@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.10.0-pre.1",
+  "version": "0.10.0-pre.2",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "Apache-2.0",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -276,8 +276,8 @@
     "happy-dom": "^18.0.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/attestation": "0.10.0-pre.1",
-    "@noy-db/shamir": "0.10.0-pre.1"
+    "@noy-db/attestation": "0.10.0-pre.2",
+    "@noy-db/shamir": "0.10.0-pre.2"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",

package/dist/api-ARU35MCC.js

@@ -1,18 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-RNQ7V4LH.js";
-import "./chunk-PQGCWTTI.js";
-import "./chunk-WRLWEYHY.js";
-import "./chunk-OJAFKGI7.js";
-import "./chunk-6B4X447I.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-YIVAKBCW.js";
-import "./chunk-6Y3UJT5H.js";
-import "./chunk-VUBRHJ4H.js";
-import "./chunk-JGYCKX56.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-ARU35MCC.js.map

package/dist/capsule/enclave-aes/classify/reveal.d.ts

@@ -1,10 +0,0 @@
-import type { EncryptedEnvelope } from '../../../kernel/types.js';
-import type { EnclaveKey } from '../crypto.js';
-export interface RevealEngineCtx {
-    readonly collection: string;
-    readonly encrypted: boolean;
-    getEnvelope(id: string): Promise<EncryptedEnvelope | null>;
-    resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>;
-    getDEK(): Promise<EnclaveKey>;
-}
-export declare function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown>;

package/dist/capsule/enclave-aes/classify/verify.d.ts

@@ -1,36 +0,0 @@
-/**
- * The enclave verify oracle (spec §3). Verdict-only egress: no path
- * distinguishes "record missing" / "no digest" / "AAD-tamper" / "mismatch"
- * beyond { ok: false } — existence oracles are oracles too. Every path that
- * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare
- * first (C4), so wall-clock cannot enumerate records/fields/answers. The
- * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the
- * pad UNCONDITIONALLY — every outcome, including a real compare, costs the
- * same one PBKDF2 unit (no inverted exists-vs-absent oracle).
- * Elevated records (_tier > 0, with-audit tier moves) are non-comparable
- * through every door and pad-false exactly like missing records (#691) —
- * the tier-aware read surface is getAtTier, never verify.
- * Throws are reserved for caller/config bugs (ClassifiedVerifyError /
- * ClassifiedConfigError) and are exempt from the pad by design (R6 note).
- * @module
- */
-import { type EnclaveKey } from '../crypto.js';
-import { type VerifyNormalizeMode } from '../../plumbing/normalize.js';
-import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../../kernel/types.js';
-export interface VerifyEngineCtx {
-    readonly collection: string;
-    getEnvelope(id: string): Promise<EncryptedEnvelope | null>;
-    resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>;
-    getDEK(): Promise<EnclaveKey>;
-    readonly now: () => number;
-}
-export declare function verifyDigestField(ctx: VerifyEngineCtx, id: string, field: string, candidate: string, policy: VdigFieldPolicy): Promise<ClassifiedVerdict>;
-export declare function verifyTextField(ctx: VerifyEngineCtx, id: string, field: string, candidate: string, normalize: VerifyNormalizeMode): Promise<ClassifiedVerdict>;
-export declare function matchGroupFields(ctx: VerifyEngineCtx, id: string, answers: Record<string, string>, members: ReadonlyArray<{
-    readonly field: string;
-    readonly policy: VdigFieldPolicy;
-}>, opts: {
-    readonly min: number;
-}): Promise<{
-    readonly passed: boolean;
-}>;

package/dist/chunk-4RF7DVH2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/query/relate/join.ts"],"sourcesContent":["/**\n * Query DSL `.join()` — eager, single-FK, intra-vault joins.\n *\n * resolves a ref()-declared foreign key into an attached\n * right-side record under an alias, using one of two planner paths\n * selected automatically:\n *\n *   - **nested-loop** — right-side source exposes `lookupById`, so\n *     each left row costs O(1). This is the common path for joins\n *     against a Collection, which backs `lookupById` with a Map\n *     lookup.\n *   - **hash** — right-side has only `snapshot()`. Build a\n *     `Map<id, record>` once, probe per left row. Same asymptotic\n *     cost for our collections, but the path exists as a fallback\n *     for custom QuerySource implementations and as an explicit\n *     test-only override via `{ strategy: 'hash' }`.\n *\n * Scope:\n *\n *   - Equi-joins on declared `ref()` fields only. Joins on\n *     undeclared fields throw at plan time with an actionable error\n *     naming the field and collection.\n *   - Same-vault only. Cross-vault correlation goes\n *     through `queryAcross`; this is an architectural\n *     invariant, not a limitation we plan to lift.\n *   - Hard row ceiling via `JoinTooLargeError` — default 50k per\n *     side, override via `{ maxRows }`. Warns at 80% of the ceiling\n *     on the existing warn channel.\n *   - Three ref-mode behaviors on dangling refs:\n *     strict → `DanglingReferenceError`,\n *     warn → attach `null` with a one-shot warning,\n *     cascade → attach `null` silently (cascade is a delete-time\n *     mode; any dangling refs still present at read time are\n *     mid-flight cascades or orphans from earlier, not a DSL error).\n *\n * Partition-awareness seam:\n *\n * Every `JoinLeg` carries a `partitionScope` field that is always `'all'`.\n * The executor never reads it. See {@link JoinLeg.partitionScope} for the\n * two constraints (#1342) that decide how it may ever be populated — one of\n * them silently invalidates stored materialized views.\n *\n * Joins stay OUT of the ledger: reads don't touch `_ledger/`,\n * including joined reads.\n */\n\nimport type { RefDescriptor, RefMode } from '../../refs.js'\nimport type { Clause } from '../predicate.js'\nimport type { ViaPipeline } from '../../via/pipeline.js'\nimport { readPath } from '../predicate.js'\nimport { matchDeclaredJoin, type JoinOnPlan } from './join-on.js'\nimport { JoinTooLargeError, DanglingReferenceError } from '../../errors.js'\n\n/** Planner strategy for a single join leg. Auto-selected unless overridden. */\nexport type JoinStrategy = 'hash' | 'nested'\n\n/**\n * Which side of a join leg is preserved (#1289).\n *\n *   - `'left'`  — every left row survives, `null` under the alias when the\n *     FK resolves to nothing. This is what `.join()` has always done, and it\n *     is the default for a leg that names no direction.\n *   - `'right'` — every RIGHT record survives, including one nothing points\n *     at; a left row whose FK matches nothing is dropped.\n *   - `'full'`  — the union of the two.\n *\n * `'right'` and `'full'` are the only two that need the reverse index — see\n * {@link outerJoinFromRight}. A forward leg is driven by the left row's FK\n * and never has to ask \"did anything point at this\".\n */\nexport type JoinDirection = 'left' | 'right' | 'full'\n\n/** Default per-side row ceiling before `.join()` throws `JoinTooLargeError`. */\nexport const DEFAULT_JOIN_MAX_ROWS = 50_000\n\n/**\n * Default row ceiling for cross-join expansion. Matches JoinTooLargeError's ceiling.\n *\n * ⭐ #1458 — moved here from `kernel/query/builder.ts`. Find carries no\n * cross-join concept, and a constant is the cheapest thing to leave behind by\n * accident: it would have kept `builder.ts` as the const's home while every\n * reader of it lived in `relate/`.\n */\nexport const DEFAULT_CROSS_JOIN_MAX_ROWS = 50_000\n\n/**\n * Fraction of the row ceiling at which a one-shot warning is emitted.\n * At 80% we warn; at 100% we throw. The warn gives consumers a\n * heads-up before the hard error so they can raise the ceiling or\n * filter further without first hitting a broken query.\n */\nconst JOIN_WARN_FRACTION = 0.8\n\n/**\n * Internal representation of a single join leg in the query plan.\n *\n * This is the primary place the partition seam is honored: every leg carries\n * a `partitionScope` field that is always `'all'` and is never read by the\n * executor. See {@link JoinLeg.partitionScope}.\n */\nexport interface JoinLeg {\n  /** Field on the left-side record holding the foreign key value. */\n  readonly field: string\n  /** Alias key under which the joined right-side record attaches. */\n  readonly as: string\n  /** Target collection name, resolved from the `ref()` declaration. */\n  readonly target: string\n  /** Ref mode controlling behavior on dangling refs at read time. */\n  readonly mode: RefMode\n  /** Manual planner strategy override. `undefined` → auto-select. */\n  readonly strategy: JoinStrategy | undefined\n  /** Per-side row ceiling override. `undefined` → DEFAULT_JOIN_MAX_ROWS. */\n  readonly maxRows: number | undefined\n  /**\n   * Partition scope for future partition-aware joins. Always `'all'` today —\n   * the executor never reads this field. Do not remove even though it looks\n   * unused: it is a plan-shape seam.\n   *\n   * ⛔ TWO CONSTRAINTS BEFORE POPULATING THIS (#1342):\n   *\n   * 1. **It is a `queryHash` input on a HAND-COMPOSED path only — NOT for a\n   *    registered materialized view.** ⚠️ This paragraph asserted the\n   *    opposite until 2026-09-04; the correction is the measurement.\n   *    `MaterializedViewRegistry` feeds `computeQueryHash` from\n   *    `summarizeQueryPlan()` (`materialized-views/registry.ts:201,243`),\n   *    and that summary has never emitted `partitionScope`. `serializePlan()`\n   *    *does* emit `plan.joins` verbatim, and `canonicalizeQueryPlan` is\n   *    exported, so a consumer composing\n   *    `computeQueryHash(name, deps, canonicalizeQueryPlan(serializePlan(q)))`\n   *    by hand does carry the field in their hash. **That composition, and\n   *    only that one, is what this constraint binds** — it is also the\n   *    composition `__tests__/query-partition-scope.test.ts` builds, which is\n   *    why the file read as evidence for the stronger claim.\n   *    ⭐ So populating this field does NOT invalidate registered MVs. The\n   *    reason to leave it alone is smaller and still sufficient: it is a\n   *    DERIVED value — storing it buys nothing, and it is the one leg key\n   *    emitted UNCONDITIONALLY rather than omitted-at-default, so any later\n   *    move to summarise it (see #1389's rule) would shift every joined MV's\n   *    hash at once, for zero gain. Derive the scope in the EXECUTOR from\n   *    clauses the plan already carries. Pinned by\n   *    `__tests__/query-partition-scope.test.ts`, which now pins BOTH paths.\n   *\n   * 2. **The seam-change route was RULED OUT, and the pruning shipped\n   *    anyway** — ADR 0007, \"partitioning is collection-shaped\". Pruning only\n   *    pays on the `scan()` path (`query()` runs over an in-memory,\n   *    already-decrypted cache where `candidateRecords()`'s hash / sorted /\n   *    compound dispatch (#1344, #1345) narrows better than a partition ever\n   *    could). Buying it by teaching `NoydbStore.listPage` a filter would\n   *    have meant lifting the partition key out of the ciphertext into a\n   *    storage key or cleartext metadata — a permanent per-record\n   *    classification handed to the backend, and a change to the published\n   *    `@noy-db/hub/to` contract across every `to-*` adapter. **Ruled no.**\n   *    ⭐ The pruning was bought instead with information the store already\n   *    has: `listPage(vault, **collection**, …)` names the collection in\n   *    cleartext, so a partition modelled as its own collection is never\n   *    fetched because it is never asked for.\n   *\n   * ⭐ **THE SCOPE IS NOW DERIVED, IN THE EXECUTOR, AND THIS FIELD IS STILL\n   * DORMANT.** `kernel/query/relate/partition.ts`'s `resolvePartitionScope()` is the\n   * one decision function — `with-store/partitioned/` and `explain()` both\n   * call it — and it takes the plan's top-level clause list, never a stored\n   * leg. It is sound in one direction only: narrow ONLY on a whitelist of\n   * provable shapes (`==` / `in` on the declared key at the top level of the\n   * AND-ed clause list), and fall back to `'all'` for everything else —\n   * `or` groups, negations, callback clauses, and any Via-covered clause\n   * (its operand is in STORED form, not partition-key space, which is why\n   * `candidateRecords` refuses the index for it too). A partition wrongly\n   * excluded is silently missing data.\n   */\n  readonly partitionScope: 'all' | readonly string[]\n  /**\n   * Which side is preserved (#1289). `undefined` reads as `'left'` — the\n   * pre-#1289 behaviour — so every plan built before this field existed, and\n   * every serialized plan that omits it, keeps its meaning exactly.\n   */\n  readonly direction?: JoinDirection\n  /**\n   * INNER join (#1361) — drop every left row whose alias resolves to nothing,\n   * instead of attaching `null` under it.\n   *\n   * Only `.join()` sets it (a right/full leg already drops on its own side),\n   * and only when the caller passes `{ mode: 'inner' }`. Omitted rather than\n   * written as `false` for the same reason `direction` is: a plan built\n   * without it must serialize byte-identically to a pre-#1361 one, or every\n   * stored `queryHash` moves.\n   */\n  readonly inner?: true\n  /**\n   * A DECLARED, deterministic join predicate (#1339) — composite equality or\n   * a range — instead of the `ref()`-declared FK the rest of this file\n   * resolves. Set only by `.joinOn()`, always through\n   * {@link normalizeJoinOn}, and OMITTED on every other leg: a plan built by\n   * `.join()` must serialize byte-identically to a pre-#1339 one, or every\n   * stored `queryHash` moves (the same discipline `direction` and `inner`\n   * follow above).\n   *\n   * ⭐ This is the field that separates `.joinOn()` from `.crossJoin({ on })`.\n   * It is plain JSON, so it survives `serializePlan()` and\n   * `summarizeQueryPlan()` and a materialized view can therefore DEPEND on\n   * it. A closure cannot. See `join-on.ts`.\n   */\n  readonly on?: JoinOnPlan\n  /**\n   * When `true`, this is a dictionary join. The executor\n   * resolves the left-field value against the dict snapshot and\n   * attaches `{ ...labels, key }` rather than a right-side record.\n   * `target` holds the dictionary name (not a collection name).\n   */\n  readonly isDictJoin?: true\n}\n\n/**\n * Minimal shape of a joinable right-side record source.\n *\n * Collections implement this structurally via their `QuerySource`;\n * sources without `lookupById` force the hash-join fallback. Kept as\n * a thin interface so tests can wire up plain-object sources without\n * pulling in the full Collection class.\n *\n * The optional `subscribe` is used by `Query.live()` to merge\n * right-side change streams into the live re-run trigger. Sources\n * that omit `subscribe` still work for live joins — they just\n * don't drive re-fires when their right side mutates. Collection\n * implements `subscribe` by hooking into the existing per-\n * vault event emitter.\n */\nexport interface JoinableSource {\n  snapshot(): readonly unknown[]\n  lookupById?(id: string): unknown\n  /**\n   * Default locale a label-resolving query falls back to when the query\n   * itself is locale-less. Set by a `staticDict()`-backed source from its\n   * `displayLocale` so `{ by: 'label' }` resolves under a locale-less read.\n   * Plain `_dict_*`-backed sources omit it.\n   */\n  readonly displayLocale?: string\n  /**\n   * Sync present-for-join dressing (#626 retirement, #650 Task 6) — when\n   * present and the query carries a locale, each joined right-side record\n   * is passed through this hook (built by the right-side `Collection` from\n   * its own i18n-text + lookup-label bindings) BEFORE it is attached under\n   * the leg's alias — so a joined `i18nText` field resolves to a string\n   * (not a raw `{ locale }` map) and a joined lookup field gains its\n   * `<field>Label`. Locale-less queries leave joined fields raw\n   * (consistent with a locale-less read). Replaces the old `i18nFields`\n   * data field — the join executor no longer resolves i18n locale itself,\n   * it just calls this hook.\n   */\n  readonly presentForJoin?: (record: unknown, locale: string) => unknown\n  /**\n   * The id-paired view of {@link snapshot} (#1289).\n   *\n   * ⚠️ A `Collection` snapshot record does NOT carry its own id — the id is\n   * the cache key, not a field. The forward join never noticed, because it\n   * reads the id off the LEFT row's FK and calls `lookupById`. A right/full\n   * outer join has to ask each RIGHT record \"what is your id, and did\n   * anything point at you\", and there is no field to read it from.\n   *\n   * Optional so a plain-object test source stays valid; `outerJoinFromRight`\n   * falls back to an `id` FIELD on the record, which is what such sources\n   * carry. A real Collection supplies this and the fallback never runs.\n   */\n  snapshotEntries?(): readonly { readonly id: string; readonly record: unknown }[]\n  /**\n   * Via RESULT decode for this source's own records (#1289) — the same\n   * `via.decodeResults` a top-level `toArray()` applies (money's stored\n   * scaled-int → canonical decimal, etc.).\n   *\n   * It exists because Via dressing keys by BARE FIELD NAME: the moment a\n   * record moves under an alias (`{ client: { amount } }`, or both sides of\n   * `crossJoinWith`) the top-level decode cannot see it, and the row silently\n   * serves raw money. Distinct from `presentForJoin`, which is the LOCALE\n   * half (i18n text + lookup labels) and only runs for a locale-carrying\n   * query — this half is locale-free and always applies.\n   */\n  readonly decodeResults?: (record: unknown) => unknown\n  /**\n   * This source's own compiled Via pipeline (#1337 / #1338).\n   *\n   * The two halves above (`presentForJoin`, `decodeResults`) dress a record\n   * that is ON ITS WAY OUT. Ordering, grouping and reduction happen while it\n   * is still under an alias mid-plan, and they need the pipeline itself:\n   * `compareForOrder` to sort an aliased money field by MAGNITUDE rather than\n   * lexically over its stored scaled integer, and `wrapReducers` to rewrite\n   * `sum('client.credit')` into the exact-BigInt money reducer (which also\n   * applies the RIGHT collection's `queryable: 'none'` posture gate — the\n   * gate whose silent absence is why joined aggregation was refused).\n   *\n   * A THUNK, not a property: `_applyMoneyFields` can rebuild a collection's\n   * pipeline after this source object has been handed out, and a copied\n   * reference would go quietly stale — the same discipline `decodeResults`\n   * above already follows.\n   *\n   * Optional: a plain-object test source declares none, and every consumer\n   * treats absence as \"no binding covers anything here\".\n   */\n  readonly via?: () => ViaPipeline | undefined\n  /**\n   * Subscribe to mutations on this source. The callback fires\n   * AFTER the underlying record set has been updated. Returns an\n   * unsubscribe function. Optional — sources without this method\n   * cannot trigger live-join re-fires from their side.\n   */\n  subscribe?(cb: () => void): () => void\n}\n\n/**\n * Join resolution context attached to a `Query` when it's constructed\n * from a `Collection`. Holds everything the `.join()` method needs to\n * translate a field name into a target collection + ref mode, and\n * everything the executor needs to read the right side.\n *\n * Kept as a structural interface so `Vault` can implement it\n * without `Query` needing to import `Vault` (circular-import\n * avoid). The Collection wires this up in its `query()` method using\n * the `joinResolver` back-reference the Vault passes in.\n */\nexport interface JoinContext {\n  /** Name of the left-side (owning) collection. */\n  readonly leftCollection: string\n  /**\n   * The owning collection's default locale. Used to resolve joined\n   * i18n fields at the `join` layer when a terminal call doesn't pass an\n   * explicit locale — so `openVault({ locale })` flows to joins like it does\n   * to `get`/`list`. A per-call `toArray({ locale })` overrides it.\n   */\n  readonly defaultLocale?: string\n  /** Look up a `RefDescriptor` by field name on the left collection. */\n  resolveRef(field: string): RefDescriptor | null\n  /** Resolve a right-side source by target collection name. */\n  resolveSource(collectionName: string): JoinableSource | null\n  /**\n   * Resolve a dictKey join source. Returns a `JoinableSource`\n   * whose snapshot exposes `{ key, ...labels }` records, keyed by the\n   * stable dictionary key. `null` when the field is not a dictKey.\n   *\n   * The source is built from the compartment's in-memory dictionary\n   * snapshot — same data as `DictionaryHandle.list()`, O(1) per lookup.\n   */\n  resolveDictSource?(field: string): JoinableSource | null\n}\n\n/**\n * Does this clause address a field that only exists once join legs are\n * attached — i.e. is its path rooted at a join alias?\n *\n * Only `FieldClause` is inspectable. A `FilterClause` carries an opaque\n * function and a `WherePredicateClause` a named one, so neither can be\n * classified; both stay on the pre-join side, which is where they have\n * always run. See `splitAroundJoins`.\n */\nfunction referencesJoinAlias(clause: Clause, aliases: ReadonlySet<string>): boolean {\n  if (clause.type !== 'field') return false\n  // `where('client.name', …)` addresses the alias; so does the anti-join\n  // form `where('client', '==', null)`, where the path IS the alias.\n  return aliases.has(clause.field.split('.')[0]!)\n}\n\n/**\n * Split a plan's clauses into those evaluable before the join legs run and\n * those that need the joined shape (#1030).\n *\n * Join legs attach after `where` so the left set can be narrowed (and\n * index-driven) first. That is the right default, but it silently broke any\n * predicate addressing a joined alias: the field did not exist yet, so\n * `readPath` returned `undefined`, nothing matched, and the query returned an\n * empty result with no error.\n *\n * The split is deliberately narrow. When no clause addresses an alias — every\n * query written against the previous behaviour — `postJoin` is empty and the\n * caller takes its original path unchanged. The reordered pipeline therefore\n * only ever runs for queries that match nothing today.\n *\n * KNOWN RESIDUAL: `.filter(r => r.client?.name === 'Ann')` cannot be\n * classified (the predicate is a closure), so it still runs pre-join and still\n * sees no alias. Prefer `.where()` for anything addressing a joined field.\n *\n * Shared by the eager `Query` and the streaming `ScanBuilder` so the two\n * cannot drift on which side a clause belongs to.\n */\nexport function splitAroundJoins(\n  clauses: readonly Clause[],\n  joins: readonly JoinLeg[],\n): { readonly preJoin: readonly Clause[]; readonly postJoin: readonly Clause[] } {\n  if (joins.length === 0 || clauses.length === 0) return { preJoin: clauses, postJoin: [] }\n  const aliases = new Set(joins.map(leg => leg.as))\n  const preJoin: Clause[] = []\n  const postJoin: Clause[] = []\n  for (const clause of clauses) {\n    ;(referencesJoinAlias(clause, aliases) ? postJoin : preJoin).push(clause)\n  }\n  return { preJoin, postJoin }\n}\n\n/**\n * Does any `orderBy` entry address a field that only exists once the legs are\n * attached (#1337)?\n *\n * The ordering half of {@link splitAroundJoins}, kept beside it because the\n * two answer the same question about different parts of the plan, and because\n * `Query.toArray()` and `Query.explain()` must not drift on the answer — one\n * decides when the sort runs, the other reports it.\n *\n * ⚠️ Only `plan.joins` legs count. A `crossJoin` alias lives in the CLAUSE\n * list and its expansion already runs before ordering, so an ordering over\n * one has never needed moving.\n */\nexport function orderReferencesJoinAlias(\n  orderBy: readonly { readonly field: string }[],\n  joins: readonly JoinLeg[],\n): boolean {\n  if (joins.length === 0 || orderBy.length === 0) return false\n  const aliases = new Set(joins.map(leg => leg.as))\n  return orderBy.some(entry => aliases.has(entry.field.split('.')[0]!))\n}\n\n/**\n * Does any leg drop left rows (#1361)?\n *\n * The entry condition for every terminal that must run the legs even though\n * nothing addresses an alias: an inner leg is no longer projection-only, so\n * `count()`, `exists()` and the ordering placement in `toArray()` all have to\n * ask. Kept beside {@link splitAroundJoins} and {@link orderReferencesJoinAlias}\n * because the three answer the same family of question, and because\n * `Query.toArray()` and `Query.explain()` must not drift on the answer.\n */\nexport function joinsDropLeftRows(joins: readonly JoinLeg[]): boolean {\n  return joins.some(leg => leg.inner === true)\n}\n\n/**\n * Coerce an unknown FK value into a lookup key string.\n *\n * Legitimate ref values are strings or numbers — the same narrowing\n * the write-time `enforceRefsOnPut` path applies. Anything else\n * (objects, arrays, booleans, null, undefined) is treated as \"no\n * ref\" and returns `null`, so the join attaches `null` instead of\n * running `String({})` and producing `'[object Object]'` as a\n * bucket key. This matches the lint rule guidance and keeps\n * bizarre FK values from producing silently-wrong lookups.\n */\nexport function coerceRefKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Warn-channel deduplication for dangling-ref `'warn'` mode. Keyed\n * by `field → target:refId` so the same dangling ref only produces\n * one warning even across many rows or repeated queries.\n */\nconst warnedDanglingKeys = new Set<string>()\nfunction warnOnceDangling(field: string, target: string, refId: string): void {\n  const key = `${field}→${target}:${refId}`\n  if (warnedDanglingKeys.has(key)) return\n  warnedDanglingKeys.add(key)\n  console.warn(\n    `[noy-db] .join() encountered dangling ref in 'warn' mode: ` +\n      `field \"${field}\" → \"${target}:${refId}\" not found. Attaching null.`,\n  )\n}\n\n/**\n * Track row-ceiling warnings to fire only once per (target, side).\n * Prevents per-query spam when a consumer is running the same query\n * repeatedly (e.g. in a reactive loop).\n */\nconst warnedCeilingKeys = new Set<string>()\nfunction warnCeilingApproaching(\n  target: string,\n  side: 'left' | 'right',\n  rows: number,\n  maxRows: number,\n): void {\n  const key = `${target}:${side}`\n  if (warnedCeilingKeys.has(key)) return\n  warnedCeilingKeys.add(key)\n  const pct = Math.round((rows / maxRows) * 100)\n  console.warn(\n    `[noy-db] .join() ${side} side is at ${pct}% of the ${maxRows}-row ` +\n      `ceiling for target \"${target}\" (${rows} rows). Streaming joins over ` +\n      `scan() are not yet supported for collections that need to exceed this.`,\n  )\n}\n\n/**\n * Apply every join leg in the plan against a base set of left-side\n * rows. Called by the query executor after `where` / `orderBy` /\n * `offset` / `limit` have narrowed the left set.\n *\n * Each leg attaches a `leg.as` field to every row. Returns a new\n * array of plain objects — the original left rows are not mutated\n * (structural sharing is fine for the inner fields, but the\n * top-level object is a fresh clone so consumers can further mutate\n * safely).\n *\n * **Ordering:** joins run AFTER orderBy / limit / offset by DEFAULT, so\n * \"top 10 invoices with client\" sorts and paginates the left side first\n * (index-driven) and joins only the page. Two things flip that, and both\n * are decided by the plan, never by a flag: a `where` addressing an alias\n * (#1030, {@link splitAroundJoins}) and an `orderBy` addressing one (#1337,\n * {@link orderReferencesJoinAlias}). Either one moves the sort and the page\n * to AFTER the legs, because neither can be evaluated against a row where\n * the alias does not exist yet. ⚠️ That query necessarily loses the\n * index-driven ordering fast path — the cost of sorting on a field the\n * index does not hold. `Query.explain()` names which placement a plan gets.\n *\n * An INNER leg (#1361) moves only the PAGE, not the sort: the drop removes\n * rows, so `limit` must observe it, but the ordering is on a left-side field\n * that the drop cannot reorder. `toArray()` therefore sorts pre-join, joins,\n * and slices after — and `explain()` reports `pre-join` on the sort and\n * `post-join` on the page rather than one word for both.\n *\n * **Multi-FK chaining:** each leg's `maxRows` is enforced\n * against the current left-row count independently. Because\n * joins are equi-joins on the target's primary key (one-to-one or\n * one-to-null), the left row count is constant across legs — no\n * cartesian blowup. The per-leg left-side check is still necessary\n * so that a later leg with a tighter ceiling correctly fires on a\n * query like `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`,\n * which should throw on the second leg if the left set exceeds 50.\n */\nexport function applyJoins(\n  rows: readonly unknown[],\n  joins: readonly JoinLeg[],\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  if (joins.length === 0) return [...rows]\n\n  let result: unknown[] = [...rows]\n  for (const leg of joins) {\n    result = applyOneJoin(result, leg, context, locale)\n  }\n  return result\n}\n\n/**\n * One leg, plus the #1361 inner-join drop.\n *\n * The drop is applied to the leg's OUTPUT rather than threaded through the\n * three producers (nested-loop, hash, dict) — an unmatched row is `null` under\n * the alias in all three by construction, and `attachJoin` has already run, so\n * a strict-mode `DanglingReferenceError` still fires for a dangling ref that\n * `inner` would otherwise hide.\n */\nfunction applyOneJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  const rows = applyOneJoinRaw(leftRows, leg, context, locale)\n  if (leg.inner !== true) return rows\n  return rows.filter(row => row !== null && typeof row === 'object' && (row as Record<string, unknown>)[leg.as] != null)\n}\n\nfunction applyOneJoinRaw(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  // Dict join path — resolve left-field value against the\n  // dictionary snapshot and attach { key, ...labels } under leg.as.\n  if (leg.isDictJoin) {\n    const dictSource = context.resolveDictSource?.(leg.field)\n    if (!dictSource) {\n      throw new Error(\n        `.join() field \"${leg.field}\" on \"${context.leftCollection}\" is declared as a ` +\n          `dictKey join but the dict source could not be resolved. ` +\n          `Ensure the dictionary has at least one entry.`,\n      )\n    }\n    const out: unknown[] = []\n    const snapshot = dictSource.snapshot()\n    const dictMap = new Map<string, unknown>()\n    for (const entry of snapshot) {\n      const k = readPath(entry, 'key')\n      if (typeof k === 'string') dictMap.set(k, entry)\n    }\n    for (const left of leftRows) {\n      const rawId = readPath(left, leg.field)\n      const key = coerceRefKey(rawId)\n      const dictEntry = key === null ? undefined : dictMap.get(key)\n      out.push({ ...(left as Record<string, unknown>), [leg.as]: dictEntry ?? null })\n    }\n    return out\n  }\n\n  const source = context.resolveSource(leg.target)\n  if (!source) {\n    throw new Error(\n      `.join() cannot resolve target collection \"${leg.target}\" ` +\n        `(referenced from field \"${leg.field}\" on \"${context.leftCollection}\"). ` +\n        `Make sure the target collection has been opened via vault.collection() ` +\n        `at least once before running the query.`,\n    )\n  }\n\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n\n  // Per-leg left-side ceiling check. In a\n  // multi-FK chain, each leg's `maxRows` is enforced independently\n  // against the current left-row count, so\n  // `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`\n  // correctly throws on the second leg if the left set exceeds 50.\n  if (leftRows.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: -1,\n      maxRows,\n      side: 'left',\n      message:\n        `.join() left side has ${leftRows.length} rows, exceeding the ${maxRows}-row ` +\n        `ceiling for target \"${leg.target}\". Filter the left side further with ` +\n        `where()/limit() before joining, or raise the ceiling via { maxRows }. ` +\n        `Streaming joins over scan() are not yet supported.`,\n    })\n  }\n  if (leftRows.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'left', leftRows.length, maxRows)\n  }\n\n  const rightSnapshot = source.snapshot()\n  if (rightSnapshot.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: rightSnapshot.length,\n      maxRows,\n      side: 'right',\n      message:\n        `.join() right side \"${leg.target}\" has ${rightSnapshot.length} rows, ` +\n        `exceeding the ${maxRows}-row ceiling. Raise the ceiling via { maxRows } ` +\n        `if the data genuinely fits in memory, or track  for streaming joins.`,\n    })\n  }\n  if (rightSnapshot.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'right', rightSnapshot.length, maxRows)\n  }\n\n  // `join`-layer dressing (#650 Task 6, #626 retirement). When the query\n  // carries a locale (per-call or the owning collection's default) and the\n  // right side declares a `presentForJoin` hook, resolve each matched right\n  // record through it before it's attached. Locale-less → leave raw.\n  const effLocale = locale ?? context.defaultLocale\n  const presentResolve: ((right: unknown) => unknown) | undefined =\n    effLocale !== undefined && source.presentForJoin !== undefined\n      ? (right) =>\n          right !== null && typeof right === 'object'\n            ? source.presentForJoin!(right, effLocale)\n            : right\n      : undefined\n\n  // #1339 — a declared `on` replaces the FK lookup entirely: there is no\n  // ref, so neither `lookupById` nor the id-keyed hash means anything. It\n  // runs BEFORE the strategy/direction selection below because it answers\n  // both questions itself (see `join-on.ts` for which strategy serves which\n  // shape, and at what cost).\n  if (leg.on !== undefined) {\n    return declaredJoin(leftRows, leg, leg.on, rightSnapshot, maxRows, presentResolve)\n  }\n\n  // Strategy selection: explicit override wins; otherwise prefer\n  // nested-loop when the source exposes lookupById (O(1) per row),\n  // falling back to hash join when it doesn't.\n  const strategy: JoinStrategy =\n    leg.strategy ?? (source.lookupById ? 'nested' : 'hash')\n\n  // #1289 — a right/full outer join cannot be driven by the left row's FK,\n  // because the rows it must produce are exactly the ones no FK names. It\n  // reverses the index instead: bucket the LEFT rows by their FK value, then\n  // walk the right snapshot asking each record \"did anything point at me\".\n  const direction = leg.direction ?? 'left'\n  if (direction !== 'left') {\n    return outerJoinFromRight(leftRows, leg, source, direction, presentResolve)\n  }\n\n  if (strategy === 'nested' && source.lookupById) {\n    // Bind through an arrow so the `this` context of lookupById\n    // doesn't drift — same pattern as the existing candidateRecords\n    // helper in builder.ts.\n    const lookup = (id: string): unknown => source.lookupById?.(id)\n    return nestedLoopJoin(leftRows, leg, lookup, presentResolve)\n  }\n  return hashJoin(leftRows, leg, rightSnapshot, presentResolve)\n}\n\n/**\n * Execute a declared-`on` leg (#1339).\n *\n * The match set comes from `join-on.ts`; this function is only the part that\n * has to agree with the rest of `.join()` — the alias attachment, the\n * present/decode dressing, and the OUTPUT ceiling.\n *\n * ⚠️ The output ceiling is not redundant with the two side ceilings above. A\n * ref join is one-to-one, so `output === leftRows`; a declared join is\n * many-to-many, so 1,000 × 1,000 rows both comfortably under a 50,000-row\n * side ceiling can produce a million rows. Checking as rows are produced is\n * what makes an unbounded theta join an error rather than a hang.\n */\nfunction declaredJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  on: JoinOnPlan,\n  rightSnapshot: readonly unknown[],\n  maxRows: number,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const matches = matchDeclaredJoin(leftRows, on, rightSnapshot, maxRows, produced => {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: rightSnapshot.length,\n      maxRows,\n      side: 'output',\n      message:\n        `.joinOn(\"${leg.target}\") produced more than ${maxRows} rows (${produced} and counting) from ` +\n        `${leftRows.length} left x ${rightSnapshot.length} right. A declared \\`on\\` is many-to-many, so ` +\n        `the per-side ceilings do not bound the result. Narrow the predicate, filter the left side ` +\n        `with where()/limit() before joining, or raise the ceiling via { maxRows }.`,\n    })\n  })\n  const out: unknown[] = []\n  for (const { left, right } of matches) {\n    const dressed = presentResolve && right !== undefined ? presentResolve(right) : right\n    // `rawId` is `undefined` on purpose: a declared join has no ref, so\n    // \"matched nothing\" is never a DANGLING ref — `attachJoin` reads a null\n    // key as \"no reference at all\" and attaches null without consulting the\n    // ref mode. An unmatched row is data, not corruption.\n    out.push(attachJoin(left, leg, dressed, undefined))\n  }\n  return out\n}\n\nfunction nestedLoopJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  lookupById: (id: string) => unknown,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : lookupById(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\nfunction hashJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  rightSnapshot: readonly unknown[],\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  // Build the right-side hash once per query execution. We key on\n  // the `id` field because ref() always points to a target's primary\n  // key — non-equi and non-id joins are out of scope for.\n  const rightMap = new Map<string, unknown>()\n  for (const record of rightSnapshot) {\n    const rawId = readPath(record, 'id')\n    const key = coerceRefKey(rawId)\n    if (key !== null) {\n      rightMap.set(key, record)\n    }\n  }\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : rightMap.get(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\n/**\n * Bucket the left rows by the FK value they carry, so the right side can be\n * asked \"did anything point at this record\" in O(1).\n *\n * This IS the reverse index #1289 names. It is built per execution and lives\n * only for the length of the join: nothing is persisted, no store is touched,\n * and it costs one pass over the left set that the forward path does not pay.\n * Left rows with a null/uncoercible FK are absent from every bucket — they are\n * \"no reference at all\", never a match.\n */\nfunction reverseIndex(leftRows: readonly unknown[], field: string): Map<string, unknown[]> {\n  return bucketByRefKey(leftRows, left => readPath(left, field))\n}\n\n/**\n * The reverse-FK index, generalised over what sits in the bucket (#1352).\n *\n * `outerJoinFromRight` buckets bare left ROWS by their FK; `traverse()`\n * buckets id-paired ENTRIES, because a child row alone cannot say what its\n * own id is (a Collection snapshot record carries no `id` field — the id is\n * the cache key). Same question — \"who points at this?\" — same coercion\n * rules, so it is deliberately one implementation rather than two that can\n * drift on what counts as a usable FK value.\n *\n * `readKey` extracts the raw FK from an item; `coerceRefKey` then decides\n * whether it is a key at all. An item whose FK is nullish, or is neither a\n * string nor a number, is dropped — \"no reference\", not \"a reference to\n * `[object Object]`\".\n */\nexport function bucketByRefKey<V>(\n  items: readonly V[],\n  readKey: (item: V) => unknown,\n): Map<string, V[]> {\n  const buckets = new Map<string, V[]>()\n  for (const item of items) {\n    const key = coerceRefKey(readKey(item))\n    if (key === null) continue\n    const bucket = buckets.get(key)\n    if (bucket) bucket.push(item)\n    else buckets.set(key, [item])\n  }\n  return buckets\n}\n\n/**\n * Right / full outer join (#1289).\n *\n * Walks the RIGHT snapshot as the driving relation. A right record with a\n * non-empty bucket emits one row per left row in it (identical in shape to\n * what the forward path would have produced); a right record nothing points\n * at emits a LEFT-LESS row — `{ [leg.as]: right }` and nothing else, which is\n * SQL's \"the left columns are NULL\" rendered in an object language.\n *\n * `'full'` then appends the left rows the right side never claimed, in their\n * original order, with `null` under the alias — i.e. exactly the rows the\n * forward left-outer path would emit for them, ref-mode behaviour included.\n * `'right'` drops those rows, but still runs the ref-mode check on them: a\n * strict dangling ref is a data-integrity finding, and hiding it behind a\n * change of join direction would make corruption depend on which method the\n * caller happened to type.\n */\nfunction outerJoinFromRight(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  source: JoinableSource,\n  direction: JoinDirection,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const byRight = reverseIndex(leftRows, leg.field)\n  const matchedLeft = new Set<unknown>()\n  const out: unknown[] = []\n\n  // Prefer the id-paired view: a Collection record has no `id` field, so\n  // reading one off the record would leave every bucket unmatched and turn a\n  // right join into \"every right record is an orphan\" — wrong, and quietly so\n  // in `cascade`/`warn` mode. The field fallback serves plain-object sources.\n  const entries: readonly { id: string | null; record: unknown }[] =\n    source.snapshotEntries?.() ??\n    source.snapshot().map(record => ({ id: coerceRefKey(readPath(record, 'id')), record }))\n\n  for (const { id: rid, record: right } of entries) {\n    const dressed = presentResolve ? presentResolve(right) : right\n    const bucket = rid === null ? undefined : byRight.get(rid)\n    if (bucket === undefined || bucket.length === 0) {\n      // Nothing points at this record — the row that only a right/full outer\n      // join can produce.\n      out.push({ [leg.as]: dressed })\n      continue\n    }\n    for (const left of bucket) {\n      matchedLeft.add(left)\n      out.push(attachJoin(left, leg, dressed, readPath(left, leg.field)))\n    }\n  }\n\n  for (const left of leftRows) {\n    if (matchedLeft.has(left)) continue\n    // Unmatched left row: `attachJoin` with an undefined right applies the\n    // ref mode (strict throws, warn warns once) and attaches null.\n    const row = attachJoin(left, leg, undefined, readPath(left, leg.field))\n    if (direction === 'full') out.push(row)\n  }\n\n  return out\n}\n\n/**\n * Attach the resolved right-side record (or null) to the left row\n * under the alias, applying ref-mode semantics for the dangling\n * case.\n *\n * A left-side record whose FK field is null/undefined is NOT a\n * dangling ref — it's \"no reference at all\", which is always\n * allowed regardless of mode. This matches the write-time\n * `enforceRefsOnPut` behavior: \"Nullish ref values are allowed —\n * treat them as 'no reference'.\"\n *\n * Only non-null FKs pointing at non-existent targets trigger the\n * mode behavior.\n */\nfunction attachJoin(\n  left: unknown,\n  leg: JoinLeg,\n  right: unknown,\n  rawId: unknown,\n): unknown {\n  if (left === null || typeof left !== 'object') {\n    // Pathological input — return as-is. Shouldn't happen in\n    // practice because QuerySource yields objects, but defensive\n    // because plan execution is untyped at this layer.\n    return left\n  }\n  const merged: Record<string, unknown> = { ...(left as Record<string, unknown>) }\n\n  // \"No ref at all\" — null/undefined FK value, or a non-string/non-\n  // number FK that coerceRefKey treated as no-ref. Never throws\n  // regardless of mode; matches the write-time policy that nullish\n  // refs are allowed.\n  const refKey = coerceRefKey(rawId)\n  if (right === undefined) {\n    if (refKey !== null && leg.mode === 'strict') {\n      throw new DanglingReferenceError({\n        field: leg.field,\n        target: leg.target,\n        refId: refKey,\n        message:\n          `.join() strict dangling: record references \"${leg.target}:${refKey}\" ` +\n          `via field \"${leg.field}\", but no such record exists. Use ref() mode 'warn' ` +\n          `or 'cascade' if dangling refs are acceptable, or run ` +\n          `vault.checkIntegrity() to find and fix the orphans.`,\n      })\n    }\n    if (refKey !== null && leg.mode === 'warn') {\n      warnOnceDangling(leg.field, leg.target, refKey)\n    }\n    // For 'cascade' and null refs we attach null silently. Cascade\n    // is a delete-time mode; any dangling refs visible at read time\n    // are either mid-flight or pre-existing orphans, not a DSL error.\n    merged[leg.as] = null\n  } else {\n    merged[leg.as] = right\n  }\n  return merged\n}\n\n/**\n * Test-only: reset the join warning deduplication state between\n * tests. Production code never calls this — the dedup state is\n * intentionally process-scoped so a noisy query doesn't spam the\n * console once per component render.\n */\nexport function resetJoinWarnings(): void {\n  warnedDanglingKeys.clear()\n  warnedCeilingKeys.clear()\n}\n"],"mappings":";;;;;;;;;;;;AAyEO,IAAM,wBAAwB;AAU9B,IAAM,8BAA8B;AAQ3C,IAAM,qBAAqB;AAoQ3B,SAAS,oBAAoB,QAAgB,SAAuC;AAClF,MAAI,OAAO,SAAS,QAAS,QAAO;AAGpC,SAAO,QAAQ,IAAI,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,CAAE;AAChD;AAwBO,SAAS,iBACd,SACA,OAC+E;AAC/E,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,EAAG,QAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AACxF,QAAM,UAAU,IAAI,IAAI,MAAM,IAAI,SAAO,IAAI,EAAE,CAAC;AAChD,QAAM,UAAoB,CAAC;AAC3B,QAAM,WAAqB,CAAC;AAC5B,aAAW,UAAU,SAAS;AAC5B;AAAC,KAAC,oBAAoB,QAAQ,OAAO,IAAI,WAAW,SAAS,KAAK,MAAM;AAAA,EAC1E;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAeO,SAAS,yBACd,SACA,OACS;AACT,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,EAAG,QAAO;AACvD,QAAM,UAAU,IAAI,IAAI,MAAM,IAAI,SAAO,IAAI,EAAE,CAAC;AAChD,SAAO,QAAQ,KAAK,WAAS,QAAQ,IAAI,MAAM,MAAM,MAAM,GAAG,EAAE,CAAC,CAAE,CAAC;AACtE;AAYO,SAAS,kBAAkB,OAAoC;AACpE,SAAO,MAAM,KAAK,SAAO,IAAI,UAAU,IAAI;AAC7C;AAaO,SAAS,aAAa,OAA+B;AAC1D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AAOA,IAAM,qBAAqB,oBAAI,IAAY;AAC3C,SAAS,iBAAiB,OAAe,QAAgB,OAAqB;AAC5E,QAAM,MAAM,GAAG,KAAK,SAAI,MAAM,IAAI,KAAK;AACvC,MAAI,mBAAmB,IAAI,GAAG,EAAG;AACjC,qBAAmB,IAAI,GAAG;AAC1B,UAAQ;AAAA,IACN,oEACY,KAAK,aAAQ,MAAM,IAAI,KAAK;AAAA,EAC1C;AACF;AAOA,IAAM,oBAAoB,oBAAI,IAAY;AAC1C,SAAS,uBACP,QACA,MACA,MACA,SACM;AACN,QAAM,MAAM,GAAG,MAAM,IAAI,IAAI;AAC7B,MAAI,kBAAkB,IAAI,GAAG,EAAG;AAChC,oBAAkB,IAAI,GAAG;AACzB,QAAM,MAAM,KAAK,MAAO,OAAO,UAAW,GAAG;AAC7C,UAAQ;AAAA,IACN,oBAAoB,IAAI,eAAe,GAAG,YAAY,OAAO,4BACpC,MAAM,MAAM,IAAI;AAAA,EAE3C;AACF;AAuCO,SAAS,WACd,MACA,OACA,SACA,QACW;AACX,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC,GAAG,IAAI;AAEvC,MAAI,SAAoB,CAAC,GAAG,IAAI;AAChC,aAAW,OAAO,OAAO;AACvB,aAAS,aAAa,QAAQ,KAAK,SAAS,MAAM;AAAA,EACpD;AACA,SAAO;AACT;AAWA,SAAS,aACP,UACA,KACA,SACA,QACW;AACX,QAAM,OAAO,gBAAgB,UAAU,KAAK,SAAS,MAAM;AAC3D,MAAI,IAAI,UAAU,KAAM,QAAO;AAC/B,SAAO,KAAK,OAAO,SAAO,QAAQ,QAAQ,OAAO,QAAQ,YAAa,IAAgC,IAAI,EAAE,KAAK,IAAI;AACvH;AAEA,SAAS,gBACP,UACA,KACA,SACA,QACW;AAGX,MAAI,IAAI,YAAY;AAClB,UAAM,aAAa,QAAQ,oBAAoB,IAAI,KAAK;AACxD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,kBAAkB,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,MAG5D;AAAA,IACF;AACA,UAAM,MAAiB,CAAC;AACxB,UAAM,WAAW,WAAW,SAAS;AACrC,UAAM,UAAU,oBAAI,IAAqB;AACzC,eAAW,SAAS,UAAU;AAC5B,YAAM,IAAI,SAAS,OAAO,KAAK;AAC/B,UAAI,OAAO,MAAM,SAAU,SAAQ,IAAI,GAAG,KAAK;AAAA,IACjD;AACA,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,YAAY,QAAQ,OAAO,SAAY,QAAQ,IAAI,GAAG;AAC5D,UAAI,KAAK,EAAE,GAAI,MAAkC,CAAC,IAAI,EAAE,GAAG,aAAa,KAAK,CAAC;AAAA,IAChF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,QAAQ,cAAc,IAAI,MAAM;AAC/C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,6CAA6C,IAAI,MAAM,6BAC1B,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,IAGvE;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,WAAW;AAO/B,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,SACE,yBAAyB,SAAS,MAAM,wBAAwB,OAAO,4BAChD,IAAI,MAAM;AAAA,IAGrC,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,UAAU,oBAAoB;AAClD,2BAAuB,IAAI,QAAQ,QAAQ,SAAS,QAAQ,OAAO;AAAA,EACrE;AAEA,QAAM,gBAAgB,OAAO,SAAS;AACtC,MAAI,cAAc,SAAS,SAAS;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW,cAAc;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,SACE,uBAAuB,IAAI,MAAM,SAAS,cAAc,MAAM,wBAC7C,OAAO;AAAA,IAE5B,CAAC;AAAA,EACH;AACA,MAAI,cAAc,SAAS,UAAU,oBAAoB;AACvD,2BAAuB,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO;AAAA,EAC3E;AAMA,QAAM,YAAY,UAAU,QAAQ;AACpC,QAAM,iBACJ,cAAc,UAAa,OAAO,mBAAmB,SACjD,CAAC,UACC,UAAU,QAAQ,OAAO,UAAU,WAC/B,OAAO,eAAgB,OAAO,SAAS,IACvC,QACN;AAON,MAAI,IAAI,OAAO,QAAW;AACxB,WAAO,aAAa,UAAU,KAAK,IAAI,IAAI,eAAe,SAAS,cAAc;AAAA,EACnF;AAKA,QAAM,WACJ,IAAI,aAAa,OAAO,aAAa,WAAW;AAMlD,QAAM,YAAY,IAAI,aAAa;AACnC,MAAI,cAAc,QAAQ;AACxB,WAAO,mBAAmB,UAAU,KAAK,QAAQ,WAAW,cAAc;AAAA,EAC5E;AAEA,MAAI,aAAa,YAAY,OAAO,YAAY;AAI9C,UAAM,SAAS,CAAC,OAAwB,OAAO,aAAa,EAAE;AAC9D,WAAO,eAAe,UAAU,KAAK,QAAQ,cAAc;AAAA,EAC7D;AACA,SAAO,SAAS,UAAU,KAAK,eAAe,cAAc;AAC9D;AAeA,SAAS,aACP,UACA,KACA,IACA,eACA,SACA,gBACW;AACX,QAAM,UAAU,kBAAkB,UAAU,IAAI,eAAe,SAAS,cAAY;AAClF,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW,cAAc;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,SACE,YAAY,IAAI,MAAM,yBAAyB,OAAO,UAAU,QAAQ,uBACrE,SAAS,MAAM,WAAW,cAAc,MAAM;AAAA,IAGrD,CAAC;AAAA,EACH,CAAC;AACD,QAAM,MAAiB,CAAC;AACxB,aAAW,EAAE,MAAM,MAAM,KAAK,SAAS;AACrC,UAAM,UAAU,kBAAkB,UAAU,SAAY,eAAe,KAAK,IAAI;AAKhF,QAAI,KAAK,WAAW,MAAM,KAAK,SAAS,MAAS,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,eACP,UACA,KACA,YACA,gBACW;AACX,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,WAAW,GAAG;AACrD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,SACP,UACA,KACA,eACA,gBACW;AAIX,QAAM,WAAW,oBAAI,IAAqB;AAC1C,aAAW,UAAU,eAAe;AAClC,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,MAAM;AAChB,eAAS,IAAI,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,SAAS,IAAI,GAAG;AACvD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAYA,SAAS,aAAa,UAA8B,OAAuC;AACzF,SAAO,eAAe,UAAU,UAAQ,SAAS,MAAM,KAAK,CAAC;AAC/D;AAiBO,SAAS,eACd,OACA,SACkB;AAClB,QAAM,UAAU,oBAAI,IAAiB;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,aAAa,QAAQ,IAAI,CAAC;AACtC,QAAI,QAAQ,KAAM;AAClB,UAAM,SAAS,QAAQ,IAAI,GAAG;AAC9B,QAAI,OAAQ,QAAO,KAAK,IAAI;AAAA,QACvB,SAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAmBA,SAAS,mBACP,UACA,KACA,QACA,WACA,gBACW;AACX,QAAM,UAAU,aAAa,UAAU,IAAI,KAAK;AAChD,QAAM,cAAc,oBAAI,IAAa;AACrC,QAAM,MAAiB,CAAC;AAMxB,QAAM,UACJ,OAAO,kBAAkB,KACzB,OAAO,SAAS,EAAE,IAAI,aAAW,EAAE,IAAI,aAAa,SAAS,QAAQ,IAAI,CAAC,GAAG,OAAO,EAAE;AAExF,aAAW,EAAE,IAAI,KAAK,QAAQ,MAAM,KAAK,SAAS;AAChD,UAAM,UAAU,iBAAiB,eAAe,KAAK,IAAI;AACzD,UAAM,SAAS,QAAQ,OAAO,SAAY,QAAQ,IAAI,GAAG;AACzD,QAAI,WAAW,UAAa,OAAO,WAAW,GAAG;AAG/C,UAAI,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC;AAC9B;AAAA,IACF;AACA,eAAW,QAAQ,QAAQ;AACzB,kBAAY,IAAI,IAAI;AACpB,UAAI,KAAK,WAAW,MAAM,KAAK,SAAS,SAAS,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,aAAW,QAAQ,UAAU;AAC3B,QAAI,YAAY,IAAI,IAAI,EAAG;AAG3B,UAAM,MAAM,WAAW,MAAM,KAAK,QAAW,SAAS,MAAM,IAAI,KAAK,CAAC;AACtE,QAAI,cAAc,OAAQ,KAAI,KAAK,GAAG;AAAA,EACxC;AAEA,SAAO;AACT;AAgBA,SAAS,WACP,MACA,KACA,OACA,OACS;AACT,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAI7C,WAAO;AAAA,EACT;AACA,QAAM,SAAkC,EAAE,GAAI,KAAiC;AAM/E,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,UAAU,QAAW;AACvB,QAAI,WAAW,QAAQ,IAAI,SAAS,UAAU;AAC5C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,OAAO,IAAI;AAAA,QACX,QAAQ,IAAI;AAAA,QACZ,OAAO;AAAA,QACP,SACE,+CAA+C,IAAI,MAAM,IAAI,MAAM,gBACrD,IAAI,KAAK;AAAA,MAG3B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ;AAC1C,uBAAiB,IAAI,OAAO,IAAI,QAAQ,MAAM;AAAA,IAChD;AAIA,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,oBAA0B;AACxC,qBAAmB,MAAM;AACzB,oBAAkB,MAAM;AAC1B;","names":[]}

package/dist/chunk-6B4X447I.js

@@ -1,40 +0,0 @@
-import {
-  base64ToBuffer,
-  bufferToBase64
-} from "./chunk-6Y3UJT5H.js";
-
-// src/capsule/plumbing/sign.ts
-var ALG = "Ed25519";
-var subtle = globalThis.crypto.subtle;
-function toB64url(bytes) {
-  return bufferToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromB64url(s) {
-  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
-  return base64ToBuffer(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
-}
-async function generateSigningKeyPair() {
-  const kp = await subtle.generateKey(ALG, true, ["sign", "verify"]);
-  const rawPub = new Uint8Array(await subtle.exportKey("raw", kp.publicKey));
-  const pkcs8 = new Uint8Array(await subtle.exportKey("pkcs8", kp.privateKey));
-  return { publicKeyB64: toB64url(rawPub), privateKeyPkcs8B64: toB64url(pkcs8) };
-}
-async function signBytes(privateKeyPkcs8B64, message) {
-  const key = await subtle.importKey("pkcs8", fromB64url(privateKeyPkcs8B64), ALG, false, ["sign"]);
-  return toB64url(new Uint8Array(await subtle.sign(ALG, key, message)));
-}
-async function verifyBytes(publicKeyB64, sigB64url, message) {
-  try {
-    const key = await subtle.importKey("raw", fromB64url(publicKeyB64), ALG, false, ["verify"]);
-    return await subtle.verify(ALG, key, fromB64url(sigB64url), message);
-  } catch {
-    return false;
-  }
-}
-
-export {
-  generateSigningKeyPair,
-  signBytes,
-  verifyBytes
-};
-//# sourceMappingURL=chunk-6B4X447I.js.map

package/dist/chunk-6B4X447I.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/capsule/plumbing/sign.ts"],"sourcesContent":["/**\n * The enclave's `sign` group — Ed25519 over WebCrypto, base64url encoded.\n *\n * Moved in from `@noy-db/attestation` (capsule seam spec, D5): signing is a\n * crypto primitive, and the one a post-quantum enclave swaps (Ed25519 →\n * ML-DSA). Attestation issue/revoke and the pod signature convention call\n * these; `@noy-db/attestation` keeps its own copy for hub-less verifiers,\n * and `__tests__/enclave-sign-group.test.ts` pins the two interoperable.\n *\n * Encoding is base64url without padding — the same bytes-to-string mapping\n * attestation uses, so a key or signature is one string in both places.\n *\n * ⚠️ SHARED, with a known limit. Ed25519 is the `sign` group for BOTH\n * `enclave-aes` and `exclave-plain` — the seam design's group table says so —\n * which is why this lives in the plumbing rather than in a capsule. It is NOT\n * shared with a future `enclave-pqc`, whose whole point is swapping Ed25519\n * for ML-DSA. When that capsule arrives, `sign` becomes a parameterised group\n * like `cipher`; it is not one today because there is no second implementation\n * to parameterise against, and a seam with one implementation is a guess.\n */\nimport { bufferToBase64, base64ToBuffer } from './digest.js'\n\nconst ALG = 'Ed25519'\nconst subtle = globalThis.crypto.subtle\n\nfunction toB64url(bytes: Uint8Array): string {\n  return bufferToBase64(bytes).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction fromB64url(s: string): Uint8Array {\n  const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4))\n  return base64ToBuffer(s.replace(/-/g, '+').replace(/_/g, '/') + pad)\n}\n\nexport async function generateSigningKeyPair(): Promise<{\n  /** base64url raw (32 bytes) — non-secret, publishable */\n  publicKeyB64: string\n  /** base64url pkcs8 — secret, wrap before persisting */\n  privateKeyPkcs8B64: string\n}> {\n  const kp = await subtle.generateKey(ALG, true, ['sign', 'verify'])\n  const rawPub = new Uint8Array(await subtle.exportKey('raw', kp.publicKey))\n  const pkcs8 = new Uint8Array(await subtle.exportKey('pkcs8', kp.privateKey))\n  return { publicKeyB64: toB64url(rawPub), privateKeyPkcs8B64: toB64url(pkcs8) }\n}\n\nexport async function signBytes(privateKeyPkcs8B64: string, message: Uint8Array): Promise<string> {\n  const key = await subtle.importKey('pkcs8', fromB64url(privateKeyPkcs8B64) as BufferSource, ALG, false, ['sign'])\n  return toB64url(new Uint8Array(await subtle.sign(ALG, key, message as BufferSource)))\n}\n\n/** Fails closed: any malformed input is `false`, never a throw. */\nexport async function verifyBytes(publicKeyB64: string, sigB64url: string, message: Uint8Array): Promise<boolean> {\n  try {\n    const key = await subtle.importKey('raw', fromB64url(publicKeyB64) as BufferSource, ALG, false, ['verify'])\n    return await subtle.verify(ALG, key, fromB64url(sigB64url) as BufferSource, message as BufferSource)\n  } catch {\n    return false\n  }\n}\n"],"mappings":";;;;;;AAsBA,IAAM,MAAM;AACZ,IAAM,SAAS,WAAW,OAAO;AAEjC,SAAS,SAAS,OAA2B;AAC3C,SAAO,eAAe,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACxF;AAEA,SAAS,WAAW,GAAuB;AACzC,QAAM,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI,OAAO,IAAK,EAAE,SAAS,CAAE;AACnE,SAAO,eAAe,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,GAAG;AACrE;AAEA,eAAsB,yBAKnB;AACD,QAAM,KAAK,MAAM,OAAO,YAAY,KAAK,MAAM,CAAC,QAAQ,QAAQ,CAAC;AACjE,QAAM,SAAS,IAAI,WAAW,MAAM,OAAO,UAAU,OAAO,GAAG,SAAS,CAAC;AACzE,QAAM,QAAQ,IAAI,WAAW,MAAM,OAAO,UAAU,SAAS,GAAG,UAAU,CAAC;AAC3E,SAAO,EAAE,cAAc,SAAS,MAAM,GAAG,oBAAoB,SAAS,KAAK,EAAE;AAC/E;AAEA,eAAsB,UAAU,oBAA4B,SAAsC;AAChG,QAAM,MAAM,MAAM,OAAO,UAAU,SAAS,WAAW,kBAAkB,GAAmB,KAAK,OAAO,CAAC,MAAM,CAAC;AAChH,SAAO,SAAS,IAAI,WAAW,MAAM,OAAO,KAAK,KAAK,KAAK,OAAuB,CAAC,CAAC;AACtF;AAGA,eAAsB,YAAY,cAAsB,WAAmB,SAAuC;AAChH,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,UAAU,OAAO,WAAW,YAAY,GAAmB,KAAK,OAAO,CAAC,QAAQ,CAAC;AAC1G,WAAO,MAAM,OAAO,OAAO,KAAK,KAAK,WAAW,SAAS,GAAmB,OAAuB;AAAA,EACrG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-6Y3UJT5H.js

@@ -1,157 +0,0 @@
-import {
-  ValidationError
-} from "./chunk-JGYCKX56.js";
-
-// src/capsule/plumbing/normalize.ts
-function normalizeForVerify(mode, value) {
-  const nfc = value.normalize("NFC");
-  if (mode === "password") return nfc;
-  return nfc.toLowerCase().normalize("NFC").trim().replace(/\s+/g, " ");
-}
-
-// src/capsule/plumbing/digest.ts
-var subtle = globalThis.crypto.subtle;
-var KEY_BITS = 256;
-var SALT_BYTES = 32;
-var IV_BYTES = 12;
-var RECOVERY_SECRET_BYTES = 32;
-var PRESENCE_TAG_KEY_DOMAIN = "noydb.presence.tag.v1";
-var ECHO_KDF_CONTEXT = new Uint8Array([255, ...new TextEncoder().encode("noydb-echo-secret-v1")]);
-function encodeEchoParts(parts) {
-  for (const name of ["prompt", "echo", "key"]) {
-    if (typeof parts?.[name] !== "string") {
-      throw new ValidationError("echo secret parts must be three strings: prompt, echo, key");
-    }
-  }
-  const enc = new TextEncoder();
-  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p));
-  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0);
-  const out = new Uint8Array(total);
-  out.set(ECHO_KDF_CONTEXT, 0);
-  let offset = ECHO_KDF_CONTEXT.length;
-  for (const s of segments) {
-    new DataView(out.buffer).setUint32(offset, s.length, false);
-    out.set(s, offset + 4);
-    offset += 4 + s.length;
-  }
-  return out;
-}
-async function sha256Hex(data) {
-  const hash = await subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function sha256Bytes(data) {
-  return new Uint8Array(await subtle.digest("SHA-256", data));
-}
-async function deriveBlobAddressKey(root, tier) {
-  const rawRoot = await subtle.exportKey("raw", root);
-  const hkdfKey = await subtle.importKey("raw", rawRoot, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-blob-address");
-  const info = new TextEncoder().encode(`tier:${tier}`);
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
-  return subtle.importKey("raw", bits, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
-}
-async function hmacSha256Hex(key, data) {
-  const rawKey = await subtle.exportKey("raw", key);
-  const hmacKey = await subtle.importKey(
-    "raw",
-    rawKey,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const sig = await subtle.sign("HMAC", hmacKey, data);
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function derivePresenceKey(dek, collectionName) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey(
-    "raw",
-    rawDek,
-    "HKDF",
-    false,
-    ["deriveBits"]
-  );
-  const salt = new TextEncoder().encode("noydb-presence");
-  const info = new TextEncoder().encode(collectionName);
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function derivePresenceTagKey(dek, collectionName) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN);
-  const info = new TextEncoder().encode(collectionName);
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
-  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-}
-async function hmacSignHex(key, data) {
-  const sig = await subtle.sign("HMAC", key, data);
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hkdfAesGcmKey(ikm, salt, info) {
-  const key = await subtle.importKey("raw", ikm, "HKDF", false, ["deriveKey"]);
-  return subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    key,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-function generateIV() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
-}
-function generateSalt() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
-}
-function generateRecoverySecret() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES));
-}
-function bufferToBase64(buffer) {
-  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary);
-}
-function base64ToBuffer(base64) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
-export {
-  normalizeForVerify,
-  KEY_BITS,
-  IV_BYTES,
-  encodeEchoParts,
-  sha256Hex,
-  sha256Bytes,
-  deriveBlobAddressKey,
-  hmacSha256Hex,
-  derivePresenceKey,
-  derivePresenceTagKey,
-  hmacSignHex,
-  hkdfAesGcmKey,
-  generateIV,
-  generateSalt,
-  generateRecoverySecret,
-  bufferToBase64,
-  base64ToBuffer
-};
-//# sourceMappingURL=chunk-6Y3UJT5H.js.map

package/dist/chunk-6Y3UJT5H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/capsule/plumbing/normalize.ts","../src/capsule/plumbing/digest.ts"],"sourcesContent":["/**\n * Preset normalization for verify candidates AND stored comparands (§4).\n * Both sides of every comparison route through the SAME function so\n * write-time digests and verify-time candidates agree. @module\n */\nexport type VerifyNormalizeMode = 'password' | 'secret-answer'\n\nexport function normalizeForVerify(mode: VerifyNormalizeMode, value: string): string {\n  const nfc = value.normalize('NFC')\n  if (mode === 'password') return nfc\n  // secret-answer: NFC -> casefold -> re-NFC -> trim -> collapse internal\n  // whitespace runs. `.toLowerCase()` is the chosen casefold approximation\n  // (JS has no full Unicode caseless-match in the stdlib, e.g. ß stays ß);\n  // the re-NFC after lowercasing keeps the result deterministic.\n  return nfc.toLowerCase().normalize('NFC').trim().replace(/\\s+/g, ' ')\n}\n","/**\n * The digest group — hashing, HKDF over public inputs, randomness, base64.\n *\n * Shared by every capsule, and that is the design's own answer rather than a\n * convenience: the capsule-seam spec's group table marks `digest` \"as today\"\n * for `enclave-aes`, `exclave-plain` AND `enclave-pqc` alike. Hashes are not\n * secrets, so there is nothing here to swap — a plaintext capsule computes the\n * same SHA-256 as an encrypting one, and a blob address derived differently\n * per capsule would simply be a bug.\n *\n * ⚠️ This module calls `crypto.subtle`, inside `capsule/**`, which is where the\n * `subtle-outside-capsule` ban permits it. The ban's TARGET is code outside the\n * capsule reaching for WebCrypto on its own; a shared capsule-layer primitive\n * is the thing it is pushing callers toward.\n */\nimport { ValidationError } from '../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** AES key size in bits. Shared: every capsule that derives an AES-GCM subkey\n *  from the digest group produces a 256-bit key, or the derivations diverge. */\nexport const KEY_BITS = 256\n\nconst SALT_BYTES = 32\nexport const IV_BYTES = 12\nconst RECOVERY_SECRET_BYTES = 32\nconst PRESENCE_TAG_KEY_DOMAIN = 'noydb.presence.tag.v1'\n\n/** The echo-secret typed parts. Encoding lives here with `encodeEchoParts`; the\n *  KEK derivation that consumes it stays in the capsule's `authenticate` group. */\nexport interface EchoSecretParts {\n  readonly prompt: string\n  readonly echo: string\n  readonly key: string\n}\n\nconst ECHO_KDF_CONTEXT = new Uint8Array([0xff, ...new TextEncoder().encode('noydb-echo-secret-v1')])\n\n/**\n * AG-1 encoding: domain context + 4-byte big-endian length prefix per\n * part. Two independent guarantees make a single typed string unable to\n * derive an echo vault's KEK (spec AG-1):\n *\n *   1. The `0xFF` context prefix — UTF-8 never produces that byte, so the\n *      encoding is provably not the encoding of ANY string (not merely of\n *      no separator-joined form).\n *   2. Structural length prefixes — part boundaries are key material, so\n *      re-splitting the same characters changes the derived KEK.\n *\n * @throws ValidationError when any part is not a string — the single\n * chokepoint every echo KEK derivation and block mint passes through, so a\n * malformed parts object cannot be `TextEncoder`-coerced into key material.\n */\nexport function encodeEchoParts(parts: EchoSecretParts): Uint8Array {\n  for (const name of ['prompt', 'echo', 'key'] as const) {\n    if (typeof parts?.[name] !== 'string') {\n      throw new ValidationError('echo secret parts must be three strings: prompt, echo, key')\n    }\n  }\n  const enc = new TextEncoder()\n  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p))\n  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0)\n  const out = new Uint8Array(total)\n  out.set(ECHO_KDF_CONTEXT, 0)\n  let offset = ECHO_KDF_CONTEXT.length\n  for (const s of segments) {\n    new DataView(out.buffer).setUint32(offset, s.length, false)\n    out.set(s, offset + 4)\n    offset += 4 + s.length\n  }\n  return out\n}\n\n/**\n * SHA-256 hex digest of raw bytes. Used to derive content-addressed\n * eTags for blob deduplication. Computed on plaintext bytes\n * before compression and encryption so the eTag identifies content, not\n * ciphertext, and survives re-encryption (key rotation, re-upload).\n */\nexport async function sha256Hex(data: Uint8Array): Promise<string> {\n  const hash = await subtle.digest('SHA-256', data as unknown as BufferSource)\n  return Array.from(new Uint8Array(hash))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/** SHA-256 of raw bytes, as bytes. */\nexport async function sha256Bytes(data: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.digest('SHA-256', data as unknown as BufferSource))\n}\n\n// ─── HMAC-SHA-256 ─────────────────────────────\n\n/**\n * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).\n *\n * The blob eTag is an HMAC over the plaintext. It used to be keyed by the\n * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation\n * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,\n * permanently. `decryptResponse()` checks that unconditionally, so the\n * presigned-URL read path raised `TamperedError` on legitimate data forever;\n * dedup also split, minting a second address for identical bytes.\n *\n * The fix is a `root` that rotation never touches (`_blob_addr`, refused by\n * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES\n * while every address stays stable, which is what makes the AAD\n * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /\n * `_blob_versions_*` row survive it untouched.\n *\n * **Derived PER TIER, deliberately.** A single vault-wide address would make an\n * elevated blob and a tier-0 blob with identical content share an eTag,\n * leaking equality across a boundary the tier system exists to enforce — and\n * `rehomeForTier` re-addresses on a tier move precisely because the address is\n * tier-scoped today. Domain separation keeps that property while removing the\n * rotation coupling: the two are independent axes, and only one of them was\n * ever meant to change the address.\n *\n * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can\n * never coincide with a wrapping or encryption key.\n */\nexport async function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey> {\n  const rawRoot = await subtle.exportKey('raw', root)\n  const hkdfKey = await subtle.importKey('raw', rawRoot, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-blob-address')\n  const info = new TextEncoder().encode(`tier:${tier}`)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  // Imported as AES-GCM only because `hmacSha256Hex` re-exports raw and\n  // re-imports as HMAC; the algorithm tag here is a carrier, never used to\n  // encrypt anything.\n  return subtle.importKey('raw', bits, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt'])\n}\n\n/**\n * HMAC-SHA-256(key, data) as hex.\n *\n * Keyed, unlike {@link sha256Hex}: blob eTags derived with this are opaque to\n * the store, so an attacker with store access cannot pre-compute the address of\n * a file they guess at. Dedup still works inside a vault, where the key is shared.\n */\nexport async function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  // Export AES-GCM DEK raw bytes → import as HMAC key\n  const rawKey = await subtle.exportKey('raw', key)\n  const hmacKey = await subtle.importKey(\n    'raw',\n    rawKey,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const sig = await subtle.sign('HMAC', hmacKey, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n// ─── AAD-aware Binary Encrypt / Decrypt ──\n\n/**\n * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.\n *\n * The presence key is domain-separated from the data DEK by the fixed salt\n * `'noydb-presence'` and the `info` = collection name. This means:\n *  - The adapter never sees the presence key.\n *  - Presence payloads rotate automatically when the collection DEK is rotated.\n *  - Revoked users cannot derive the new presence key after a DEK rotation.\n *\n * @param dek            The collection's AES-256-GCM DEK (extractable).\n * @param collectionName Used as the HKDF `info` parameter for domain separation.\n * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.\n */\nexport async function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  // Step 1: export DEK raw bytes\n  const rawDek = await subtle.exportKey('raw', dek)\n\n  // Step 2: import as HKDF key material\n  const hkdfKey = await subtle.importKey(\n    'raw',\n    rawDek,\n    'HKDF',\n    false,\n    ['deriveBits'],\n  )\n\n  // Step 3: derive 256 bits with salt='noydb-presence' and info=collectionName\n  const salt = new TextEncoder().encode('noydb-presence')\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n\n  // Step 4: import derived bits as AES-GCM key\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Derive the presence-TAG key from a collection DEK: a non-extractable,\n * sign-only HMAC-SHA256 key, HKDF-separated from the presence PAYLOAD key\n * ({@link derivePresenceKey}) by its own salt. The tag is the adapter-opaque\n * record id for storage-polled presence; the adapter never sees the userId.\n */\nexport async function derivePresenceTagKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN)\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * HMAC-SHA256 hex with a key that IS an HMAC key (e.g. from\n * {@link derivePresenceTagKey}). {@link hmacSha256Hex} takes an AES-GCM\n * carrier and re-imports its raw bytes, which needs an extractable key;\n * this one signs directly and works with non-extractable keys.\n */\nexport async function hmacSignHex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  const sig = await subtle.sign('HMAC', key, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * HKDF-SHA256 → non-extractable AES-256-GCM key from caller-supplied input\n * key material. The magic-link content key derives here from\n * `(serverSecret, SHA-256(token), info)`; `salt`/`info` are the caller's\n * domain separation, this function adds none.\n */\nexport async function hkdfAesGcmKey(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<CryptoKey> {\n  const key = await subtle.importKey('raw', ikm as BufferSource, 'HKDF', false, ['deriveKey'])\n  return subtle.deriveKey(\n    { name: 'HKDF', hash: 'SHA-256', salt: salt as BufferSource, info: info as BufferSource },\n    key,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n// ─── Sealed Field Key Derivation ──────────────────────────\n\n/** Generate a random 12-byte IV for AES-GCM. */\nexport function generateIV(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES))\n}\n\n/** Generate a random 32-byte salt for PBKDF2. */\nexport function generateSalt(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES))\n}\n\n/**\n * Mint a fresh recovery secret — the high-entropy value a recovery profile\n * wraps the DEK set under and then hands out (Shamir splits it into shares;\n * paper prints it). Not a salt: a salt is public, this is not, and a fork\n * may size them differently. The reference enclave returns 32 bytes.\n *\n * Callers must zero the buffer once it has been wrapped and split.\n */\nexport function generateRecoverySecret(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES))\n}\n\n// ─── Recipient sealing (RSA-OAEP-SHA256) ───────────────────────────────\n//\n// The managed-secret TLV wraps a per-blob CEK for a recipient who holds an\n// RSA private key — locally (`MemoryRecipientSealer`) or in a KMS\n// (`@noy-db/at-aws-kms`, wire-compatible with RSAES_OAEP_SHA_256). Only the\n// asymmetric steps live here; the TLV layout stays in `managed-secret.ts`.\nexport function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string {\n  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer)\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]!)\n  }\n  return btoa(binary)\n}\nexport function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer> {\n  const binary = atob(base64)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes\n}\n"],"mappings":";;;;;AAOO,SAAS,mBAAmB,MAA2B,OAAuB;AACnF,QAAM,MAAM,MAAM,UAAU,KAAK;AACjC,MAAI,SAAS,WAAY,QAAO;AAKhC,SAAO,IAAI,YAAY,EAAE,UAAU,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG;AACtE;;;ACEA,IAAM,SAAS,WAAW,OAAO;AAI1B,IAAM,WAAW;AAExB,IAAM,aAAa;AACZ,IAAM,WAAW;AACxB,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAUhC,IAAM,mBAAmB,IAAI,WAAW,CAAC,KAAM,GAAG,IAAI,YAAY,EAAE,OAAO,sBAAsB,CAAC,CAAC;AAiB5F,SAAS,gBAAgB,OAAoC;AAClE,aAAW,QAAQ,CAAC,UAAU,QAAQ,KAAK,GAAY;AACrD,QAAI,OAAO,QAAQ,IAAI,MAAM,UAAU;AACrC,YAAM,IAAI,gBAAgB,4DAA4D;AAAA,IACxF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,WAAW,CAAC,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC;AAC/E,QAAM,QAAQ,iBAAiB,SAAS,SAAS,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC;AACrF,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,IAAI,kBAAkB,CAAC;AAC3B,MAAI,SAAS,iBAAiB;AAC9B,aAAW,KAAK,UAAU;AACxB,QAAI,SAAS,IAAI,MAAM,EAAE,UAAU,QAAQ,EAAE,QAAQ,KAAK;AAC1D,QAAI,IAAI,GAAG,SAAS,CAAC;AACrB,cAAU,IAAI,EAAE;AAAA,EAClB;AACA,SAAO;AACT;AAQA,eAAsB,UAAU,MAAmC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO,WAAW,IAA+B;AAC3E,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAGA,eAAsB,YAAY,MAAuC;AACvE,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,WAAW,IAA+B,CAAC;AACvF;AA+BA,eAAsB,qBAAqB,MAAiB,MAAkC;AAC5F,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,IAAI;AAClD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,SAAS,QAAQ,OAAO,CAAC,YAAY,CAAC;AACpF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,oBAAoB;AAC1D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,QAAQ,IAAI,EAAE;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AAIrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,SAAS,CAAC;AACxF;AASA,eAAsB,cAAc,KAAgB,MAAmC;AAErF,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,SAAS,IAA+B;AAC9E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAiBA,eAAsB,kBAAkB,KAAgB,gBAA4C;AAElG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAGhD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AAGA,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB;AACtD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AAGA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAQA,eAAsB,qBAAqB,KAAgB,gBAA4C;AACrG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,uBAAuB;AAC7D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AACrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAQA,eAAsB,YAAY,KAAgB,MAAmC;AACnF,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAA+B;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAQA,eAAsB,cAAc,KAAiB,MAAkB,MAAsC;AAC3G,QAAM,MAAM,MAAM,OAAO,UAAU,OAAO,KAAqB,QAAQ,OAAO,CAAC,WAAW,CAAC;AAC3F,SAAO,OAAO;AAAA,IACZ,EAAE,MAAM,QAAQ,MAAM,WAAW,MAA4B,KAA2B;AAAA,IACxF;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAKO,SAAS,aAAyB;AACvC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,QAAQ,CAAC;AACnE;AAGO,SAAS,eAA2B;AACzC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AACrE;AAUO,SAAS,yBAAqC;AACnD,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,qBAAqB,CAAC;AAChF;AAQO,SAAS,eAAe,QAA0C;AACvE,QAAM,QAAQ,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;AAC3E,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAAA,EACzC;AACA,SAAO,KAAK,MAAM;AACpB;AACO,SAAS,eAAe,QAAyC;AACtE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-AYUMAPOS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../capsule/index.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadMVExecutor = lazy(() => import('./executor.js'))\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ collection: MV_STALE_COLLECTION, id: mvName, version: 1 }, { data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    executor ??= (await loadMVExecutor()).MaterializedViewExecutor\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;;;;AAeA,IAAM,iBAAiB,KAAK,MAAM,OAAO,wBAAe,CAAC;AA4BzD,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,YAAY,qBAAqB,IAAI,QAAQ,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1H,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,kBAAc,MAAM,eAAe,GAAG;AAQtC,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}