keri-ts 2.0.1 → 2.2.0

package/types/app/ipex/group-issuance.d.ts

@@ -0,0 +1,281 @@
+/**
+ * Group DH issuance steps for the runtime's `IssuanceOperations` owner.
+ *
+ * A local group issues (or receives) a v2 DH credential through the same live table, status read and wait as an
+ * individual. This module holds what is specific to a group: the explicit consent calls, the per-operation
+ * state machine that `IssuanceOperations.processOnce` advances, and the child handler that lets the
+ * `/multisig/qry` and `/multisig/rpy` wrappers of DH reach it.
+ *
+ * Consent (the only calls that sign, each returning after local commit without waiting on a member):
+ *
+ * | who                           | call                                      | what it signs                                       |
+ * | ----------------------------- | ----------------------------------------- | --------------------------------------------------- |
+ * | issuer custodian, prepare     | {@link prepareGroupIssuance}              | the custodian's contribution to a fresh Grant       |
+ * | issuer custodian, one consent | {@link proposeGroupIssuance}              | prepare, then approve its own proposal              |
+ * | issuer member                 | {@link approveGroupIssuance}              | this member's Grant contribution, and consent to its later DH query contribution |
+ * | holder custodian or member    | {@link approveGroupIssuanceExchange}      | consent to DH (contributions follow as they arrive) |
+ * | a member that only follows    | {@link followGroupIssuanceProof}          | nothing; verifies the custodian's final proof       |
+ *
+ * The registry update is a separate consent: the custodian proposes the BUP through `proposeRegistryEvent`
+ * (its own contribution is its approval) and every other issuer member approves that proposal with
+ * `approveGroupProposal`. Admit is a separate consent as well.
+ *
+ * Automatic, inside `processOnce`: sending a member's own proposal, authenticating the Grant, approving DH once
+ * the Grant is authenticated, the custodian's evidence, query and reply traffic, wrapper intake, finishing the
+ * Grant and the proof broadcast to the other members. Root copies are not sent here: the DH completion cue
+ * feeds the runtime's `RootReplicator`, which sends exactly one copy per member.
+ *
+ * Reload: nothing about a group operation is durable but the protocol stores. A member that reloads reads
+ * `awaitingExchangeConsent` for a pending Grant it holds no root for and consents again with the same call;
+ * its signatures are deterministic, so consenting twice produces the same bytes. A custodian that reloaded
+ * after retaining its root resumes when the stores allow it ({@link deriveGroupCustody}).
+ */
+import { type CesrFrame, SerderACDC, SerderKERI } from "cesr-ts";
+import { type Operation } from "effection";
+import { type RegistryEventRef } from "../credentials/registry-settling.js";
+import type { Exchanger, ExchangeRouteHandler } from "../exchanges/exchanging.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+import type { CounselInputs } from "../multisig/counseling.js";
+import { type GroupCoordinator } from "../multisig/group-members.js";
+import { type Multiplexor, type MultisigChildRoute } from "../multisig/grouping.js";
+import { type RegistryProposeDeps } from "../multisig/proposing.js";
+import { type GrantDraft, type IssuanceBegun, type IssuanceDeps, type IssuanceOperations, type IssuanceRole, type LiveIssuance } from "./issuance.js";
+/** One DH child route and the handler that delegates its wrappers to this owner. */
+export type GroupRouteBinding = [route: string, handler: ExchangeRouteHandler];
+/** Collaborators only a group needs; an owner without them issues as an individual alone. */
+export interface GroupIssuanceDeps {
+    /** Where the DH child wrappers (`/multisig/qry`, `/multisig/rpy`) are delegated; one owner per runtime registers. */
+    readonly mux: Pick<Multiplexor, "addChildHandler" | "removeChildHandler">;
+    /** Collaborators of the custodian's registry update proposal. */
+    readonly registry: RegistryProposeDeps;
+}
+/** A prepared Grant and the proposal the other issuer members consent to. */
+export interface PreparedGroupGrant {
+    grant: string;
+    proposal: Uint8Array;
+}
+/** The custodian a group's accepted coordinator elects, and whether the local member is it. */
+export interface GroupElection {
+    coordinator: GroupCoordinator;
+    /** AID of the elected member that generates and retains the DH keys. */
+    custodian: string;
+    lead: boolean;
+}
+/** Choices of a group member's consent to a Grant. */
+export interface GroupConsentOptions {
+    /** SAID of the accepted group event whose threshold evidence elects the custodian; default the latest establishment. */
+    coordinator?: string;
+    /** Witness codes and counseling choices for the registry update's anchor; the CLI passes `fallbackAfterMs: 0`. */
+    anchor?: CounselInputs;
+}
+/** Choices of an issuer member's approval of a stored or supplied Grant proposal. */
+export interface GroupApprovalOptions extends GroupConsentOptions {
+    /** The proposal as bytes; omitted: the stored proposal wrapper. */
+    proposal?: Uint8Array;
+}
+/** Choices of following a group issuance to its final proof. */
+export interface GroupFollowOptions {
+    coordinator?: string;
+    /** The custodian's final proof as bytes; omitted: the proof wrapper the mailbox stored. */
+    proof?: Uint8Array;
+}
+/** A stored Grant proposal a member may consent to. */
+export interface GroupIssuanceProposal {
+    /** SAID of the Grant to pass to {@link approveGroupIssuance}. */
+    grant: string;
+    /** SAID of the `/multisig/exn` wrapper that carries it. */
+    wrapper: string;
+    /** The group that issues. */
+    group: string;
+    /** AID of the member that proposed it. */
+    proposer: string;
+    recipient: string;
+    /** True once this member's runtime holds the accepted Grant, so nothing is left to consent to. */
+    complete: boolean;
+}
+/**
+ * The local member of a group as one party to a group issuance: the group, the member that signs for it, and the
+ * custodian its accepted coordinator elects. Resolving checks everything a consent relies on once, so no later step
+ * re-derives it. Not exported from the runtime barrel.
+ */
+export declare class GroupParty {
+    readonly hby: Habery;
+    readonly group: Hab;
+    readonly member: Hab;
+    readonly coordinator: GroupCoordinator;
+    readonly custodian: string;
+    private constructor();
+    /**
+     * The party of `group` under `coordinator` (default the group's latest establishment event).
+     *
+     * @throws ValidationError for an owner composed without group collaborators, an identifier that is not a local
+     * group, or a coordinator that is not an accepted event electing a current signing member.
+     */
+    static resolve(deps: IssuanceDeps, group: Hab, coordinator?: string): GroupParty;
+    /** Whether the local member is the elected custodian. */
+    get lead(): boolean;
+    /** The other current signing members of the group. */
+    others(): string[];
+    /** The election this party stands for. */
+    election(): GroupElection;
+    /** Wrap `child` for the other members; the parent authenticates one exact child and never supplies its threshold. */
+    wrap(child: CesrFrame, route: MultisigChildRoute): Operation<Uint8Array>;
+}
+/**
+ * Pure read of a group's election under `coordinator` (default its latest establishment event): who is the
+ * custodian and whether the local member is it.
+ *
+ * @throws ValidationError as {@link GroupParty.resolve}.
+ */
+export declare function groupIssuanceElection(ops: IssuanceOperations, group: string, coordinator?: string): GroupElection;
+/** What deriving a custodian reads: the identities and the retained Grant. */
+export interface CustodyDeps {
+    hby: Habery;
+    exc: Exchanger;
+}
+/**
+ * The party a restarted group custodian was frozen with, derived from the stores. The local member is the
+ * custodian when it holds the root of every registry the Grant discloses and received none of them as a copy: a
+ * root reaches a non-custodian only as a stored `/registry/root` exchange addressed to it, so that exchange tells
+ * a member that was sent its copy from the member whose own DH exchange retained the root. The coordinator is the
+ * latest accepted group event whose threshold evidence elects that member; DH only checks that the frozen
+ * coordinator still elects the frozen custodian, so any such event serves. Null when the member received a copy
+ * of a disclosed root, holds none, or no accepted event elects it.
+ */
+export declare function deriveGroupCustody(deps: CustodyDeps, hab: Hab, grant: string): GroupElection | null;
+/**
+ * Prepare the custodian's first partial Grant for a fresh credential, preserving the discloser's fresh-origin and
+ * far-node checks, and return the proposal the other issuer members consent to. Signs the custodian's Grant
+ * contribution and files it locally; sends nothing and approves no DH exchange. The group is the credential's
+ * managed registry's.
+ *
+ * @throws ValidationError unless the local member is the elected custodian of the group that owns the
+ * credential's registry.
+ */
+export declare function prepareGroupIssuance(ops: IssuanceOperations, draft: GrantDraft, coordinator?: string): Operation<PreparedGroupGrant>;
+/**
+ * Stored Grant proposals, one per Grant, of `group` or of every local group. The wrapper kept is another member's
+ * where there is one (the proposal as received), and this member's own contribution otherwise.
+ */
+export declare function groupIssuanceProposals(ops: IssuanceOperations, group?: Hab): GroupIssuanceProposal[];
+/**
+ * The issuer member's consent to a group Grant, and through it to contributing this member's signature to the DH
+ * query when the custodian's arrives. The group is the proposal's. Verifies the proposal (it must carry the
+ * elected custodian's signature) and rebuilds the exact Grant from its fresh inputs, signs this member's
+ * contribution, files it and records the operation. Returns after local commit: sending the contribution to the
+ * other members, and everything after, is `processOnce`.
+ *
+ * Calling it again after a reload produces the same signature and resumes the operation: a member that reloads
+ * between consent and completion consents again.
+ *
+ * @throws ValidationError for a proposal the stores do not prove, one the elected custodian did not sign, an
+ * operation already begun, or a Grant that differs from its exact fresh issuance inputs.
+ */
+export declare function approveGroupIssuance(ops: IssuanceOperations, grantSaid: string, options?: GroupApprovalOptions): Operation<IssuanceBegun>;
+/**
+ * A custodian's one consent to issue a fresh credential: prepares the Grant ({@link prepareGroupIssuance}) and
+ * approves its own proposal ({@link approveGroupIssuance}). The other members approve the proposal it sent.
+ */
+export declare function proposeGroupIssuance(ops: IssuanceOperations, draft: GrantDraft, options?: GroupConsentOptions): Operation<IssuanceBegun>;
+/**
+ * The holder group member's consent to DH for one authenticated pending Grant addressed to the group (the group is
+ * the Grant's recipient). Approves DH through the coordinator's election; the member's contribution to the reply,
+ * and for the custodian the keys, follow from `processOnce`. Admit is a separate consent.
+ *
+ * @throws ValidationError for a Grant that is not pending for a local group, or an operation already begun.
+ */
+export declare function approveGroupIssuanceExchange(ops: IssuanceOperations, said: string, coordinator?: string): IssuanceBegun;
+/**
+ * Follow a group issuance that has already been contributed to, only to verify and accept the custodian's final
+ * proof: the file-free path of an issuer member that left after contributing and returns for the proof. The group
+ * is the Grant's sender. Signs nothing. The proof may already be stored (it arrives by mailbox), or be supplied as
+ * bytes.
+ *
+ * @throws ValidationError for a Grant this runtime's groups did not send, or one already begun.
+ */
+export declare function followGroupIssuanceProof(ops: IssuanceOperations, said: string, options?: GroupFollowOptions): Operation<IssuanceBegun>;
+/**
+ * The custodian's exact public proof of a completed group issuance: the proof support and the
+ * `/multisig/ipex-proof` wrapper every other member received, read back from the stores. A copy for members that
+ * were away and for a file hand-off.
+ *
+ * @throws ValidationError unless the local member is the custodian of the Grant's sending group and has published
+ * the proof of an accepted Grant.
+ */
+export declare function groupIssuanceProof(ops: IssuanceOperations, said: string): Operation<Uint8Array>;
+/** How a group issuance starts: consent from a proposal, only following the proof, or resumed after a restart. */
+export type GroupIssuanceMode = "consent" | "proofOnly" | "resumed";
+/** What starts one group issuance beyond its party, Grant and nodes. */
+export interface GroupStart {
+    mode?: GroupIssuanceMode;
+    /** The member's own proposal wrapper still owed to the other members. */
+    proposal?: Uint8Array;
+    /** Witness codes and counseling choices for the registry update's anchor, memory only. */
+    anchor?: CounselInputs;
+}
+/** A proposal wrapper and the child it commits. */
+export interface GroupProposalFrame {
+    parent: SerderKERI;
+    child: CesrFrame;
+}
+/** The per-operation state `IssuanceOperations` keeps for a group party; memory only. */
+export declare class GroupIssuance {
+    readonly party: GroupParty;
+    readonly role: IssuanceRole;
+    readonly grant: SerderKERI;
+    readonly nodes: readonly CesrFrame[];
+    /** Wrappers received and not yet taken into DH, by SAID. */
+    readonly pending: Map<string, GroupWrapper>;
+    readonly seen: Set<string>;
+    approved: boolean;
+    contributed: boolean;
+    started: boolean;
+    /** Exact DH message this member contributes to, once frozen. */
+    frozen?: Uint8Array;
+    query?: Uint8Array;
+    nextQuery: number;
+    nextProofScan: number;
+    /** The custodian's registry update, once proposed. */
+    registryUpdate?: RegistryEventRef;
+    /** Proposal wrapper this member still owes the other members. */
+    proposal?: Uint8Array;
+    nodeBytes?: Uint8Array;
+    readonly mode: GroupIssuanceMode;
+    readonly anchor?: CounselInputs;
+    constructor(party: GroupParty, role: IssuanceRole, grant: SerderKERI, nodes: readonly CesrFrame[], start?: GroupStart);
+    /** SAID of the Grant. */
+    get said(): string;
+    /** DH transaction id: the opening Grant's SAID, or the transaction a continuation Grant joins. */
+    get xid(): string;
+    /** The other party: the holder (issuer role) or the issuer (holder role). */
+    get peer(): string;
+    /** The disclosed credential the Grant carries first. */
+    get origin(): SerderACDC;
+    /** The credential's registry. */
+    get registry(): string;
+    /** Whether `parent` is a DH child wrapper of this operation, beyond the structure every group wrapper has. */
+    accepts(parent: SerderKERI, children: readonly CesrFrame[]): boolean;
+}
+/** A DH wrapper and its child, kept until this member takes it into DH. */
+export interface GroupWrapper {
+    wrapper: SerderKERI;
+    child: CesrFrame;
+}
+/**
+ * Delegate the DH child wrappers of `/multisig/qry` and `/multisig/rpy` to this owner, once. The delegation is
+ * structural: a wrapper that arrives before a member consents is kept as evidence and found by the operation
+ * when it starts, and consent alone ever makes a member contribute. Registration refuses a second owner on
+ * one runtime, which is the multiplexor's rule.
+ */
+export declare function registerGroupRoutes(ops: IssuanceOperations): void;
+/** Release the delegation; a reopened runtime builds a new multiplexor, so this is for owners that outlive a phase. */
+export declare function releaseGroupRoutes(ops: IssuanceOperations): void;
+/**
+ * Advance one group operation by one pass; true once the Grant is accepted and nothing is left to do. Mirrors
+ * the order of the loop it replaces: own proposal, Grant authentication, DH approval, the custodian's evidence and
+ * query, wrapper intake and contribution, outgoing DH messages, the custodian's registry update, finish and proof.
+ * Every signature here is one the consent that began the operation covers; the registry update's approval by
+ * other members is not.
+ */
+export declare function stepGroup(ops: IssuanceOperations, op: LiveIssuance): Operation<boolean>;
+//# sourceMappingURL=group-issuance.d.ts.map

package/types/app/ipex/group-issuance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-issuance.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/group-issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAEL,KAAK,SAAS,EAMd,UAAU,EACV,UAAU,EAEX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAWjD,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,WAAW,EAKhB,KAAK,kBAAkB,EAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAI1F,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAQvB,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAE/E,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,qHAAqH;IACrH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,oBAAoB,CAAC,CAAC;IAC1E,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,wHAAwH;IACxH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kHAAkH;IAClH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,mEAAmE;IACnE,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAEnB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,KAAK,EAAE,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG;IACpB,QAAQ,CAAC,WAAW,EAAE,gBAAgB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAL5B,OAAO;IAQP;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU;IAehF,yDAAyD;IACzD,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,sDAAsD;IACtD,MAAM,IAAI,MAAM,EAAE;IAIlB,0CAA0C;IAC1C,QAAQ,IAAI,aAAa;IAIzB,qHAAqH;IACpH,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,GAAG,SAAS,CAAC,UAAU,CAAC;CAa1E;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,aAAa,CAEjH;AAoCD,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAuBnG;AAYD;;;;;;;;GAQG;AACH,wBAAiB,oBAAoB,CACnC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,UAAU,EACjB,WAAW,CAAC,EAAE,MAAM,GACnB,SAAS,CAAC,kBAAkB,CAAC,CAY/B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAuBpG;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAiB,oBAAoB,CACnC,GAAG,EAAE,kBAAkB,EACvB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,SAAS,CAAC,aAAa,CAAC,CAkE1B;AAED;;;GAGG;AACH,wBAAiB,oBAAoB,CACnC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,mBAAwB,GAChC,SAAS,CAAC,aAAa,CAAC,CAG1B;AAkBD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,GACnB,aAAa,CAQf;AAED;;;;;;;GAOG;AACH,wBAAiB,wBAAwB,CACvC,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,SAAS,CAAC,aAAa,CAAC,CAS1B;AAED;;;;;;;GAOG;AACH,wBAAiB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAmBhG;AAED,kHAAkH;AAClH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,yFAAyF;AACzF,qBAAa,aAAa;IAqBtB,QAAQ,CAAC,KAAK,EAAE,UAAU;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE;IAvBtC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,4BAAmC;IACnD,QAAQ,CAAC,IAAI,cAAqB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,UAAS;IACpB,OAAO,UAAS;IAChB,gEAAgE;IAChE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,SAAS,SAAK;IACd,aAAa,SAAK;IAClB,sDAAsD;IACtD,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;gBAGrB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,SAAS,SAAS,EAAE,EACpC,KAAK,GAAE,UAAe;IAQxB,yBAAyB;IACzB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,kGAAkG;IAClG,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,6EAA6E;IAC7E,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,wDAAwD;IACxD,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,iCAAiC;IACjC,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,8GAA8G;IAC9G,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO;CAOrE;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;CAClB;AA2BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAgBjE;AAED,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAKhE;AAsFD;;;;;;GAMG;AACH,wBAAiB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,EAAE,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAkIxF"}

package/types/app/ipex/ipex-admitting.d.ts

@@ -0,0 +1,47 @@
+/**
+ * IPEX Admit preparation over borrowed protocol owners.
+ *
+ * Reads accepted Grants and their graph truth from the Habery, Exchanger and
+ * registry store only; it records no admission. Embedders that keep admitted
+ * records (the wallet) call it before and after their own inventory writes.
+ */
+import { type SerderKERI, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import type { RegistryStore } from "../../acdc/registering.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+import type { Habery } from "../identity/habbing.js";
+import type { Receiptor, WitnessAuthMap } from "../witness/receipting.js";
+/** A signed response prepared after consent/current policy; intake and delivery remain caller-owned. */
+export interface PreparedAdmit {
+    admit: SerderKERI;
+    wire: Uint8Array;
+    support: Uint8Array;
+}
+/** Borrow concrete owners only; no constructor opens a store or starts a worker. */
+export declare class IpexAdmitter {
+    readonly hby: Habery;
+    readonly registry: RegistryStore;
+    readonly exc: Exchanger;
+    constructor(hby: Habery, registry: RegistryStore, exc: Exchanger);
+    /** Authenticate accepted outer evidence through existing replay, without current node policy. */
+    accepted(said: string, route: string): Promise<SerderKERI>;
+    /** New use requires current node evidence and a valid root under shared issued-state policy. */
+    graphAccepted(grant: string, origin: string): boolean;
+    /** Resolve only the origin actually carried by this accepted Grant. */
+    origin(grant: SerderKERI): string;
+    /** Freeze an unsigned response only after explicit consent, exact prior authentication and current root truth. */
+    prepareAdmitBody(grant: string, holder: string, { consent, message, gvrsn }?: {
+        consent?: boolean;
+        message?: string;
+        gvrsn?: Versionage;
+    }): Operation<SerderKERI>;
+    /** Sign an individual response; group approval consumes the same unsigned body through its own exact-stream owner. */
+    prepareAdmit(grant: string, holder: string, { consent, message, gvrsn, receiptor, auths }?: {
+        consent?: boolean;
+        message?: string;
+        gvrsn?: Versionage;
+        receiptor?: Receiptor;
+        auths?: WitnessAuthMap;
+    }): Operation<PreparedAdmit>;
+}
+//# sourceMappingURL=ipex-admitting.d.ts.map

package/types/app/ipex/ipex-admitting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipex-admitting.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/ipex-admitting.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,UAAU,EAAY,MAAM,SAAS,CAAC;AACjF,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO1E,wGAAwG;AACxG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,oFAAoF;AACpF,qBAAa,YAAY;IACX,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS;gBAAtE,GAAG,EAAE,MAAM,EAAW,QAAQ,EAAE,aAAa,EAAW,GAAG,EAAE,SAAS;IAE3F,iGAAiG;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAShE,gGAAgG;IAChG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAYrD,uEAAuE;IACvE,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAejC,kHAAkH;IACjH,gBAAgB,CACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,EAAE,OAAe,EAAE,OAAY,EAAE,KAAgB,EAAE,GAAE;QACnD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,UAAU,CAAC;KACf,GACL,SAAS,CAAC,UAAU,CAAC;IAexB,sHAAsH;IACrH,YAAY,CACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,EAAE,OAAe,EAAE,OAAY,EAAE,KAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAE;QACrE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,KAAK,CAAC,EAAE,cAAc,CAAC;KACnB,GACL,SAAS,CAAC,aAAa,CAAC;CAqB5B"}

package/types/app/ipex/ipex-conversation.d.ts

@@ -0,0 +1,195 @@
+/**
+ * Legacy (v1) IPEX conversation for a single-signature controller: send an
+ * apply, offer, agree or spurn, read where a conversation stands and observe it
+ * until the peer replies. Owned by the library so that every host (CLI, wallet,
+ * service) runs one implementation.
+ *
+ * Operations follow the workflow contract. `sendIpexApply`, `sendIpexOffer`,
+ * `sendIpexAgree` and `sendIpexSpurn` are explicit: each validates the accepted
+ * prior message, signs exactly one exchange, accepts it locally, hands it to the
+ * Poster and returns once that delivery attempt has an outcome. They never wait
+ * for the peer. `ipexExchangeStatus` is a pure synchronous read of durable
+ * state. `waitForIpexExchange` only observes: it starts no worker and returns a
+ * timed-out value instead of throwing.
+ *
+ * Boundaries:
+ * - Dependencies are narrow collaborators, not an AgentRuntime (ADR-0013). The
+ *   host owns their lifetimes and must be running the Poster worker so the
+ *   delivery attempt can complete (`withRuntimeWorkers` for a one-shot host).
+ * - Recipients arrive as resolved AIDs; contact lookup is a host concern.
+ * - Group controllers do not use these operations: their propose/approve split
+ *   needs the multisig coordinator, which the group proposal API will own.
+ * - Durable state records acceptance, not delivery, so there is no "sent but
+ *   unanswered" read distinct from `awaiting-reply`; a send's return value is
+ *   the evidence that it was sent.
+ */
+import { type SerderKERI, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import type { Reger } from "../../db/reger.js";
+import type { Poster } from "../delivery/forwarding.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { Reactor } from "../protocol/reactor.js";
+import { type RuntimeClock } from "../runtime/runtime-clock.js";
+import type { ChangeSink, WaitResult } from "../runtime/workflow-contract.js";
+import { type IpexVerb } from "./ipexing.js";
+/** Collaborators sending an exchange needs; nothing else is reachable from here. */
+export interface IpexSendDeps {
+    /** Borrowed identities and accepted-state stores. */
+    readonly hby: Habery;
+    /** Parser/dispatcher that accepts the signed exchange into local state. */
+    readonly reactor: Reactor;
+    /** Escrow processing, and the exchanger that reports acceptance, over the same database as `hby`. */
+    readonly protocol: ProtocolProcessor;
+    /** Delivery queue; its worker must be running while a send awaits its outcome. */
+    readonly postman: Poster;
+    /** Optional sink told `{kind:"ipex", id:"<said>"}` for the new exchange and its prior after local acceptance. */
+    readonly changes?: ChangeSink;
+}
+/** The exchange a send signed and accepted, with the destinations that took it. */
+export interface IpexSent {
+    readonly exn: SerderKERI;
+    /** Successful destination URLs. */
+    readonly deliveries: string[];
+}
+/** Choices shared by every conversation send. */
+export interface IpexMessageOptions {
+    /** Resolved recipient AID. */
+    recipient: string;
+    /** Free-text `m` field; defaults to empty. */
+    message?: string;
+}
+/** Stores the status read inspects. A `Habery` and a `Reger` fit. */
+export interface IpexStatusDeps {
+    /** Accepted exchange messages and their reply indexes. */
+    readonly hby: Pick<Habery, "db">;
+    /** Saved credential index. */
+    readonly reger: Pick<Reger, "saved">;
+}
+/** Wallet fact for a grant: the credential it carries and whether the wallet saved it. */
+export interface IpexCredentialFact {
+    readonly said: string;
+    readonly saved: boolean;
+}
+/**
+ * Where one accepted exchange stands.
+ * - `unknown`: no accepted exchange has this SAID.
+ * - `awaiting-reply`: accepted and no response is accepted against it yet.
+ * - `replied`: a response is accepted; `reply.route` is `null` only if the
+ *   indexed response is no longer stored.
+ *
+ * `credential` is present for grants only.
+ */
+export type IpexExchangeStatus = {
+    state: "unknown";
+} | {
+    state: "awaiting-reply";
+    route: string;
+    credential?: IpexCredentialFact;
+} | {
+    state: "replied";
+    route: string;
+    reply: {
+        said: string;
+        route: string | null;
+    };
+    credential?: IpexCredentialFact;
+};
+/**
+ * Require a local single-signature sender.
+ *
+ * @throws ValidationError when `sender` is not a local AID of `hby` or is a group AID.
+ */
+export declare function requireIpexSender(hby: Habery, sender: Hab): void;
+/**
+ * Validate an accepted predecessor and its known parties before any local signing.
+ *
+ * @throws ValidationError when the prior is not accepted, has the wrong route or
+ * parties, or already has an accepted response.
+ */
+export declare function requireIpexPrior(hby: Pick<Habery, "db">, sender: string, recipient: string, said: string, verb: Exclude<IpexVerb, "apply">): void;
+/**
+ * Accept one signed exchange locally and confirm it was accepted.
+ *
+ * @param wire Signed exchange followed by its attachments.
+ * @param refusal Message for the infrastructure failure of a local exchange that was not accepted.
+ * @param prior Said of the message this one answers; its status changes too.
+ */
+export declare function acceptIpexExchange(deps: Pick<IpexSendDeps, "reactor" | "protocol" | "changes">, exn: SerderKERI, wire: Uint8Array, genus: Versionage, refusal: string, prior?: string): Operation<void>;
+/** Choices for {@link sendIpexApply}. */
+export interface IpexApplyOptions extends IpexMessageOptions {
+    /** Schema SAID requested. */
+    schema: string;
+    /** Requested attribute values; defaults to none. */
+    attrs?: Record<string, unknown>;
+}
+/**
+ * Send an `/ipex/apply` asking `recipient` for a credential of `schema`.
+ * An apply starts a conversation, so there is no prior to validate and sending
+ * it twice sends two distinct applies.
+ *
+ * @throws ValidationError for a sender that is not a local single-signature AID or a refused local exchange.
+ */
+export declare function sendIpexApply(deps: IpexSendDeps, sender: Hab, { recipient, schema, attrs, message }: IpexApplyOptions): Operation<IpexSent>;
+/** Choices for {@link sendIpexOffer}. */
+export interface IpexOfferOptions extends IpexMessageOptions {
+    /** Raw ACDC message embedded as the offer's `acdc`. */
+    acdc: Uint8Array;
+    /** Said of the accepted apply this offer answers; omit for an unsolicited offer. */
+    apply?: string;
+}
+/**
+ * Send an `/ipex/offer` carrying one embedded ACDC, optionally answering an apply.
+ *
+ * @throws ValidationError as for {@link requireIpexPrior} when `apply` is given.
+ */
+export declare function sendIpexOffer(deps: IpexSendDeps, sender: Hab, { recipient, acdc, apply, message }: IpexOfferOptions): Operation<IpexSent>;
+/** Choices for {@link sendIpexAgree}. */
+export interface IpexAgreeOptions extends IpexMessageOptions {
+    /** Said of the accepted offer being agreed to. */
+    offer: string;
+}
+/**
+ * Send an `/ipex/agree` answering an accepted offer.
+ *
+ * @throws ValidationError as for {@link requireIpexPrior}.
+ */
+export declare function sendIpexAgree(deps: IpexSendDeps, sender: Hab, { recipient, offer, message }: IpexAgreeOptions): Operation<IpexSent>;
+/** Choices for {@link sendIpexSpurn}. */
+export interface IpexSpurnOptions extends IpexMessageOptions {
+    /** Said of the accepted apply, offer, agree or grant being rejected. */
+    prior: string;
+}
+/**
+ * Send an `/ipex/spurn` rejecting an accepted apply, offer, agree or grant.
+ *
+ * @throws ValidationError as for {@link requireIpexPrior}.
+ */
+export declare function sendIpexSpurn(deps: IpexSendDeps, sender: Hab, { recipient, prior, message }: IpexSpurnOptions): Operation<IpexSent>;
+/**
+ * Pure synchronous status of the accepted exchange `said`, derived from the
+ * exchange store, the reply index and (for grants) the saved-credential index.
+ * Mutates nothing.
+ */
+export declare function ipexExchangeStatus(deps: IpexStatusDeps, said: string): IpexExchangeStatus;
+/** What a {@link waitForIpexExchange} is waiting for. */
+export type IpexWaitFor = "replied" | "credential-saved";
+/** Choices for {@link waitForIpexExchange}. */
+export interface IpexWaitOptions {
+    /** Wall-clock budget. */
+    timeoutMs: number;
+    /** `replied` (default) waits for an accepted response; `credential-saved` for a grant's credential to be saved. */
+    until?: IpexWaitFor;
+    /** Elapsed milliseconds between reads. */
+    pollMs?: number;
+    clock?: RuntimeClock;
+}
+/**
+ * Observe `said` until the wanted state holds or the budget expires. A wait
+ * that is already satisfied returns at once. Starts no worker: the host's own
+ * poller and escrow loop make the peer's reply or the credential arrive.
+ *
+ * @returns `settled`, or `timed-out`; both carry the status read at return.
+ */
+export declare function waitForIpexExchange(deps: IpexStatusDeps, said: string, { timeoutMs, until, pollMs, clock }: IpexWaitOptions): Operation<WaitResult<IpexExchangeStatus>>;
+//# sourceMappingURL=ipex-conversation.d.ts.map

package/types/app/ipex/ipex-conversation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipex-conversation.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/ipex-conversation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAIlD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG9E,OAAO,EAML,KAAK,QAAQ,EAEd,MAAM,cAAc,CAAC;AAEtB,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAC3E;IACA,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEJ;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAOhE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EACvB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAC/B,IAAI,CAON;AAED;;;;;;GAMG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,EAC5D,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACb,SAAS,CAAC,IAAI,CAAC,CAMjB;AA8BD,yCAAyC;AACzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAiB,aAAa,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,GAAG,EACX,EAAE,SAAS,EAAE,MAAM,EAAE,KAAU,EAAE,OAAY,EAAE,EAAE,gBAAgB,GAChE,SAAS,CAAC,QAAQ,CAAC,CAOrB;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,uDAAuD;IACvD,IAAI,EAAE,UAAU,CAAC;IACjB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAiB,aAAa,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,GAAG,EACX,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE,gBAAgB,GACzD,SAAS,CAAC,QAAQ,CAAC,CAUrB;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAiB,aAAa,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,GAAG,EACX,EAAE,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE,gBAAgB,GACnD,SAAS,CAAC,QAAQ,CAAC,CAKrB;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAiB,aAAa,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,GAAG,EACX,EAAE,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE,gBAAgB,GACnD,SAAS,CAAC,QAAQ,CAAC,CAKrB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAazF;AAED,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAEzD,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mHAAmH;IACnH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAOD;;;;;;GAMG;AACH,wBAAiB,mBAAmB,CAClC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,EAAE,SAAS,EAAE,KAAiB,EAAE,MAAY,EAAE,KAAmB,EAAE,EAAE,eAAe,GACnF,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAS3C"}