@noy-db/hub 0.2.0-pre.19 → 0.2.0-pre.20

package/dist/{chunk-OY7RX2VL.js → chunk-WWVJXBOT.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SHIUFIPW.js";
+} from "./chunk-TA6HPKWQ.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -13,11 +13,11 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-OKOKPYWH.js";
+} from "./chunk-37VGJM3T.js";
 import {
   ConflictError,
   NotFoundError
-} from "./chunk-DJF3FXW5.js";
+} from "./chunk-OTWT6BAJ.js";
 
 // src/blobs/mime-magic.ts
 function hex(s) {
@@ -280,6 +280,9 @@ var BlobSet = class {
   userId;
   maxBlobBytes;
   erasableBlobs;
+  debugPlaintext;
+  objectStore;
+  blobFields;
   constructor(opts) {
     this.store = opts.store;
     this.vault = opts.vault;
@@ -290,6 +293,9 @@ var BlobSet = class {
     this.userId = opts.userId;
     this.maxBlobBytes = opts.maxBlobBytes;
     this.erasableBlobs = opts.erasableBlobs === true;
+    this.debugPlaintext = opts.debugPlaintext === true;
+    this.objectStore = opts.objectStore;
+    this.blobFields = opts.blobFields;
   }
   /**
    * Resolve the key the blob's CHUNKS are encrypted under.
@@ -677,6 +683,49 @@ var BlobSet = class {
    *    If overwriting an existing slot, decrements the old eTag's refCount.
    */
   async put(slotName, data, opts) {
+    if (this.objectStore && this.blobFields?.[slotName]?.external) {
+      const policy = this.blobFields[slotName];
+      let contentType = opts?.mimeType;
+      if (!contentType) {
+        const detected = detectMagic(data.subarray(0, 16));
+        contentType = detected?.mime ?? "application/octet-stream";
+      }
+      const key = `${this.collection}/${this.recordId}/${slotName}`;
+      const isPublic = policy.public === true;
+      const backlink = await this.buildBacklink(slotName, policy.backlink ?? "opaque-token");
+      await this.objectStore.putObject(key, data, {
+        contentType,
+        public: isPublic,
+        ...backlink.userMeta ? { userMeta: backlink.userMeta } : {}
+      });
+      const uploaderUserId2 = opts?.uploadedBy ?? this.userId;
+      let oldETag;
+      await this.casUpdateSlots((slots) => {
+        oldETag = slots[slotName]?.eTag || void 0;
+        const prevMeta = slots[slotName]?.external?.meta;
+        slots[slotName] = {
+          eTag: "",
+          external: {
+            key,
+            contentType,
+            ...isPublic ? { public: true } : {},
+            ...backlink.token ? { backlink: backlink.token } : {},
+            ...prevMeta ? { meta: prevMeta } : {}
+          },
+          filename: slotName,
+          size: data.byteLength,
+          mimeType: contentType,
+          uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...uploaderUserId2 !== void 0 ? { uploadedBy: uploaderUserId2 } : {}
+        };
+        return slots;
+      });
+      if (oldETag) {
+        await this.releaseRef(oldETag, 1, false).catch(() => {
+        });
+      }
+      return;
+    }
     const blobDEK = this.encrypted ? await this.getDEK(BLOB_COLLECTION) : null;
     const eTag = blobDEK ? await hmacSha256Hex(blobDEK, data) : await plainSha256Hex(data);
     let mimeType = opts?.mimeType;
@@ -692,12 +741,13 @@ var BlobSet = class {
     } else {
       shouldCompress = true;
     }
+    if (this.debugPlaintext) shouldCompress = false;
     const existingBlob = await this.loadBlobObject(eTag);
     if (existingBlob) {
       await this.casUpdateRefCount(eTag, 1);
     } else {
       const { bytes: compressed, algorithm } = shouldCompress ? await compressBytes(data) : { bytes: data, algorithm: "none" };
-      const chunkSize = this.effectiveChunkSize(opts);
+      const chunkSize = this.debugPlaintext ? Math.max(compressed.byteLength, 1) : this.effectiveChunkSize(opts);
       const chunkCount = Math.max(1, Math.ceil(compressed.byteLength / chunkSize));
       let chunkKey = blobDEK;
       let wrappedCek;
@@ -762,10 +812,114 @@ var BlobSet = class {
     const { slots } = await this.loadSlots();
     const slot = slots[slotName];
     if (!slot) return null;
+    if (slot.external) {
+      if (!this.objectStore) {
+        throw new NotFoundError(`Blob slot "${slotName}" is external but no objectStore is configured`);
+      }
+      return this.objectStore.getObject(slot.external.key);
+    }
     const result = await this.loadBlobObject(slot.eTag);
     if (!result) return null;
     return this.fetchAllChunks(result.blob);
   }
+  /**
+   * A URL to fetch an `external` slot's object directly — presigned
+   * (time-limited) or public, per the projection. Returns `null` if the slot
+   * does not exist. Throws for a non-external slot (use `get()`/`response()`).
+   */
+  async url(slotName, opts) {
+    const { slots } = await this.loadSlots();
+    const slot = slots[slotName];
+    if (!slot) return null;
+    if (!slot.external) {
+      throw new NotFoundError(`Blob slot "${slotName}" is not external \u2014 url() is only for external fields`);
+    }
+    if (!this.objectStore) {
+      throw new NotFoundError(`Blob slot "${slotName}" is external but no objectStore is configured`);
+    }
+    return this.objectStore.objectUrl(slot.external.key, opts);
+  }
+  /**
+   * Build the backlink stamped onto an external object's metadata — the
+   * self-describing "secondary store" reference back to this record. See
+   * {@link BlobFieldPolicy.backlink}. Returns the `userMeta` to attach and, for
+   * `opaque-token`, the `token` to record on the slot.
+   */
+  async buildBacklink(slotName, mode) {
+    if (mode === "none") return {};
+    const ref = { vault: this.vault, collection: this.collection, record: this.recordId, field: slotName };
+    if (mode === "plain") {
+      return {
+        userMeta: {
+          "noydb-vault": ref.vault,
+          "noydb-collection": ref.collection,
+          "noydb-record": ref.record,
+          "noydb-field": ref.field
+        }
+      };
+    }
+    if (mode === "encrypted" && this.encrypted) {
+      const dek = await this.getDEK(BLOB_COLLECTION);
+      const { iv, data } = await encrypt(JSON.stringify(ref), dek);
+      return { userMeta: { "noydb-backlink-enc": `${iv}.${data}` } };
+    }
+    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16));
+    const token = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    return { userMeta: { "noydb-backlink": token }, token };
+  }
+  /**
+   * Adopt an EXISTING object in the projection into this slot **without
+   * re-uploading** — used by import/bootstrap to anchor objects already in the
+   * bucket. Writes the external slot record (the catalog entry).
+   */
+  async adoptExternal(slotName, ref) {
+    const uploaderUserId = this.userId;
+    await this.casUpdateSlots((slots) => {
+      slots[slotName] = {
+        eTag: "",
+        external: {
+          key: ref.key,
+          ...ref.contentType ? { contentType: ref.contentType } : {},
+          ...ref.public ? { public: true } : {},
+          ...ref.backlink ? { backlink: ref.backlink } : {},
+          ...ref.meta ? { meta: ref.meta } : {}
+        },
+        filename: slotName,
+        size: ref.size ?? 0,
+        ...ref.contentType ? { mimeType: ref.contentType } : {},
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...uploaderUserId !== void 0 ? { uploadedBy: uploaderUserId } : {}
+      };
+      return slots;
+    });
+  }
+  /**
+   * Merge derived metadata (video `duration`, image `width`/`height`, arbitrary
+   * metatags) into an external slot's secondary metadata store. Typically called
+   * from an AWS-side processing callback (MediaConvert / ffprobe / Rekognition)
+   * once it has probed the object. No-op for a missing or non-external slot.
+   */
+  async setExternalMeta(slotName, meta) {
+    await this.casUpdateSlots((slots) => {
+      const slot = slots[slotName];
+      if (!slot?.external) return null;
+      slots[slotName] = {
+        ...slot,
+        external: { ...slot.external, meta: { ...slot.external.meta, ...meta } }
+      };
+      return slots;
+    });
+  }
+  /**
+   * Read an external slot's synced derived metadata (the secondary store).
+   * Returns `null` for a missing or non-external slot, `{}` if none synced yet.
+   */
+  async externalMeta(slotName) {
+    const { slots } = await this.loadSlots();
+    const slot = slots[slotName];
+    if (!slot?.external) return null;
+    return slot.external.meta ?? {};
+  }
   /**
    * List all slot entries for this record.
    * Returns metadata only — no chunk data is loaded.
@@ -780,12 +934,19 @@ var BlobSet = class {
    */
   async delete(slotName) {
     let eTagToRelease;
+    let externalKeyToDelete;
     await this.casUpdateSlots((slots) => {
       if (!(slotName in slots)) return null;
-      eTagToRelease = slots[slotName].eTag;
+      const slot = slots[slotName];
+      if (slot.external) externalKeyToDelete = slot.external.key;
+      else eTagToRelease = slot.eTag;
       delete slots[slotName];
       return slots;
     });
+    if (externalKeyToDelete && this.objectStore) {
+      await this.objectStore.deleteObject(externalKeyToDelete).catch(() => {
+      });
+    }
     if (eTagToRelease) {
       await this.releaseRef(eTagToRelease, 1, false).catch(() => {
       });
@@ -992,7 +1153,7 @@ var BlobSet = class {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const { decryptBytesWithAAD: decryptAAD } = await import("./crypto-B46VNH6X.js");
+    const { decryptBytesWithAAD: decryptAAD } = await import("./crypto-456N7UVX.js");
     const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const body = new ReadableStream({
@@ -1043,6 +1204,91 @@ async function plainSha256Hex(data) {
   return sha256Hex(data);
 }
 
+// src/blobs/object-projection.ts
+function memoryObjectProjection(opts = {}) {
+  const base = opts.baseUrl ?? "memory://objects";
+  const store = /* @__PURE__ */ new Map();
+  return {
+    name: "memory",
+    async putObject(key, bytes, o) {
+      store.set(key, {
+        bytes,
+        contentType: o.contentType,
+        public: o.public === true,
+        ...o.userMeta ? { userMeta: o.userMeta } : {}
+      });
+    },
+    async getObject(key) {
+      return store.get(key)?.bytes ?? null;
+    },
+    async deleteObject(key) {
+      store.delete(key);
+    },
+    async headObject(key) {
+      const e = store.get(key);
+      if (!e) return null;
+      return {
+        size: e.bytes.byteLength,
+        contentType: e.contentType,
+        ...e.userMeta ? { userMeta: e.userMeta } : {}
+      };
+    },
+    async objectUrl(key, o) {
+      const e = store.get(key);
+      if (e?.public) return `${base}/${key}`;
+      return `${base}/${key}?sig=memory&expires=${o?.expiresInSeconds ?? 900}`;
+    },
+    async putUrl(key, o) {
+      return `${base}/${key}?upload=memory&ct=${encodeURIComponent(o.contentType)}`;
+    },
+    async listPrefix(prefix) {
+      const out = [];
+      for (const [key, e] of store) {
+        if (!key.startsWith(prefix)) continue;
+        out.push({
+          key,
+          meta: { size: e.bytes.byteLength, contentType: e.contentType, ...e.userMeta ? { userMeta: e.userMeta } : {} }
+        });
+      }
+      return out;
+    }
+  };
+}
+
+// src/blobs/import-external.ts
+function defaultDeriveRecordId(key) {
+  const parts = key.split("/");
+  return parts.length >= 2 ? parts[parts.length - 2] ?? null : null;
+}
+async function importExternalObjects(args) {
+  const { collection, objectStore, field } = args;
+  const opts = args.options ?? {};
+  const derive = opts.deriveRecordId ?? defaultDeriveRecordId;
+  const makeRecord = opts.makeRecord ?? ((id) => ({ id }));
+  const objects = await objectStore.listPrefix(opts.prefix ?? "");
+  const recordIds = [];
+  let imported = 0;
+  let skipped = 0;
+  for (const { key, meta } of objects) {
+    const recordId = derive(key);
+    if (!recordId) {
+      skipped++;
+      continue;
+    }
+    if (await collection.get(recordId) == null) {
+      await collection.put(recordId, makeRecord(recordId));
+    }
+    await collection.blob(recordId).adoptExternal(field, {
+      key,
+      ...meta.size !== void 0 ? { size: meta.size } : {},
+      ...meta.contentType ? { contentType: meta.contentType } : {}
+    });
+    recordIds.push(recordId);
+    imported++;
+  }
+  return { imported, skipped, recordIds };
+}
+
 export {
   detectMimeType,
   detectMagic,
@@ -1053,6 +1299,8 @@ export {
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX,
   DEFAULT_CHUNK_SIZE,
-  BlobSet
+  BlobSet,
+  memoryObjectProjection,
+  importExternalObjects
 };
-//# sourceMappingURL=chunk-OY7RX2VL.js.map
+//# sourceMappingURL=chunk-WWVJXBOT.js.map

package/dist/chunk-WWVJXBOT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/blobs/mime-magic.ts","../src/blobs/blob-set.ts","../src/blobs/object-projection.ts","../src/blobs/import-external.ts"],"sourcesContent":["/**\n * Lightweight MIME type detection from magic bytes (file signatures).\n *\n * Designed for the blob store's auto-detection feature. Operates on the first 16 bytes of\n * plaintext — no filesystem access, no filename guessing.\n *\n * ## Detection strategies\n *\n * 1. **Prefix match** — magic bytes at offset 0 (most formats).\n * 2. **Offset match** — magic bytes at a fixed offset > 0 (ISOBMFF: offset 4).\n * 3. **Compound match** — two separate byte sequences at different offsets\n *    (RIFF-based: bytes 0-3 + bytes 8-11).\n *\n * ## Formats excluded (require offset > 16 bytes)\n *\n * - TAR (`ustar` at offset 257)\n * - ISO 9660 (`CD001` at offset 32769)\n *\n * @module\n */\n\n// ─── Types ───────────────────────────────────────────────────────────────\n\ninterface MagicRule {\n  /** IANA MIME type (or widely-used x- type). */\n  readonly mime: string\n  /** Human-readable format name for diagnostics. */\n  readonly format: string\n  /** Magic bytes to match, as a Uint8Array. */\n  readonly bytes: Uint8Array\n  /** Byte offset where the magic starts. Default 0. */\n  readonly offset?: number\n  /**\n   * For compound checks (RIFF, FORM): a second byte sequence that must\n   * also match at `secondaryOffset`.\n   */\n  readonly secondaryBytes?: Uint8Array\n  /** Offset of the secondary match. */\n  readonly secondaryOffset?: number\n  /** If true, the format is already compressed — skip gzip in blob.put(). */\n  readonly preCompressed?: true\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────\n\n/** Convert a hex string like `'FF D8 FF'` to Uint8Array. */\nfunction hex(s: string): Uint8Array {\n  return new Uint8Array(s.split(' ').map((b) => parseInt(b, 16)))\n}\n\n// ─── Magic rules ─────────────────────────────────────────────────────────\n//\n// Ordered by detection priority: more specific (longer) signatures first\n// within the same offset group, so that e.g. RAR v5 (8 bytes) is tested\n// before RAR v4 (7 bytes).\n//\n// Sources verified against:\n//   - Gary Kessler's File Signatures Table\n//   - Wikipedia \"List of file signatures\"\n//   - IANA MIME type registry\n//   - Individual format specifications (PNG RFC 2083, PDF ISO 32000, etc.)\n//\n// Each entry includes the original CSV row number for traceability.\n\nconst MAGIC_RULES: readonly MagicRule[] = [\n  // ── Images ───────────────────────────────────────────────────────────\n\n  // #2  PNG — full 8-byte signature (RFC 2083)\n  { mime: 'image/png', format: 'PNG', bytes: hex('89 50 4E 47 0D 0A 1A 0A'), preCompressed: true },\n\n  // #1  JPEG — FF D8 FF (third byte is start of APP marker, always FF)\n  { mime: 'image/jpeg', format: 'JPEG', bytes: hex('FF D8 FF'), preCompressed: true },\n\n  // #7  WebP — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = WEBP\n  {\n    mime: 'image/webp',\n    format: 'WebP',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('57 45 42 50'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  // #5  TIFF (little-endian) — II + version 42\n  { mime: 'image/tiff', format: 'TIFF', bytes: hex('49 49 2A 00') },\n\n  // #6  TIFF (big-endian) — MM + version 42\n  { mime: 'image/tiff', format: 'TIFF', bytes: hex('4D 4D 00 2A') },\n\n  // #3  GIF — GIF8 (covers GIF87a and GIF89a)\n  { mime: 'image/gif', format: 'GIF', bytes: hex('47 49 46 38'), preCompressed: true },\n\n  // #4  BMP — BM\n  { mime: 'image/bmp', format: 'BMP', bytes: hex('42 4D') },\n\n  //  PSD — 8BPS\n  { mime: 'image/vnd.adobe.photoshop', format: 'PSD', bytes: hex('38 42 50 53') },\n\n  // #8  ICO — 00 00 01 00 (note: 00 00 02 00 is CUR cursor format)\n  { mime: 'image/x-icon', format: 'ICO', bytes: hex('00 00 01 00') },\n\n  // #9  HEIC — ISOBMFF: ftyp at offset 4, brand \"heic\" at offset 8\n  {\n    mime: 'image/heic',\n    format: 'HEIC',\n    bytes: hex('66 74 79 70'),\n    offset: 4,\n    secondaryBytes: hex('68 65 69 63'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  // ── Documents ────────────────────────────────────────────────────────\n\n  //  PDF — %PDF\n  { mime: 'application/pdf', format: 'PDF', bytes: hex('25 50 44 46') },\n\n  //  RTF — {\\rtf\n  { mime: 'application/rtf', format: 'RTF', bytes: hex('7B 5C 72 74 66') },\n\n  // ── Archives & compression ───────────────────────────────────────────\n\n  //  RAR v5 — 8-byte signature (test before RAR v4)\n  { mime: 'application/vnd.rar', format: 'RAR v5', bytes: hex('52 61 72 21 1A 07 01 00'), preCompressed: true },\n\n  //  RAR v4 — 7-byte signature\n  { mime: 'application/vnd.rar', format: 'RAR v4', bytes: hex('52 61 72 21 1A 07 00'), preCompressed: true },\n\n  //  7-Zip — 6-byte signature\n  { mime: 'application/x-7z-compressed', format: '7Z', bytes: hex('37 7A BC AF 27 1C'), preCompressed: true },\n\n  //  XZ — 6-byte stream header\n  { mime: 'application/x-xz', format: 'XZ', bytes: hex('FD 37 7A 58 5A 00'), preCompressed: true },\n\n  //  ZIP — PK\\x03\\x04 (local file header)\n  { mime: 'application/zip', format: 'ZIP', bytes: hex('50 4B 03 04'), preCompressed: true },\n\n  //  GZIP — 1F 8B\n  { mime: 'application/gzip', format: 'GZIP', bytes: hex('1F 8B'), preCompressed: true },\n\n  //  BZIP2 — BZh\n  { mime: 'application/x-bzip2', format: 'BZIP2', bytes: hex('42 5A 68'), preCompressed: true },\n\n  //  LZIP — LZIP\n  { mime: 'application/x-lzip', format: 'LZIP', bytes: hex('4C 5A 49 50'), preCompressed: true },\n\n  // ── Audio ────────────────────────────────────────────────────────────\n\n  //  WAV — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = WAVE\n  {\n    mime: 'audio/wav',\n    format: 'WAV',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('57 41 56 45'),\n    secondaryOffset: 8,\n  },\n\n  //  AIFF — FORM compound: bytes 0-3 = FORM, bytes 8-11 = AIFF\n  {\n    mime: 'audio/aiff',\n    format: 'AIFF',\n    bytes: hex('46 4F 52 4D'),\n    secondaryBytes: hex('41 49 46 46'),\n    secondaryOffset: 8,\n  },\n\n  //  FLAC — fLaC\n  { mime: 'audio/flac', format: 'FLAC', bytes: hex('66 4C 61 43') },\n\n  //  OGG — OggS (container — may hold Vorbis, Opus, Theora, etc.)\n  { mime: 'application/ogg', format: 'OGG', bytes: hex('4F 67 67 53') },\n\n  //  MIDI — MThd\n  { mime: 'audio/midi', format: 'MIDI', bytes: hex('4D 54 68 64') },\n\n  //  MP3 (ID3-tagged) — ID3\n  { mime: 'audio/mpeg', format: 'MP3', bytes: hex('49 44 33'), preCompressed: true },\n\n  // ── Video ────────────────────────────────────────────────────────────\n\n  //  AVI — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = AVI\\x20\n  {\n    mime: 'video/x-msvideo',\n    format: 'AVI',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('41 56 49 20'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  //  WMV/ASF — 8-byte ASF header GUID prefix\n  { mime: 'video/x-ms-wmv', format: 'WMV', bytes: hex('30 26 B2 75 8E 66 CF 11'), preCompressed: true },\n\n  //  MKV/WebM — EBML header (Matroska container)\n  { mime: 'video/x-matroska', format: 'MKV', bytes: hex('1A 45 DF A3'), preCompressed: true },\n\n  //  FLV — FLV\n  { mime: 'video/x-flv', format: 'FLV', bytes: hex('46 4C 56'), preCompressed: true },\n\n  //  MOV — ISOBMFF: ftyp at offset 4, brand \"qt  \" at offset 8\n  {\n    mime: 'video/quicktime',\n    format: 'MOV',\n    bytes: hex('66 74 79 70'),\n    offset: 4,\n    secondaryBytes: hex('71 74 20 20'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  //  MP4 — ISOBMFF: ftyp at offset 4 (brands vary: isom, mp41, mp42, etc.)\n  //     Tested AFTER MOV and HEIC so their specific brands match first.\n  { mime: 'video/mp4', format: 'MP4', bytes: hex('66 74 79 70'), offset: 4, preCompressed: true },\n\n  // ── Executables & binaries ───────────────────────────────────────────\n\n  //  SQLite — \"SQLite 3\" (first 8 bytes of the 16-byte header)\n  { mime: 'application/vnd.sqlite3', format: 'SQLite', bytes: hex('53 51 4C 69 74 65 20 33') },\n\n  //  WASM — \\0asm\n  { mime: 'application/wasm', format: 'WASM', bytes: hex('00 61 73 6D') },\n\n  //  ELF — \\x7FELF\n  { mime: 'application/x-elf', format: 'ELF', bytes: hex('7F 45 4C 46') },\n\n  //  PE (EXE/DLL) — MZ\n  { mime: 'application/vnd.microsoft.portable-executable', format: 'PE', bytes: hex('4D 5A') },\n\n  //  Mach-O — all four single-arch variants\n  { mime: 'application/x-mach-binary', format: 'Mach-O 64 LE', bytes: hex('CF FA ED FE') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 64 BE', bytes: hex('FE ED FA CF') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 32 LE', bytes: hex('CE FA ED FE') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 32 BE', bytes: hex('FE ED FA CE') },\n\n  //  Java Class — CA FE BA BE\n  //     Note: collides with Mach-O Universal Binary. Disambiguated by checking\n  //     bytes 4-7: Java class version is >= 0x002D (45), while fat binary\n  //     arch count is a small number (typically 0x00000002).\n  //     We place Java after Mach-O single-arch entries so the more common\n  //     Mach-O variants match first. The CA FE BA BE collision between Java\n  //     and Mach-O fat binary is resolved by the caller if needed.\n  { mime: 'application/java-vm', format: 'Java Class', bytes: hex('CA FE BA BE') },\n\n  //  DEX — dex\\n (Android Dalvik Executable)\n  { mime: 'application/vnd.android.dex', format: 'DEX', bytes: hex('64 65 78 0A') },\n\n  // ── Package formats ──────────────────────────────────────────────────\n\n  //  DEB — !<arch> (ar archive; DEB-specific member follows)\n  { mime: 'application/vnd.debian.binary-package', format: 'DEB', bytes: hex('21 3C 61 72 63 68 3E') },\n\n  //  RPM — ED AB EE DB\n  { mime: 'application/x-rpm', format: 'RPM', bytes: hex('ED AB EE DB') },\n\n  //  CAB — MSCF\n  { mime: 'application/vnd.ms-cab-compressed', format: 'CAB', bytes: hex('4D 53 43 46'), preCompressed: true },\n\n  // ── Capture & Flash ──────────────────────────────────────────────────\n\n  //  PCAP (little-endian) — D4 C3 B2 A1\n  { mime: 'application/vnd.tcpdump.pcap', format: 'PCAP', bytes: hex('D4 C3 B2 A1') },\n\n  //  PCAP (big-endian) — A1 B2 C3 D4\n  { mime: 'application/vnd.tcpdump.pcap', format: 'PCAP BE', bytes: hex('A1 B2 C3 D4') },\n\n  //  PCAPNG — Section Header Block\n  { mime: 'application/x-pcapng', format: 'PCAPNG', bytes: hex('0A 0D 0D 0A') },\n\n  //  SWF — all three variants (uncompressed, zlib, LZMA)\n  { mime: 'application/x-shockwave-flash', format: 'SWF', bytes: hex('46 57 53') },\n  { mime: 'application/x-shockwave-flash', format: 'SWF zlib', bytes: hex('43 57 53'), preCompressed: true },\n  { mime: 'application/x-shockwave-flash', format: 'SWF LZMA', bytes: hex('5A 57 53'), preCompressed: true },\n\n  // ── Data formats ─────────────────────────────────────────────────────\n\n  //  Parquet — PAR1 (no registered IANA MIME; using Apache's informal type)\n  { mime: 'application/vnd.apache.parquet', format: 'Parquet', bytes: hex('50 41 52 31') },\n\n  //  Avro Object Container — Obj\\x01\n  { mime: 'application/avro', format: 'Avro', bytes: hex('4F 62 6A 01') },\n\n  //  NES ROM — NES\\x1A (iNES header)\n  { mime: 'application/x-nintendo-nes-rom', format: 'NES ROM', bytes: hex('4E 45 53 1A') },\n] as const\n\n// ─── MP3 sync word ───────────────────────────────────────────────────────\n//\n// MP3 files without an ID3 tag start with a frame sync word where the top\n// 11 bits are set: 0xFFE0 mask. The ID3 signature (49 44 33) is handled\n// as a normal rule above. The sync-word check is a fallback tested in\n// `detectMimeType` after all rules.\n\nfunction isMp3SyncWord(byte0: number, byte1: number): boolean {\n  return byte0 === 0xff && (byte1 & 0xe0) === 0xe0\n}\n\n// ─── Detection ───────────────────────────────────────────────────────────\n\n/**\n * Detect MIME type from the first bytes of a file.\n *\n * @param header - The first 16 bytes (or more) of the plaintext. Passing\n *   fewer than 16 bytes may miss compound and offset-based matches.\n * @returns Detected MIME type, or `'application/octet-stream'` if unknown.\n */\nexport function detectMimeType(header: Uint8Array): string {\n  const result = detectMagic(header)\n  return result?.mime ?? 'application/octet-stream'\n}\n\n/**\n * Detect MIME type and whether the format is already compressed.\n *\n * Used by `BlobSet.put()` to decide whether to skip gzip compression.\n *\n * @param header - The first 16 bytes (or more) of the plaintext.\n * @returns `{ mime, preCompressed }` or `null` if no match.\n */\nexport function detectMagic(\n  header: Uint8Array,\n): { mime: string; format: string; preCompressed: boolean } | null {\n  for (const rule of MAGIC_RULES) {\n    if (matchRule(header, rule)) {\n      return {\n        mime: rule.mime,\n        format: rule.format,\n        preCompressed: rule.preCompressed ?? false,\n      }\n    }\n  }\n\n  // Fallback: MP3 sync word (no ID3 tag)\n  if (header.length >= 2 && isMp3SyncWord(header[0]!, header[1]!)) {\n    return { mime: 'audio/mpeg', format: 'MP3', preCompressed: true }\n  }\n\n  return null\n}\n\n/**\n * Check whether a format is already compressed (should skip gzip).\n *\n * @param mimeType - A MIME type string.\n * @returns `true` if the format is known to be pre-compressed.\n */\nexport function isPreCompressed(mimeType: string): boolean {\n  return PRE_COMPRESSED_MIMES.has(mimeType)\n}\n\n// ─── Internal matching ───────────────────────────────────────────────────\n\nfunction matchRule(header: Uint8Array, rule: MagicRule): boolean {\n  const offset = rule.offset ?? 0\n  const end = offset + rule.bytes.length\n\n  // Not enough data for the primary match\n  if (header.length < end) return false\n\n  // Primary byte sequence\n  for (let i = 0; i < rule.bytes.length; i++) {\n    if (header[offset + i] !== rule.bytes[i]) return false\n  }\n\n  // Secondary byte sequence (compound check)\n  if (rule.secondaryBytes && rule.secondaryOffset !== undefined) {\n    const sEnd = rule.secondaryOffset + rule.secondaryBytes.length\n    if (header.length < sEnd) return false\n    for (let i = 0; i < rule.secondaryBytes.length; i++) {\n      if (header[rule.secondaryOffset + i] !== rule.secondaryBytes[i]) return false\n    }\n  }\n\n  return true\n}\n\n// ─── Pre-compressed MIME set ─────────────────────────────────────────────\n//\n// Built from the rules above. Used by `isPreCompressed()` for callers who\n// already know the MIME type (e.g. from a Content-Type header) and want to\n// skip the magic-byte detection step.\n\nconst PRE_COMPRESSED_MIMES = new Set<string>(\n  MAGIC_RULES.filter((r) => r.preCompressed).map((r) => r.mime),\n)\n","import type {\n  NoydbStore,\n  EncryptedEnvelope,\n  BlobObject,\n  SlotRecord,\n  SlotInfo,\n  VersionRecord,\n  BlobPutOptions,\n  BlobResponseOptions,\n} from '../types.js'\nimport { NOYDB_FORMAT_VERSION } from '../types.js'\nimport type { ObjectProjection } from './object-projection.js'\nimport type { BlobFieldsConfig } from './blob-compaction.js'\nimport {\n  encrypt,\n  decrypt,\n  hmacSha256Hex,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  bufferToBase64,\n  base64ToBuffer,\n  generateDEK,\n} from '../crypto.js'\nimport { wrapCek, unwrapCek } from '../record-keys/index.js'\nimport { ConflictError, NotFoundError } from '../errors.js'\nimport { detectMagic, isPreCompressed } from './mime-magic.js'\n\n// ─── Internal collection names ─────────────────────────────────────────\n\n/**\n * DEK slot name for vault-shared blob data. Calling `getDEK('_blob')`\n * auto-creates a blob DEK the first time — same lazy-creation mechanism\n * used for any user-defined collection.\n */\nexport const BLOB_COLLECTION = '_blob'\n\n/** Stores `BlobObject` metadata envelopes, keyed by eTag. */\nexport const BLOB_INDEX_COLLECTION = '_blob_index'\n\n/**\n * Stores encrypted chunk envelopes, keyed by `{eTag}/{chunkIndex}`.\n * NOT loaded into the in-memory query layer. Fetched on demand by\n * `BlobSet.get()` / `BlobSet.response()`.\n */\nexport const BLOB_CHUNKS_COLLECTION = '_blob_chunks'\n\n/** Prefix for per-collection slot metadata collections. */\nexport const BLOB_SLOTS_PREFIX = '_blob_slots_'\n\n/** Prefix for per-collection version records. */\nexport const BLOB_VERSIONS_PREFIX = '_blob_versions_'\n\n/**\n * Default chunk size: 256 KB raw bytes.\n * After AES-GCM (same size) + base64 (~33% inflation) → ~342 KB per\n * envelope, safely within DynamoDB's 400 KB item limit.\n */\nexport const DEFAULT_CHUNK_SIZE = 256 * 1024\n\n/** Maximum CAS retry attempts for refCount and slot metadata updates. */\nconst MAX_CAS_RETRIES = 5\n\n// ─── Compression helpers ───────────────────────────────────────────────\n\nasync function compressBytes(\n  data: Uint8Array,\n): Promise<{ bytes: Uint8Array; algorithm: 'gzip' | 'none' }> {\n  if (typeof CompressionStream === 'undefined') {\n    return { bytes: data, algorithm: 'none' }\n  }\n  // Pipe through the stream so `readable` is drained CONCURRENTLY with the\n  // write. The await-write-then-read form deadlocks once the output exceeds the\n  // stream's internal buffer (the writer backpressures waiting for a reader that\n  // hasn't started yet) — see #409.\n  const piped = new Response(data as Uint8Array<ArrayBuffer>).body!.pipeThrough(new CompressionStream('gzip'))\n  const buf = await new Response(piped).arrayBuffer()\n  return { bytes: new Uint8Array(buf), algorithm: 'gzip' }\n}\n\nasync function decompressBytes(data: Uint8Array): Promise<Uint8Array> {\n  if (typeof DecompressionStream === 'undefined') {\n    throw new Error(\n      '[noy-db] DecompressionStream not available — cannot decompress blob chunk',\n    )\n  }\n  // Concurrent read via pipeThrough — the await-write-then-read form deadlocks\n  // when the DECOMPRESSED output exceeds the stream buffer (~16 KB), which is\n  // exactly the #409 hang (small compressed input → large output → backpressure).\n  const piped = new Response(data as Uint8Array<ArrayBuffer>).body!.pipeThrough(new DecompressionStream('gzip'))\n  const buf = await new Response(piped).arrayBuffer()\n  return new Uint8Array(buf)\n}\n\nfunction concatChunks(chunks: Uint8Array[]): Uint8Array {\n  const total = chunks.reduce((s, c) => s + c.byteLength, 0)\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const c of chunks) {\n    out.set(c, offset)\n    offset += c.byteLength\n  }\n  return out\n}\n\n/** Build the AAD binding for chunk integrity: \"{eTag}:{chunkIndex}:{chunkCount}\" */\nfunction chunkAAD(eTag: string, chunkIndex: number, chunkCount: number): Uint8Array {\n  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`)\n}\n\n// ─── BlobSet ──────────────────────────────────────────────────────────\n\n/**\n * Handle for reading, writing, versioning, and deleting binary blobs\n * on a specific record.\n *\n * Obtained via `collection.blob(id)`. No I/O is performed until you\n * call a method.\n *\n * ## Storage layout\n *\n * ```\n * _blob_index/{eTag}                            BlobObject metadata (vault-shared DEK)\n * _blob_chunks/{eTag}/{chunkIndex}              Encrypted chunk data (vault-shared DEK + AAD)\n * _blob_slots_{collection}/{recordId}           Slot map (parent collection DEK)\n * _blob_versions_{collection}/{recordId}/{slot}/{label}  Published versions (parent collection DEK)\n * ```\n *\n * ## Deduplication\n *\n * `put()` computes `eTag = HMAC-SHA-256(blobDEK, plaintext)` — keyed so the\n * store cannot predict eTags for known content. If another record already\n * uploaded the same bytes, the chunks are reused and `refCount` is incremented.\n *\n * ## Chunk integrity\n *\n * Each chunk is encrypted with AES-256-GCM using AAD = `{eTag}:{index}:{count}`,\n * preventing chunk reorder, substitution, and truncation attacks.\n */\nexport class BlobSet {\n  private readonly store: NoydbStore\n  private readonly vault: string\n  private readonly collection: string\n  private readonly recordId: string\n  private readonly getDEK: (name: string) => Promise<CryptoKey>\n  private readonly encrypted: boolean\n  private readonly userId: string | undefined\n  private readonly maxBlobBytes: number | undefined\n  private readonly erasableBlobs: boolean\n  private readonly debugPlaintext: boolean\n  private readonly objectStore: ObjectProjection | undefined\n  private readonly blobFields: BlobFieldsConfig | undefined\n\n  constructor(opts: {\n    store: NoydbStore\n    vault: string\n    collection: string\n    recordId: string\n    getDEK: (name: string) => Promise<CryptoKey>\n    encrypted: boolean\n    userId?: string\n    maxBlobBytes?: number\n    erasableBlobs?: boolean\n    debugPlaintext?: boolean\n    objectStore?: ObjectProjection\n    blobFields?: BlobFieldsConfig\n  }) {\n    this.store = opts.store\n    this.vault = opts.vault\n    this.collection = opts.collection\n    this.recordId = opts.recordId\n    this.getDEK = opts.getDEK\n    this.encrypted = opts.encrypted\n    this.userId = opts.userId\n    this.maxBlobBytes = opts.maxBlobBytes\n    this.erasableBlobs = opts.erasableBlobs === true\n    this.debugPlaintext = opts.debugPlaintext === true\n    this.objectStore = opts.objectStore\n    this.blobFields = opts.blobFields\n  }\n\n  /**\n   * Resolve the key the blob's CHUNKS are encrypted under.\n   *\n   * - `_cek` present (erasable blob) → unwrap the per-blob content CEK under\n   *   the `_blob` DEK. Deleting the BlobObject (at `refCount → 0`) makes this\n   *   key unrecoverable → the chunks are crypto-shredded.\n   * - `_cek` absent (legacy) → the `_blob` DEK encrypts chunks directly.\n   * - unencrypted vault → `null` (chunks stored as plaintext base64).\n   */\n  private async resolveChunkKey(blob: Pick<BlobObject, '_cek'>): Promise<CryptoKey | null> {\n    if (!this.encrypted) return null\n    const blobDEK = await this.getDEK(BLOB_COLLECTION)\n    return blob._cek !== undefined ? await unwrapCek(blob._cek, blobDEK) : blobDEK\n  }\n\n  /** The internal collection that holds slot metadata for this collection's blobs. */\n  private get slotsCollection(): string {\n    return `${BLOB_SLOTS_PREFIX}${this.collection}`\n  }\n\n  /** The internal collection that holds published versions for this collection's blobs. */\n  private get versionsCollection(): string {\n    return `${BLOB_VERSIONS_PREFIX}${this.collection}`\n  }\n\n  // ─── Slot Metadata I/O (CAS-protected) ─────────────────────────────\n\n  private async loadSlots(): Promise<{\n    slots: Record<string, SlotRecord>\n    version: number\n  }> {\n    const envelope = await this.store.get(this.vault, this.slotsCollection, this.recordId)\n    if (!envelope) return { slots: {}, version: 0 }\n\n    if (!this.encrypted) {\n      return {\n        slots: JSON.parse(envelope._data) as Record<string, SlotRecord>,\n        version: envelope._v,\n      }\n    }\n\n    const dek = await this.getDEK(this.collection)\n    const json = await decrypt(envelope._iv, envelope._data, dek)\n    return {\n      slots: JSON.parse(json) as Record<string, SlotRecord>,\n      version: envelope._v,\n    }\n  }\n\n  private async saveSlots(\n    slots: Record<string, SlotRecord>,\n    currentVersion: number,\n  ): Promise<void> {\n    const json = JSON.stringify(slots)\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(this.collection)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: currentVersion + 1,\n        _ts: now,\n        _iv: iv,\n        _data: data,\n      }\n    } else {\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: currentVersion + 1,\n        _ts: now,\n        _iv: '',\n        _data: json,\n      }\n    }\n\n    await this.store.put(\n      this.vault,\n      this.slotsCollection,\n      this.recordId,\n      envelope,\n      currentVersion > 0 ? currentVersion : undefined,\n    )\n  }\n\n  /**\n   * CAS retry loop for slot metadata updates. Re-reads slots on conflict\n   * and re-applies the mutation function.\n   */\n  private async casUpdateSlots(\n    mutate: (slots: Record<string, SlotRecord>) => Record<string, SlotRecord> | null,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const { slots, version } = await this.loadSlots()\n      const updated = mutate(slots)\n      if (updated === null) return // no-op\n      try {\n        await this.saveSlots(updated, version)\n        return\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n  }\n\n  // ─── Blob Index I/O (versioned for CAS refCount) ──────────────────\n\n  private async loadBlobObject(eTag: string): Promise<{ blob: BlobObject; version: number } | null> {\n    const envelope = await this.store.get(this.vault, BLOB_INDEX_COLLECTION, eTag)\n    if (!envelope) return null\n\n    if (!this.encrypted) {\n      return { blob: JSON.parse(envelope._data) as BlobObject, version: envelope._v }\n    }\n\n    const dek = await this.getDEK(BLOB_COLLECTION)\n    const json = await decrypt(envelope._iv, envelope._data, dek)\n    return { blob: JSON.parse(json) as BlobObject, version: envelope._v }\n  }\n\n  private async writeBlobObject(blob: BlobObject, expectedVersion?: number): Promise<void> {\n    const json = JSON.stringify(blob)\n    const now = new Date().toISOString()\n    const newVersion = (expectedVersion ?? 0) + 1\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(BLOB_COLLECTION)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: '', _data: json }\n    }\n\n    await this.store.put(\n      this.vault,\n      BLOB_INDEX_COLLECTION,\n      blob.eTag,\n      envelope,\n      expectedVersion,\n    )\n  }\n\n  /**\n   * CAS retry loop for refCount changes on a BlobObject.\n   */\n  private async casUpdateRefCount(eTag: string, delta: number): Promise<number> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const result = await this.loadBlobObject(eTag)\n      if (!result) throw new NotFoundError(`BlobObject ${eTag} not found`)\n      const { blob, version } = result\n      const updated: BlobObject = { ...blob, refCount: blob.refCount + delta }\n      try {\n        await this.writeBlobObject(updated, version)\n        return updated.refCount\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n    throw new ConflictError(-1) // exhausted retries\n  }\n\n  /**\n   * Release `n` references to a blob and reclaim it at refCount 0 (#365 slice 4).\n   *\n   * The single reclaim choke point for every reference-drop path — slot\n   * delete/overwrite, published-version delete, and `forget()` shred — so the\n   * refCount-0 policy is uniform:\n   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE\n   *    copy of the wrapped content CEK → chunks permanently undecryptable) and\n   *    reclaim the chunks. The crypto-shred is EAGER on every path: GDPR erasure\n   *    must not wait on orphan retention.\n   *  - **legacy blob** (no `_cek`) → reclaimed only when `reclaimLegacy` (the\n   *    `forget()` erasure path); otherwise left for deferred GC so the existing\n   *    `BlobLifecyclePolicy.orphanRetentionDays` semantics are preserved.\n   *\n   * @returns `'shredded'` (erasable, refCount 0, chunks dead) · `'retainedShared'`\n   *   (erasable, still referenced) · `'residue'` (legacy — not a crypto-shred).\n   */\n  private async releaseRef(\n    eTag: string,\n    n: number,\n    reclaimLegacy: boolean,\n  ): Promise<'shredded' | 'retainedShared' | 'residue'> {\n    const loaded = await this.loadBlobObject(eTag)\n    if (!loaded) return 'shredded' // already gone\n    const erasable = loaded.blob._cek !== undefined\n    const remaining = await this.casUpdateRefCount(eTag, -n)\n    if (remaining > 0) return erasable ? 'retainedShared' : 'residue'\n\n    if (erasable || reclaimLegacy) {\n      await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag)\n      for (let i = 0; i < loaded.blob.chunkCount; i++) {\n        await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`)\n      }\n    }\n    return erasable ? 'shredded' : 'residue'\n  }\n\n  /**\n   * Crypto-shred this record's blob attachments (#365 slice 2) — called by\n   * `vault.forget()`.\n   *\n   * For each distinct eTag the record references (a record may attach the same\n   * content under several slot names → several refCount holds): decrement the\n   * blob's refCount by that many. When it reaches 0:\n   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE\n   *    recoverable copy of the wrapped content CEK → chunks permanently\n   *    undecryptable) and reclaim the chunk bytes. This is the crypto-shred.\n   *  - **legacy blob** (no `_cek`) → chunks are under the shared `_blob` DEK and\n   *    stay decryptable until byte-deleted; we delete the orphaned chunks +\n   *    index but report it as residue, not a cryptographic erasure.\n   * When refCount stays > 0 the content legitimately persists for its other\n   * owner — reported as `retainedShared` (or `residue` if legacy).\n   *\n   * Finally drops the record's slot map, severing the subject's link.\n   */\n  async shredAllForRecord(): Promise<{\n    shredded: string[]\n    retainedShared: string[]\n    residue: string[]\n  }> {\n    const { slots } = await this.loadSlots()\n    const slotNames = Object.keys(slots)\n    const shredded: string[] = []\n    const retainedShared: string[] = []\n    const residue: string[] = []\n    if (slotNames.length === 0) return { shredded, retainedShared, residue }\n\n    // Reference count from THIS record per eTag.\n    const holds = new Map<string, number>()\n    for (const name of slotNames) {\n      const eTag = slots[name]!.eTag\n      holds.set(eTag, (holds.get(eTag) ?? 0) + 1)\n    }\n\n    for (const [eTag, n] of holds) {\n      // Forget erasure reclaims legacy orphans too (the record is being erased),\n      // so reclaimLegacy = true — but only erasable blobs count as a crypto-shred.\n      const outcome = await this.releaseRef(eTag, n, true)\n      if (outcome === 'shredded') shredded.push(eTag)\n      else if (outcome === 'retainedShared') retainedShared.push(eTag)\n      else residue.push(eTag)\n    }\n\n    // Sever the subject's link: drop the record's slot map.\n    await this.store.delete(this.vault, this.slotsCollection, this.recordId)\n    return { shredded, retainedShared, residue }\n  }\n\n  /** CAS retry loop for an arbitrary BlobObject mutation. */\n  private async casUpdateBlobObject(\n    eTag: string,\n    mutate: (blob: BlobObject) => BlobObject,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const result = await this.loadBlobObject(eTag)\n      if (!result) throw new NotFoundError(`BlobObject ${eTag} not found`)\n      try {\n        await this.writeBlobObject(mutate(result.blob), result.version)\n        return\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n    throw new ConflictError(-1) // exhausted retries\n  }\n\n  /**\n   * Migrate this record's LEGACY blobs (no `_cek`, chunks under the shared\n   * `_blob` DEK) to per-blob content CEKs so they become crypto-shreddable\n   * (#365 slice 3). Returns the eTags migrated vs. already-erasable.\n   *\n   * **Explicit maintenance pass** (mirrors the record-CEK migration posture):\n   * re-encrypts the existing compressed chunks IN PLACE under a fresh content\n   * CEK — preserving the eTag, chunkCount, chunkSize, and compression — then\n   * flips the `_cek` discriminant. Crash-safe + idempotent via `_cekPending`:\n   *   1. persist the wrapped content CEK in `_cekPending` (readers ignore it →\n   *      the blob stays readable under the `_blob` DEK; the key survives a crash);\n   *   2. re-encrypt each chunk under the content CEK (a resume reads an\n   *      already-migrated chunk under the content CEK, else under the `_blob` DEK);\n   *   3. promote `_cekPending` → `_cek` (atomic flip). Reads now use the CEK.\n   * A re-run after a crash resumes from whichever phase was reached.\n   *\n   * Dedup-safe: migrating a shared blob (refCount > 1) re-keys it for every\n   * referencer at once; a non-erasable collection still reads it (it unwraps\n   * `_cek` under the `_blob` DEK it holds).\n   */\n  async migrate(): Promise<{ migrated: string[]; alreadyErasable: string[] }> {\n    const migrated: string[] = []\n    const alreadyErasable: string[] = []\n    if (!this.encrypted) return { migrated, alreadyErasable }\n\n    const blobDEK = await this.getDEK(BLOB_COLLECTION)\n    const { slots } = await this.loadSlots()\n    const eTags = new Set(Object.values(slots).map((s) => s.eTag))\n\n    for (const eTag of eTags) {\n      const loaded = await this.loadBlobObject(eTag)\n      if (!loaded) continue\n      const blob = loaded.blob\n      if (blob._cek !== undefined) { alreadyErasable.push(eTag); continue }\n\n      // Phase 1 — persist the content CEK (resume reuses an existing pending one).\n      let contentCek: CryptoKey\n      if (blob._cekPending !== undefined) {\n        contentCek = await unwrapCek(blob._cekPending, blobDEK)\n      } else {\n        contentCek = await generateDEK()\n        const wrapped = await wrapCek(contentCek, blobDEK)\n        await this.casUpdateBlobObject(eTag, (b) => ({ ...b, _cekPending: wrapped }))\n      }\n\n      // Phase 2 — re-encrypt each chunk under the content CEK, in place.\n      for (let i = 0; i < blob.chunkCount; i++) {\n        let raw: Uint8Array | null\n        try {\n          raw = await this.readChunk(eTag, i, blob.chunkCount, blobDEK)\n        } catch {\n          // Already re-encrypted under the content CEK (crash resume).\n          raw = await this.readChunk(eTag, i, blob.chunkCount, contentCek)\n        }\n        if (!raw) {\n          throw new NotFoundError(\n            `Blob chunk ${i}/${blob.chunkCount} missing for eTag \"${eTag}\" during migration`,\n          )\n        }\n        await this.writeChunk(eTag, i, blob.chunkCount, raw, contentCek)\n      }\n\n      // Phase 3 — promote _cekPending → _cek (atomic flip).\n      await this.casUpdateBlobObject(eTag, (b) => {\n        const { _cekPending, ...rest } = b\n        return _cekPending === undefined ? b : { ...rest, _cek: _cekPending }\n      })\n      migrated.push(eTag)\n    }\n    return { migrated, alreadyErasable }\n  }\n\n  // ─── Chunk I/O (with AAD binding) ─────────────────────────────────\n\n  private async writeChunk(\n    eTag: string,\n    index: number,\n    chunkCount: number,\n    chunk: Uint8Array,\n    dek: CryptoKey | null,\n  ): Promise<void> {\n    const id = `${eTag}_${index}`\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (dek) {\n      const aad = chunkAAD(eTag, index, chunkCount)\n      const { iv, data } = await encryptBytesWithAAD(chunk, dek, aad)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: 1,\n        _ts: now,\n        _iv: '',\n        _data: bufferToBase64(chunk),\n      }\n    }\n\n    await this.store.put(this.vault, BLOB_CHUNKS_COLLECTION, id, envelope)\n  }\n\n  private async readChunk(\n    eTag: string,\n    index: number,\n    chunkCount: number,\n    dek: CryptoKey | null,\n  ): Promise<Uint8Array | null> {\n    const envelope = await this.store.get(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${index}`)\n    if (!envelope) return null\n\n    if (dek) {\n      const aad = chunkAAD(eTag, index, chunkCount)\n      return await decryptBytesWithAAD(envelope._iv, envelope._data, dek, aad)\n    }\n\n    return base64ToBuffer(envelope._data)\n  }\n\n  // ─── Version record I/O ───────────────────────────────────────────\n\n  private versionKey(slotName: string, label: string): string {\n    return `${this.recordId}::${slotName}::${label}`\n  }\n\n  private async loadVersionRecord(slotName: string, label: string): Promise<VersionRecord | null> {\n    const key = this.versionKey(slotName, label)\n    const envelope = await this.store.get(this.vault, this.versionsCollection, key)\n    if (!envelope) return null\n\n    if (!this.encrypted) {\n      return JSON.parse(envelope._data) as VersionRecord\n    }\n\n    const dek = await this.getDEK(this.collection)\n    const json = await decrypt(envelope._iv, envelope._data, dek)\n    return JSON.parse(json) as VersionRecord\n  }\n\n  private async writeVersionRecord(slotName: string, record: VersionRecord): Promise<void> {\n    const key = this.versionKey(slotName, record.label)\n    const json = JSON.stringify(record)\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(this.collection)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: '', _data: json }\n    }\n\n    await this.store.put(this.vault, this.versionsCollection, key, envelope)\n  }\n\n  private async deleteVersionRecord(slotName: string, label: string): Promise<void> {\n    const key = this.versionKey(slotName, label)\n    await this.store.delete(this.vault, this.versionsCollection, key)\n  }\n\n  // ─── Effective chunk size ─────────────────────────────────────────\n\n  private effectiveChunkSize(opts?: BlobPutOptions): number {\n    if (opts?.chunkSize) return opts.chunkSize\n    if (this.maxBlobBytes) return this.maxBlobBytes\n    return DEFAULT_CHUNK_SIZE\n  }\n\n  // ─── Fetch all chunks for a blob ──────────────────────────────────\n\n  private async fetchAllChunks(blob: BlobObject): Promise<Uint8Array> {\n    // Chunks are keyed under the per-blob content CEK (erasable) or directly\n    // under the `_blob` DEK (legacy) — resolveChunkKey discriminates on `_cek`.\n    const chunkKey = await this.resolveChunkKey(blob)\n    const chunks: Uint8Array[] = []\n\n    for (let i = 0; i < blob.chunkCount; i++) {\n      const chunk = await this.readChunk(blob.eTag, i, blob.chunkCount, chunkKey)\n      if (!chunk) {\n        throw new NotFoundError(\n          `Blob chunk ${i}/${blob.chunkCount} missing for eTag \"${blob.eTag}\" on record \"${this.recordId}\"`,\n        )\n      }\n      chunks.push(chunk)\n    }\n\n    const assembled = concatChunks(chunks)\n    return blob.compression === 'gzip' ? await decompressBytes(assembled) : assembled\n  }\n\n  // ─── Public API: Slot management ──────────────────────────────────\n\n  /**\n   * Upload bytes and attach them to this record under `slotName`.\n   *\n   * 1. Computes `eTag = HMAC-SHA-256(blobDEK, plaintext)` for keyed content-addressing.\n   * 2. Auto-detects MIME type from magic bytes if not provided.\n   * 3. If a blob with this eTag already exists, skips chunk upload (deduplication)\n   *    and CAS-increments refCount.\n   * 4. Otherwise: compresses → splits into chunks → encrypts each chunk with\n   *    AAD binding → writes `_blob_chunks` → writes `BlobObject` to `_blob_index`.\n   * 5. CAS-updates the slot metadata in `_blob_slots_{collection}`.\n   *    If overwriting an existing slot, decrements the old eTag's refCount.\n   */\n  async put(slotName: string, data: Uint8Array, opts?: BlobPutOptions): Promise<void> {\n    // External-projection path: the field is declared `external` and an\n    // ObjectProjection is configured → write the raw bytes as ONE native object\n    // (unencrypted, servable) and record an `external` slot (the catalog entry).\n    // Bypasses eTag/chunk/CEK/dedup entirely.\n    if (this.objectStore && this.blobFields?.[slotName]?.external) {\n      const policy = this.blobFields[slotName]\n      let contentType = opts?.mimeType\n      if (!contentType) {\n        const detected = detectMagic(data.subarray(0, 16))\n        contentType = detected?.mime ?? 'application/octet-stream'\n      }\n      const key = `${this.collection}/${this.recordId}/${slotName}`\n      const isPublic = policy.public === true\n      // Stamp a self-describing backlink onto the object's metadata (the\n      // \"secondary store\"): default opaque-token (no name leak).\n      const backlink = await this.buildBacklink(slotName, policy.backlink ?? 'opaque-token')\n      await this.objectStore.putObject(key, data, {\n        contentType,\n        public: isPublic,\n        ...(backlink.userMeta ? { userMeta: backlink.userMeta } : {}),\n      })\n\n      const uploaderUserId = opts?.uploadedBy ?? this.userId\n      let oldETag: string | undefined\n      await this.casUpdateSlots((slots) => {\n        oldETag = slots[slotName]?.eTag || undefined\n        // Preserve any previously-synced derived metadata across re-upload.\n        const prevMeta = slots[slotName]?.external?.meta\n        slots[slotName] = {\n          eTag: '',\n          external: {\n            key,\n            contentType,\n            ...(isPublic ? { public: true } : {}),\n            ...(backlink.token ? { backlink: backlink.token } : {}),\n            ...(prevMeta ? { meta: prevMeta } : {}),\n          },\n          filename: slotName,\n          size: data.byteLength,\n          mimeType: contentType,\n          uploadedAt: new Date().toISOString(),\n          ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n        }\n        return slots\n      })\n      // If this slot previously held a chunk-based blob, release that eTag.\n      if (oldETag) {\n        await this.releaseRef(oldETag, 1, false).catch(() => {})\n      }\n      return\n    }\n\n    // Step 1 — keyed content-hash (plaintext, before compression)\n    const blobDEK = this.encrypted ? await this.getDEK(BLOB_COLLECTION) : null\n    const eTag = blobDEK\n      ? await hmacSha256Hex(blobDEK, data)\n      : await plainSha256Hex(data)\n\n    // Step 2 — MIME detection\n    let mimeType = opts?.mimeType\n    if (!mimeType) {\n      const detected = detectMagic(data.subarray(0, 16))\n      if (detected) mimeType = detected.mime\n    }\n\n    // Determine compression: explicit opt > auto-detect > default true\n    let shouldCompress: boolean\n    if (opts?.compress !== undefined) {\n      shouldCompress = opts.compress\n    } else if (mimeType && isPreCompressed(mimeType)) {\n      shouldCompress = false\n    } else {\n      shouldCompress = true\n    }\n    // Debug-plaintext: write the blob as a single un-gzipped object so the\n    // stored chunk's base64 `_data` decodes directly to the original bytes\n    // (`base64 -d`) — no gzip layer, no multi-chunk reassembly. (encrypt:false\n    // already stores chunks unencrypted; this drops the remaining indirection.)\n    if (this.debugPlaintext) shouldCompress = false\n\n    // Step 3 — deduplication check\n    const existingBlob = await this.loadBlobObject(eTag)\n\n    if (existingBlob) {\n      // eTag already exists — just increment refCount (CAS retry). Dedup is\n      // preserved across the content-CEK split: the chunks (and the BlobObject's\n      // `_cek`, if any) are reused as-is; a new referencer never re-encrypts.\n      await this.casUpdateRefCount(eTag, +1)\n    } else {\n      // Step 4 — compress\n      const { bytes: compressed, algorithm } = shouldCompress\n        ? await compressBytes(data)\n        : { bytes: data, algorithm: 'none' as const }\n\n      // Debug-plaintext stores the whole blob as one object (single chunk) so\n      // it is one directly-openable file in the store rather than N shards.\n      const chunkSize = this.debugPlaintext\n        ? Math.max(compressed.byteLength, 1)\n        : this.effectiveChunkSize(opts)\n      const chunkCount = Math.max(1, Math.ceil(compressed.byteLength / chunkSize))\n\n      // Erasable collection (`perRecordKeys`): mint a fresh per-blob content\n      // CEK and encrypt the chunks under it instead of the shared `_blob` DEK,\n      // so the BlobObject's wrapped `_cek` is the sole recoverable copy → a\n      // refCount-0 delete crypto-shreds the chunks. `eTag` (the dedup address)\n      // is still keyed off the `_blob` DEK, unchanged.\n      let chunkKey = blobDEK\n      let wrappedCek: string | undefined\n      if (blobDEK && this.erasableBlobs) {\n        const contentCek = await generateDEK()\n        wrappedCek = await wrapCek(contentCek, blobDEK)\n        chunkKey = contentCek\n      }\n\n      // Step 5 — write chunks FIRST with AAD binding (safe failure order)\n      for (let i = 0; i < chunkCount; i++) {\n        const start = i * chunkSize\n        await this.writeChunk(\n          eTag, i, chunkCount,\n          compressed.subarray(start, start + chunkSize),\n          chunkKey,\n        )\n      }\n\n      // Step 6 — write blob index entry after all chunks succeed\n      await this.writeBlobObject({\n        eTag,\n        size: data.byteLength,\n        compressedSize: compressed.byteLength,\n        compression: algorithm,\n        chunkSize,\n        chunkCount,\n        ...(mimeType !== undefined ? { mimeType } : {}),\n        createdAt: new Date().toISOString(),\n        refCount: 1,\n        ...(wrappedCek !== undefined ? { _cek: wrappedCek } : {}),\n      })\n    }\n\n    // Step 7 — CAS-update slot metadata\n    const uploaderUserId = opts?.uploadedBy ?? this.userId\n    await this.casUpdateSlots((slots) => {\n      const oldETag = slots[slotName]?.eTag\n      slots[slotName] = {\n        eTag,\n        filename: slotName,\n        size: data.byteLength,\n        ...(mimeType !== undefined ? { mimeType } : {}),\n        uploadedAt: new Date().toISOString(),\n        ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n      }\n      // Schedule old eTag refCount decrement (non-blocking best-effort)\n      if (oldETag && oldETag !== eTag) {\n        this._deferredRefDecrement = oldETag\n      }\n      return slots\n    })\n\n    // Release the old eTag outside the CAS loop. An erasable blob dropping to\n    // refCount 0 here is crypto-shredded eagerly; a legacy one defers to GC.\n    if (this._deferredRefDecrement) {\n      const oldETag = this._deferredRefDecrement\n      this._deferredRefDecrement = undefined\n      await this.releaseRef(oldETag, 1, false).catch(() => {\n        // Best-effort — a missed decrement is reconciled by a later pass.\n      })\n    }\n  }\n\n  private _deferredRefDecrement: string | undefined\n\n  /**\n   * Fetch all bytes for the named slot.\n   * Returns `null` if the slot does not exist.\n   * Throws `NotFoundError` if the index entry exists but a chunk is missing.\n   */\n  async get(slotName: string): Promise<Uint8Array | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    if (slot.external) {\n      if (!this.objectStore) {\n        throw new NotFoundError(`Blob slot \"${slotName}\" is external but no objectStore is configured`)\n      }\n      return this.objectStore.getObject(slot.external.key)\n    }\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    return this.fetchAllChunks(result.blob)\n  }\n\n  /**\n   * A URL to fetch an `external` slot's object directly — presigned\n   * (time-limited) or public, per the projection. Returns `null` if the slot\n   * does not exist. Throws for a non-external slot (use `get()`/`response()`).\n   */\n  async url(slotName: string, opts?: { expiresInSeconds?: number }): Promise<string | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n    if (!slot.external) {\n      throw new NotFoundError(`Blob slot \"${slotName}\" is not external — url() is only for external fields`)\n    }\n    if (!this.objectStore) {\n      throw new NotFoundError(`Blob slot \"${slotName}\" is external but no objectStore is configured`)\n    }\n    return this.objectStore.objectUrl(slot.external.key, opts)\n  }\n\n  /**\n   * Build the backlink stamped onto an external object's metadata — the\n   * self-describing \"secondary store\" reference back to this record. See\n   * {@link BlobFieldPolicy.backlink}. Returns the `userMeta` to attach and, for\n   * `opaque-token`, the `token` to record on the slot.\n   */\n  private async buildBacklink(\n    slotName: string,\n    mode: 'opaque-token' | 'encrypted' | 'plain' | 'none',\n  ): Promise<{ userMeta?: Record<string, string>; token?: string }> {\n    if (mode === 'none') return {}\n    const ref = { vault: this.vault, collection: this.collection, record: this.recordId, field: slotName }\n    if (mode === 'plain') {\n      return {\n        userMeta: {\n          'noydb-vault': ref.vault,\n          'noydb-collection': ref.collection,\n          'noydb-record': ref.record,\n          'noydb-field': ref.field,\n        },\n      }\n    }\n    if (mode === 'encrypted' && this.encrypted) {\n      const dek = await this.getDEK(BLOB_COLLECTION)\n      const { iv, data } = await encrypt(JSON.stringify(ref), dek)\n      return { userMeta: { 'noydb-backlink-enc': `${iv}.${data}` } }\n    }\n    // opaque-token — also the fallback when `encrypted` is requested on a\n    // plaintext vault (no DEK to encrypt under).\n    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n    const token = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')\n    return { userMeta: { 'noydb-backlink': token }, token }\n  }\n\n  /**\n   * Adopt an EXISTING object in the projection into this slot **without\n   * re-uploading** — used by import/bootstrap to anchor objects already in the\n   * bucket. Writes the external slot record (the catalog entry).\n   */\n  async adoptExternal(\n    slotName: string,\n    ref: {\n      key: string\n      size?: number\n      contentType?: string\n      public?: boolean\n      backlink?: string\n      meta?: Record<string, unknown>\n    },\n  ): Promise<void> {\n    const uploaderUserId = this.userId\n    await this.casUpdateSlots((slots) => {\n      slots[slotName] = {\n        eTag: '',\n        external: {\n          key: ref.key,\n          ...(ref.contentType ? { contentType: ref.contentType } : {}),\n          ...(ref.public ? { public: true } : {}),\n          ...(ref.backlink ? { backlink: ref.backlink } : {}),\n          ...(ref.meta ? { meta: ref.meta } : {}),\n        },\n        filename: slotName,\n        size: ref.size ?? 0,\n        ...(ref.contentType ? { mimeType: ref.contentType } : {}),\n        uploadedAt: new Date().toISOString(),\n        ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n      }\n      return slots\n    })\n  }\n\n  /**\n   * Merge derived metadata (video `duration`, image `width`/`height`, arbitrary\n   * metatags) into an external slot's secondary metadata store. Typically called\n   * from an AWS-side processing callback (MediaConvert / ffprobe / Rekognition)\n   * once it has probed the object. No-op for a missing or non-external slot.\n   */\n  async setExternalMeta(slotName: string, meta: Record<string, unknown>): Promise<void> {\n    await this.casUpdateSlots((slots) => {\n      const slot = slots[slotName]\n      if (!slot?.external) return null\n      slots[slotName] = {\n        ...slot,\n        external: { ...slot.external, meta: { ...slot.external.meta, ...meta } },\n      }\n      return slots\n    })\n  }\n\n  /**\n   * Read an external slot's synced derived metadata (the secondary store).\n   * Returns `null` for a missing or non-external slot, `{}` if none synced yet.\n   */\n  async externalMeta(slotName: string): Promise<Record<string, unknown> | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot?.external) return null\n    return slot.external.meta ?? {}\n  }\n\n  /**\n   * List all slot entries for this record.\n   * Returns metadata only — no chunk data is loaded.\n   */\n  async list(): Promise<SlotInfo[]> {\n    const { slots } = await this.loadSlots()\n    return Object.entries(slots).map(([name, slot]) => ({ name, ...slot }))\n  }\n\n  /**\n   * Delete the named slot from this record.\n   * Decrements refCount on the blob. Chunks are GC'd by `vault.blobGC()`.\n   */\n  async delete(slotName: string): Promise<void> {\n    let eTagToRelease: string | undefined\n    let externalKeyToDelete: string | undefined\n\n    await this.casUpdateSlots((slots) => {\n      if (!(slotName in slots)) return null\n      const slot = slots[slotName]!\n      if (slot.external) externalKeyToDelete = slot.external.key\n      else eTagToRelease = slot.eTag\n      delete slots[slotName]\n      return slots\n    })\n\n    if (externalKeyToDelete && this.objectStore) {\n      // External objects are hard-deleted (no crypto-shred — they were never\n      // encrypted). CDN/replica cache TTLs may retain a copy; see the design.\n      await this.objectStore.deleteObject(externalKeyToDelete).catch(() => {})\n    }\n\n    if (eTagToRelease) {\n      // Erasable blobs are crypto-shredded at refCount 0 (this also covers\n      // compaction eviction, which routes through delete()); legacy blobs keep\n      // deferred-GC / orphan-retention semantics.\n      await this.releaseRef(eTagToRelease, 1, false).catch(() => {\n        // Best-effort — a missed decrement is reconciled by a later pass.\n      })\n    }\n  }\n\n  /**\n   * Return a native `Response` whose body streams the decrypted,\n   * decompressed blob bytes with full HTTP metadata headers.\n   *\n   * Note: implementation is buffered — all chunks are loaded into\n   * memory before being enqueued. True streaming deferred to.\n   *\n   * Returns `null` if the slot does not exist.\n   */\n  async response(slotName: string, opts?: BlobResponseOptions): Promise<Response | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    return this.buildResponse(slot, result.blob, opts)\n  }\n\n  /**\n   * Decrypt the slot and wrap the bytes in a browser ObjectURL ready\n   * to feed into `<img src>`, `<a href>`, etc. The caller MUST call\n   * `revoke()` when the URL is no longer needed — otherwise the URL\n   * (and the underlying decrypted Blob) are pinned for the lifetime\n   * of the document, which leaks memory in long-lived pages.\n   *\n   * Returns `null` when the slot does not exist.\n   *\n   * Throws when `URL.createObjectURL` is unavailable in the host\n   * environment (Node without DOM, restricted workers). Framework\n   * adapters — `useBlobURL` in `@noy-db/in-vue`, etc. — guard against\n   * this for SSR contexts and stay at `null` instead of propagating.\n   */\n  async objectURL(\n    slotName: string,\n    opts?: { mimeType?: string },\n  ): Promise<{ url: string; revoke: () => void } | null> {\n    if (typeof URL === 'undefined' || typeof URL.createObjectURL !== 'function') {\n      throw new Error(\n        'BlobSet.objectURL: URL.createObjectURL is unavailable in this environment. ' +\n        'Call this from the browser, or use BlobSet.get() and create the URL yourself.',\n      )\n    }\n    const bytes = await this.get(slotName)\n    if (!bytes) return null\n\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    const type = opts?.mimeType ?? slot?.mimeType ?? 'application/octet-stream'\n\n    // Pinning the underlying ArrayBuffer in a Blob is what backs the\n    // ObjectURL — once we createObjectURL the URL holds a strong ref\n    // to the Blob, so the local `blob` variable can fall out of scope.\n    // Copy through a fresh ArrayBuffer so TS narrows away the\n    // SharedArrayBuffer branch of `ArrayBufferLike` (Uint8Array is\n    // generic over the backing buffer type since TS 5.7).\n    const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer\n    const blob = new Blob([buffer], { type })\n    const url = URL.createObjectURL(blob)\n    let revoked = false\n    const revoke = (): void => {\n      if (revoked) return\n      revoked = true\n      URL.revokeObjectURL(url)\n    }\n    return { url, revoke }\n  }\n\n  // ─── Public API: Published versions (UC-3 amendment versioning) ───\n\n  /**\n   * Publish the current slot content as a named version snapshot.\n   *\n   * The published version holds an independent refCount reference to\n   * the blob. Even if the slot is later overwritten or deleted, the\n   * published version keeps the blob data alive.\n   *\n   * Publishing with an existing label overwrites it — if the eTags differ,\n   * refCounts are adjusted accordingly.\n   */\n  async publish(slotName: string, label: string): Promise<void> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) throw new NotFoundError(`Slot \"${slotName}\" not found on record \"${this.recordId}\"`)\n\n    // Check for existing version with this label\n    const existing = await this.loadVersionRecord(slotName, label)\n    if (existing && existing.eTag === slot.eTag) return // no-op: same blob\n\n    // Write the version record\n    const record: VersionRecord = {\n      label,\n      eTag: slot.eTag,\n      publishedAt: new Date().toISOString(),\n      ...(this.userId !== undefined ? { publishedBy: this.userId } : {}),\n    }\n    await this.writeVersionRecord(slotName, record)\n\n    // Increment refCount for the new version's eTag\n    await this.casUpdateRefCount(slot.eTag, +1)\n\n    // If overwriting an existing version with a different eTag, release the old\n    // one (crypto-shred at refCount 0 when erasable).\n    if (existing && existing.eTag !== slot.eTag) {\n      await this.releaseRef(existing.eTag, 1, false).catch(() => {})\n    }\n  }\n\n  /**\n   * Fetch bytes for a published version.\n   * Returns `null` if the version does not exist.\n   */\n  async getVersion(slotName: string, label: string): Promise<Uint8Array | null> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return null\n\n    const result = await this.loadBlobObject(record.eTag)\n    if (!result) return null\n\n    return this.fetchAllChunks(result.blob)\n  }\n\n  /**\n   * List all published versions for a slot.\n   */\n  async listVersions(slotName: string): Promise<VersionRecord[]> {\n    const prefix = `${this.recordId}::${slotName}::`\n    const allKeys = await this.store.list(this.vault, this.versionsCollection)\n    const matchingKeys = allKeys.filter((k) => k.startsWith(prefix))\n\n    const versions: VersionRecord[] = []\n    for (const key of matchingKeys) {\n      const envelope = await this.store.get(this.vault, this.versionsCollection, key)\n      if (!envelope) continue\n\n      if (!this.encrypted) {\n        versions.push(JSON.parse(envelope._data) as VersionRecord)\n      } else {\n        const dek = await this.getDEK(this.collection)\n        const json = await decrypt(envelope._iv, envelope._data, dek)\n        versions.push(JSON.parse(json) as VersionRecord)\n      }\n    }\n\n    return versions\n  }\n\n  /**\n   * Delete a published version. Decrements refCount on its blob.\n   */\n  async deleteVersion(slotName: string, label: string): Promise<void> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return\n\n    await this.deleteVersionRecord(slotName, label)\n    await this.releaseRef(record.eTag, 1, false).catch(() => {})\n  }\n\n  /**\n   * Return a `Response` for a published version — same as `response()`\n   * but reads from the version record's eTag instead of the current slot.\n   */\n  async responseVersion(\n    slotName: string,\n    label: string,\n    opts?: BlobResponseOptions,\n  ): Promise<Response | null> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return null\n\n    const result = await this.loadBlobObject(record.eTag)\n    if (!result) return null\n\n    // Build a synthetic SlotRecord from the version + blob data\n    const slotLike: SlotRecord = {\n      eTag: record.eTag,\n      filename: opts?.filename ?? `${slotName}-${label}`,\n      size: result.blob.size,\n      ...(result.blob.mimeType !== undefined ? { mimeType: result.blob.mimeType } : {}),\n      uploadedAt: record.publishedAt,\n      ...(record.publishedBy !== undefined ? { uploadedBy: record.publishedBy } : {}),\n    }\n\n    return this.buildResponse(slotLike, result.blob, opts)\n  }\n\n  // ─── Diagnostics ──────────────────────────────────────────────────\n\n  /**\n   * Return the `BlobObject` metadata for the named slot.\n   * Returns `null` if the slot or blob does not exist.\n   */\n  async blobInfo(slotName: string): Promise<BlobObject | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n    const result = await this.loadBlobObject(slot.eTag)\n    return result?.blob ?? null\n  }\n\n  // ─── Presigned URL (E5) ────────────────────────────────────────────\n\n  /**\n   * Generate a presigned URL for direct client download of the blob's\n   * ciphertext. Only works when the blob store supports `presignUrl`.\n   *\n   * **Important:** The URL returns encrypted data. The caller must\n   * decrypt client-side using `decryptResponse()` or a service worker.\n   *\n   * Returns `null` if the slot doesn't exist or the store doesn't support presigning.\n   */\n  async presignedUrl(slotName: string, expiresInSeconds = 3600): Promise<string | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    // Only works for single-chunk blobs where the store supports presigning\n    if (result.blob.chunkCount !== 1) return null\n    if (!this.store.presignUrl) return null\n\n    const chunkId = `${slot.eTag}_0`\n    return this.store.presignUrl(this.vault, '_blob_chunks', chunkId, expiresInSeconds)\n  }\n\n  /**\n   * Decrypt a ciphertext Response (e.g. from a presigned URL fetch)\n   * back into a plaintext Response with correct headers.\n   *\n   * Usage with service worker or client-side fetch:\n   * ```ts\n   * const url = await blobs.presignedUrl('invoice.pdf')\n   * const cipherResponse = await fetch(url)\n   * const plainResponse = await blobs.decryptResponse('invoice.pdf', cipherResponse)\n   * ```\n   */\n  async decryptResponse(slotName: string, cipherResponse: Response): Promise<Response | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    // Parse the envelope from the ciphertext response\n    const text = await cipherResponse.text()\n    const envelope = JSON.parse(text) as { _iv: string; _data: string }\n\n    const blobDEK = this.encrypted ? await this.getDEK('_blob') : null\n    if (!blobDEK) {\n      return this.buildResponse(slot, result.blob, { inline: true })\n    }\n\n    // Decrypt the single chunk\n    const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount)\n    const { decryptBytesWithAAD: decryptAAD } = await import('../crypto.js')\n    const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad)\n    const plaintext = result.blob.compression === 'gzip'\n      ? await decompressBytes(decrypted)\n      : decrypted\n\n    const body = new ReadableStream<Uint8Array>({\n      start(controller) {\n        controller.enqueue(plaintext)\n        controller.close()\n      },\n    })\n\n    const filename = slot.filename\n    return new Response(body, {\n      headers: {\n        'Content-Type': slot.mimeType ?? 'application/octet-stream',\n        'Content-Length': String(slot.size),\n        'ETag': `\"${slot.eTag}\"`,\n        'Content-Disposition': `inline; filename=\"${filename}\"`,\n        'Last-Modified': new Date(slot.uploadedAt).toUTCString(),\n      },\n    })\n  }\n\n  // ─── Internal: build Response from slot + blob ────────────────────\n\n  private async buildResponse(\n    slot: SlotRecord,\n    blob: BlobObject,\n    opts?: BlobResponseOptions,\n  ): Promise<Response> {\n    const fetchAllChunks = this.fetchAllChunks.bind(this)\n\n    // buffered — all chunks loaded into memory then enqueued.\n    const body = new ReadableStream<Uint8Array>({\n      async start(controller) {\n        try {\n          const output = await fetchAllChunks(blob)\n          controller.enqueue(output)\n          controller.close()\n        } catch (err) {\n          controller.error(err)\n        }\n      },\n    })\n\n    const filename = opts?.filename ?? slot.filename\n    const disposition = opts?.inline\n      ? `inline; filename=\"${filename}\"`\n      : `attachment; filename=\"${filename}\"`\n\n    return new Response(body, {\n      headers: {\n        'Content-Type': slot.mimeType ?? 'application/octet-stream',\n        'Content-Length': String(slot.size),\n        'ETag': `\"${slot.eTag}\"`,\n        'Content-Disposition': disposition,\n        'Last-Modified': new Date(slot.uploadedAt).toUTCString(),\n      },\n    })\n  }\n}\n\n// ─── Fallback for unencrypted mode ──────────────────────────────────────\n\nimport { sha256Hex } from '../crypto.js'\n\nasync function plainSha256Hex(data: Uint8Array): Promise<string> {\n  return sha256Hex(data)\n}\n","/**\n * `ObjectProjection` — the capability an `as-*` projection store implements to\n * hold blob bytes as native, directly-consumable objects (e.g. servable S3\n * objects) rather than the encrypted-envelope chunks a `NoydbStore` holds.\n *\n * This is the shared seam behind **direct-serve blobs** (#412) and the\n * **debug raw-object path** (#413): \"write these bytes as one real object and\n * give me a URL to it.\" See the as-aws-s3 design spec.\n *\n * Unlike `NoydbStore` (ciphertext in / ciphertext out), an `ObjectProjection`\n * sees **raw bytes** — it is `as-*`, not `to-*`, and lives **outside** the\n * zero-knowledge guarantee. Wiring it up is a deliberate, per-field opt-in.\n */\n\n/** Metadata about a stored object, without its body. */\nexport interface ObjectMeta {\n  readonly size: number\n  readonly contentType?: string\n  readonly etag?: string\n  readonly lastModified?: string\n  /** S3-style user metadata (`x-amz-meta-*`). Small; see the design's\n   *  plain / encrypted / opaque-token modes. */\n  readonly userMeta?: Record<string, string>\n}\n\nexport interface PutObjectOptions {\n  readonly contentType: string\n  /** World-readable object (CDN origin) vs private (presigned-only). Default false. */\n  readonly public?: boolean\n  /** User metadata mirrored onto the object (the \"secondary store\"). */\n  readonly userMeta?: Record<string, string>\n}\n\nexport interface ObjectUrlOptions {\n  /** TTL for a presigned URL (ignored for a public object). */\n  readonly expiresInSeconds?: number\n}\n\nexport interface PutUrlOptions {\n  readonly contentType: string\n  readonly expiresInSeconds?: number\n}\n\n/** One entry returned by {@link ObjectProjection.listPrefix}. */\nexport interface ObjectListEntry {\n  readonly key: string\n  readonly meta: ObjectMeta\n}\n\nexport interface ObjectProjection {\n  /** Diagnostic name (e.g. `'aws-s3'`, `'memory'`). */\n  readonly name?: string\n  /** Write raw bytes as a single native object with a real content type. */\n  putObject(key: string, bytes: Uint8Array, opts: PutObjectOptions): Promise<void>\n  /** Read the raw bytes back; `null` if absent. */\n  getObject(key: string): Promise<Uint8Array | null>\n  /** Delete the object. Idempotent — absent is not an error. */\n  deleteObject(key: string): Promise<void>\n  /** Object metadata without the body; `null` if absent. */\n  headObject(key: string): Promise<ObjectMeta | null>\n  /** A URL to GET the object — presigned (time-limited) or stable public. */\n  objectUrl(key: string, opts?: ObjectUrlOptions): Promise<string>\n  /** A presigned URL the client PUTs bytes to directly (large-file upload,\n   *  bytes bypass the hub). */\n  putUrl(key: string, opts: PutUrlOptions): Promise<string>\n  /** List objects under a key prefix — for import / reconcile. */\n  listPrefix(prefix: string): Promise<ObjectListEntry[]>\n}\n\n/**\n * In-memory {@link ObjectProjection} — a reference implementation for tests,\n * local development, and the hub's blob-wiring conformance. Holds bytes in a\n * `Map`; URLs are synthetic (`memory://…`). Not for production.\n */\nexport function memoryObjectProjection(opts: { baseUrl?: string } = {}): ObjectProjection {\n  const base = opts.baseUrl ?? 'memory://objects'\n  const store = new Map<\n    string,\n    { bytes: Uint8Array; contentType: string; userMeta?: Record<string, string>; public: boolean }\n  >()\n  return {\n    name: 'memory',\n    async putObject(key, bytes, o) {\n      store.set(key, {\n        bytes,\n        contentType: o.contentType,\n        public: o.public === true,\n        ...(o.userMeta ? { userMeta: o.userMeta } : {}),\n      })\n    },\n    async getObject(key) {\n      return store.get(key)?.bytes ?? null\n    },\n    async deleteObject(key) {\n      store.delete(key)\n    },\n    async headObject(key) {\n      const e = store.get(key)\n      if (!e) return null\n      return {\n        size: e.bytes.byteLength,\n        contentType: e.contentType,\n        ...(e.userMeta ? { userMeta: e.userMeta } : {}),\n      }\n    },\n    async objectUrl(key, o) {\n      const e = store.get(key)\n      if (e?.public) return `${base}/${key}`\n      return `${base}/${key}?sig=memory&expires=${o?.expiresInSeconds ?? 900}`\n    },\n    async putUrl(key, o) {\n      return `${base}/${key}?upload=memory&ct=${encodeURIComponent(o.contentType)}`\n    },\n    async listPrefix(prefix) {\n      const out: ObjectListEntry[] = []\n      for (const [key, e] of store) {\n        if (!key.startsWith(prefix)) continue\n        out.push({\n          key,\n          meta: { size: e.bytes.byteLength, contentType: e.contentType, ...(e.userMeta ? { userMeta: e.userMeta } : {}) },\n        })\n      }\n      return out\n    },\n  }\n}\n","/**\n * Import / bootstrap (reverse projection) — walk an existing bucket/prefix in an\n * {@link ObjectProjection} and build a master collection where each record\n * anchors one object, restoring the record-anchoring invariant for objects that\n * pre-date noy-db (or were written by another system). See as-aws-s3 §3.8.\n *\n * Idempotent: re-running re-adopts the same objects under the same record ids.\n */\nimport type { ObjectProjection } from './object-projection.js'\n\n/** Minimal collection surface this utility needs (avoids importing the kernel). */\nexport interface ImportableCollection {\n  get(id: string): Promise<unknown>\n  put(id: string, record: unknown): Promise<unknown>\n  blob(id: string): {\n    adoptExternal(\n      slot: string,\n      ref: { key: string; size?: number; contentType?: string; public?: boolean; backlink?: string },\n    ): Promise<void>\n  }\n}\n\nexport interface ImportExternalOptions {\n  /** Only consider objects under this key prefix. Default `''` (all). */\n  prefix?: string\n  /**\n   * Derive the record id for an object key. Default: the path segment before\n   * the last — i.e. `{collection}/{recordId}/{field}` → `recordId`. Return\n   * `null` to skip the object.\n   */\n  deriveRecordId?: (key: string) => string | null\n  /** Build the anchor record for a new id. Default `{ id }`. */\n  makeRecord?: (id: string) => unknown\n}\n\nexport interface ImportExternalResult {\n  imported: number\n  skipped: number\n  recordIds: string[]\n}\n\nfunction defaultDeriveRecordId(key: string): string | null {\n  const parts = key.split('/')\n  return parts.length >= 2 ? (parts[parts.length - 2] ?? null) : null\n}\n\n/**\n * Build/extend `collection` from the objects under `prefix` in `objectStore`,\n * adopting each as the `field` blob on its derived record.\n */\nexport async function importExternalObjects(args: {\n  collection: ImportableCollection\n  objectStore: ObjectProjection\n  field: string\n  options?: ImportExternalOptions\n}): Promise<ImportExternalResult> {\n  const { collection, objectStore, field } = args\n  const opts = args.options ?? {}\n  const derive = opts.deriveRecordId ?? defaultDeriveRecordId\n  const makeRecord = opts.makeRecord ?? ((id: string) => ({ id }))\n\n  const objects = await objectStore.listPrefix(opts.prefix ?? '')\n  const recordIds: string[] = []\n  let imported = 0\n  let skipped = 0\n\n  for (const { key, meta } of objects) {\n    const recordId = derive(key)\n    if (!recordId) {\n      skipped++\n      continue\n    }\n    if ((await collection.get(recordId)) == null) {\n      await collection.put(recordId, makeRecord(recordId))\n    }\n    await collection.blob(recordId).adoptExternal(field, {\n      key,\n      ...(meta.size !== undefined ? { size: meta.size } : {}),\n      ...(meta.contentType ? { contentType: meta.contentType } : {}),\n    })\n    recordIds.push(recordId)\n    imported++\n  }\n\n  return { imported, skipped, recordIds }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8CA,SAAS,IAAI,GAAuB;AAClC,SAAO,IAAI,WAAW,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;AAChE;AAgBA,IAAM,cAAoC;AAAA;AAAA;AAAA,EAIxC,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG/F,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAGlF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA,EAGA,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAGnF,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,OAAO,EAAE;AAAA;AAAA,EAGxD,EAAE,MAAM,6BAA6B,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG9E,EAAE,MAAM,gBAAgB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGjE;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,QAAQ;AAAA,IACR,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA,EAKA,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGpE,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,gBAAgB,EAAE;AAAA;AAAA;AAAA,EAKvE,EAAE,MAAM,uBAAuB,QAAQ,UAAU,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG5G,EAAE,MAAM,uBAAuB,QAAQ,UAAU,OAAO,IAAI,sBAAsB,GAAG,eAAe,KAAK;AAAA;AAAA,EAGzG,EAAE,MAAM,+BAA+B,QAAQ,MAAM,OAAO,IAAI,mBAAmB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG1G,EAAE,MAAM,oBAAoB,QAAQ,MAAM,OAAO,IAAI,mBAAmB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG/F,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAGzF,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,OAAO,GAAG,eAAe,KAAK;AAAA;AAAA,EAGrF,EAAE,MAAM,uBAAuB,QAAQ,SAAS,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAG5F,EAAE,MAAM,sBAAsB,QAAQ,QAAQ,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK7F;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGpE,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,cAAc,QAAQ,OAAO,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAKjF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA,EAGA,EAAE,MAAM,kBAAkB,QAAQ,OAAO,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAGpG,EAAE,MAAM,oBAAoB,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAG1F,EAAE,MAAM,eAAe,QAAQ,OAAO,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAGlF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,QAAQ;AAAA,IACR,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA,EAIA,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,QAAQ,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK9F,EAAE,MAAM,2BAA2B,QAAQ,UAAU,OAAO,IAAI,yBAAyB,EAAE;AAAA;AAAA,EAG3F,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,qBAAqB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,iDAAiD,QAAQ,MAAM,OAAO,IAAI,OAAO,EAAE;AAAA;AAAA,EAG3F,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASvF,EAAE,MAAM,uBAAuB,QAAQ,cAAc,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG/E,EAAE,MAAM,+BAA+B,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA;AAAA,EAKhF,EAAE,MAAM,yCAAyC,QAAQ,OAAO,OAAO,IAAI,sBAAsB,EAAE;AAAA;AAAA,EAGnG,EAAE,MAAM,qBAAqB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,qCAAqC,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK3G,EAAE,MAAM,gCAAgC,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGlF,EAAE,MAAM,gCAAgC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGrF,EAAE,MAAM,wBAAwB,QAAQ,UAAU,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG5E,EAAE,MAAM,iCAAiC,QAAQ,OAAO,OAAO,IAAI,UAAU,EAAE;AAAA,EAC/E,EAAE,MAAM,iCAAiC,QAAQ,YAAY,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA,EACzG,EAAE,MAAM,iCAAiC,QAAQ,YAAY,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAKzG,EAAE,MAAM,kCAAkC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGvF,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,kCAAkC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AACzF;AASA,SAAS,cAAc,OAAe,OAAwB;AAC5D,SAAO,UAAU,QAAS,QAAQ,SAAU;AAC9C;AAWO,SAAS,eAAe,QAA4B;AACzD,QAAM,SAAS,YAAY,MAAM;AACjC,SAAO,QAAQ,QAAQ;AACzB;AAUO,SAAS,YACd,QACiE;AACjE,aAAW,QAAQ,aAAa;AAC9B,QAAI,UAAU,QAAQ,IAAI,GAAG;AAC3B,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,QACb,eAAe,KAAK,iBAAiB;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,UAAU,KAAK,cAAc,OAAO,CAAC,GAAI,OAAO,CAAC,CAAE,GAAG;AAC/D,WAAO,EAAE,MAAM,cAAc,QAAQ,OAAO,eAAe,KAAK;AAAA,EAClE;AAEA,SAAO;AACT;AAQO,SAAS,gBAAgB,UAA2B;AACzD,SAAO,qBAAqB,IAAI,QAAQ;AAC1C;AAIA,SAAS,UAAU,QAAoB,MAA0B;AAC/D,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,MAAM,SAAS,KAAK,MAAM;AAGhC,MAAI,OAAO,SAAS,IAAK,QAAO;AAGhC,WAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,QAAI,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,EAAG,QAAO;AAAA,EACnD;AAGA,MAAI,KAAK,kBAAkB,KAAK,oBAAoB,QAAW;AAC7D,UAAM,OAAO,KAAK,kBAAkB,KAAK,eAAe;AACxD,QAAI,OAAO,SAAS,KAAM,QAAO;AACjC,aAAS,IAAI,GAAG,IAAI,KAAK,eAAe,QAAQ,KAAK;AACnD,UAAI,OAAO,KAAK,kBAAkB,CAAC,MAAM,KAAK,eAAe,CAAC,EAAG,QAAO;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO;AACT;AAQA,IAAM,uBAAuB,IAAI;AAAA,EAC/B,YAAY,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC9D;;;AC7VO,IAAM,kBAAkB;AAGxB,IAAM,wBAAwB;AAO9B,IAAM,yBAAyB;AAG/B,IAAM,oBAAoB;AAG1B,IAAM,uBAAuB;AAO7B,IAAM,qBAAqB,MAAM;AAGxC,IAAM,kBAAkB;AAIxB,eAAe,cACb,MAC4D;AAC5D,MAAI,OAAO,sBAAsB,aAAa;AAC5C,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO;AAAA,EAC1C;AAKA,QAAM,QAAQ,IAAI,SAAS,IAA+B,EAAE,KAAM,YAAY,IAAI,kBAAkB,MAAM,CAAC;AAC3G,QAAM,MAAM,MAAM,IAAI,SAAS,KAAK,EAAE,YAAY;AAClD,SAAO,EAAE,OAAO,IAAI,WAAW,GAAG,GAAG,WAAW,OAAO;AACzD;AAEA,eAAe,gBAAgB,MAAuC;AACpE,MAAI,OAAO,wBAAwB,aAAa;AAC9C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,QAAQ,IAAI,SAAS,IAA+B,EAAE,KAAM,YAAY,IAAI,oBAAoB,MAAM,CAAC;AAC7G,QAAM,MAAM,MAAM,IAAI,SAAS,KAAK,EAAE,YAAY;AAClD,SAAO,IAAI,WAAW,GAAG;AAC3B;AAEA,SAAS,aAAa,QAAkC;AACtD,QAAM,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,YAAY,CAAC;AACzD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,QAAQ;AACtB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAGA,SAAS,SAAS,MAAc,YAAoB,YAAgC;AAClF,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,UAAU,EAAE;AACvE;AA+BO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAaT;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,aAAa,KAAK;AACvB,SAAK,WAAW,KAAK;AACrB,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,eAAe,KAAK;AACzB,SAAK,gBAAgB,KAAK,kBAAkB;AAC5C,SAAK,iBAAiB,KAAK,mBAAmB;AAC9C,SAAK,cAAc,KAAK;AACxB,SAAK,aAAa,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,gBAAgB,MAA2D;AACvF,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,UAAM,UAAU,MAAM,KAAK,OAAO,eAAe;AACjD,WAAO,KAAK,SAAS,SAAY,MAAM,UAAU,KAAK,MAAM,OAAO,IAAI;AAAA,EACzE;AAAA;AAAA,EAGA,IAAY,kBAA0B;AACpC,WAAO,GAAG,iBAAiB,GAAG,KAAK,UAAU;AAAA,EAC/C;AAAA;AAAA,EAGA,IAAY,qBAA6B;AACvC,WAAO,GAAG,oBAAoB,GAAG,KAAK,UAAU;AAAA,EAClD;AAAA;AAAA,EAIA,MAAc,YAGX;AACD,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,iBAAiB,KAAK,QAAQ;AACrF,QAAI,CAAC,SAAU,QAAO,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE;AAE9C,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,OAAO,KAAK,MAAM,SAAS,KAAK;AAAA,QAChC,SAAS,SAAS;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,UAAM,OAAO,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAC5D,WAAO;AAAA,MACL,OAAO,KAAK,MAAM,IAAI;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,OACA,gBACe;AACf,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI,iBAAiB;AAAA,QACrB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI,iBAAiB;AAAA,QACrB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,MAAM;AAAA,MACf,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,iBAAiB,IAAI,iBAAiB;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,QACe;AACf,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,KAAK,UAAU;AAChD,YAAM,UAAU,OAAO,KAAK;AAC5B,UAAI,YAAY,KAAM;AACtB,UAAI;AACF,cAAM,KAAK,UAAU,SAAS,OAAO;AACrC;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,eAAe,MAAqE;AAChG,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,uBAAuB,IAAI;AAC7E,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAiB,SAAS,SAAS,GAAG;AAAA,IAChF;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,UAAM,OAAO,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAC5D,WAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,SAAS,GAAG;AAAA,EACtE;AAAA,EAEA,MAAc,gBAAgB,MAAkB,iBAAyC;AACvF,UAAM,OAAO,KAAK,UAAU,IAAI;AAChC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,cAAc,mBAAmB,KAAK;AAC5C,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,YAAY,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC5F,OAAO;AACL,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,YAAY,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC5F;AAEA,UAAM,KAAK,MAAM;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,MAAc,OAAgC;AAC5E,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,cAAc,IAAI,YAAY;AACnE,YAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,YAAM,UAAsB,EAAE,GAAG,MAAM,UAAU,KAAK,WAAW,MAAM;AACvE,UAAI;AACF,cAAM,KAAK,gBAAgB,SAAS,OAAO;AAC3C,eAAO,QAAQ;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,cAAc,EAAE;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAc,WACZ,MACA,GACA,eACoD;AACpD,UAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,WAAW,OAAO,KAAK,SAAS;AACtC,UAAM,YAAY,MAAM,KAAK,kBAAkB,MAAM,CAAC,CAAC;AACvD,QAAI,YAAY,EAAG,QAAO,WAAW,mBAAmB;AAExD,QAAI,YAAY,eAAe;AAC7B,YAAM,KAAK,MAAM,OAAO,KAAK,OAAO,uBAAuB,IAAI;AAC/D,eAAS,IAAI,GAAG,IAAI,OAAO,KAAK,YAAY,KAAK;AAC/C,cAAM,KAAK,MAAM,OAAO,KAAK,OAAO,wBAAwB,GAAG,IAAI,IAAI,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AACA,WAAO,WAAW,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,oBAIH;AACD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,YAAY,OAAO,KAAK,KAAK;AACnC,UAAM,WAAqB,CAAC;AAC5B,UAAM,iBAA2B,CAAC;AAClC,UAAM,UAAoB,CAAC;AAC3B,QAAI,UAAU,WAAW,EAAG,QAAO,EAAE,UAAU,gBAAgB,QAAQ;AAGvE,UAAM,QAAQ,oBAAI,IAAoB;AACtC,eAAW,QAAQ,WAAW;AAC5B,YAAM,OAAO,MAAM,IAAI,EAAG;AAC1B,YAAM,IAAI,OAAO,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,IAC5C;AAEA,eAAW,CAAC,MAAM,CAAC,KAAK,OAAO;AAG7B,YAAM,UAAU,MAAM,KAAK,WAAW,MAAM,GAAG,IAAI;AACnD,UAAI,YAAY,WAAY,UAAS,KAAK,IAAI;AAAA,eACrC,YAAY,iBAAkB,gBAAe,KAAK,IAAI;AAAA,UAC1D,SAAQ,KAAK,IAAI;AAAA,IACxB;AAGA,UAAM,KAAK,MAAM,OAAO,KAAK,OAAO,KAAK,iBAAiB,KAAK,QAAQ;AACvE,WAAO,EAAE,UAAU,gBAAgB,QAAQ;AAAA,EAC7C;AAAA;AAAA,EAGA,MAAc,oBACZ,MACA,QACe;AACf,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,cAAc,IAAI,YAAY;AACnE,UAAI;AACF,cAAM,KAAK,gBAAgB,OAAO,OAAO,IAAI,GAAG,OAAO,OAAO;AAC9D;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,cAAc,EAAE;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,UAAsE;AAC1E,UAAM,WAAqB,CAAC;AAC5B,UAAM,kBAA4B,CAAC;AACnC,QAAI,CAAC,KAAK,UAAW,QAAO,EAAE,UAAU,gBAAgB;AAExD,UAAM,UAAU,MAAM,KAAK,OAAO,eAAe;AACjD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,QAAQ,IAAI,IAAI,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAE7D,eAAW,QAAQ,OAAO;AACxB,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ;AACb,YAAM,OAAO,OAAO;AACpB,UAAI,KAAK,SAAS,QAAW;AAAE,wBAAgB,KAAK,IAAI;AAAG;AAAA,MAAS;AAGpE,UAAI;AACJ,UAAI,KAAK,gBAAgB,QAAW;AAClC,qBAAa,MAAM,UAAU,KAAK,aAAa,OAAO;AAAA,MACxD,OAAO;AACL,qBAAa,MAAM,YAAY;AAC/B,cAAM,UAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,cAAM,KAAK,oBAAoB,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,aAAa,QAAQ,EAAE;AAAA,MAC9E;AAGA,eAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAI;AACJ,YAAI;AACF,gBAAM,MAAM,KAAK,UAAU,MAAM,GAAG,KAAK,YAAY,OAAO;AAAA,QAC9D,QAAQ;AAEN,gBAAM,MAAM,KAAK,UAAU,MAAM,GAAG,KAAK,YAAY,UAAU;AAAA,QACjE;AACA,YAAI,CAAC,KAAK;AACR,gBAAM,IAAI;AAAA,YACR,cAAc,CAAC,IAAI,KAAK,UAAU,sBAAsB,IAAI;AAAA,UAC9D;AAAA,QACF;AACA,cAAM,KAAK,WAAW,MAAM,GAAG,KAAK,YAAY,KAAK,UAAU;AAAA,MACjE;AAGA,YAAM,KAAK,oBAAoB,MAAM,CAAC,MAAM;AAC1C,cAAM,EAAE,aAAa,GAAG,KAAK,IAAI;AACjC,eAAO,gBAAgB,SAAY,IAAI,EAAE,GAAG,MAAM,MAAM,YAAY;AAAA,MACtE,CAAC;AACD,eAAS,KAAK,IAAI;AAAA,IACpB;AACA,WAAO,EAAE,UAAU,gBAAgB;AAAA,EACrC;AAAA;AAAA,EAIA,MAAc,WACZ,MACA,OACA,YACA,OACA,KACe;AACf,UAAM,KAAK,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK;AACP,YAAM,MAAM,SAAS,MAAM,OAAO,UAAU;AAC5C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,oBAAoB,OAAO,KAAK,GAAG;AAC9D,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF,OAAO;AACL,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI;AAAA,QACJ,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO,eAAe,KAAK;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,wBAAwB,IAAI,QAAQ;AAAA,EACvE;AAAA,EAEA,MAAc,UACZ,MACA,OACA,YACA,KAC4B;AAC5B,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,wBAAwB,GAAG,IAAI,IAAI,KAAK,EAAE;AAC5F,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,KAAK;AACP,YAAM,MAAM,SAAS,MAAM,OAAO,UAAU;AAC5C,aAAO,MAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,IACzE;AAEA,WAAO,eAAe,SAAS,KAAK;AAAA,EACtC;AAAA;AAAA,EAIQ,WAAW,UAAkB,OAAuB;AAC1D,WAAO,GAAG,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,kBAAkB,UAAkB,OAA8C;AAC9F,UAAM,MAAM,KAAK,WAAW,UAAU,KAAK;AAC3C,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAC9E,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,KAAK,MAAM,SAAS,KAAK;AAAA,IAClC;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,UAAM,OAAO,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAC5D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAc,mBAAmB,UAAkB,QAAsC;AACvF,UAAM,MAAM,KAAK,WAAW,UAAU,OAAO,KAAK;AAClD,UAAM,OAAO,KAAK,UAAU,MAAM;AAClC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF,OAAO;AACL,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,KAAK,QAAQ;AAAA,EACzE;AAAA,EAEA,MAAc,oBAAoB,UAAkB,OAA8B;AAChF,UAAM,MAAM,KAAK,WAAW,UAAU,KAAK;AAC3C,UAAM,KAAK,MAAM,OAAO,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAAA,EAClE;AAAA;AAAA,EAIQ,mBAAmB,MAA+B;AACxD,QAAI,MAAM,UAAW,QAAO,KAAK;AACjC,QAAI,KAAK,aAAc,QAAO,KAAK;AACnC,WAAO;AAAA,EACT;AAAA;AAAA,EAIA,MAAc,eAAe,MAAuC;AAGlE,UAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI;AAChD,UAAM,SAAuB,CAAC;AAE9B,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,QAAQ,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,KAAK,YAAY,QAAQ;AAC1E,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,cAAc,CAAC,IAAI,KAAK,UAAU,sBAAsB,KAAK,IAAI,gBAAgB,KAAK,QAAQ;AAAA,QAChG;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAEA,UAAM,YAAY,aAAa,MAAM;AACrC,WAAO,KAAK,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,IAAI;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,IAAI,UAAkB,MAAkB,MAAsC;AAKlF,QAAI,KAAK,eAAe,KAAK,aAAa,QAAQ,GAAG,UAAU;AAC7D,YAAM,SAAS,KAAK,WAAW,QAAQ;AACvC,UAAI,cAAc,MAAM;AACxB,UAAI,CAAC,aAAa;AAChB,cAAM,WAAW,YAAY,KAAK,SAAS,GAAG,EAAE,CAAC;AACjD,sBAAc,UAAU,QAAQ;AAAA,MAClC;AACA,YAAM,MAAM,GAAG,KAAK,UAAU,IAAI,KAAK,QAAQ,IAAI,QAAQ;AAC3D,YAAM,WAAW,OAAO,WAAW;AAGnC,YAAM,WAAW,MAAM,KAAK,cAAc,UAAU,OAAO,YAAY,cAAc;AACrF,YAAM,KAAK,YAAY,UAAU,KAAK,MAAM;AAAA,QAC1C;AAAA,QACA,QAAQ;AAAA,QACR,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC;AAED,YAAMA,kBAAiB,MAAM,cAAc,KAAK;AAChD,UAAI;AACJ,YAAM,KAAK,eAAe,CAAC,UAAU;AACnC,kBAAU,MAAM,QAAQ,GAAG,QAAQ;AAEnC,cAAM,WAAW,MAAM,QAAQ,GAAG,UAAU;AAC5C,cAAM,QAAQ,IAAI;AAAA,UAChB,MAAM;AAAA,UACN,UAAU;AAAA,YACR;AAAA,YACA;AAAA,YACA,GAAI,WAAW,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,YACnC,GAAI,SAAS,QAAQ,EAAE,UAAU,SAAS,MAAM,IAAI,CAAC;AAAA,YACrD,GAAI,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,UACvC;AAAA,UACA,UAAU;AAAA,UACV,MAAM,KAAK;AAAA,UACX,UAAU;AAAA,UACV,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACnC,GAAIA,oBAAmB,SAAY,EAAE,YAAYA,gBAAe,IAAI,CAAC;AAAA,QACvE;AACA,eAAO;AAAA,MACT,CAAC;AAED,UAAI,SAAS;AACX,cAAM,KAAK,WAAW,SAAS,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACzD;AACA;AAAA,IACF;AAGA,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,OAAO,eAAe,IAAI;AACtE,UAAM,OAAO,UACT,MAAM,cAAc,SAAS,IAAI,IACjC,MAAM,eAAe,IAAI;AAG7B,QAAI,WAAW,MAAM;AACrB,QAAI,CAAC,UAAU;AACb,YAAM,WAAW,YAAY,KAAK,SAAS,GAAG,EAAE,CAAC;AACjD,UAAI,SAAU,YAAW,SAAS;AAAA,IACpC;AAGA,QAAI;AACJ,QAAI,MAAM,aAAa,QAAW;AAChC,uBAAiB,KAAK;AAAA,IACxB,WAAW,YAAY,gBAAgB,QAAQ,GAAG;AAChD,uBAAiB;AAAA,IACnB,OAAO;AACL,uBAAiB;AAAA,IACnB;AAKA,QAAI,KAAK,eAAgB,kBAAiB;AAG1C,UAAM,eAAe,MAAM,KAAK,eAAe,IAAI;AAEnD,QAAI,cAAc;AAIhB,YAAM,KAAK,kBAAkB,MAAM,CAAE;AAAA,IACvC,OAAO;AAEL,YAAM,EAAE,OAAO,YAAY,UAAU,IAAI,iBACrC,MAAM,cAAc,IAAI,IACxB,EAAE,OAAO,MAAM,WAAW,OAAgB;AAI9C,YAAM,YAAY,KAAK,iBACnB,KAAK,IAAI,WAAW,YAAY,CAAC,IACjC,KAAK,mBAAmB,IAAI;AAChC,YAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,WAAW,aAAa,SAAS,CAAC;AAO3E,UAAI,WAAW;AACf,UAAI;AACJ,UAAI,WAAW,KAAK,eAAe;AACjC,cAAM,aAAa,MAAM,YAAY;AACrC,qBAAa,MAAM,QAAQ,YAAY,OAAO;AAC9C,mBAAW;AAAA,MACb;AAGA,eAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,cAAM,QAAQ,IAAI;AAClB,cAAM,KAAK;AAAA,UACT;AAAA,UAAM;AAAA,UAAG;AAAA,UACT,WAAW,SAAS,OAAO,QAAQ,SAAS;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAGA,YAAM,KAAK,gBAAgB;AAAA,QACzB;AAAA,QACA,MAAM,KAAK;AAAA,QACX,gBAAgB,WAAW;AAAA,QAC3B,aAAa;AAAA,QACb;AAAA,QACA;AAAA,QACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,QAC7C,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,UAAU;AAAA,QACV,GAAI,eAAe,SAAY,EAAE,MAAM,WAAW,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH;AAGA,UAAM,iBAAiB,MAAM,cAAc,KAAK;AAChD,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,UAAU,MAAM,QAAQ,GAAG;AACjC,YAAM,QAAQ,IAAI;AAAA,QAChB;AAAA,QACA,UAAU;AAAA,QACV,MAAM,KAAK;AAAA,QACX,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,QAC7C,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,GAAI,mBAAmB,SAAY,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA,MACvE;AAEA,UAAI,WAAW,YAAY,MAAM;AAC/B,aAAK,wBAAwB;AAAA,MAC/B;AACA,aAAO;AAAA,IACT,CAAC;AAID,QAAI,KAAK,uBAAuB;AAC9B,YAAM,UAAU,KAAK;AACrB,WAAK,wBAAwB;AAC7B,YAAM,KAAK,WAAW,SAAS,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAErD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,MAAM,IAAI,UAA8C;AACtD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,QAAI,KAAK,UAAU;AACjB,UAAI,CAAC,KAAK,aAAa;AACrB,cAAM,IAAI,cAAc,cAAc,QAAQ,gDAAgD;AAAA,MAChG;AACA,aAAO,KAAK,YAAY,UAAU,KAAK,SAAS,GAAG;AAAA,IACrD;AAEA,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,eAAe,OAAO,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAI,UAAkB,MAA8D;AACxF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI,cAAc,cAAc,QAAQ,4DAAuD;AAAA,IACvG;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI,cAAc,cAAc,QAAQ,gDAAgD;AAAA,IAChG;AACA,WAAO,KAAK,YAAY,UAAU,KAAK,SAAS,KAAK,IAAI;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,cACZ,UACA,MACgE;AAChE,QAAI,SAAS,OAAQ,QAAO,CAAC;AAC7B,UAAM,MAAM,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,YAAY,QAAQ,KAAK,UAAU,OAAO,SAAS;AACrG,QAAI,SAAS,SAAS;AACpB,aAAO;AAAA,QACL,UAAU;AAAA,UACR,eAAe,IAAI;AAAA,UACnB,oBAAoB,IAAI;AAAA,UACxB,gBAAgB,IAAI;AAAA,UACpB,eAAe,IAAI;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,eAAe,KAAK,WAAW;AAC1C,YAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,GAAG,GAAG,GAAG;AAC3D,aAAO,EAAE,UAAU,EAAE,sBAAsB,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE;AAAA,IAC/D;AAGA,UAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,UAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC/E,WAAO,EAAE,UAAU,EAAE,kBAAkB,MAAM,GAAG,MAAM;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cACJ,UACA,KAQe;AACf,UAAM,iBAAiB,KAAK;AAC5B,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,QAAQ,IAAI;AAAA,QAChB,MAAM;AAAA,QACN,UAAU;AAAA,UACR,KAAK,IAAI;AAAA,UACT,GAAI,IAAI,cAAc,EAAE,aAAa,IAAI,YAAY,IAAI,CAAC;AAAA,UAC1D,GAAI,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,UACrC,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,UACjD,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,QACvC;AAAA,QACA,UAAU;AAAA,QACV,MAAM,IAAI,QAAQ;AAAA,QAClB,GAAI,IAAI,cAAc,EAAE,UAAU,IAAI,YAAY,IAAI,CAAC;AAAA,QACvD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,GAAI,mBAAmB,SAAY,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA,MACvE;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBAAgB,UAAkB,MAA8C;AACpF,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,OAAO,MAAM,QAAQ;AAC3B,UAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,YAAM,QAAQ,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG,KAAK,SAAS,MAAM,GAAG,KAAK,EAAE;AAAA,MACzE;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAA2D;AAC5E,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,WAAO,KAAK,SAAS,QAAQ,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAA4B;AAChC,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,WAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,UAAiC;AAC5C,QAAI;AACJ,QAAI;AAEJ,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,UAAI,EAAE,YAAY,OAAQ,QAAO;AACjC,YAAM,OAAO,MAAM,QAAQ;AAC3B,UAAI,KAAK,SAAU,uBAAsB,KAAK,SAAS;AAAA,UAClD,iBAAgB,KAAK;AAC1B,aAAO,MAAM,QAAQ;AACrB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,uBAAuB,KAAK,aAAa;AAG3C,YAAM,KAAK,YAAY,aAAa,mBAAmB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACzE;AAEA,QAAI,eAAe;AAIjB,YAAM,KAAK,WAAW,eAAe,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAE3D,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,UAAkB,MAAsD;AACrF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,cAAc,MAAM,OAAO,MAAM,IAAI;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,UACJ,UACA,MACqD;AACrD,QAAI,OAAO,QAAQ,eAAe,OAAO,IAAI,oBAAoB,YAAY;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,KAAK,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AAEnB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,UAAM,OAAO,MAAM,YAAY,MAAM,YAAY;AAQjD,UAAM,SAAS,MAAM,OAAO,MAAM,MAAM,YAAY,MAAM,aAAa,MAAM,UAAU;AACvF,UAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,KAAK,CAAC;AACxC,UAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,QAAI,UAAU;AACd,UAAM,SAAS,MAAY;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,UAAI,gBAAgB,GAAG;AAAA,IACzB;AACA,WAAO,EAAE,KAAK,OAAO;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,QAAQ,UAAkB,OAA8B;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,SAAS,QAAQ,0BAA0B,KAAK,QAAQ,GAAG;AAG9F,UAAM,WAAW,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC7D,QAAI,YAAY,SAAS,SAAS,KAAK,KAAM;AAG7C,UAAM,SAAwB;AAAA,MAC5B;AAAA,MACA,MAAM,KAAK;AAAA,MACX,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,GAAI,KAAK,WAAW,SAAY,EAAE,aAAa,KAAK,OAAO,IAAI,CAAC;AAAA,IAClE;AACA,UAAM,KAAK,mBAAmB,UAAU,MAAM;AAG9C,UAAM,KAAK,kBAAkB,KAAK,MAAM,CAAE;AAI1C,QAAI,YAAY,SAAS,SAAS,KAAK,MAAM;AAC3C,YAAM,KAAK,WAAW,SAAS,MAAM,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,UAAkB,OAA2C;AAC5E,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAS,MAAM,KAAK,eAAe,OAAO,IAAI;AACpD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,eAAe,OAAO,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,UAA4C;AAC7D,UAAM,SAAS,GAAG,KAAK,QAAQ,KAAK,QAAQ;AAC5C,UAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK,OAAO,KAAK,kBAAkB;AACzE,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC;AAE/D,UAAM,WAA4B,CAAC;AACnC,eAAW,OAAO,cAAc;AAC9B,YAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAC9E,UAAI,CAAC,SAAU;AAEf,UAAI,CAAC,KAAK,WAAW;AACnB,iBAAS,KAAK,KAAK,MAAM,SAAS,KAAK,CAAkB;AAAA,MAC3D,OAAO;AACL,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,cAAM,OAAO,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAC5D,iBAAS,KAAK,KAAK,MAAM,IAAI,CAAkB;AAAA,MACjD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,UAAkB,OAA8B;AAClE,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ;AAEb,UAAM,KAAK,oBAAoB,UAAU,KAAK;AAC9C,UAAM,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBACJ,UACA,OACA,MAC0B;AAC1B,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAS,MAAM,KAAK,eAAe,OAAO,IAAI;AACpD,QAAI,CAAC,OAAQ,QAAO;AAGpB,UAAM,WAAuB;AAAA,MAC3B,MAAM,OAAO;AAAA,MACb,UAAU,MAAM,YAAY,GAAG,QAAQ,IAAI,KAAK;AAAA,MAChD,MAAM,OAAO,KAAK;AAAA,MAClB,GAAI,OAAO,KAAK,aAAa,SAAY,EAAE,UAAU,OAAO,KAAK,SAAS,IAAI,CAAC;AAAA,MAC/E,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,gBAAgB,SAAY,EAAE,YAAY,OAAO,YAAY,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,KAAK,cAAc,UAAU,OAAO,MAAM,IAAI;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,UAA8C;AAC3D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAa,UAAkB,mBAAmB,MAA8B;AACpF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,OAAO,KAAK,eAAe,EAAG,QAAO;AACzC,QAAI,CAAC,KAAK,MAAM,WAAY,QAAO;AAEnC,UAAM,UAAU,GAAG,KAAK,IAAI;AAC5B,WAAO,KAAK,MAAM,WAAW,KAAK,OAAO,gBAAgB,SAAS,gBAAgB;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,gBAAgB,UAAkB,gBAAoD;AAC1F,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAGpB,UAAM,OAAO,MAAM,eAAe,KAAK;AACvC,UAAM,WAAW,KAAK,MAAM,IAAI;AAEhC,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,OAAO,OAAO,IAAI;AAC9D,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,cAAc,MAAM,OAAO,MAAM,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC/D;AAGA,UAAM,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO,KAAK,UAAU;AACzD,UAAM,EAAE,qBAAqB,WAAW,IAAI,MAAM,OAAO,sBAAc;AACvE,UAAM,YAAY,MAAM,WAAW,SAAS,KAAK,SAAS,OAAO,SAAS,GAAG;AAC7E,UAAM,YAAY,OAAO,KAAK,gBAAgB,SAC1C,MAAM,gBAAgB,SAAS,IAC/B;AAEJ,UAAM,OAAO,IAAI,eAA2B;AAAA,MAC1C,MAAM,YAAY;AAChB,mBAAW,QAAQ,SAAS;AAC5B,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF,CAAC;AAED,UAAM,WAAW,KAAK;AACtB,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB,KAAK,YAAY;AAAA,QACjC,kBAAkB,OAAO,KAAK,IAAI;AAAA,QAClC,QAAQ,IAAI,KAAK,IAAI;AAAA,QACrB,uBAAuB,qBAAqB,QAAQ;AAAA,QACpD,iBAAiB,IAAI,KAAK,KAAK,UAAU,EAAE,YAAY;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAIA,MAAc,cACZ,MACA,MACA,MACmB;AACnB,UAAM,iBAAiB,KAAK,eAAe,KAAK,IAAI;AAGpD,UAAM,OAAO,IAAI,eAA2B;AAAA,MAC1C,MAAM,MAAM,YAAY;AACtB,YAAI;AACF,gBAAM,SAAS,MAAM,eAAe,IAAI;AACxC,qBAAW,QAAQ,MAAM;AACzB,qBAAW,MAAM;AAAA,QACnB,SAAS,KAAK;AACZ,qBAAW,MAAM,GAAG;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,WAAW,MAAM,YAAY,KAAK;AACxC,UAAM,cAAc,MAAM,SACtB,qBAAqB,QAAQ,MAC7B,yBAAyB,QAAQ;AAErC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB,KAAK,YAAY;AAAA,QACjC,kBAAkB,OAAO,KAAK,IAAI;AAAA,QAClC,QAAQ,IAAI,KAAK,IAAI;AAAA,QACrB,uBAAuB;AAAA,QACvB,iBAAiB,IAAI,KAAK,KAAK,UAAU,EAAE,YAAY;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAMA,eAAe,eAAe,MAAmC;AAC/D,SAAO,UAAU,IAAI;AACvB;;;AClvCO,SAAS,uBAAuB,OAA6B,CAAC,GAAqB;AACxF,QAAM,OAAO,KAAK,WAAW;AAC7B,QAAM,QAAQ,oBAAI,IAGhB;AACF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,UAAU,KAAK,OAAO,GAAG;AAC7B,YAAM,IAAI,KAAK;AAAA,QACb;AAAA,QACA,aAAa,EAAE;AAAA,QACf,QAAQ,EAAE,WAAW;AAAA,QACrB,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,UAAU,KAAK;AACnB,aAAO,MAAM,IAAI,GAAG,GAAG,SAAS;AAAA,IAClC;AAAA,IACA,MAAM,aAAa,KAAK;AACtB,YAAM,OAAO,GAAG;AAAA,IAClB;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,IAAI,MAAM,IAAI,GAAG;AACvB,UAAI,CAAC,EAAG,QAAO;AACf,aAAO;AAAA,QACL,MAAM,EAAE,MAAM;AAAA,QACd,aAAa,EAAE;AAAA,QACf,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/C;AAAA,IACF;AAAA,IACA,MAAM,UAAU,KAAK,GAAG;AACtB,YAAM,IAAI,MAAM,IAAI,GAAG;AACvB,UAAI,GAAG,OAAQ,QAAO,GAAG,IAAI,IAAI,GAAG;AACpC,aAAO,GAAG,IAAI,IAAI,GAAG,uBAAuB,GAAG,oBAAoB,GAAG;AAAA,IACxE;AAAA,IACA,MAAM,OAAO,KAAK,GAAG;AACnB,aAAO,GAAG,IAAI,IAAI,GAAG,qBAAqB,mBAAmB,EAAE,WAAW,CAAC;AAAA,IAC7E;AAAA,IACA,MAAM,WAAW,QAAQ;AACvB,YAAM,MAAyB,CAAC;AAChC,iBAAW,CAAC,KAAK,CAAC,KAAK,OAAO;AAC5B,YAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAC7B,YAAI,KAAK;AAAA,UACP;AAAA,UACA,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,aAAa,EAAE,aAAa,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,EAAG;AAAA,QAChH,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpFA,SAAS,sBAAsB,KAA4B;AACzD,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,SAAO,MAAM,UAAU,IAAK,MAAM,MAAM,SAAS,CAAC,KAAK,OAAQ;AACjE;AAMA,eAAsB,sBAAsB,MAKV;AAChC,QAAM,EAAE,YAAY,aAAa,MAAM,IAAI;AAC3C,QAAM,OAAO,KAAK,WAAW,CAAC;AAC9B,QAAM,SAAS,KAAK,kBAAkB;AACtC,QAAM,aAAa,KAAK,eAAe,CAAC,QAAgB,EAAE,GAAG;AAE7D,QAAM,UAAU,MAAM,YAAY,WAAW,KAAK,UAAU,EAAE;AAC9D,QAAM,YAAsB,CAAC;AAC7B,MAAI,WAAW;AACf,MAAI,UAAU;AAEd,aAAW,EAAE,KAAK,KAAK,KAAK,SAAS;AACnC,UAAM,WAAW,OAAO,GAAG;AAC3B,QAAI,CAAC,UAAU;AACb;AACA;AAAA,IACF;AACA,QAAK,MAAM,WAAW,IAAI,QAAQ,KAAM,MAAM;AAC5C,YAAM,WAAW,IAAI,UAAU,WAAW,QAAQ,CAAC;AAAA,IACrD;AACA,UAAM,WAAW,KAAK,QAAQ,EAAE,cAAc,OAAO;AAAA,MACnD;AAAA,MACA,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC9D,CAAC;AACD,cAAU,KAAK,QAAQ;AACvB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,SAAS,UAAU;AACxC;","names":["uploaderUserId"]}

package/dist/{chunk-CYNTFU2D.js → chunk-YPIOFSN3.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-DJF3FXW5.js";
+} from "./chunk-OTWT6BAJ.js";
 
 // src/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-CYNTFU2D.js.map
+//# sourceMappingURL=chunk-YPIOFSN3.js.map

package/dist/{chunk-PTGQPWMV.js → chunk-ZONKSLF2.js}

@@ -1,6 +1,6 @@
 import {
   readPath
-} from "./chunk-LSIIPKYT.js";
+} from "./chunk-U2XSUCDF.js";
 
 // src/aggregate/reducers.ts
 function count(opts) {
@@ -120,4 +120,4 @@ export {
   min,
   max
 };
-//# sourceMappingURL=chunk-PTGQPWMV.js.map
+//# sourceMappingURL=chunk-ZONKSLF2.js.map