keri-ts 2.0.1 → 2.2.0

package/types/app/ipex/issuance.d.ts

@@ -0,0 +1,443 @@
+/**
+ * Runtime-owned operations for single-signature v2 DH issuance.
+ *
+ * One `IssuanceOperations` owner holds an in-memory table of live operations. The user begins an
+ * operation with `beginIssuance`, which signs the Grant, approves the DH exchange, starts the query
+ * and records that authorisation in memory. The host's runtime loop (or, in a one-shot CLI, a driver
+ * under `withRuntimeWorkers`) then calls `processOnce`, which performs exactly the steps
+ * `tufa ipex --issue` performed itself: send the proof support and Grant, deliver DH traffic, resend
+ * a freshly dated query each second until DH completes, and once DH completes stage and anchor the registry update (BUP),
+ * `finish` the Grant and send the final proof support. Nothing starts an operation or signs except
+ * inside an operation the user began while its in-memory authorisation lives.
+ *
+ * Workflow-contract shape (`app/runtime/workflow-contract.ts`): `beginIssuance` returns after local
+ * commit and never waits for the peer; `issuanceStatus` is a pure read; `waitForIssuance` only
+ * observes and returns a `WaitResult`; `abandonIssuance` is local.
+ *
+ * There is no operation store. Status is derived from the protocol stores plus the live table, so a
+ * reopened store reads what the stores prove, whatever the process was doing:
+ *
+ * | stores prove                                                              | status                                   |
+ * | ------------------------------------------------------------------------- | ---------------------------------------- |
+ * | holder: pending Grant, no root held                                       | `awaitingExchangeConsent`                |
+ * | pending Grant past its deadline                                           | `expired`                                |
+ * | holder: root held, not committed otherwise; issuer: update accepted       | `active`, `rootRetained` (adopted)       |
+ * | issuer: pending Grant, update not accepted                                | `interrupted`                            |
+ * | root held and the registry committed to another exchange                  | `interrupted`                            |
+ * | holder: Grant accepted, no accepted Admit                                 | `active`, `awaitingAdmitConsent`         |
+ * | holder: accepted Admit                                                    | `done`, `admitted`                       |
+ * | issuer: Grant accepted                                                    | `done`, `issued`                         |
+ *
+ * Lost on reload, by design: the phases that live only in memory (`exchangingKeys`, `awaitingAnchor`,
+ * `proving` read `rootRetained` or `interrupted` afterwards), the `abandoned` and `failed` end states
+ * with their reasons (an abandoned holder reads `awaitingExchangeConsent` again, an abandoned issuer
+ * `interrupted`, and an abandoned operation whose root and accepted update remain is adopted and
+ * completed on the next start; it signs nothing and Admit stays a separate consent), the consent
+ * timestamps, and whether the issuer's final proof support was delivered (an issuer whose Grant is
+ * accepted reads `done` even if the process ended before that message went out). A Grant the issuer
+ * prepared but never began reads `interrupted`, the same as one whose process ended; so does an issuer
+ * that ended between staging its registry update and anchoring it (an explicit recovery action for that
+ * case is a planned follow-up; until then it needs a new Grant, and a held root nothing committed to is
+ * replaced). A wallet that wants any of these keeps them itself from the `ChangeSink`.
+ *
+ * After a restart the first `processOnce` finds the pending Grants this runtime's identifiers are party
+ * to that hold a root and can finish without new key exchange ({@link resumableExchange}) and adopts
+ * them: the holder waits for or verifies the issuer's update, an issuer whose update is already
+ * accepted finishes. Neither signs: the issuer's update was anchored before the restart, and
+ * `Dhke.finish` only proves the held root against the accepted update before the Grant is accepted. A
+ * new Grant on a registry that holds an unused root (no update staged or accepted) replaces that root
+ * when its exchange retains its own; otherwise the refusal stands. A KERIpy peer keeps the old rule and
+ * refuses a second exchange on a registry it holds a root for. The Grant's exchange deadline bounds
+ * everything, even a late completion; passing it reads `expired`.
+ *
+ * The runtime never writes wallet inventory. Completion is pushed to the `ChangeSink` as
+ * `{kind: "issuance", id: <grant>}` and the embedder records it.
+ *
+ * A local group issues and receives through the same table, status and wait: its consent calls and per-operation
+ * steps are in `group-issuance.ts` and run inside the same `processOnce`. A group exchange is not resumed after a
+ * restart (its frozen coordinator and custodian are not stored): a group pending Grant with no root reads
+ * `awaitingExchangeConsent`, and a member consents again with the same call.
+ *
+ * Collaborators are narrow concrete owners (ADR-0013); no `AgentRuntime`.
+ */
+import { SerderACDC, type SerderKERI, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import { type DerivedUpdateStore } from "../../acdc/custody.js";
+import { Dhke } from "../../acdc/dhking.js";
+import type { Regery } from "../../acdc/registraring.js";
+import type { Poster } from "../delivery/forwarding.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { Reactor } from "../protocol/reactor.js";
+import { type DeliveryFailure, type DeliveryMessage, DeliveryOutbox, type Outbound } from "../runtime/delivery-outbox.js";
+import type { RetryPolicy } from "../runtime/retry-backoff.js";
+import type { RuntimeClock } from "../runtime/runtime-clock.js";
+import { type ChangeSink, type WaitResult } from "../runtime/workflow-contract.js";
+import type { Receiptor, WitnessAuthMap } from "../witness/receipting.js";
+import { GroupIssuance, type GroupIssuanceDeps, type GroupRouteBinding } from "./group-issuance.js";
+import { IpexDiscloser, type IssuanceGrantOptions } from "./ipex-discloser.js";
+/**
+ * Milliseconds between resends of the issuer query. Each resend is a new query (new date, SAID and signatures):
+ * the peer's KRAM caches every query it accepts, so an identical resend is a replay it drops, which would
+ * strand a peer that took the first query and then lost it before consenting (a process that ended, or a
+ * retained query that outlived its window).
+ */
+export declare const ISSUANCE_QUERY_RESEND_MS = 1000;
+/**
+ * Milliseconds between scans of the pending exchange escrow for Grants a restarted process can finish. The scan
+ * repeats because what makes a Grant resumable can arrive after the restart (an issuer's update accepted once the
+ * other members approve it).
+ */
+export declare const ISSUANCE_SWEEP_MS = 5000;
+/** Which side of the exchange the local identifier is. */
+export type IssuanceRole = "issuer" | "holder";
+/** Terminal states that are not completion; each carries a reason. */
+export type IssuanceEndState = "abandoned" | "interrupted" | "expired" | "failed";
+/** Where an active issuance is. Group and holder phases extend this union. */
+export type IssuancePhase = "awaitingExchangeConsent" | "exchangingKeys" | "rootRetained"
+/** Group issuer: the Grant lacks member contributions; the group threshold has not authenticated it. */
+ | "awaitingGrantSignatures" | "awaitingAnchor" | "proving" | "awaitingAdmitConsent";
+/** A user step an active issuance waits for. Single-signature issuers never wait: `beginIssuance` authorises the anchor. */
+export type IssuanceNeed = "exchange" | "admit";
+/** Status of one issuance, discriminated on `state`. A pure read. */
+export type IssuanceStatus = {
+    state: "active";
+    role: IssuanceRole;
+    phase: IssuancePhase;
+    needs?: IssuanceNeed;
+    /** The Grant's exchange deadline (ISO 8601), while the exchange is still open. */
+    deadline?: string;
+    /** Present while a delivery is failing and being retried with a doubling delay. */
+    failure?: DeliveryFailure;
+} | {
+    state: "done";
+    role: IssuanceRole;
+    phase: "issued" | "admitted";
+} | {
+    state: IssuanceEndState;
+    role: IssuanceRole;
+    reason: string;
+};
+/** Delivery of signed bytes; resolves once the transport reports an outcome and throws when it failed. */
+export interface IssuanceDelivery {
+    /** `topic` defaults to the credential mailbox topic; group members coordinate on `multisig`. */
+    deliver(message: DeliveryMessage): Operation<string[]>;
+}
+/**
+ * Adapt a `Poster`; its delivery worker must be running (a one-shot CLI runs it under `withRuntimeWorkers`).
+ * A wire of several complete messages (proof support plus Grant) goes as one ordered stream, which mailbox
+ * forwarding needs; a single message goes as an ordinary send, which is what a direct peer's query route expects.
+ */
+export declare function posterDelivery(postman: Pick<Poster, "send" | "sendStream" | "wait">): IssuanceDelivery;
+/** Collaborators of an Admit: everything that needs no DH owner, so a host without per-identifier owners can admit. */
+export interface AdmitDeps {
+    readonly hby: Habery;
+    /** Registry environment; only its public `store` is read here. */
+    readonly rgy: Pick<Regery, "store">;
+    readonly exc: Exchanger;
+    /** Receipt collector for an anchored Admit; its genus selects the witness protocol version. */
+    readonly receiptor: Receiptor;
+    /** Local intake of what this identifier signs. */
+    readonly reactor: Pick<Reactor, "processBytes">;
+    readonly protocol: Pick<ProtocolProcessor, "processEscrowsOnce" | "dispatch">;
+    readonly delivery: IssuanceDelivery;
+    /** Same clock the exchanger and DH owners were composed with. */
+    readonly clock: RuntimeClock;
+    readonly changes?: ChangeSink;
+}
+/** Narrow collaborators of the issuance owner. Hosts adapt their runtime to this once. */
+export interface IssuanceDeps extends AdmitDeps {
+    /** Registry environment; `rgy.store` is the public registry store. */
+    readonly rgy: Regery;
+    /** Per-identifier DH owners (`runtime.ipex`), so several identifiers can issue on one runtime. */
+    readonly dhkes: {
+        dhke(hab: Hab): Dhke;
+    };
+    /** Non-secret derivation coordinates of blinded registry updates. */
+    readonly derived: DerivedUpdateStore;
+    /** Delivery retry delays; {@link DEFAULT_RETRY_POLICY} when absent. */
+    readonly retry?: Readonly<RetryPolicy>;
+    /** Milliseconds between issuer query resends; {@link ISSUANCE_QUERY_RESEND_MS} when absent. */
+    readonly queryResendMs?: number;
+    /** Collaborators of group issuance; absent, this owner issues and holds as an individual only. */
+    readonly group?: GroupIssuanceDeps;
+}
+/** One operation the user began or adopted; exists only while it is live in this process. */
+export interface LiveIssuance {
+    /** SAID of the Grant exchange. */
+    readonly grant: string;
+    /** DH transaction id; differs from the Grant SAID for a Grant that continues an earlier exchange. */
+    readonly xid: string;
+    readonly role: IssuanceRole;
+    /** The Grant's original exchange deadline (ISO 8601). */
+    deadline: string | null;
+    readonly hab: Hab;
+    readonly dh: Dhke;
+    readonly peer: string;
+    readonly registry: string;
+    /** Null while a group issuer's Grant lacks member contributions: KRAM fixes the lifetime once the group authenticates it. */
+    expires: bigint | null;
+    /** Issuer only: what the loop sends and anchors. Absent for a holder. */
+    readonly issuer?: {
+        readonly credential: SerderACDC;
+        /** Grant body and nested disclosure, the input of proof support. */
+        readonly raw: Uint8Array;
+        readonly grantWire: Uint8Array;
+        /** The latest signed DH query; null once DH is complete (a completed issuer after a restart). */
+        query: Uint8Array | null;
+        /** Transient witness codes for the anchor. */
+        readonly auths?: WitnessAuthMap;
+        sent: boolean;
+        nextQuery: number;
+    };
+    /** Group party state, for an operation of a local group; such an operation has no {@link issuer} part. */
+    readonly group?: GroupIssuance;
+    phase: IssuancePhase;
+    /** Signed bytes the steps decided to send and delivery has not yet taken; a member briefly offline is retried. */
+    readonly outbox: DeliveryOutbox;
+    /** The steps are done; the operation ends once the outbox is empty. */
+    finished: boolean;
+    /** A step is running; overlapping `processOnce` calls skip it. */
+    busy: boolean;
+}
+/** How long delivery failures may last on an operation that has no Grant deadline yet before it ends `failed`. */
+export declare const ISSUANCE_RETRY_BOUND_MS = 600000;
+/** What `beginIssuance` selected. */
+export interface IssuanceBegun {
+    grant: string;
+    xid: string;
+}
+/** A fresh credential and how its Grant is addressed; the issuer is its registry's identifier. */
+export interface GrantDraft {
+    credential: SerderACDC;
+    options: IssuanceGrantOptions;
+}
+/** A Grant taken into local pending issuance and the wire a host may deliver or file itself. */
+export interface PreparedGrant {
+    grant: string;
+    wire: Uint8Array;
+}
+/** What an operation that ended in this process reports until the process ends. */
+interface EndedIssuance {
+    role: IssuanceRole;
+    state: IssuanceEndState;
+    reason: string;
+}
+/**
+ * The live operations table and its driver. One per host runtime; every identifier of that runtime may
+ * issue through it. Only `processOnce` performs work, and only for operations in
+ * {@link IssuanceOperations.live}.
+ */
+export declare class IssuanceOperations {
+    readonly deps: IssuanceDeps;
+    /** Operations live in this process. Internal to this module's functions. */
+    readonly live: Map<string, LiveIssuance>;
+    /** Operations that ended in this process with their reasons; not durable, see the module doc. */
+    readonly ended: Map<string, EndedIssuance>;
+    readonly discloser: IpexDiscloser;
+    /** The DH child handlers this owner registered on the multiplexor, once a group operation began. */
+    groupRoutes: GroupRouteBinding[] | null;
+    /** When the next scan for resumable Grants is due (host clock, ms); 0 until the first pass. */
+    private nextSweep;
+    /** Grants a scan found resumable and adoption refused; they are not tried again in this process. */
+    private readonly refused;
+    /** Grants an earlier process left resumable: each is adopted once, or dropped. */
+    private stale;
+    constructor(deps: IssuanceDeps);
+    /** Whether a pass has work: a live operation, or the one-time scan for resumable Grants has not run. */
+    active(): boolean;
+    /**
+     * Advance every live operation by one pass. Each pass is bounded by the operation's Grant deadline.
+     * The first pass also adopts the pending Grants the stores prove resumable ({@link resumableGrants});
+     * that signs and sends nothing.
+     */
+    processOnce(): Operation<void>;
+    /** End a live operation: release its DH approval, remember why until the process ends, tell the sink. */
+    end(op: LiveIssuance, state: IssuanceEndState, reason: string): void;
+    /** Drop the live entry and the DH approval; a missing approval means the owner already closed. */
+    private release;
+    /**
+     * Adopt one Grant an earlier process left resumable, without signing: the holder waits for or verifies the
+     * update, an issuer whose update is already accepted finishes. A Grant the exchange can no longer resume is
+     * dropped and reads from the stores. False means the Keeper is locked and the Grant is retried.
+     */
+    private settle;
+    /** Rebuild the live entry of a resumable Grant from the stored Grant and the held roots. */
+    private adopt;
+    /**
+     * Adopt a group custodian's completed exchange after a restart, signing nothing: the coordinator and custodian
+     * the exchange was frozen with are derived from the stores ({@link deriveGroupCustody}), the holder's root is
+     * already held, and the group steps finish the Grant against the accepted update. The only signature is the
+     * endorsement of the public proof wrapper the original consent already covers.
+     */
+    private adoptGroup;
+    /** The live entry of a group operation; its lifetime is the Grant's once KRAM has accepted it, else unknown. */
+    private liveGroup;
+    private timer;
+    /**
+     * Queue signed bytes for delivery from the identifier that signed them. Steps decide what to send; {@link drain}
+     * sends it, so a member that is briefly offline delays the operation instead of ending it.
+     */
+    enqueue(op: LiveIssuance, message: Outbound): void;
+    /**
+     * Deliver the queued messages in order. A failure keeps the message and schedules a retry with a doubling delay;
+     * it ends the operation only where nothing else bounds it: the Grant deadline ends one that has it, and failures
+     * lasting {@link ISSUANCE_RETRY_BOUND_MS} end one that has none yet. True when the outbox is empty.
+     */
+    private drain;
+    /** One pass: send what is queued, step only once the queue is empty, send what the step queued. */
+    private advance;
+    /** Record a phase change of a live operation and tell the sink; the group steps call it too. */
+    setPhase(op: LiveIssuance, phase: IssuancePhase): void;
+    /**
+     * Record one group operation the user consented to ({@link approveGroupIssuance},
+     * {@link approveGroupIssuanceExchange}, {@link followGroupIssuanceProof}). A holder approves DH here, with its
+     * consent; an issuer approves once the group has authenticated the Grant.
+     */
+    beginGroup(group: GroupIssuance): IssuanceBegun;
+    /** One pass of the issuer loop, in the order of the CLI loop it replaces. */
+    private step;
+    /**
+     * The query to resend now, signed afresh (`Dhke.requery`: same keys and scope, new `dt`, SAID and signatures).
+     * An unchanged resend is a KRAM replay once the peer has accepted the original, so it can never reach a peer
+     * that lost it; a new query is timely whatever window the peer runs. Re-signing happens only here, inside the
+     * live authorisation that began the operation; with the Keeper locked the last query goes again unchanged. A
+     * group threshold query cannot be re-dated by one member; group issuance is not run here.
+     */
+    private renewed;
+    /**
+     * Holder, DH complete: wait for the issuer's registry update, then verify it and finish the Grant. The
+     * issuance is then complete but for the holder's separate Admit consent.
+     */
+    private receive;
+    /** DH is complete: stage and anchor the BUP under the live authorisation, finish the Grant, send proof support. */
+    private finish;
+}
+/**
+ * Sign a fresh Grant for `credential` and take it into local pending issuance
+ * without approving DH or generating a root. A host may deliver or file the
+ * returned wire itself and begin later with the Grant SAID.
+ */
+export declare function prepareIssuanceGrant(ops: IssuanceOperations, draft: GrantDraft): Operation<PreparedGrant>;
+/**
+ * The issuer's one "issue this credential" consent for a prepared Grant ({@link prepareIssuanceGrant}); the
+ * issuer is the Grant's sender. Approves the DH exchange, signs the query and records the
+ * authorisation, including the later KEL signature that anchors the registry
+ * update, in memory. Returns after local commit; `processOnce` does the rest.
+ *
+ * @throws ValidationError for a Grant that is not this identifier's exact
+ * unanchored pending issuance, an unmanaged registry, a group identifier, or
+ * an issuance already begun or completed.
+ */
+export declare function beginIssuance(ops: IssuanceOperations, grant: string, auths?: WitnessAuthMap): Operation<IssuanceBegun>;
+/**
+ * The issuer's one consent to issue a fresh credential: signs the Grant ({@link prepareIssuanceGrant}) and begins
+ * the issuance ({@link beginIssuance}) in one step.
+ */
+export declare function proposeIssuance(ops: IssuanceOperations, draft: GrantDraft, auths?: WitnessAuthMap): Operation<IssuanceBegun>;
+/**
+ * Pure read of one issuance: what ended in this process, the live table, and otherwise what the protocol
+ * stores prove (see the module doc for the table and what a reload loses). A pending Grant no live
+ * operation holds reads `interrupted` (or `expired` once the Grant deadline has passed); that is a
+ * statement, not a write.
+ *
+ * @throws ValidationError when `grant` is not a v2 Grant this runtime's identifiers are party to.
+ */
+export declare function issuanceStatus(ops: IssuanceOperations, grant: string): IssuanceStatus;
+/** A pending Grant addressed to a local identifier that no one has consented to yet. */
+export interface PendingGrant {
+    /** SAID of the Grant exchange. */
+    grant: string;
+    /** The local identifier the Grant is addressed to. */
+    holder: string;
+    /** The AID that sent the Grant. */
+    issuer: string;
+    /** SAID of the disclosed credential. */
+    credential: string;
+    /** The credential's registry. */
+    registry: string;
+    /** The Grant's exchange deadline (ISO 8601). */
+    deadline: string;
+}
+/**
+ * Pure read of the Grants waiting for the holder's exchange consent: authenticated pending v2 Grants addressed
+ * to a local identifier (to `hab` when given) for which {@link approveIssuanceExchange} would be accepted.
+ * `issuanceStatus` throws for a Grant until it is stored; this lists the stored ones, so an embedder needs no poll.
+ */
+export declare function pendingIssuanceGrants(ops: IssuanceOperations, { hab }?: {
+    hab?: Hab;
+}): PendingGrant[];
+/**
+ * Pure read of the pending Grants addressed to a local group (to `group` when given) that its members have not
+ * consented to: authenticated pending v2 Grants whose issuance status reads `awaitingExchangeConsent`.
+ * {@link pendingIssuanceGrants} lists the individual identifiers' Grants and skips groups; this is its group form.
+ */
+export declare function pendingGroupGrants(ops: IssuanceOperations, { group }?: {
+    group?: Hab;
+}): PendingGrant[];
+/** Options for {@link waitForIssuance}. */
+export interface IssuanceWaitOptions {
+    /** Wall-clock budget. */
+    timeoutMs: number;
+    clock?: RuntimeClock;
+    /** Settle on this instead of any non-active state, e.g. a holder stopping where it needs the Admit consent. */
+    until?: (status: IssuanceStatus) => boolean;
+}
+/**
+ * Observe until the issuance is done or ended, or the budget expires. Starts no
+ * worker and drives nothing: someone else must call `processOnce`.
+ */
+export declare function waitForIssuance(ops: IssuanceOperations, grant: string, { timeoutMs, clock, until }: IssuanceWaitOptions): Operation<WaitResult<IssuanceStatus>>;
+/**
+ * The holder's consent to the DH exchange for one pending Grant addressed to a local identifier. Approves DH and records the
+ * consent; `processOnce` then answers the issuer's query, waits for its registry update and finishes the Grant.
+ * Admitting the credential is a separate consent ({@link admitIssuance}).
+ */
+export declare function approveIssuanceExchange(ops: IssuanceOperations, grant: string): IssuanceBegun;
+/** A signed Admit already accepted locally; delivery is the next, separate step. */
+export interface IssuanceAdmit {
+    admit: SerderKERI;
+    /** The holder that signed it, the sender of the delivery. */
+    src: string;
+    /** Support and Admit bytes, in delivery order. */
+    wire: Uint8Array;
+    /** The issuer the Admit answers. */
+    dest: string;
+}
+/** Choices of an Admit. */
+export interface AdmitOptions {
+    message?: string;
+    gvrsn?: Versionage;
+    auths?: WitnessAuthMap;
+}
+/**
+ * The holder's consent to admit one accepted Grant: signs the Admit, accepts it locally and records it. Works for
+ * a Grant finished by this module and for any other accepted v2 Grant. Returns
+ * before delivery so an embedder can record its own inventory first; see {@link deliverIssuanceAdmit}.
+ *
+ * @throws ValidationError for a Grant that is not accepted and addressed to a local identifier, an admitted Grant, or a group identifier.
+ */
+export declare function admitIssuance(deps: AdmitDeps, grant: string, options?: AdmitOptions): Operation<IssuanceAdmit>;
+/** Deliver an accepted Admit; needs the host's delivery worker. Returns the destinations reached. */
+export declare function deliverIssuanceAdmit(delivery: IssuanceDelivery, admitted: IssuanceAdmit): Operation<string[]>;
+/**
+ * Rebuild an Admit this process signed earlier so it can be delivered again, after a failed delivery or a
+ * restart. The wire is rebuilt from the stored signatures or source seal, so it is the bytes first made and
+ * nothing is signed. Delivery stays with {@link deliverIssuanceAdmit}. A peer that already took the Admit
+ * may drop the repeat as a replay.
+ *
+ * @throws ValidationError for an Admit no local identifier signed or whose retained factors no longer authenticate.
+ */
+export declare function rebuildIssuanceAdmit(deps: AdmitDeps, admit: string): Operation<IssuanceAdmit>;
+/**
+ * Local abandon: release the DH approval (ephemeral keys, permanent refusal of
+ * this operation) and read `abandoned` until the process ends. Does not message the peer and does
+ * not undo a retained root or a registry update that was already anchored.
+ * Does nothing to an issuance that is already done or ended.
+ *
+ * @throws ValidationError when no issuance was begun for `grant`.
+ */
+export declare function abandonIssuance(ops: IssuanceOperations, grant: string, reason?: string): void;
+export {};
+//# sourceMappingURL=issuance.d.ts.map

package/types/app/ipex/issuance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuance.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAML,UAAU,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EAEhB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAQ,KAAK,SAAS,EAAQ,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,KAAK,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,IAAI,EAA8D,MAAM,sBAAsB,CAAC;AACxG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAIzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,QAAQ,EACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,KAAK,UAAU,EAA6B,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC9G,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAEL,aAAa,EACb,KAAK,iBAAiB,EAEtB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAgB,aAAa,EAAE,KAAK,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAEjH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAEvC,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElF,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GACrB,yBAAyB,GACzB,gBAAgB,GAChB,cAAc;AAChB,wGAAwG;GACtG,yBAAyB,GACzB,gBAAgB,GAChB,SAAS,GACT,sBAAsB,CAAC;AAE3B,4HAA4H;AAC5H,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhD,qEAAqE;AACrE,MAAM,MAAM,cAAc,GACtB;IACA,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B,GACC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,GACnE;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,0GAA0G;AAC1G,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,GAAG,gBAAgB,CAYtG;AAED,uHAAuH;AACvH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,UAAU,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;KAAE,CAAC;IACzC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6HAA6H;IAC7H,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,oEAAoE;QACpE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,iGAAiG;QACjG,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;QACzB,8CAA8C;QAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0GAA0G;IAC1G,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,kHAAkH;IAClH,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,kHAAkH;AAClH,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAE/C,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;CAClB;AAqBD,mFAAmF;AACnF,UAAU,aAAa;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,gBAAgB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,kBAAkB;IAejB,QAAQ,CAAC,IAAI,EAAE,YAAY;IAdvC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,4BAAmC;IAChD,iGAAiG;IACjG,QAAQ,CAAC,KAAK,6BAAoC;IAClD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,oGAAoG;IACpG,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAQ;IAC/C,+FAA+F;IAC/F,OAAO,CAAC,SAAS,CAAK;IACtB,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,kFAAkF;IAClF,OAAO,CAAC,KAAK,CAAmB;gBAEX,IAAI,EAAE,YAAY;IAIvC,wGAAwG;IACxG,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACF,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC;IA8B/B,yGAAyG;IACzG,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMpE,kGAAkG;IAClG,OAAO,CAAC,OAAO;IASf;;;;OAIG;IACH,OAAO,CAAE,MAAM;IA2Bf,4FAA4F;IAC5F,OAAO,CAAE,KAAK;IA6Bd;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAUlB,gHAAgH;IAChH,OAAO,CAAC,SAAS;IAoBjB,OAAO,CAAE,KAAK;IAKd;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,GAAG,IAAI;IAIlD;;;;OAIG;IACH,OAAO,CAAE,KAAK;IAQd,mGAAmG;IACnG,OAAO,CAAE,OAAO;IAUhB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAMtD;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;IAmB/C,6EAA6E;IAC7E,OAAO,CAAE,IAAI;IA6Bb;;;;;;OAMG;IACH,OAAO,CAAC,OAAO;IAWf;;;OAGG;IACH,OAAO,CAAE,OAAO;IAQhB,mHAAmH;IACnH,OAAO,CAAE,MAAM;CAkBhB;AA2DD;;;;GAIG;AACH,wBAAiB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,CAe1G;AA+CD;;;;;;;;;GASG;AACH,wBAAiB,aAAa,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,cAAc,GACrB,SAAS,CAAC,aAAa,CAAC,CAyB1B;AAED;;;GAGG;AACH,wBAAiB,eAAe,CAC9B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,UAAU,EACjB,KAAK,CAAC,EAAE,cAAc,GACrB,SAAS,CAAC,aAAa,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,MAAM,GACZ,cAAc,CA2ChB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAA;CAAO,GAAG,YAAY,EAAE,CAuB1G;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAE;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GAAG,YAAY,EAAE,CAwB3G;AASD,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC;CAC7C;AAED;;;GAGG;AACH,wBAAiB,eAAe,CAC9B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,MAAM,EACb,EAAE,SAAS,EAAE,KAAsB,EAAE,KAA6C,EAAE,EAAE,mBAAmB,GACxG,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAIvC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAuB7F;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,IAAI,EAAE,UAAU,CAAC;IACjB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAiB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,SAAS,CAAC,aAAa,CAAC,CAiBnH;AAED,qGAAqG;AACrG,wBAAiB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAE9G;AAED;;;;;;;GAOG;AACH,wBAAiB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAe9F;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,SAA0B,GAAG,IAAI,CAS9G"}

package/types/app/ipex/pending-presentations.d.ts

@@ -0,0 +1,25 @@
+import type { Hab } from "../identity/habbing.js";
+import { type UnblindingOperations, type UnblindingStatus } from "./unblinding-workflow.js";
+/** A pending Grant addressed to a local identifier. */
+export interface PendingPresentation {
+    /** SAID of the Grant exchange. */
+    grant: string;
+    /** The local identifier it is addressed to. */
+    disclosee: string;
+    /** The AID that sent it. */
+    presenter: string;
+    /** SAID of the credential the Grant discloses, when its first node is one. */
+    credential?: string;
+    /** The Grant's exchange deadline (ISO 8601). */
+    deadline: string;
+    /** `active`: an Unblind is running for it; `interrupted`: none is, so consent is needed. */
+    status: UnblindingStatus;
+}
+/**
+ * The pending v2 Grants addressed to a local identifier (to `hab` when given) that are inside their deadline.
+ * Mutates nothing.
+ */
+export declare function pendingPresentations(ops: UnblindingOperations, { hab }?: {
+    hab?: Hab;
+}): PendingPresentation[];
+//# sourceMappingURL=pending-presentations.d.ts.map

package/types/app/ipex/pending-presentations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-presentations.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/pending-presentations.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAE9G,uDAAuD;AACvD,MAAM,WAAW,mBAAmB;IAClC,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAA;CAAO,GAAG,mBAAmB,EAAE,CAwBlH"}

package/types/app/ipex/presentation-files.d.ts

@@ -0,0 +1,47 @@
+import { type Operation } from "effection";
+import type { Regery } from "../../acdc/registraring.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { Reactor } from "../protocol/reactor.js";
+import type { RuntimeClock } from "../runtime/runtime-clock.js";
+import type { Receiptor } from "../witness/receipting.js";
+import type { IpexV2BodyOptions } from "./ipex-building.js";
+import { type CredentialViews, type DisclosureSelection } from "./ipex-discloser.js";
+/** A partial group file is explicit; prepared means the sender threshold, not issuer consent, is complete. */
+export interface PreparedPresentationFile {
+    grant: string;
+    wire: Uint8Array;
+    prepared: boolean;
+    deadline: string | null;
+}
+/** Grant body options of a prepared file. */
+export interface PresentationFileOptions extends IpexV2BodyOptions {
+    priorSaid?: string;
+}
+/** A completed prepared Grant imported from its file. */
+export interface ResumedPresentationFile {
+    grant: string;
+    wire: Uint8Array;
+    deadline: string;
+    /** Proof support and the completed Grant, in delivery order. */
+    delivery: Uint8Array;
+}
+/** Collaborators of the exact-file group presentation; no runtime bundle. */
+export interface PresentationFileDeps {
+    readonly hby: Habery;
+    readonly rgy: Pick<Regery, "store">;
+    readonly exc: Exchanger;
+    readonly receiptor: Receiptor;
+    readonly reactor: Pick<Reactor, "processBytes">;
+    /** Only the sender-threshold KRAM owner is read, to refuse preparation when KRAM is off. */
+    readonly protocol: Pick<ProtocolProcessor, "kvy">;
+    readonly clock: RuntimeClock;
+    /** Embedder inventory the selection reads. */
+    readonly views: CredentialViews;
+}
+/** Freeze one selected public view; a group member may append its signature to the same exact proposal file. */
+export declare function preparePresentationFile(deps: PresentationFileDeps, hab: Hab, selection: DisclosureSelection, options: PresentationFileOptions, proposal?: Uint8Array): Operation<PreparedPresentationFile>;
+/** Import only additions to an existing sender-authenticated preparation; missing issuer consent cannot be recreated. */
+export declare function resumePresentationFile(deps: PresentationFileDeps, hab: Hab, said: string, raw: Uint8Array): Operation<ResumedPresentationFile>;
+//# sourceMappingURL=presentation-files.d.ts.map

package/types/app/ipex/presentation-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-files.d.ts","sourceRoot":"","sources":["../../../src/app/ipex/presentation-files.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAIzD,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAA+B,MAAM,qBAAqB,CAAC;AAElH,8GAA8G;AAC9G,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAqGD,gHAAgH;AAChH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,oBAAoB,EAC1B,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,mBAAmB,EAC9B,OAAO,EAAE,uBAAuB,EAChC,QAAQ,CAAC,EAAE,UAAU,GACpB,SAAS,CAAC,wBAAwB,CAAC,CAiDrC;AACD,yHAAyH;AACzH,wBAAiB,sBAAsB,CACrC,IAAI,EAAE,oBAAoB,EAC1B,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,UAAU,GACd,SAAS,CAAC,uBAAuB,CAAC,CAqCpC"}