@interop/wallet-core 0.61.0 → 0.65.0

package/dist/unlock/standingWebvh.d.ts

@@ -1,6 +1,8 @@
 import type { DIDDoc, DIDLog, VerificationMethod } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import { type LadderStandingInventory } from '../clientAnnex/ladder.js';
 /**
  * The narrow store seam the self-enrolling and delegated-bridge ceremonies
  * write through: a public read of the log and the delegated `did.jsonl` PUT.
@@ -8,6 +10,87 @@ import type { ResourceLogPinStore } from '@interop/vh-resource-log';
  * it too.
  */
 export type UnlockLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+/**
+ * Which half of a credential's inventory one bind entry carries. `'all'` is
+ * the merged entry: the `keyAgreement` member, the update-key commitment, and
+ * the ladder VM together. The split halves exist for a ceremony that must
+ * land the credential's decryption material before its authority: `'key'`
+ * publishes the `keyAgreement` member alone, `'authority'` installs the
+ * ladder VM and commits the rung-0 hash.
+ */
+export type UnlockInventoryPart = 'all' | 'key' | 'authority';
+/**
+ * The ladder inventory the removal edit resolved from the log diverges from
+ * what the caller was told one read earlier. A ceremony that names its
+ * expected ladder VM ids (the retirement's stage 0, which hands the same list
+ * to the dependent-record re-mint pass) gets this refusal BEFORE the edit is
+ * published, so a concurrent ceremony -- or a host serving different log
+ * versions to the two reads -- cannot make the strike diverge from what the
+ * re-mint pass acted on. Nothing is written. Matched on `name` (the error
+ * crosses app-injected seams that may resolve to another copy of this
+ * package).
+ */
+export declare class LadderInventoryDriftError extends Error {
+    readonly expected: string[];
+    readonly attributed: string[];
+    constructor({ expected, attributed }: {
+        expected: string[];
+        attributed: string[];
+    });
+}
+/**
+ * A retirement whose ladder attribution could not claim the retired
+ * credential's ladder VM, refused with nothing written. The shape is the
+ * seedless strike claiming nothing: the credential still stands in the
+ * document, the walk struck no ladder VM, and ladder VMs stand there that it
+ * could not claim. A leftover VM would keep the retired credential's
+ * delegation authority alive -- under `capabilityDelegation` it can still
+ * sign a DELETE-only capability on the account Space -- and nothing
+ * downstream can tell such a leftover from a sibling credential's standing
+ * VM, so the retirement is the one place the state can be closed
+ * (`decisions/0015`).
+ *
+ * `unclaimedLadderVmIds` names every ladder VM the walk left unclaimed, and
+ * `anchorKeyMultibase` the update key the walk was anchored on (a recovery
+ * code's revocation anchors on the rung-0 multibase the registry recorded at
+ * issuance). On a
+ * multi-credential account that list carries the siblings' VMs beside the
+ * retired credential's, since telling them apart is exactly what the walk
+ * could not do. `retryableWithLadderSeed` says whether a retry supplying the
+ * credential's ladder seed can let attribution succeed. The gate raises this
+ * error only from a seedless claim (a seeded one either strikes the derived
+ * VM or proves there is none), so the hint is `true` from this library; the
+ * member is the wallets' read for the retry they offer.
+ * Matched on `name` (the error crosses app-injected seams that may resolve
+ * to another copy of this package).
+ */
+export declare class UnclaimedLadderVmRetirementError extends Error {
+    readonly unclaimedLadderVmIds: string[];
+    readonly retryableWithLadderSeed: boolean;
+    readonly anchorKeyMultibase?: string;
+    constructor({ unclaimedLadderVmIds, retryableWithLadderSeed, anchorKeyMultibase }: {
+        unclaimedLadderVmIds: string[];
+        retryableWithLadderSeed: boolean;
+        anchorKeyMultibase?: string;
+    });
+}
+/**
+ * What the removal edit says about ladder VMs: `struck`, the ids this entry
+ * removed from the document, and `unclaimed`, the ladder VMs still standing
+ * afterwards that this credential's attribution could not claim.
+ *
+ * `unclaimed` is information, and the caller cannot read an orphan out of it
+ * by subtraction alone: a VM standing here may perfectly well be a SIBLING
+ * credential's, which this ladder has no business claiming. The gate that
+ * refuses the seedless strike claiming nothing is narrower
+ * ({@link assertLadderVmClaimed}): it reads `struck` empty beside a
+ * non-empty `unclaimed` while the credential itself still stands, and it
+ * runs only for a credential that carries a ladder.
+ */
+export interface LadderVmRemovalReport {
+    struck: string[];
+    unclaimed: string[];
+}
 /**
  * How a credential's key-agreement key is published in the document: the key
  * verbatim (a high-entropy credential -- passkey PRF, recovery code), or its
@@ -23,7 +106,7 @@ export type UnlockKeyAgreementPublication = {
 /**
  * A standing credential's public inventory as the document and log carry it:
  * its key-agreement publication and the update key whose hash stands in
- * `nextKeyHashes` (ladder rung 0 at bind time; a code's single derived key).
+ * `nextKeyHashes` (ladder rung 0 at bind time, for every credential kind).
  */
 export interface StandingUnlockKeys {
     keyAgreement: UnlockKeyAgreementPublication;
@@ -44,6 +127,161 @@ export declare function unlockKeyVmId({ did, keyAgreement }: {
     did: string;
     keyAgreement: UnlockKeyAgreementPublication;
 }): string;
+/**
+ * What of a standing credential's ladder currently stands in the published
+ * log, resolved with the recorded update key as ANCHOR and the credential's
+ * own key-agreement id as the attribution's second arm. The removal edit uses
+ * it to know what to strike; the retirement ceremony uses it one stage
+ * earlier, to name the ladder VM it is about to strike to the pass that
+ * re-mints whatever that VM signed for other credentials.
+ *
+ * It lives here rather than in the ceremony because this module is the one
+ * base-side holder of the annex attribution helpers (the pinned lint
+ * exception).
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   a resolved, caller-verified log
+ * @param options.did {string}   the account DID the log resolves to
+ * @param options.unlockKeys {StandingUnlockKeys}   the credential's recorded
+ *   public inventory
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed,
+ *   when the ceremony holds it
+ * @returns {Promise<LadderStandingInventory>}
+ */
+export declare function attributeUnlockLadderInventory({ log, did, unlockKeys, ladderSeed }: {
+    log: DIDLog;
+    did: string;
+    unlockKeys: StandingUnlockKeys;
+    ladderSeed?: Uint8Array;
+}): Promise<LadderStandingInventory>;
+/**
+ * What of the document's ladder VMs a credential's attribution claims: the
+ * VM its seed derives (when the ceremony holds one), plus every VM the log
+ * attributes to its ladder. Resolved once here and shared by the removal
+ * edit, the retirement ceremony's pre-edit stage, and the read-only
+ * pre-flight, so the three agree on what is struck and what is left.
+ *
+ * `struck` is what the removal edit strikes: the derived id when it stands,
+ * and the attributed ids. `unclaimed` is every ladder VM standing in the
+ * document that neither the seed nor the attribution claims -- on a
+ * multi-credential account, the siblings' VMs at least. A supplied seed also
+ * cross-checks the attribution: a log attributing a VM the seed does not
+ * derive refuses with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the document the attribution ran over
+ * @param options.did {string}   the account DID
+ * @param options.inventory {LadderStandingInventory}   the credential's
+ *   attributed ladder inventory ({@link attributeUnlockLadderInventory})
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed
+ * @returns {Promise<{ ladderVmId?: string, struck: string[], unclaimed:
+ *   string[] }>}   the seed-derived VM id when a seed was held
+ */
+export declare function ladderVmClaimOf({ doc, did, inventory, ladderSeed }: {
+    doc: DIDDoc;
+    did: string;
+    inventory: LadderStandingInventory;
+    ladderSeed?: Uint8Array;
+}): Promise<{
+    ladderVmId?: string;
+    struck: string[];
+    unclaimed: string[];
+}>;
+/**
+ * The retirement gate (`decisions/0015`): refuses, with
+ * {@link UnclaimedLadderVmRetirementError}, a retirement of a
+ * ladder-carrying credential whose SEEDLESS claim struck nothing while a
+ * ladder VM that COULD BE THIS CREDENTIAL'S stands unclaimed and the
+ * credential itself still stands in the document. Deliberately narrower than
+ * "`unclaimed` is non-empty", which every retirement on a healthy
+ * multi-credential account produces, and narrower again than the standing
+ * unclaimed set: a sibling credential's VM is nothing this retirement could
+ * leave behind.
+ *
+ * Which unclaimed VMs are candidates is
+ * {@link ladderVmIdsIntroducedWithCredential}'s question, read off the log's
+ * entry shapes rather than off an attribution that has already refused: a VM
+ * introduced by the entry that introduced this credential's `keyAgreement`
+ * member, or by the entry that committed or authorized its anchor (the split
+ * bind, whose key and authority entries sit two versions apart). None, and
+ * the credential never had a VM to leave standing, so the retirement
+ * completes and strikes what it can. That is the torn issuance's orphan -- a
+ * credential with a `keyAgreement` member, no ladder VM, and no committed
+ * rung -- which previously could never be removed at all, since a sibling's
+ * standing VM refused it forever.
+ *
+ * Two shapes pass ahead of that. A credential whose `keyAgreement` member is
+ * already gone is a completed retirement re-running. And a claim resolved
+ * WITH the seed never refuses: the derived VM is either standing (and
+ * struck) or absent, and an absent derived VM is proof the credential has
+ * nothing to claim -- the last-client transition torn between its strike and
+ * reinstall entries leaves exactly that, and a seeded retirement there must
+ * complete rather than wait on the transition's re-run. So the error's retry
+ * hint is `true` whenever this gate raises it.
+ *
+ * The caller decides whether the credential carries a ladder.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified log the claim was resolved over
+ * @param options.doc {DIDDoc}   the document the claim was resolved over
+ * @param options.credentialVmId {string}   the credential's `keyAgreement`
+ *   verification-method id ({@link unlockKeyVmId})
+ * @param options.claim {{ ladderVmId?: string, struck: string[], unclaimed:
+ *   string[] }}   from {@link ladderVmClaimOf}
+ * @param [options.anchorKeyMultibase] {string}   the update key the walk was
+ *   anchored on: the candidate reading's second anchor form, and named in
+ *   the refusal
+ * @returns {Promise<void>}
+ */
+export declare function assertLadderVmClaimed({ log, doc, credentialVmId, claim, anchorKeyMultibase }: {
+    log: DIDLog;
+    doc: DIDDoc;
+    credentialVmId: string;
+    claim: {
+        ladderVmId?: string;
+        struck: string[];
+        unclaimed: string[];
+    };
+    anchorKeyMultibase?: string;
+}): Promise<void>;
+/**
+ * The retirement gate run read-only, before anything is written: one pinned
+ * read of the account log, the credential's ladder attribution, and
+ * {@link assertLadderVmClaimed} over the result. A caller that establishes a
+ * replacement credential before it retires the old one (a passphrase change,
+ * a tap-confirmed passkey removal) runs this first, so a gate refusal lands
+ * the way an invalid-input check does -- nothing established, no
+ * pending-shaped registry entry written -- rather than after establishment,
+ * where the refusal would leave a torn state no seedless repair can clear.
+ * The in-ceremony gate stays as defense in depth, and it is what answers a
+ * log entry landing between the pre-flight and the retirement: the
+ * pre-flight's verdict holds for the head it read, and nothing binds the two
+ * reads.
+ *
+ * @param options {object}
+ * @param options.idStore {UnlockLogStore}   the account's `id` collection
+ *   read side
+ * @param options.unlockKeys {StandingUnlockKeys}   the credential's recorded
+ *   public inventory
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed,
+ *   when the caller holds it
+ * @param [options.expectedDid] {string}   the account DID the log must
+ *   resolve to
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins
+ * @param [options.logId] {string}   the account log's pin slot; required
+ *   whenever a `pinStore` is supplied
+ * @returns {Promise<LadderVmRemovalReport>}   what the retirement would
+ *   strike and what it would leave unclaimed
+ */
+export declare function preflightUnlockCredentialRetirement({ idStore, unlockKeys, ladderSeed, expectedDid, pinStore, logId }: {
+    idStore: Pick<WebvhIdStore, 'getIdResourceRaw'>;
+    unlockKeys: StandingUnlockKeys;
+    ladderSeed?: Uint8Array;
+    expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
+}): Promise<LadderVmRemovalReport>;
 /**
  * The credential's `keyAgreement` verification method: an ordinary unmarked
  * entry carrying either the key verbatim (a `Multikey` with
@@ -64,43 +302,46 @@ export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
     did: string;
     keyAgreement: UnlockKeyAgreementPublication;
 }): VerificationMethod;
-/**
- * Reads and resolves the published log through the narrow store seam.
- *
- * @param options {object}
- * @param options.store {UnlockLogStore}
- * @param [options.expectedDid] {string}   the account DID the log must resolve
- *   to, where the caller holds one
- * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
- *   pins; a served log that is a rollback, a fork, or an identity switch
- *   against the pinned head is refused (`ResourceLogContinuityError`)
- * @param [options.logId] {string}   the account log's pin slot
- *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
- *   supplied
- * @returns {Promise<PublishedWebvhLog>}
- */
-export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }: {
-    store: UnlockLogStore;
-    expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
-}): Promise<PublishedWebvhLog>;
 /**
  * BIND (run by an enrolled client, root authority): publishes a standing
  * credential's split configuration into the document -- one entry adding the
- * credential's `keyAgreement` entry (verbatim or commitment) and committing
- * its current update key's hash in `nextKeyHashes`. The update key joins
- * `updateKeys` nowhere. Idempotent: an inventory already published is a no-op,
- * so re-running a torn bind converges. The entry publishes conditionally on
- * the log this call read; a race lost to a concurrent ceremony re-runs and
- * rebases on the new head.
+ * credential's `keyAgreement` entry (verbatim or commitment), committing its
+ * current update key's hash in `nextKeyHashes`, and installing its LADDER VM
+ * under `assertionMethod` and `capabilityDelegation`, and under no other
+ * relation -- the asymmetry that recognizes it. The update key joins `updateKeys` nowhere.
+ * One entry for the whole inventory: a separate install would open a window
+ * in which the credential stands without the key it signs with.
+ *
+ * The ladder seed is the CALLER's to mint and to have already written
+ * durably. This function never mints one, so a torn bind's re-run tests
+ * idempotence against the SAME seed, finds the completed stage and publishes
+ * nothing -- where a mint-when-absent would publish a second VM that no
+ * anchored attribution could later strike. A credential with no ladder at all
+ * passes `null` and gets no VM.
+ *
+ * `part` splits the bind across two entries where a ceremony needs the
+ * credential's decryption material to precede its authority: `'key'`
+ * publishes the `keyAgreement` member alone, `'authority'` installs the
+ * ladder VM and commits the rung-0 hash, and `'all'` (the default) is the one
+ * merged entry every other caller writes.
+ *
+ * Idempotent: an inventory already published is a no-op, so re-running a torn
+ * bind converges. The entry publishes conditionally on the log this call
+ * read; a race lost to a concurrent ceremony re-runs and rebases on the new
+ * head.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the BINDING client's own
- *   did:webvh update-key seeds
+ * @param options.signer {AccountLogSigner}   who signs the entry: the BINDING
+ *   client's own did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the credential's public
  *   inventory
+ * @param options.ladderSeed {Uint8Array | null}   the credential's ladder
+ *   seed, whose VM this entry installs; `null` for a credential that carries
+ *   no ladder
+ * @param [options.part] {string}   `'all'` (the default), `'key'`, or
+ *   `'authority'` -- see above
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, from the caller's stored account pointer
  * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
@@ -118,8 +359,10 @@ export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }:
  */
 export declare function publishUnlockKey(options: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     unlockKeys: StandingUnlockKeys;
+    ladderSeed: Uint8Array | null;
+    part?: UnlockInventoryPart;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;
@@ -146,31 +389,79 @@ export declare function publishUnlockKey(options: {
  * rung key still sitting in `updateKeys` (plus the never-claimed hashes its
  * reveal entry committed). Trusting the recorded multibase alone would leave
  * the live rung commitment standing: a latent re-seizure credential via the
- * reveal mechanism. A supplied `ladderSeed` strengthens the attribution (every
- * rung known a priori, independent of the anchor's staleness); without it the
- * log walk alone resolves the inventory. For a single-key credential (a
+ * reveal mechanism. The seedless walk recovers the rungs BEHIND the anchor
+ * too, reading the log's positional rules backwards, so an anchor advanced by
+ * a self-enrollment resolves the same inventory a bind-time anchor does
+ * wherever each rung's hash was committed by an entry that also revealed the
+ * previous rung, or by a handover. One reachable shape falls outside that: a
+ * ladder VM the last-client transition reinstalled, whose acting rung a later
+ * self-enrollment then spends. That reveal-and-commit entry authorizes no key,
+ * so the backward walk cannot name the rung that signed it, and the VM stays
+ * standing as `unclaimed` (WC-158). A supplied `ladderSeed` is then a shortcut
+ * and a cross-check rather than a requirement (every rung known outright, no
+ * backward walk). For a
+ * single-key credential (a
  * recovery code, a never-self-enrolled bind) the resolution degenerates to
  * exactly the recorded key's hash, as before.
  *
- * The seed also names the credential's LADDER VM -- the stable sibling a
- * last-client forget's install entry publishes under `assertionMethod` and
- * `capabilityDelegation`, left standing by a forget torn after that entry --
- * and the removal strikes it in the same entry, so a retired seed no longer
- * signs governed-log appends or account delegations. The sibling is derived
- * from the seed alone, with nothing in the log attributing it to a ladder, so
- * a removal without the seed leaves it: rotation is the remedy for a leaked
- * seed exactly when the ceremony holds the credential.
- *
- * @param options {object}   see {@link publishUnlockKey}, plus
- *   `[ladderSeed]` -- the retired credential's ladder seed, when in hand
- * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
- *   {@link publishUnlockKey}
+ * The credential's LADDER VM goes in the same entry, so a retired credential
+ * no longer signs governed-log appends or account delegations. This is the
+ * sole remover, and it needs no seed to do it: the VM is attributed from the
+ * log on any of three arms ({@link attributeLadderInventory}). The SIGNER
+ * arm claims a VM whose publishing entry a ladder rung signed. The
+ * CO-INTRODUCTION arm claims one whose publishing entry also introduced this
+ * credential's own `keyAgreement` member, which is what reaches a bind entry
+ * an enrolled client signed; it fires only when that entry introduced exactly
+ * one credential-class key-agreement member and exactly one ladder VM. The
+ * COMMITMENT arm claims one whose publishing entry committed a hash this
+ * ladder knows a priori and introduced no other credential's member, which is
+ * what reaches a reinstall for a credential whose member already stands. A VM
+ * no arm claims is left standing rather than struck -- on an account
+ * with several standing credentials, striking an unattributed key would take
+ * out a survivor's. With the seed in hand the derived id is struck too, and
+ * an attribution naming any OTHER VM refuses with
+ * {@link LadderAttributionError} rather than acting on a ladder the seed and
+ * the recorded anchor disagree about.
+ *
+ * @param options {object}   see {@link publishUnlockKey}, plus:
+ * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
+ *   seed, when in hand
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through (a transient session's, bound to its generation
+ *   delegation; an enrolled client's own root-invoking store). Supplied, the
+ *   post-strike `did:web` projection is PUT through it immediately BEFORE
+ *   this entry publishes, which is what keeps a ladder-signed removal from
+ *   leaving `did.json` naming the retired credential. Best-effort: a failed
+ *   PUT is warned and the removal proceeds. Omitted, the ladder arm leaves
+ *   the projection to the next visit's `ensureDidWebProjection` and the
+ *   client arm publishes it after the entry, as before
+ * @param [options.expectedLadderVmIds] {string[]}   the ladder VM ids the
+ *   caller already resolved for this credential, from its own read of the
+ *   log. Supplied, this edit's own attribution must match them as a set --
+ *   after the seed cross-check above -- or the edit refuses with
+ *   {@link LadderInventoryDriftError} before writing anything. That is what
+ *   ties the retirement's stage-0 read (whose list the dependent-record
+ *   re-mint pass acted on) to this one, which is otherwise independent
+ * @param [options.requireLadderVmClaim] {boolean}   the credential carries a
+ *   ladder, so its VM must be claimed: the edit refuses with
+ *   {@link UnclaimedLadderVmRetirementError} before writing when the claim
+ *   struck nothing while ladder VMs stand unclaimed and the credential still
+ *   stands ({@link assertLadderVmClaimed}). The retirement ceremony sets it,
+ *   and so does a recovery code's removal, whose inventory carries the code's
+ *   own ladder VM. The refusal names the recorded update key the walk was
+ *   anchored on
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog, ladderVm:
+ *   LadderVmRemovalReport }>}   see {@link publishUnlockKey}, plus the ladder
+ *   VM report: what this entry struck, and what stands unclaimed after it
  */
 export declare function removeUnlockKey(options: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
+    expectedLadderVmIds?: string[];
+    requireLadderVmClaim?: boolean;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;
@@ -179,5 +470,6 @@ export declare function removeUnlockKey(options: {
     did: string;
     doc: DIDDoc;
     log: DIDLog;
+    ladderVm: LadderVmRemovalReport;
 }>;
 //# sourceMappingURL=standingWebvh.d.ts.map

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAalC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAYnE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,cAAc,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AASlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAMnE,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,WAAW,CAAA;AAE7D;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;gBAEjB,EACV,QAAQ,EACR,UAAU,EACX,EAAE;QACD,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,EAAE,MAAM,EAAE,CAAA;KACrB;CAYF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;gBAExB,EACV,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EACnB,EAAE;QACD,oBAAoB,EAAE,MAAM,EAAE,CAAA;QAC9B,uBAAuB,EAAE,OAAO,CAAA;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B;CAmBF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,UAAU,EACV,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAUnC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,GAAG,EACH,SAAS,EACT,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,uBAAuB,CAAA;IAClC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+B1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,GAAG,EACH,GAAG,EACH,cAAc,EACd,KAAK,EACL,kBAAkB,EACnB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mCAAmC,CAAC,EACxD,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;IAC/C,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgCjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,qBAAqB,CAAA;CAChC,CAAC,CAID"}