entry MUST suit the role (CONVENTIONS.md §2.2). A VTA that cannot mint one of them MUST refuse the creation with `vta/dids:unsupportedKeyType`; it never substitutes an algorithm or omits a key."
+                }
+            }
+        },
+        "IdentityKeyRole": {
+            "title": "IdentityKeyRole",
+            "type": "string",
+            "enum": [
+                "attestation",
+                "operational",
+                "messaging",
+                "update",
+                "authenticator"
+            ],
+            "description": "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074)."
+        },
+        "KeyType": {
+            "title": "KeyType",
+            "type": "string",
+            "enum": [
+                "ed25519",
+                "x25519",
+                "p256",
+                "mldsa44",
+                "mldsa65"
+            ],
+            "description": "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vta/did-templates/list/3.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/did-templates/list/3.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB,KAAK,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkB,IAAI,CAAC;AAK/C,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iEAA0E,CAAC;AAK5G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,wDAAwD;IAC/D,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,ySAAyS;IACxT,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,yIAAyI;SACzJ;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,2DAA2D;YAC1E,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,2BAA2B;qBACpC;oBACD,aAAa,EAAE,qFAAqF;iBACrG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;oBACrB,aAAa,EAAE,yDAAyD;iBACzE;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,aAAa,EAAE,0MAA0M;YACzN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,eAAe;gBACf,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE;wBACN,CAAC;wBACD,CAAC;wBACD,CAAC;qBACF;oBACD,aAAa,EAAE,8MAA8M;iBAC9N;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,cAAc;iBAC1B;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE;wBACN,QAAQ;wBACR,MAAM;qBACP;oBACD,WAAW,EAAE,IAAI;iBAClB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;iBACF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;iBACF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,IAAI;iBAC7B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,IAAI;iBAC7B;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,sBAAsB,EAAE;wBACtB,MAAM,EAAE,QAAQ;wBAChB,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE;4BACV,SAAS;4BACT,YAAY;yBACb;wBACD,YAAY,EAAE;4BACZ,SAAS,EAAE;gCACT,MAAM,EAAE,QAAQ;gCAChB,MAAM,EAAE;oCACN,SAAS;oCACT,cAAc;iCACf;gCACD,aAAa,EAAE,iPAAiP;6BACjQ;4BACD,YAAY,EAAE;gCACZ,MAAM,EAAE,OAAO;gCACf,UAAU,EAAE,CAAC;gCACb,OAAO,EAAE;oCACP,MAAM,EAAE,QAAQ;oCAChB,MAAM,EAAE;wCACN,SAAS;wCACT,QAAQ;wCACR,MAAM;wCACN,SAAS;wCACT,SAAS;qCACV;iCACF;gCACD,aAAa,EAAE,kqBAAkqB;6BAClrB;yBACF;qBACF;oBACD,eAAe,EAAE;wBACf,SAAS,EAAE,cAAc;qBAC1B;oBACD,aAAa,EAAE,68BAA68B;iBAC79B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,oBAAoB;qBAC7B;oBACD,aAAa,EAAE,kzBAAkzB;iBACl0B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;iBACjB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,eAAe;oBACvB,aAAa,EAAE,wCAAwC;iBACxD;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,gDAAgD;iBAChE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,gDAAgD;iBAChE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,+CAA+C;iBAC/D;aACF;SACF;QACD,OAAO,EAAE;YACP,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,kDAAkD;YACjE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP;oBACE,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,SAAS;yBACnB;qBACF;iBACF;gBACD;oBACE,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,QAAQ;yBAClB;qBACF;iBACF;gBACD;oBACE,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,SAAS;yBACnB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;yBACf;qBACF;iBACF;aACF;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,YAAY;aACb;YACD,aAAa,EAAE,0KAA0K;YACzL,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,MAAM,EAAE,yBAAyB;iBAClC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,iBAAiB;qBAC1B;oBACD,aAAa,EAAE,kXAAkX;iBAClY;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,aAAa;gBACb,aAAa;gBACb,WAAW;gBACX,QAAQ;gBACR,eAAe;aAChB;YACD,aAAa,EAAE,20DAA20D;SAC31D;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,SAAS;gBACT,SAAS;aACV;YACD,aAAa,EAAE,mhCAAmhC;SACniC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,2DAA2D;YAC1E,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,2BAA2B;qBACpC;oBACD,aAAa,EAAE,qFAAqF;iBACrG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;oBACrB,aAAa,EAAE,yDAAyD;iBACzE;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,aAAa,EAAE,0MAA0M;YACzN,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,eAAe;gBACf,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,OAAO;gBACP,WAAW;gBACX,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,eAAe,EAAE;oBACf,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE;wBACN,CAAC;wBACD,CAAC;wBACD,CAAC;qBACF;oBACD,aAAa,EAAE,8MAA8M;iBAC9N;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,cAAc;iBAC1B;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE;wBACN,QAAQ;wBACR,MAAM;qBACP;oBACD,WAAW,EAAE,IAAI;iBAClB;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;iBACF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;iBACF;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,IAAI;iBAC7B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,IAAI;iBAC7B;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,sBAAsB,EAAE;wBACtB,MAAM,EAAE,QAAQ;wBAChB,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE;4BACV,SAAS;4BACT,YAAY;yBACb;wBACD,YAAY,EAAE;4BACZ,SAAS,EAAE;gCACT,MAAM,EAAE,QAAQ;gCAChB,MAAM,EAAE;oCACN,SAAS;oCACT,cAAc;iCACf;gCACD,aAAa,EAAE,iPAAiP;6BACjQ;4BACD,YAAY,EAAE;gCACZ,MAAM,EAAE,OAAO;gCACf,UAAU,EAAE,CAAC;gCACb,OAAO,EAAE;oCACP,MAAM,EAAE,QAAQ;oCAChB,MAAM,EAAE;wCACN,SAAS;wCACT,QAAQ;wCACR,MAAM;wCACN,SAAS;wCACT,SAAS;qCACV;iCACF;gCACD,aAAa,EAAE,kqBAAkqB;6BAClrB;yBACF;qBACF;oBACD,eAAe,EAAE;wBACf,SAAS,EAAE,cAAc;qBAC1B;oBACD,aAAa,EAAE,68BAA68B;iBAC79B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,oBAAoB;qBAC7B;oBACD,aAAa,EAAE,kzBAAkzB;iBACl0B;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;iBACjB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,eAAe;oBACvB,aAAa,EAAE,wCAAwC;iBACxD;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,gDAAgD;iBAChE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,gDAAgD;iBAChE;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,+CAA+C;iBAC/D;aACF;SACF;QACD,OAAO,EAAE;YACP,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,kDAAkD;YACjE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP;oBACE,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,SAAS;yBACnB;qBACF;iBACF;gBACD;oBACE,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;qBACP;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,QAAQ;yBAClB;qBACF;iBACF;gBACD;oBACE,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,QAAQ;oBAChB,sBAAsB,EAAE,KAAK;oBAC7B,UAAU,EAAE;wBACV,MAAM;wBACN,WAAW;qBACZ;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,OAAO,EAAE,SAAS;yBACnB;wBACD,WAAW,EAAE;4BACX,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,CAAC;yBACf;qBACF;iBACF;aACF;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,YAAY;aACb;YACD,aAAa,EAAE,0KAA0K;YACzL,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,MAAM,EAAE,yBAAyB;iBAClC;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,iBAAiB;qBAC1B;oBACD,aAAa,EAAE,kXAAkX;iBAClY;aACF;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,aAAa;gBACb,aAAa;gBACb,WAAW;gBACX,QAAQ;gBACR,eAAe;aAChB;YACD,aAAa,EAAE,20DAA20D;SAC31D;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;gBACN,SAAS;gBACT,SAAS;aACV;YACD,aAAa,EAAE,mhCAAmhC;SACniC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}