@fuzdev/fuz_app 0.146.1 → 0.147.0

package/dist/auth/CLAUDE.md

@@ -31,7 +31,7 @@ over the pool so rows persist when request transactions roll back. See root
 
 ### Crypto primitives (pure, I/O-free)
 
-- `auth/keyring.ts` — `Keyring`, `create_keyring`, `validate_keyring`, `create_validated_keyring`.
+- `auth/keyring.ts` — `Keyring`, `create_keyring` (validates — the one way to build a `Keyring`), `validate_keyring`.
 - `auth/session_cookie.ts` — `SessionOptions<T>`, `parse_session`, `process_session_cookie` (`'none' | 'clear'` — no refresh action; the 30-day lifetime is an absolute cap signed once at mint), `create_session_config`, `fuz_session_config`, `SESSION_AGE_MAX`.
 - `auth/password.ts` — `Password`, `PasswordProvided`, `PasswordHashDeps`, `PASSWORD_LENGTH_MIN` (12, OWASP), `PASSWORD_LENGTH_MAX` (300).
 - `auth/password_argon2.ts` — `hash_password`, `verify_password`, `verify_dummy`, `argon2_password_deps`.

package/dist/auth/bootstrap_account.d.ts

@@ -72,7 +72,8 @@ export interface BootstrapAccountDeps {
  * Uses an atomic `bootstrap_lock` UPDATE to prevent concurrent bootstrap
  * attempts (TOCTOU). The full flow runs in a single transaction:
  *
- * 1. Read and verify the bootstrap token (before transaction)
+ * 1. Read and verify the bootstrap token (before transaction) — the file's
+ *    raw bytes less one optional trailing LF, compared in constant time
  * 2. Hash the password (CPU-intensive, before transaction)
  * 3. Acquire the bootstrap lock atomically (inside transaction)
  * 4. Create account + actor

package/dist/auth/bootstrap_account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CA2EhC,CAAC"}
+{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CA6EhC,CAAC"}

package/dist/auth/bootstrap_account.js

@@ -12,13 +12,24 @@ import { ERROR_INVALID_TOKEN, ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSI
 import { ROLE_ADMIN, ROLE_KEEPER } from './role_schema.js';
 import { query_create_account_with_actor } from './account_queries.js';
 import { query_create_role_grant } from './role_grant_queries.js';
+/**
+ * Strip exactly one trailing `\n` from the operator-written token bytes.
+ *
+ * Not `trim()`: trimming widens the set of accepted tokens — `tok\r\n`,
+ * `tok  \n`, or a leading newline would all pass. One trailing LF is the
+ * newline a POSIX editor appends; anything else stays in the bytes and fails
+ * the compare, so operators write the token exactly. Twin of the Rust
+ * `strip_one_trailing_newline` (`fuz_auth`).
+ */
+const strip_one_trailing_newline = (bytes) => bytes.at(-1) === 0x0a ? bytes.subarray(0, -1) : bytes;
 /**
  * Bootstrap the first account with keeper and admin privileges.
  *
  * Uses an atomic `bootstrap_lock` UPDATE to prevent concurrent bootstrap
  * attempts (TOCTOU). The full flow runs in a single transaction:
  *
- * 1. Read and verify the bootstrap token (before transaction)
+ * 1. Read and verify the bootstrap token (before transaction) — the file's
+ *    raw bytes less one optional trailing LF, compared in constant time
  * 2. Hash the password (CPU-intensive, before transaction)
  * 3. Acquire the bootstrap lock atomically (inside transaction)
  * 4. Create account + actor
@@ -41,17 +52,17 @@ export const bootstrap_account = async (deps, provided_token, input) => {
     // wire always carried, with the specific reason logged for the operator.
     let expected_token;
     try {
-        expected_token = new TextDecoder().decode(await read_secure_file(token_path)).trim();
+        expected_token = strip_one_trailing_newline(await read_secure_file(token_path));
     }
     catch (err) {
         log.warn(`bootstrap token file rejected: ${to_error_message(err)}`);
         return { ok: false, error: ERROR_TOKEN_FILE_MISSING, status: 404 };
     }
-    // Defense-in-depth: no .trim() on provided_token — tokens must match exactly.
-    // The expected_token is already trimmed above.
+    // raw bytes on both sides, nothing trimmed — the provided token must be the
+    // file's bytes exactly, less the one newline an editor appends
     const provided_buf = Buffer.from(provided_token);
-    const expected_buf = Buffer.from(expected_token);
-    if (provided_buf.length !== expected_buf.length || !timingSafeEqual(provided_buf, expected_buf)) {
+    if (provided_buf.length !== expected_token.length ||
+        !timingSafeEqual(provided_buf, expected_token)) {
         return { ok: false, error: ERROR_INVALID_TOKEN, status: 401 };
     }
     // 2. Hash password (CPU-intensive, before transaction)

package/dist/auth/keyring.d.ts

@@ -7,12 +7,12 @@
  *
  * @example
  * ```ts
- * const keyring = create_keyring(process.env.SECRET_FUZ_COOKIE_KEYS);
- * if (!keyring) throw new Error('No keys configured');
+ * const result = create_keyring(process.env.SECRET_FUZ_COOKIE_KEYS);
+ * if (!result.ok) throw new Error(`SECRET_FUZ_COOKIE_KEYS: ${result.errors.join('; ')}`);
  *
- * const signed = await keyring.sign('user:123:1700000000');
- * const result = await keyring.verify(signed);
- * // result = { value: 'user:123:1700000000', key_index: 0 }
+ * const signed = await result.keyring.sign('user:123:1700000000');
+ * const verified = await result.keyring.verify(signed);
+ * // verified = { value: 'user:123:1700000000', key_index: 0 }
  * ```
  *
  * @module
@@ -38,24 +38,42 @@ export interface Keyring {
     } | null>;
 }
 /**
- * Create a keyring from environment variable.
+ * Result of `create_keyring`.
+ * Discriminated union — callers handle the error case their own way.
+ */
+export type CreateKeyringResult = {
+    ok: true;
+    keyring: Keyring;
+} | {
+    ok: false;
+    errors: Array<string>;
+};
+/**
+ * Validate a keys value and create a keyring from it — the one way to build a
+ * `Keyring`.
  *
- * Keys are separated by `__` for rotation support. First key is used
- * for signing, all keys are tried for verification.
+ * Keys are separated by `__` for rotation support; empty entries are skipped.
+ * The first key signs, every key verifies. A value with no key, or with any key
+ * shorter than `MIN_KEY_LENGTH` characters, is refused with every reason
+ * (`validate_keyring`), so a weak key fails loud at startup rather than signing
+ * cookies. Twin of the Rust `Keyring::new`.
  *
- * CryptoKeys are cached on first use for performance.
+ * Returns a discriminated union so callers handle exit/logging their own way
+ * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`). CryptoKeys are cached on first use.
  *
- * **Security: key rotation is an operational concern.** Old keys remain valid
- * for verification indefinitely — a leaked old key can forge session cookies
- * until it is removed from `SECRET_FUZ_COOKIE_KEYS`. After rotating to a new
- * signing key, remove the old key within a grace period (e.g. 24–48 hours,
- * long enough for active sessions to re-sign with the new key via cookie
- * refresh). Treat `SECRET_FUZ_COOKIE_KEYS` changes as security-critical deploys.
+ * **Key rotation is an operational concern.** Put the new key first and keep
+ * the old one after it: new cookies are signed with the new key, and cookies
+ * the old key signed keep verifying. Nothing re-signs a cookie, so an old key
+ * stays live until the last cookie it signed expires — `SESSION_AGE_MAX` after
+ * the rotation — and dropping it sooner signs out every session it still
+ * carries. A key that leaked is dropped at once, since it can forge cookies for
+ * as long as it is listed. Treat `SECRET_FUZ_COOKIE_KEYS` changes as
+ * security-critical deploys.
  *
  * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
- * @returns keyring or null if no keys configured
+ * @returns `{ok: true, keyring}` or `{ok: false, errors}`
  */
-export declare const create_keyring: (env_value: string | undefined) => Keyring | null;
+export declare const create_keyring: (env_value: string | undefined) => CreateKeyringResult;
 /**
  * Validate key ring configuration.
  *
@@ -67,25 +85,4 @@ export declare const create_keyring: (env_value: string | undefined) => Keyring
  * @returns array of validation errors (empty if valid)
  */
 export declare const validate_keyring: (env_value: string | undefined) => Array<string>;
-/**
- * Result of `create_validated_keyring`.
- * Discriminated union — callers handle the error case their own way.
- */
-export type ValidatedKeyringResult = {
-    ok: true;
-    keyring: Keyring;
-} | {
-    ok: false;
-    errors: Array<string>;
-};
-/**
- * Validate and create a keyring in one step.
- *
- * Returns a discriminated union so callers handle exit/logging their own way
- * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`).
- *
- * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
- * @returns `{ok: true, keyring}` or `{ok: false, errors}`
- */
-export declare const create_validated_keyring: (env_value: string | undefined) => ValidatedKeyringResult;
 //# sourceMappingURL=keyring.d.ts.map

package/dist/auth/keyring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyring.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB;;;OAGG;IACH,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;OAIG;IACH,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACvF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,OAAO,GAAG,IAiCxE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAc5E,CAAC;AA6CF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,sBAUxE,CAAC"}
+{"version":3,"file":"keyring.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB;;;OAGG;IACH,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;OAIG;IACH,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACvF;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,mBAmC9D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAc5E,CAAC"}

package/dist/auth/keyring.js

@@ -7,41 +7,58 @@
  *
  * @example
  * ```ts
- * const keyring = create_keyring(process.env.SECRET_FUZ_COOKIE_KEYS);
- * if (!keyring) throw new Error('No keys configured');
+ * const result = create_keyring(process.env.SECRET_FUZ_COOKIE_KEYS);
+ * if (!result.ok) throw new Error(`SECRET_FUZ_COOKIE_KEYS: ${result.errors.join('; ')}`);
  *
- * const signed = await keyring.sign('user:123:1700000000');
- * const result = await keyring.verify(signed);
- * // result = { value: 'user:123:1700000000', key_index: 0 }
+ * const signed = await result.keyring.sign('user:123:1700000000');
+ * const verified = await result.keyring.verify(signed);
+ * // verified = { value: 'user:123:1700000000', key_index: 0 }
  * ```
  *
  * @module
  */
 const KEY_SEPARATOR = '__';
 const MIN_KEY_LENGTH = 32;
+/**
+ * The one spelling of an HMAC-SHA256 signature the keyring accepts: 32 bytes as
+ * padded standard base64 — 43 characters, the last holding the final 2 bits
+ * with zero low bits, then one `=`. Stricter than `atob`, which skips
+ * whitespace, accepts missing padding, and ignores trailing bits, so several
+ * strings would otherwise verify as one signature. Matches the Rust twin's
+ * strict decode.
+ */
+const SIGNATURE_BASE64_PATTERN = /^[A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=$/;
 const encoder = new TextEncoder();
 /**
- * Create a keyring from environment variable.
+ * Validate a keys value and create a keyring from it — the one way to build a
+ * `Keyring`.
  *
- * Keys are separated by `__` for rotation support. First key is used
- * for signing, all keys are tried for verification.
+ * Keys are separated by `__` for rotation support; empty entries are skipped.
+ * The first key signs, every key verifies. A value with no key, or with any key
+ * shorter than `MIN_KEY_LENGTH` characters, is refused with every reason
+ * (`validate_keyring`), so a weak key fails loud at startup rather than signing
+ * cookies. Twin of the Rust `Keyring::new`.
  *
- * CryptoKeys are cached on first use for performance.
+ * Returns a discriminated union so callers handle exit/logging their own way
+ * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`). CryptoKeys are cached on first use.
  *
- * **Security: key rotation is an operational concern.** Old keys remain valid
- * for verification indefinitely — a leaked old key can forge session cookies
- * until it is removed from `SECRET_FUZ_COOKIE_KEYS`. After rotating to a new
- * signing key, remove the old key within a grace period (e.g. 24–48 hours,
- * long enough for active sessions to re-sign with the new key via cookie
- * refresh). Treat `SECRET_FUZ_COOKIE_KEYS` changes as security-critical deploys.
+ * **Key rotation is an operational concern.** Put the new key first and keep
+ * the old one after it: new cookies are signed with the new key, and cookies
+ * the old key signed keep verifying. Nothing re-signs a cookie, so an old key
+ * stays live until the last cookie it signed expires — `SESSION_AGE_MAX` after
+ * the rotation — and dropping it sooner signs out every session it still
+ * carries. A key that leaked is dropped at once, since it can forge cookies for
+ * as long as it is listed. Treat `SECRET_FUZ_COOKIE_KEYS` changes as
+ * security-critical deploys.
  *
  * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
- * @returns keyring or null if no keys configured
+ * @returns `{ok: true, keyring}` or `{ok: false, errors}`
  */
 export const create_keyring = (env_value) => {
+    const errors = validate_keyring(env_value);
+    if (errors.length > 0)
+        return { ok: false, errors };
     const secrets = parse_keys(env_value);
-    if (secrets.length === 0)
-        return null;
     // Cache CryptoKey promises - imported once on first use
     const key_cache = [];
     const get_key = (index) => {
@@ -51,7 +68,7 @@ export const create_keyring = (env_value) => {
         return key_cache[index];
     };
     // Create the opaque key ring - secrets captured in closure, never exposed
-    return {
+    const keyring = {
         async sign(value) {
             const key = await get_key(0);
             return sign_with_crypto_key(value, key);
@@ -67,6 +84,7 @@ export const create_keyring = (env_value) => {
             return null;
         }
     };
+    return { ok: true, keyring };
 };
 /**
  * Validate key ring configuration.
@@ -105,41 +123,16 @@ const verify_with_crypto_key = async (signed_value, key) => {
         return false;
     const value = signed_value.slice(0, dot_index);
     const signature_base64 = signed_value.slice(dot_index + 1);
-    let signature;
-    try {
-        const decoded = atob(signature_base64);
-        const bytes = new Uint8Array(decoded.length);
-        for (let i = 0; i < decoded.length; i++) {
-            bytes[i] = decoded.charCodeAt(i);
-        }
-        signature = bytes.buffer;
-    }
-    catch {
+    if (!SIGNATURE_BASE64_PATTERN.test(signature_base64))
         return false;
+    const decoded = atob(signature_base64);
+    const bytes = new Uint8Array(decoded.length);
+    for (let i = 0; i < decoded.length; i++) {
+        bytes[i] = decoded.charCodeAt(i);
     }
-    const valid = await crypto.subtle.verify('HMAC', key, signature, encoder.encode(value));
+    const valid = await crypto.subtle.verify('HMAC', key, bytes, encoder.encode(value));
     return valid ? value : false;
 };
-/**
- * Validate and create a keyring in one step.
- *
- * Returns a discriminated union so callers handle exit/logging their own way
- * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`).
- *
- * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
- * @returns `{ok: true, keyring}` or `{ok: false, errors}`
- */
-export const create_validated_keyring = (env_value) => {
-    const errors = validate_keyring(env_value);
-    if (errors.length > 0) {
-        return { ok: false, errors };
-    }
-    const keyring = create_keyring(env_value);
-    if (!keyring) {
-        return { ok: false, errors: ['SECRET_FUZ_COOKIE_KEYS is required'] };
-    }
-    return { ok: true, keyring };
-};
 const parse_keys = (env_value) => {
     if (!env_value)
         return [];

package/dist/auth/password_argon2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password_argon2.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/password_argon2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiBtD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAEpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC3B,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAKF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAMpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,gBAIlC,CAAC"}
+{"version":3,"file":"password_argon2.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/password_argon2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA2BtD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAEpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC3B,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAGpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,gBAIlC,CAAC"}

package/dist/auth/password_argon2.js

@@ -9,19 +9,27 @@
  * @module
  */
 import { hash, verify } from '@node-rs/argon2';
+/** @node-rs/argon2 `Algorithm.Argon2id` — const enum, cannot import with isolatedModules. */
+const ARGON2ID = 2;
 /**
  * Argon2id options following OWASP recommendations.
  *
  * @see https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
  */
-/** @node-rs/argon2 `Algorithm.Argon2id` — const enum, cannot import with isolatedModules. */
-const ARGON2ID = 2;
 const ARGON2_OPTIONS = {
     algorithm: ARGON2ID,
     memoryCost: 19456, // 19 MiB
     timeCost: 2,
     parallelism: 1
 };
+/**
+ * A fixed Argon2id PHC string with the production parameters, verified against
+ * on an account-lookup miss so that path does the same work as a real
+ * verification. No password matches it in practice (its digest is all zero
+ * bytes). Precomputed, so the first miss costs no hash either. Byte-identical
+ * with the Rust `DUMMY_HASH` (`fuz_auth`).
+ */
+const DUMMY_HASH = '$argon2id$v=19$m=19456,t=2,p=1$AAAAAAAAAAAAAAAAAAAAAA$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
 /**
  * Hash a password using Argon2id.
  *
@@ -46,8 +54,6 @@ export const verify_password = async (password, password_hash) => {
         return false;
     }
 };
-/** Cached dummy hash for timing attack resistance. */
-let dummy_hash = null;
 /**
  * Verify a password against a dummy hash for timing attack resistance.
  *
@@ -58,10 +64,7 @@ let dummy_hash = null;
  * @returns always `false`
  */
 export const verify_dummy = async (password) => {
-    if (!dummy_hash) {
-        dummy_hash = await hash_password('dummy_password_for_timing_resistance');
-    }
-    await verify_password(password, dummy_hash);
+    await verify_password(password, DUMMY_HASH);
     return false;
 };
 /**

package/dist/auth/session_cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAgCrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}
+{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAWjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAiCrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}

package/dist/auth/session_cookie.js

@@ -22,6 +22,8 @@ export const SESSION_AGE_MAX = 60 * 60 * 24 * 30;
 const VALUE_SEPARATOR = ':';
 /** Strict integer matcher for the embedded `expires_at` field. */
 const EXPIRES_AT_INTEGER_RE = /^\d+$/;
+/** The largest `expires_at` the Rust spine's `u64` parse accepts. */
+const EXPIRES_AT_MAX = 18446744073709551615n;
 /**
  * Default cookie options for session cookies.
  *
@@ -69,9 +71,10 @@ export const parse_session = async (signed_value, keyring, options, now_seconds)
     // theoretical, but stricter parsing closes the gap as defense-in-depth.
     if (!EXPIRES_AT_INTEGER_RE.test(expires_at_str))
         return null;
-    const expires_at = parseInt(expires_at_str, 10);
-    if (!Number.isFinite(expires_at))
+    // refuse what the Rust spine's `u64` parse refuses, leading zeros allowed
+    if (BigInt(expires_at_str) > EXPIRES_AT_MAX)
         return null;
+    const expires_at = parseInt(expires_at_str, 10);
     // Check expiration
     const now = now_seconds ?? Math.floor(Date.now() / 1000);
     if (expires_at <= now)

package/dist/db/CLAUDE.md

@@ -187,32 +187,34 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
   `query_fact_holder_unheld` (answered from holder rows alone).
 - **`fact_store.ts`** — `PgFactStore`, implementing `HeldFactStore` (reads per
   the `@fuzdev/fuz_util/fact_store.ts` `FactStore` contract; puts take
-  `HeldFactPutOptions`, whose required `holder` —
-  an actor id, or `null` for a system put — is recorded in `fact_holder` on
-  every put, a dedup hit included, in one transaction with the fact row and its
-  refs): size-routed writes (embedded ≤
-  `embedded_threshold` / disk CAS above it), JSON ref auto-extract, idempotent
-  put, verify-on-read for disk-backed content. With `disk_root` + `fs` (the
+  `HeldFactPutOptions`, whose required `holder` — an actor id, or `null` for a
+  system put — is recorded in `fact_holder` on every put, a dedup hit included,
+  in one transaction with the fact row and its refs): size-routed writes
+  (embedded ≤ `embedded_threshold` / disk CAS above it), refs exactly as each
+  put declares them (the bytes are never scanned), idempotent put,
+  verify-on-read for disk-backed content. With `disk_root` + `fs` (the
   `runtime/*Deps`) configured, oversize `put` and the streaming `put_stream`
   write to the `<shard>/<rest>` disk CAS and `get` reads from it; without them
   an oversize write throws (`put_stream` needs `fs` for a body of any size).
   The disk CAS is the only place `get` reads external bytes from; the store
   makes no network request. A row whose `external_url` is not a
   `file:<shard>/<rest>` URL (the store never writes one), and any external row
-  on a store with no disk CAS, reads as `null` with a warning; the serve route
-  404s the former.
+  on a store with no disk CAS, reads as `null` with a warning; one naming another
+  fact's file reads as `null` with an error. The serve route 404s both.
 - **`file_fact_url.ts`** — the canonical `file:<shard>/<rest>` URL shape
   (`FileFactUrl` brand, `mint_file_fact_url` / `parse_file_fact_url` /
   `FILE_FACT_URL_PATTERN`) plus `fact_disk_path(hash) → {shard, rest}`, the
-  single source of truth for the on-disk layout (twins the Rust `fuz_fact`).
+  single source of truth for the on-disk layout, and `file_fact_url_addresses`,
+  the check that a URL names its own hash's file (twins the Rust `fuz_fact`).
 - **`fact_disk_storage.ts`** — the filesystem CAS over `runtime/{FsStream,FsWrite,FsRemove,FsRead}Deps`
-  (not raw `node:fs`): `stream_fact_to_disk` (bounded-memory blake3+sha256 single
-  pass, buffer→spill, fsync-then-atomic-rename, dedup-drop if the CAS path already
-  exists), `write_fact_bytes_to_disk` (buffering twin), `read_fact_bytes_from_disk`,
-  and `sweep_orphan_temps` (reaps stale `.tmp` spills by mtime). The temp is
-  `fsync`ed before the rename publishes it (twins the Rust `fuz_fact` §fsync
-  posture: data-sync before rename, parent-dir fsync waived) — the serve path
-  streams the file without re-hashing, so write-time durability is the guard.
+  (not raw `node:fs`): `stream_fact_to_disk` (bounded-memory blake3 as it
+  streams, buffer→spill, fsync-then-atomic-rename — over a file already at the
+  CAS path, so a repeat put heals a corrupt one), `write_fact_bytes_to_disk`
+  (buffering twin), `read_fact_bytes_from_disk`, and `sweep_orphan_temps`
+  (reaps stale `.tmp` spills by mtime). The temp is `fsync`ed before the
+  rename publishes it (twins the Rust `fuz_fact` §fsync posture: data-sync
+  before rename, parent-dir fsync waived) — the serve path streams the file
+  without re-hashing, so write-time durability is the guard.
 - **`fact_store_errors.ts`** — `FactPayloadTooLargeError` / `FactStorageFullError` (+
   `is_enospc_error`) thrown by `put_stream`, for a consumer route's 413 / 507.
 - The HTTP serving plumbing lives under `server/` (`serve_fact_route.ts`,

package/dist/db/cell_queries.d.ts

@@ -421,8 +421,9 @@ export interface CellListParams {
  * uppercase-hex digest, or a `blake3:` string of any other length is not a
  * ref. Refs are what fact serving admits a read through and what cell ref
  * admission gates on a write, so the grammar is exact: a string either is an
- * address or isn't one. Object keys are not walked — only values. (JSON facts'
- * `fact_ref` edges keep `fact_hash_extract_refs`, the substring scan.)
+ * address or isn't one. Object keys are not walked — only values. (A fact's
+ * own `fact_ref` edges are never derived from its bytes — they are the refs its
+ * put declares.)
  *
  * Returns `null` (rather than `[]`) when no refs are present — the column
  * is nullable and the `idx_cell_refs` partial index is `WHERE refs IS NOT

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAa/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,2KAegD,CAAC;AAK1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAC2F,CAAC;AAEhJ;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,2DAKmC,CAAC;AAElE,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAQ5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAiFF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,IAAI,KAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,IAI/D,CAAC"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAa/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,2KAegD,CAAC;AAK1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAC2F,CAAC;AAEhJ;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,2DAKmC,CAAC;AAElE,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAQ5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAiFF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,IAAI,KAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,IAI/D,CAAC"}

package/dist/db/cell_queries.js

@@ -494,8 +494,9 @@ const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_
  * uppercase-hex digest, or a `blake3:` string of any other length is not a
  * ref. Refs are what fact serving admits a read through and what cell ref
  * admission gates on a write, so the grammar is exact: a string either is an
- * address or isn't one. Object keys are not walked — only values. (JSON facts'
- * `fact_ref` edges keep `fact_hash_extract_refs`, the substring scan.)
+ * address or isn't one. Object keys are not walked — only values. (A fact's
+ * own `fact_ref` edges are never derived from its bytes — they are the refs its
+ * put declares.)
  *
  * Returns `null` (rather than `[]`) when no refs are present — the column
  * is nullable and the `idx_cell_refs` partial index is `WHERE refs IS NOT

package/dist/db/fact_disk_storage.d.ts

@@ -20,10 +20,12 @@
  * re-hashing it (`server/serve_fact_route.ts`). This twins the Rust `fuz_fact`
  * §fsync posture: data-sync before the rename; the parent-dir fsync stays
  * deliberately waived (a lost dirent is regenerable under content addressing).
- * If the final path already exists the temp is dropped instead of renamed over
- * — idempotent dedup (same hash → byte-identical content), mirroring the Rust
- * commit path. `.tmp/` is a sibling of `<shard>/` under the same `facts_dir` so
- * `rename` is always same-filesystem (no EXDEV).
+ * The temp is renamed over the final path even when a file is already there:
+ * the temp's bytes are the ones just hashed, so the rename is a no-op for a
+ * sound file and replaces a corrupt one (a torn write, bit rot) with bytes that
+ * match their name — a re-upload heals the CAS. `.tmp/` is a sibling of
+ * `<shard>/` under the same `facts_dir` so `rename` is always same-filesystem
+ * (no EXDEV).
  *
  * @module
  */
@@ -56,22 +58,20 @@ export type StreamPlacement = {
 };
 /**
  * Outcome of streaming an upload to storage: the `blake3:`-prefixed fact hash,
- * the bare-hex SHA-256, the byte count, and where the bytes landed.
+ * the byte count, and where the bytes landed.
  * `PgFactStore.put_stream` turns this into the `fact` row insert.
  */
 export interface StreamFactToDiskResult {
     hash: FactHash;
-    sha256: string;
     size: number;
     placement: StreamPlacement;
 }
 /**
- * Stream `source` to storage with bounded memory: hash BLAKE3 + SHA-256
- * incrementally in one pass, buffer in memory until the bytes cross
- * `embedded_threshold`, then spill the buffer + remaining chunks through a temp
- * file and atomically land it in the disk CAS. Peak heap is
- * `O(chunk + embedded_threshold)`, never `O(artifact)`, so a multi-GB upload
- * never buffers in RAM.
+ * Stream `source` to storage with bounded memory: hash BLAKE3 incrementally,
+ * buffer in memory until the bytes cross `embedded_threshold`, then spill the
+ * buffer + remaining chunks through a temp file and atomically land it in the
+ * disk CAS. Peak heap is `O(chunk + embedded_threshold)`, never `O(artifact)`, so a
+ * multi-GB upload never buffers in RAM.
  *
  * - **Embedded vs disk.** A body `<= embedded_threshold` stays in memory and is
  *   returned as `{kind: 'embedded'}` for the PG `bytes` column. Above it (with a
@@ -87,17 +87,17 @@ export interface StreamFactToDiskResult {
  *
  * @mutates `facts_dir` filesystem
  */
-export declare const stream_fact_to_disk: (deps: Pick<FactDiskStorageDeps, "mkdir" | "rename" | "remove" | "write_file_stream" | "fsync" | "stat">, facts_dir: string | undefined, source: ReadableStream<Uint8Array>, max_bytes: number, embedded_threshold: number) => Promise<StreamFactToDiskResult>;
+export declare const stream_fact_to_disk: (deps: Pick<FactDiskStorageDeps, "mkdir" | "rename" | "remove" | "write_file_stream" | "fsync">, facts_dir: string | undefined, source: ReadableStream<Uint8Array>, max_bytes: number, embedded_threshold: number) => Promise<StreamFactToDiskResult>;
 /**
  * Write fully-buffered `bytes` for `hash` to the canonical
  * `<facts_dir>/<shard>/<rest>` path, then publish via `commit_temp_to_cas`
- * (fsync'd temp + atomic rename, dedup-aware). The buffering twin of
+ * (fsync'd temp + atomic rename). The buffering twin of
  * `stream_fact_to_disk`, used by `PgFactStore.put` for oversize sync bytes.
  * Returns the `file:` `external_url` for the `fact` row.
  *
  * @mutates `facts_dir` filesystem
  */
-export declare const write_fact_bytes_to_disk: (deps: Pick<FactDiskStorageDeps, "mkdir" | "rename" | "remove" | "write_file" | "fsync" | "stat">, facts_dir: string, hash: FactHash, bytes: Uint8Array) => Promise<FileFactUrl>;
+export declare const write_fact_bytes_to_disk: (deps: Pick<FactDiskStorageDeps, "mkdir" | "rename" | "remove" | "write_file" | "fsync">, facts_dir: string, hash: FactHash, bytes: Uint8Array) => Promise<FileFactUrl>;
 /**
  * Read a disk-backed fact's bytes from the `<facts_dir>/<shard>/<rest>` layout
  * the writers above produce, addressed by the row's `file:<shard>/<rest>`

package/dist/db/fact_disk_storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_disk_storage.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_disk_storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AASH,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,oBAAoB,CAAC;AAO5B,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,GACnF,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC,GAC9D,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,GACvC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,IAAI,CACT,mBAAmB,EACnB,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,mBAAmB,GAAG,OAAO,GAAG,MAAM,CACtE,EACD,WAAW,MAAM,GAAG,SAAS,EAC7B,QAAQ,cAAc,CAAC,UAAU,CAAC,EAClC,WAAW,MAAM,EACjB,oBAAoB,MAAM,KACxB,OAAO,CAAC,sBAAsB,CA8GhC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC,EAChG,WAAW,MAAM,EACjB,MAAM,QAAQ,EACd,OAAO,UAAU,KACf,OAAO,CAAC,WAAW,CAgBrB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAC5C,WAAW,MAAM,EACjB,KAAK,MAAM,KACT,OAAO,CAAC,UAAU,CAIpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC,EAC9D,WAAW,MAAM,EACjB,UAAU;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAC3D,OAAO,CAAC,MAAM,CA0BhB,CAAC"}
+{"version":3,"file":"fact_disk_storage.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_disk_storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,oBAAoB,CAAC;AAO5B,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,GACnF,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC,GAC9D,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,GACvC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,mBAAmB,GAAG,OAAO,CAAC,EAC9F,WAAW,MAAM,GAAG,SAAS,EAC7B,QAAQ,cAAc,CAAC,UAAU,CAAC,EAClC,WAAW,MAAM,EACjB,oBAAoB,MAAM,KACxB,OAAO,CAAC,sBAAsB,CA0GhC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC,EACvF,WAAW,MAAM,EACjB,MAAM,QAAQ,EACd,OAAO,UAAU,KACf,OAAO,CAAC,WAAW,CAgBrB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAC5C,WAAW,MAAM,EACjB,KAAK,MAAM,KACT,OAAO,CAAC,UAAU,CAIpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC,EAC9D,WAAW,MAAM,EACjB,UAAU;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAC3D,OAAO,CAAC,MAAM,CA0BhB,CAAC"}