@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.1

package/dist/team/index.js

@@ -5,37 +5,40 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "../chunk-ZYWZWG6G.js";
+} from "../chunk-DGDI2D4M.js";
 import {
-  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
   isMagicLinkGrantExpired,
   listMagicLinkGrants,
-  loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
-  mintPaperRecoveryEntry,
-  mintWrappedDeksBlob,
   readMagicLinkGrantRecord,
   recoverPassphrase,
   recoverUser,
   removeAuthenticator,
   revokeMagicLinkGrant,
   rotatePassphrase,
-  savePaperRecoveryEntries,
-  unwrapDeksFromBlob,
-  unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-3YPCK6JX.js";
-import "../chunk-U26HQ6KJ.js";
+} from "../chunk-UPJNJGGA.js";
+import {
+  burnPaperRecoveryEntry,
+  loadPaperRecoveryEntries,
+  mintPaperRecoveryEntry,
+  mintWrappedDeksBlob,
+  savePaperRecoveryEntries,
+  unwrapDeksFromBlob,
+  unwrapDeksFromPaperEntry
+} from "../chunk-IGUYVGGI.js";
+import "../chunk-IO6GRPT6.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-WPLVTJ5D.js";
+} from "../chunk-IUEN57TV.js";
+import "../chunk-VQNJ7UZL.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -52,11 +55,12 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-DONMZAD2.js";
-import "../chunk-2QR2PQTT.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-WWGT2MDV.js";
+import "../chunk-ITNUCOXM.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 export {
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,

package/dist/tiers/index.d.ts

@@ -0,0 +1,5 @@
+export { l0 as NO_TIERS, l1 as TiersContext, iZ as TiersNotEnabledError, l2 as TiersStrategy, l3 as assertDeclaredTier, l4 as assertTiersEnabled, l5 as classifySealedShred, l6 as demote, l7 as elevate, l8 as getAtTier, l9 as listAtTier, la as putAtTier, lb as withTiers } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -0,0 +1,33 @@
+import {
+  NO_TIERS,
+  assertDeclaredTier,
+  assertTiersEnabled,
+  classifySealedShred,
+  demote,
+  elevate,
+  getAtTier,
+  listAtTier,
+  putAtTier,
+  withTiers
+} from "../chunk-IPB7FTQX.js";
+import "../chunk-IO6GRPT6.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import {
+  TiersNotEnabledError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  NO_TIERS,
+  TiersNotEnabledError,
+  assertDeclaredTier,
+  assertTiersEnabled,
+  classifySealedShred,
+  demote,
+  elevate,
+  getAtTier,
+  listAtTier,
+  putAtTier,
+  withTiers
+};
+//# sourceMappingURL=index.js.map

package/dist/tiers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/to/index.d.ts

@@ -0,0 +1,5 @@
+export { dq as BundleVersionConflictError, eJ as ConflictError, cV as EncryptedEnvelope, ge as ListPageResult, gM as NetworkError, gS as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, j1 as TxOp, jg as VaultSnapshot } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/to/index.js

@@ -0,0 +1,17 @@
+import "../chunk-K2WCO3NX.js";
+import {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  PodVersionConflictError,
+  StoreCapabilityError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  PodVersionConflictError,
+  StoreCapabilityError
+};
+//# sourceMappingURL=index.js.map

package/dist/to/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/transition-guard-C7ol6oPw.d.ts

@@ -0,0 +1,165 @@
+import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-BzUo1B6n.js';
+
+/**
+ * Register a guard for a collection. Guards run on every `put()` /
+ * `delete()` for the named collection (after permissions, before
+ * encryption) and may:
+ *
+ *   - `check` — block writes by throwing (typically `RecordLockedError`)
+ *   - `frozenFields` — freeze specific fields once a condition is true
+ *   - `amendment` — declare an authorized-override path with invariant
+ *
+ * Pass the returned handle to `createNoydb({ strategies: [...] })`.
+ *
+ * @see docs/superpowers/specs/2026-05-18-guards-design.md
+ */
+declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
+
+/**
+ * `immutableGuard` — declarative WORM / append-only sugar over the guard
+ * service.
+ *
+ * Issued fiscal documents (invoices, DDTs) must be immutable after issue.
+ * That is expressible today with a hand-rolled `withGuard` (block on
+ * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is
+ * repetitive and easy to get subtly wrong. `immutableGuard` generates
+ * exactly that guard from a declarative config, reusing the guard
+ * machinery wholesale — `check`/`onDelete` rejection, the ledgered
+ * `amendment` override, and composition with `periods`/`history`.
+ *
+ * ```ts
+ * createNoydb({ guardStrategies: [
+ *   immutableGuard({
+ *     collection: 'invoices',
+ *     after: (r) => r.status === 'issued',   // immutable once issued
+ *   }),
+ * ] })
+ * ```
+ *
+ * A record is mutable until `after(record)` holds; from then on, updates
+ * and deletes throw `RecordLockedError` unless performed inside an
+ * `amendment` transaction by an authorized role (the override is
+ * ledgered by the guard amendment mechanism). `appendOnly: true` is
+ * shorthand for `after: () => true` — immutable from creation.
+ */
+
+interface ImmutableGuardConfig<T extends Record<string, unknown>> {
+    /** The collection to make WORM. */
+    collection: string;
+    /**
+     * A record becomes immutable once this predicate holds. Evaluated on
+     * the *existing* (already-persisted) record, so the write that first
+     * makes it true is still allowed; subsequent writes are blocked.
+     * Mutually exclusive with `appendOnly`.
+     */
+    after?: (record: T) => boolean;
+    /** Shorthand for `after: () => true` — immutable from creation. */
+    appendOnly?: boolean;
+    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
+    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
+    /**
+     * Optional set-level invariant run over the amendment change-set after
+     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * exactly: it receives every {before, after} pair touching this
+     * collection in the amendment plus the guard context; throwing reverts
+     * the whole amendment and surfaces as `InvariantError`.
+     *
+     * Use this to keep a constraint inviolable EVEN under amendment — e.g.
+     * forbid deleting an issued document by re-throwing on any
+     * `before !== null && after === null` change, or assert a cross-record
+     * sum is preserved. When omitted the amendment is unconditionally
+     * allowed (the amendment itself is the sanctioned, ledgered override) —
+     * this is the backward-compatible default.
+     */
+    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
+}
+/**
+ * Build an immutability guard. Pass the returned handle to
+ * `createNoydb({ guardStrategies: [...] })`.
+ */
+declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
+
+/**
+ * `transitionGuard` — declarative state-machine sugar over the guard
+ * service.
+ *
+ * Any record with a lifecycle field (invoice `status`, order state,
+ * ticket workflow, subscription phase) needs transition validation: a
+ * write may only move the field along a declared arc. That is expressible
+ * with a hand-rolled `withGuard({ check })`, but every consumer
+ * re-implements the same graph lookup + error. `transitionGuard`
+ * generates exactly that guard from a state graph, reusing the guard
+ * machinery wholesale — `check` rejection, the ledgered `amendment`
+ * override, and composition with `periods`/`history`.
+ *
+ * It generalizes {@link immutableGuard}: WORM is the special case "every
+ * state has no outgoing arcs", i.e. `transitions` mapping each state to `[]`.
+ *
+ * ```ts
+ * createNoydb({ guardStrategies: [
+ *   transitionGuard<Sale>({
+ *     collection: 'sales', field: 'status',
+ *     transitions: {                          // absence of an arc = forbidden
+ *       draft: ['to_verify', 'cancelled'],
+ *       to_verify: ['proforma', 'draft', 'cancelled'],
+ *       proforma: ['invoiced', 'cancelled'],
+ *       invoiced: ['paid'], paid: [], cancelled: [],
+ *     },
+ *     initial: ['draft', 'to_verify'],        // allowed status on insert
+ *   }),
+ * ] })
+ * ```
+ *
+ * Semantics:
+ * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in
+ *   `initial`. When `initial` is omitted, any value is allowed on insert.
+ * - **Update**: the arc `(existing[field] → incoming[field])` must be
+ *   listed in `transitions[from]`, else `IllegalTransitionError`. A
+ *   same-value write (`from === to`) is allowed when `allowIdempotent`
+ *   (default `true`) — so writes that touch other fields without moving
+ *   state pass.
+ * - **Override**: inside an `amendment` transaction by an authorized role
+ *   the check is skipped and the change is ledgered (mirrors every guard).
+ *
+ * The status graph is caller-supplied data — no UI, no domain logic.
+ */
+
+interface TransitionGuardConfig<T extends Record<string, unknown>> {
+    /** The collection whose state field is governed. */
+    collection: string;
+    /** The state field on the record (e.g. `'status'`). */
+    field: keyof T & string;
+    /**
+     * The transition graph: each state maps to the states it may move to.
+     * A state absent from the map (or mapped to `[]`) is terminal — no
+     * outgoing arc, so any non-idempotent write from it is rejected.
+     */
+    transitions: Readonly<Record<string, readonly string[]>>;
+    /**
+     * States allowed as the initial value on insert (`existing === null`).
+     * Omit to allow any value on insert.
+     */
+    initial?: readonly string[];
+    /**
+     * Allow a same-value write (`from === to`) on update. Default `true` —
+     * lets a put that changes other fields, but not the state, through.
+     */
+    allowIdempotent?: boolean;
+    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
+    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
+    /**
+     * Optional set-level invariant run over the amendment change-set after
+     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * exactly. When omitted the amendment is unconditionally allowed (the
+     * amendment itself is the sanctioned, ledgered override) — the
+     * backward-compatible default. Mirrors {@link immutableGuard}.
+     */
+    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
+}
+/**
+ * Build a state-machine transition guard. Pass the returned handle to
+ * `createNoydb({ guardStrategies: [...] })`.
+ */
+declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
+
+export { type ImmutableGuardConfig as I, type TransitionGuardConfig as T, immutableGuard as i, transitionGuard as t, withGuard as w };

package/dist/tx/index.d.ts

@@ -1,21 +1,35 @@
-import { aH as TxStrategy } from '../types-Df28QFKb.js';
-export { aI as AmendmentTxOptions, aJ as TxCollection, aK as TxContext, aL as TxVault, aM as runTransaction } from '../types-Df28QFKb.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { i_ as TransactionInvariant, kX as TxStrategy } from '../index-BzUo1B6n.js';
+export { kY as AmendmentTxOptions, j0 as TxCollection, dP as TxContext, j2 as TxVault, kx as runTransaction } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**
  * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.
  */
 
+/**
+ * Options for {@link withTransactions}. Currently only commit-time
+ * changeset `invariants` (see {@link TransactionInvariant}).
+ */
+interface TransactionStrategyOptions {
+    /**
+     * Commit-time set-level invariants run over the changeset on every
+     * commit (ordinary AND amendment). See {@link TransactionInvariant}.
+     */
+    invariants?: ReadonlyArray<TransactionInvariant>;
+}
 /**
  * Build the default transactions strategy. Pass into
  * `createNoydb({ txStrategy: withTransactions() })` to enable
  * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).
+ *
+ * Supply `{ invariants }` to register commit-time changeset invariants —
+ * set-level constraints that fire after the writes commit and revert the
+ * transaction on a throw. Unlike `amendment.invariant`, these run for
+ * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.
  */
-declare function withTransactions(): TxStrategy;
+declare function withTransactions(opts?: TransactionStrategyOptions): TxStrategy;
 
-export { TxStrategy, withTransactions };
+export { TransactionInvariant, type TransactionStrategyOptions, TxStrategy, withTransactions };

package/dist/tx/index.js

@@ -3,11 +3,12 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-TFBP23BX.js";
-import "../chunk-FZU343FL.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-SKF73JOP.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/tx/dry-run.ts
+// src/with-commit/tx/dry-run.ts
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {
@@ -43,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-5PNY7LGW.js");
+      const { GuardExecutor } = await import("../executor-QZ7BXICW.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }
@@ -59,9 +60,13 @@ async function runDryRun(db, fn) {
   return { affected, guardViolations };
 }
 
-// src/tx/active.ts
-function withTransactions() {
-  return { runTransaction, runDryRun };
+// src/with-commit/tx/active.ts
+function withTransactions(opts) {
+  const invariants = opts?.invariants ?? [];
+  return {
+    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),
+    runDryRun
+  };
 }
 export {
   TxCollection,

package/dist/tx/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tx/dry-run.ts","../../src/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection.putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\nimport type { GuardExecutor as GuardExecutorType } from '../guards/executor.js'\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection.putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = (await import('../guards/executor.js')) as { GuardExecutor: typeof GuardExecutorType }\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n */\nexport function withTransactions(): TxStrategy {\n  return { runTransaction, runDryRun }\n}\n"],"mappings":";;;;;;;;;;AAiCA,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAK,MAAM,OAAO,yBAAuB;AAC/D,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;ACpFO,SAAS,mBAA+B;AAC7C,SAAO,EAAE,gBAAgB,UAAU;AACrC;","names":[]}
+{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\nimport type { GuardExecutor as GuardExecutorType } from '../../with-audit/guards/executor.js'\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = (await import('../../with-audit/guards/executor.js')) as { GuardExecutor: typeof GuardExecutorType }\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface TransactionStrategyOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: TransactionStrategyOptions): TxStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;AAiCA,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAK,MAAM,OAAO,yBAAqC;AAC7E,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;AClEO,SAAS,iBAAiB,MAA+C;AAC9E,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}

package/dist/ui/index.d.ts

@@ -0,0 +1 @@
+export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-aBkJR2sd.js';

package/dist/ui/index.js

@@ -0,0 +1 @@
+//# sourceMappingURL=index.js.map

package/dist/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/ulid-DRH25k3y.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Minimal ULID generator — zero dependencies, Web Crypto API only.
+ *
+ *. Used by the bundle writer to generate stable opaque
+ * handles for `.noydb` containers.
+ *
+ * **What's a ULID?** A 128-bit identifier encoded as 26 Crockford
+ * base32 characters. Layout:
+ *
+ * ```
+ *   01HYABCDEFGHJKMNPQRSTVWXYZ
+ *   |--------||---------------|
+ *    48-bit     80-bit
+ *    timestamp  randomness
+ * ```
+ *
+ * The first 10 chars encode a millisecond Unix timestamp (so ULIDs
+ * sort lexicographically by creation time), and the remaining 16
+ * chars are random. Crockford base32 omits I/L/O/U to avoid
+ * ambiguity in handwriting and URLs.
+ *
+ * **Why hand-roll instead of pulling in `ulid`?** The package adds
+ * a dep, the implementation is ~30 lines, and the bundle module
+ * is the only consumer. Adding `ulid` would also drag in its own
+ * crypto polyfill that we don't need on Node 18+ or modern
+ * browsers.
+ *
+ * **Privacy consideration:** the timestamp prefix is observable in
+ * the bundle header. This is a deliberate trade-off:
+ *   - Pro: lexicographic sortability lets bundle adapters list
+ *     newest-first without an extra index.
+ *   - Con: a casual observer can read the bundle's creation time
+ *     from the handle. They cannot read it from any OTHER field
+ *     (the header explicitly forbids `_exported_at`), and a
+ *     creation timestamp is the same kind of metadata that
+ *     filesystem mtime would already expose for a downloaded
+ *     bundle. The leak is therefore equivalent to what's already
+ *     visible from the file's mtime — not a new exposure.
+ *
+ * If a future use case needs timestamp-free handles, a v2 of the
+ * format could specify "use the random portion only" without a
+ * format break — `validateBundleHeader` only checks the regex
+ * shape, not the encoded timestamp.
+ */
+/**
+ * Generate a fresh ULID. Uses `crypto.getRandomValues` for the
+ * randomness portion — same Web Crypto API the rest of the
+ * codebase uses for IVs and salt.
+ *
+ * Returns a 26-character string. Calling twice in the same
+ * millisecond produces two distinct ULIDs (the random portion
+ * differs); ULIDs from the same millisecond are NOT guaranteed
+ * to be monotonically ordered relative to each other, only
+ * relative to ULIDs from a different millisecond. The bundle
+ * format never relies on intra-millisecond ordering.
+ */
+declare function generateULID(): string;
+/**
+ * Validate that a string is a syntactically well-formed ULID. Used
+ * by the bundle header validator. Does NOT verify that the
+ * timestamp portion decodes to a sensible date — the format only
+ * cares about the encoding shape.
+ */
+declare function isULID(value: string): boolean;
+
+export { generateULID as g, isULID as i };

package/dist/ulid-PTAIMDG4.js

@@ -0,0 +1,10 @@
+import {
+  generateULID,
+  isULID
+} from "./chunk-ZJADGNYF.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  generateULID,
+  isULID
+};
+//# sourceMappingURL=ulid-PTAIMDG4.js.map

package/dist/ulid-PTAIMDG4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/util/index.d.ts

@@ -1,3 +1,5 @@
+export { i as isDiscriminant } from '../discriminant-BN9REW3o.js';
+
 /**
  * Target-profile aware filename sanitizer.
  *

package/dist/util/index.js

@@ -1,8 +1,12 @@
+import {
+  isDiscriminant
+} from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/util/sanitize-filename.ts
+// src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";
 var BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g;
 var WINDOWS_RESERVED_CHARS = /[<>:"/\\|?*]/g;
@@ -185,6 +189,7 @@ function truncateToByteCap(s, max) {
   return out;
 }
 export {
+  isDiscriminant,
   sanitizeFilename
 };
 //# sourceMappingURL=index.js.map

package/dist/util/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/util/sanitize-filename.ts"],"sourcesContent":["/**\n * Target-profile aware filename sanitizer.\n *\n * Pure string in / string out. No filesystem access, no I/O. Use this\n * at the boundary where a user-supplied filename meets a storage\n * destination — local FS, ZIP archive, S3 key, URL path, SMB share —\n * to defuse the canonical 14-class footgun before it reaches that\n * destination.\n *\n * ## Threat model\n *\n *   1. Path injection — `..`, NUL bytes, `\\` on POSIX, absolute paths.\n *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,\n *      `COM1-9`, `LPT1-9`, with or without an extension.\n *   3. Windows reserved chars — `< > : \" / \\ | ? *` plus ASCII 0-31.\n *   4. Trailing `.` and ` ` on Windows / SMB.\n *   5. Unicode normalization drift — same display, different bytes →\n *      \"two files with the same name\" sync ghosts.\n *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`\n *      into `harmless.txt.exe`.\n *   7. URL `+` ambiguity in S3 presigned URLs.\n *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in\n *      pre-2006 readers.\n *   9-14. Length caps, leading/trailing whitespace + controls,\n *      `.DS_Store`-style hidden noise, etc.\n *\n * ## Always-on transforms (every profile)\n *\n *   - NFC normalize (`String.prototype.normalize('NFC')`).\n *   - Reject NUL — hard fail, not strip. Silent strip enables a\n *     classic truncation bypass (`safe.txt\\0.exe` → `safe.txt`).\n *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).\n *   - Trim leading/trailing whitespace and ASCII control chars.\n *\n * ## Non-goals (i18n boundary policy, )\n *\n *   - No transliteration.\n *   - No locale-aware slugging.\n *   - No script-specific segmentation.\n *\n * @module\n */\n\nimport { FilenameSanitizationError } from '../errors.js'\n\n/**\n * One of seven storage destinations the sanitizer knows how to defang\n * for. Pick the most restrictive that covers your write site:\n * `'macos-smb'` is the safe default for \"I don't know where these\n * files end up but they're going to a real filesystem somewhere.\"\n */\nexport type FilenameProfile =\n  | 'posix'\n  | 'windows'\n  | 'macos-smb'\n  | 'zip'\n  | 'url-path'\n  | 's3-key'\n  | 'opaque'\n\nexport interface SanitizeFilenameOptions {\n  /** Target-destination profile. */\n  readonly profile: FilenameProfile\n  /**\n   * Override the per-profile length cap. Useful when leaving headroom\n   * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write\n   * site that wants 15 bytes of slack for `-1`, `-2`, …\n   */\n  readonly maxBytes?: number\n  /**\n   * Required when `profile === 'opaque'`. The opaque profile replaces\n   * the entire input with `${opaqueId}.${ext}` (extension preserved\n   * from the input when present).\n   */\n  readonly opaqueId?: string\n}\n\nconst REPLACEMENT = '_'\n\n// Bidi overrides: U+202A LRE, U+202B RLE, U+202C PDF, U+202D LRO,\n// U+202E RLO, U+2066 LRI, U+2067 RLI, U+2068 FSI, U+2069 PDI.\nconst BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g\n\n// Reserved by Windows / NTFS / FAT / SMB.\nconst WINDOWS_RESERVED_CHARS = /[<>:\"/\\\\|?*]/g\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'CON', 'PRN', 'AUX', 'NUL',\n  'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',\n  'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',\n])\n\n// macOS legacy hidden-noise files. Match the full name.\nconst MAC_HIDDEN_NOISE = /^(?:\\.DS_Store|\\.localized|\\.fseventsd|\\._.+)$/i\n\n// RFC 3986 unreserved set.\nconst URL_UNRESERVED = /[A-Za-z0-9\\-._~]/\n\nconst utf8 = new TextEncoder()\n\nfunction isControlCode(cp: number): boolean {\n  return (cp >= 0 && cp <= 0x1f) || cp === 0x7f\n}\n\nfunction stripControlChars(s: string): string {\n  let out = ''\n  for (let i = 0; i < s.length; i++) {\n    out += isControlCode(s.charCodeAt(i)) ? REPLACEMENT : s[i]\n  }\n  return out\n}\n\nfunction trimWhitespaceAndControls(s: string): string {\n  let start = 0\n  let end = s.length\n  while (start < end) {\n    const ch = s[start]!\n    if (!isControlCode(s.charCodeAt(start)) && ch.trim() !== '') break\n    start++\n  }\n  while (end > start) {\n    const ch = s[end - 1]!\n    if (!isControlCode(s.charCodeAt(end - 1)) && ch.trim() !== '') break\n    end--\n  }\n  return s.slice(start, end)\n}\n\n/**\n * Sanitize a filename for a target-destination profile. Pure: same\n * input + options always returns the same output, no I/O.\n *\n * Returns the sanitized name. Throws {@link FilenameSanitizationError}\n * when the input cannot be made safe at all (NUL byte, empty after\n * normalization, missing `opaqueId` for the opaque profile,\n * `..` segment that would fall out of any reasonable target).\n */\nexport function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string {\n  if (typeof name !== 'string') {\n    throw new FilenameSanitizationError('input must be a string')\n  }\n  if (name.includes('\\0')) {\n    throw new FilenameSanitizationError('NUL byte in filename')\n  }\n\n  let s = name.normalize('NFC').replace(BIDI_OVERRIDES, '')\n\n  if (opts.profile === 'opaque') {\n    return applyOpaque(s, opts)\n  }\n\n  s = trimWhitespaceAndControls(s)\n\n  switch (opts.profile) {\n    case 'posix':     return cap(applyPosix(s),     opts.maxBytes ?? 255,  'utf8')\n    case 'windows':   return cap(applyWindows(s),   opts.maxBytes ?? 255,  'utf16')\n    case 'macos-smb': return cap(applyMacosSmb(s),  opts.maxBytes ?? 240,  'utf8')\n    case 'zip':       return cap(applyZip(s),       opts.maxBytes ?? 255,  'utf8')\n    case 'url-path':  return cap(applyUrlPath(s),   opts.maxBytes ?? 1024, 'bytes-pre-encode')\n    case 's3-key':    return cap(applyS3Key(s),     opts.maxBytes ?? 1024, 'utf8')\n  }\n}\n\n// ─── Profile implementations ────────────────────────────────────────────\n\nfunction applyPosix(s: string): string {\n  // POSIX is permissive; only `/` and NUL are off-limits.\n  const cleaned = s.replace(/\\//g, REPLACEMENT)\n  return rejectDotSegments(cleaned)\n}\n\nfunction applyWindows(s: string): string {\n  let cleaned = s.replace(WINDOWS_RESERVED_CHARS, REPLACEMENT)\n  cleaned = stripControlChars(cleaned)\n  // Trailing space/dot are stripped by Win32 path resolution.\n  cleaned = cleaned.replace(/[. ]+$/g, '')\n  cleaned = rejectDotSegments(cleaned)\n  return avoidWindowsReservedName(cleaned)\n}\n\nfunction applyMacosSmb(s: string): string {\n  let cleaned = applyWindows(s)\n  if (MAC_HIDDEN_NOISE.test(cleaned)) {\n    cleaned = REPLACEMENT + cleaned\n  }\n  return cleaned\n}\n\nfunction applyZip(s: string): string {\n  let cleaned = s.replace(/^\\/+/, '')\n  cleaned = rejectDotSegments(cleaned)\n  return stripControlChars(cleaned)\n}\n\nfunction applyUrlPath(s: string): string {\n  // RFC 3986 percent-encoding for path segment. Keep `unreserved`,\n  // encode everything else. `+` is encoded as `%2B` because S3 and\n  // legacy servers treat raw `+` as space ambiguously.\n  let out = ''\n  for (const ch of s) {\n    if (URL_UNRESERVED.test(ch)) { out += ch; continue }\n    const bytes = utf8.encode(ch)\n    for (const b of bytes) {\n      out += '%' + b.toString(16).toUpperCase().padStart(2, '0')\n    }\n  }\n  return out\n}\n\nfunction applyS3Key(s: string): string {\n  // Strip leading slashes BEFORE percent-encoding — once `/` is\n  // encoded to `%2F` the leading-slash regex no longer matches.\n  return applyUrlPath(s.replace(/^\\/+/, ''))\n}\n\nfunction applyOpaque(s: string, opts: SanitizeFilenameOptions): string {\n  if (!opts.opaqueId) {\n    throw new FilenameSanitizationError('opaque profile requires opaqueId')\n  }\n  // Preserve a \"safe-looking\" extension only — alphanumeric, ≤16 bytes.\n  const dot = s.lastIndexOf('.')\n  if (dot > 0 && dot < s.length - 1) {\n    const ext = s.slice(dot + 1)\n    if (/^[A-Za-z0-9]{1,16}$/.test(ext)) {\n      return `${opts.opaqueId}.${ext.toLowerCase()}`\n    }\n  }\n  return opts.opaqueId\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction rejectDotSegments(s: string): string {\n  if (s === '.' || s === '..' || s.split(/[/\\\\]/).some((seg) => seg === '..')) {\n    throw new FilenameSanitizationError('path traversal segment in filename')\n  }\n  if (s.length === 0) {\n    throw new FilenameSanitizationError('empty filename after sanitization')\n  }\n  return s\n}\n\nfunction avoidWindowsReservedName(s: string): string {\n  const dot = s.indexOf('.')\n  const base = dot === -1 ? s : s.slice(0, dot)\n  if (WINDOWS_RESERVED_NAMES.has(base.toUpperCase())) {\n    return REPLACEMENT + s\n  }\n  return s\n}\n\ntype LengthUnit = 'utf8' | 'utf16' | 'bytes-pre-encode'\n\nfunction cap(s: string, max: number, unit: LengthUnit): string {\n  if (max <= 0) {\n    throw new FilenameSanitizationError('maxBytes must be positive')\n  }\n  if (unit === 'utf16') {\n    if (s.length <= max) return s\n    return s.slice(0, max)\n  }\n  if (unit === 'bytes-pre-encode') {\n    if (utf8.encode(s).byteLength <= max) return s\n    return truncateToByteCap(s, max)\n  }\n  if (utf8.encode(s).byteLength <= max) return s\n  return truncateToByteCap(s, max)\n}\n\nfunction truncateToByteCap(s: string, max: number): string {\n  // Walk by code points so we never split a multi-byte sequence in\n  // the middle. Whole-grapheme handling (ZWJ-joined emoji) is a\n  // documented non-goal; we only protect against UTF-8 boundary\n  // splits here.\n  let out = ''\n  let used = 0\n  for (const cp of s) {\n    const n = utf8.encode(cp).byteLength\n    if (used + n > max) break\n    out += cp\n    used += n\n  }\n  if (out.length === 0) {\n    throw new FilenameSanitizationError('maxBytes too small for a single code point')\n  }\n  return out\n}\n"],"mappings":";;;;;AA6EA,IAAM,cAAc;AAIpB,IAAM,iBAAiB;AAGvB,IAAM,yBAAyB;AAE/B,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EACrB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAChE;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAClE,CAAC;AAGD,IAAM,mBAAmB;AAGzB,IAAM,iBAAiB;AAEvB,IAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,cAAc,IAAqB;AAC1C,SAAQ,MAAM,KAAK,MAAM,MAAS,OAAO;AAC3C;AAEA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,WAAO,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,GAAmB;AACpD,MAAI,QAAQ;AACZ,MAAI,MAAM,EAAE;AACZ,SAAO,QAAQ,KAAK;AAClB,UAAM,KAAK,EAAE,KAAK;AAClB,QAAI,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC7D;AAAA,EACF;AACA,SAAO,MAAM,OAAO;AAClB,UAAM,KAAK,EAAE,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,EAAE,WAAW,MAAM,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC/D;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAWO,SAAS,iBAAiB,MAAc,MAAuC;AACpF,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,0BAA0B,wBAAwB;AAAA,EAC9D;AACA,MAAI,KAAK,SAAS,IAAI,GAAG;AACvB,UAAM,IAAI,0BAA0B,sBAAsB;AAAA,EAC5D;AAEA,MAAI,IAAI,KAAK,UAAU,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AAExD,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,YAAY,GAAG,IAAI;AAAA,EAC5B;AAEA,MAAI,0BAA0B,CAAC;AAE/B,UAAQ,KAAK,SAAS;AAAA,IACpB,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,KAAM,OAAO;AAAA,IAC9E,KAAK;AAAa,aAAO,IAAI,cAAc,CAAC,GAAI,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,SAAS,CAAC,GAAS,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,MAAM,kBAAkB;AAAA,IACzF,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,MAAM,MAAM;AAAA,EAC/E;AACF;AAIA,SAAS,WAAW,GAAmB;AAErC,QAAM,UAAU,EAAE,QAAQ,OAAO,WAAW;AAC5C,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AACvC,MAAI,UAAU,EAAE,QAAQ,wBAAwB,WAAW;AAC3D,YAAU,kBAAkB,OAAO;AAEnC,YAAU,QAAQ,QAAQ,WAAW,EAAE;AACvC,YAAU,kBAAkB,OAAO;AACnC,SAAO,yBAAyB,OAAO;AACzC;AAEA,SAAS,cAAc,GAAmB;AACxC,MAAI,UAAU,aAAa,CAAC;AAC5B,MAAI,iBAAiB,KAAK,OAAO,GAAG;AAClC,cAAU,cAAc;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,SAAS,GAAmB;AACnC,MAAI,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAClC,YAAU,kBAAkB,OAAO;AACnC,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AAIvC,MAAI,MAAM;AACV,aAAW,MAAM,GAAG;AAClB,QAAI,eAAe,KAAK,EAAE,GAAG;AAAE,aAAO;AAAI;AAAA,IAAS;AACnD,UAAM,QAAQ,KAAK,OAAO,EAAE;AAC5B,eAAW,KAAK,OAAO;AACrB,aAAO,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AAGrC,SAAO,aAAa,EAAE,QAAQ,QAAQ,EAAE,CAAC;AAC3C;AAEA,SAAS,YAAY,GAAW,MAAuC;AACrE,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI,0BAA0B,kCAAkC;AAAA,EACxE;AAEA,QAAM,MAAM,EAAE,YAAY,GAAG;AAC7B,MAAI,MAAM,KAAK,MAAM,EAAE,SAAS,GAAG;AACjC,UAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,QAAI,sBAAsB,KAAK,GAAG,GAAG;AACnC,aAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,YAAY,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAC3E,UAAM,IAAI,0BAA0B,oCAAoC;AAAA,EAC1E;AACA,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,IAAI,0BAA0B,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,GAAmB;AACnD,QAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,QAAM,OAAO,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG;AAC5C,MAAI,uBAAuB,IAAI,KAAK,YAAY,CAAC,GAAG;AAClD,WAAO,cAAc;AAAA,EACvB;AACA,SAAO;AACT;AAIA,SAAS,IAAI,GAAW,KAAa,MAA0B;AAC7D,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,0BAA0B,2BAA2B;AAAA,EACjE;AACA,MAAI,SAAS,SAAS;AACpB,QAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,WAAO,EAAE,MAAM,GAAG,GAAG;AAAA,EACvB;AACA,MAAI,SAAS,oBAAoB;AAC/B,QAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,WAAO,kBAAkB,GAAG,GAAG;AAAA,EACjC;AACA,MAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,SAAO,kBAAkB,GAAG,GAAG;AACjC;AAEA,SAAS,kBAAkB,GAAW,KAAqB;AAKzD,MAAI,MAAM;AACV,MAAI,OAAO;AACX,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,KAAK,OAAO,EAAE,EAAE;AAC1B,QAAI,OAAO,IAAI,IAAK;AACpB,WAAO;AACP,YAAQ;AAAA,EACV;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,0BAA0B,4CAA4C;AAAA,EAClF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/kernel/util/sanitize-filename.ts"],"sourcesContent":["/**\n * Target-profile aware filename sanitizer.\n *\n * Pure string in / string out. No filesystem access, no I/O. Use this\n * at the boundary where a user-supplied filename meets a storage\n * destination — local FS, ZIP archive, S3 key, URL path, SMB share —\n * to defuse the canonical 14-class footgun before it reaches that\n * destination.\n *\n * ## Threat model\n *\n *   1. Path injection — `..`, NUL bytes, `\\` on POSIX, absolute paths.\n *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,\n *      `COM1-9`, `LPT1-9`, with or without an extension.\n *   3. Windows reserved chars — `< > : \" / \\ | ? *` plus ASCII 0-31.\n *   4. Trailing `.` and ` ` on Windows / SMB.\n *   5. Unicode normalization drift — same display, different bytes →\n *      \"two files with the same name\" sync ghosts.\n *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`\n *      into `harmless.txt.exe`.\n *   7. URL `+` ambiguity in S3 presigned URLs.\n *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in\n *      pre-2006 readers.\n *   9-14. Length caps, leading/trailing whitespace + controls,\n *      `.DS_Store`-style hidden noise, etc.\n *\n * ## Always-on transforms (every profile)\n *\n *   - NFC normalize (`String.prototype.normalize('NFC')`).\n *   - Reject NUL — hard fail, not strip. Silent strip enables a\n *     classic truncation bypass (`safe.txt\\0.exe` → `safe.txt`).\n *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).\n *   - Trim leading/trailing whitespace and ASCII control chars.\n *\n * ## Non-goals (i18n boundary policy, )\n *\n *   - No transliteration.\n *   - No locale-aware slugging.\n *   - No script-specific segmentation.\n *\n * @module\n */\n\nimport { FilenameSanitizationError } from '../errors.js'\n\n/**\n * One of seven storage destinations the sanitizer knows how to defang\n * for. Pick the most restrictive that covers your write site:\n * `'macos-smb'` is the safe default for \"I don't know where these\n * files end up but they're going to a real filesystem somewhere.\"\n */\nexport type FilenameProfile =\n  | 'posix'\n  | 'windows'\n  | 'macos-smb'\n  | 'zip'\n  | 'url-path'\n  | 's3-key'\n  | 'opaque'\n\nexport interface SanitizeFilenameOptions {\n  /** Target-destination profile. */\n  readonly profile: FilenameProfile\n  /**\n   * Override the per-profile length cap. Useful when leaving headroom\n   * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write\n   * site that wants 15 bytes of slack for `-1`, `-2`, …\n   */\n  readonly maxBytes?: number\n  /**\n   * Required when `profile === 'opaque'`. The opaque profile replaces\n   * the entire input with `${opaqueId}.${ext}` (extension preserved\n   * from the input when present).\n   */\n  readonly opaqueId?: string\n}\n\nconst REPLACEMENT = '_'\n\n// Bidi overrides: U+202A LRE, U+202B RLE, U+202C PDF, U+202D LRO,\n// U+202E RLO, U+2066 LRI, U+2067 RLI, U+2068 FSI, U+2069 PDI.\nconst BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g\n\n// Reserved by Windows / NTFS / FAT / SMB.\nconst WINDOWS_RESERVED_CHARS = /[<>:\"/\\\\|?*]/g\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'CON', 'PRN', 'AUX', 'NUL',\n  'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',\n  'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',\n])\n\n// macOS legacy hidden-noise files. Match the full name.\nconst MAC_HIDDEN_NOISE = /^(?:\\.DS_Store|\\.localized|\\.fseventsd|\\._.+)$/i\n\n// RFC 3986 unreserved set.\nconst URL_UNRESERVED = /[A-Za-z0-9\\-._~]/\n\nconst utf8 = new TextEncoder()\n\nfunction isControlCode(cp: number): boolean {\n  return (cp >= 0 && cp <= 0x1f) || cp === 0x7f\n}\n\nfunction stripControlChars(s: string): string {\n  let out = ''\n  for (let i = 0; i < s.length; i++) {\n    out += isControlCode(s.charCodeAt(i)) ? REPLACEMENT : s[i]\n  }\n  return out\n}\n\nfunction trimWhitespaceAndControls(s: string): string {\n  let start = 0\n  let end = s.length\n  while (start < end) {\n    const ch = s[start]!\n    if (!isControlCode(s.charCodeAt(start)) && ch.trim() !== '') break\n    start++\n  }\n  while (end > start) {\n    const ch = s[end - 1]!\n    if (!isControlCode(s.charCodeAt(end - 1)) && ch.trim() !== '') break\n    end--\n  }\n  return s.slice(start, end)\n}\n\n/**\n * Sanitize a filename for a target-destination profile. Pure: same\n * input + options always returns the same output, no I/O.\n *\n * Returns the sanitized name. Throws {@link FilenameSanitizationError}\n * when the input cannot be made safe at all (NUL byte, empty after\n * normalization, missing `opaqueId` for the opaque profile,\n * `..` segment that would fall out of any reasonable target).\n */\nexport function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string {\n  if (typeof name !== 'string') {\n    throw new FilenameSanitizationError('input must be a string')\n  }\n  if (name.includes('\\0')) {\n    throw new FilenameSanitizationError('NUL byte in filename')\n  }\n\n  let s = name.normalize('NFC').replace(BIDI_OVERRIDES, '')\n\n  if (opts.profile === 'opaque') {\n    return applyOpaque(s, opts)\n  }\n\n  s = trimWhitespaceAndControls(s)\n\n  switch (opts.profile) {\n    case 'posix':     return cap(applyPosix(s),     opts.maxBytes ?? 255,  'utf8')\n    case 'windows':   return cap(applyWindows(s),   opts.maxBytes ?? 255,  'utf16')\n    case 'macos-smb': return cap(applyMacosSmb(s),  opts.maxBytes ?? 240,  'utf8')\n    case 'zip':       return cap(applyZip(s),       opts.maxBytes ?? 255,  'utf8')\n    case 'url-path':  return cap(applyUrlPath(s),   opts.maxBytes ?? 1024, 'bytes-pre-encode')\n    case 's3-key':    return cap(applyS3Key(s),     opts.maxBytes ?? 1024, 'utf8')\n  }\n}\n\n// ─── Profile implementations ────────────────────────────────────────────\n\nfunction applyPosix(s: string): string {\n  // POSIX is permissive; only `/` and NUL are off-limits.\n  const cleaned = s.replace(/\\//g, REPLACEMENT)\n  return rejectDotSegments(cleaned)\n}\n\nfunction applyWindows(s: string): string {\n  let cleaned = s.replace(WINDOWS_RESERVED_CHARS, REPLACEMENT)\n  cleaned = stripControlChars(cleaned)\n  // Trailing space/dot are stripped by Win32 path resolution.\n  cleaned = cleaned.replace(/[. ]+$/g, '')\n  cleaned = rejectDotSegments(cleaned)\n  return avoidWindowsReservedName(cleaned)\n}\n\nfunction applyMacosSmb(s: string): string {\n  let cleaned = applyWindows(s)\n  if (MAC_HIDDEN_NOISE.test(cleaned)) {\n    cleaned = REPLACEMENT + cleaned\n  }\n  return cleaned\n}\n\nfunction applyZip(s: string): string {\n  let cleaned = s.replace(/^\\/+/, '')\n  cleaned = rejectDotSegments(cleaned)\n  return stripControlChars(cleaned)\n}\n\nfunction applyUrlPath(s: string): string {\n  // RFC 3986 percent-encoding for path segment. Keep `unreserved`,\n  // encode everything else. `+` is encoded as `%2B` because S3 and\n  // legacy servers treat raw `+` as space ambiguously.\n  let out = ''\n  for (const ch of s) {\n    if (URL_UNRESERVED.test(ch)) { out += ch; continue }\n    const bytes = utf8.encode(ch)\n    for (const b of bytes) {\n      out += '%' + b.toString(16).toUpperCase().padStart(2, '0')\n    }\n  }\n  return out\n}\n\nfunction applyS3Key(s: string): string {\n  // Strip leading slashes BEFORE percent-encoding — once `/` is\n  // encoded to `%2F` the leading-slash regex no longer matches.\n  return applyUrlPath(s.replace(/^\\/+/, ''))\n}\n\nfunction applyOpaque(s: string, opts: SanitizeFilenameOptions): string {\n  if (!opts.opaqueId) {\n    throw new FilenameSanitizationError('opaque profile requires opaqueId')\n  }\n  // Preserve a \"safe-looking\" extension only — alphanumeric, ≤16 bytes.\n  const dot = s.lastIndexOf('.')\n  if (dot > 0 && dot < s.length - 1) {\n    const ext = s.slice(dot + 1)\n    if (/^[A-Za-z0-9]{1,16}$/.test(ext)) {\n      return `${opts.opaqueId}.${ext.toLowerCase()}`\n    }\n  }\n  return opts.opaqueId\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction rejectDotSegments(s: string): string {\n  if (s === '.' || s === '..' || s.split(/[/\\\\]/).some((seg) => seg === '..')) {\n    throw new FilenameSanitizationError('path traversal segment in filename')\n  }\n  if (s.length === 0) {\n    throw new FilenameSanitizationError('empty filename after sanitization')\n  }\n  return s\n}\n\nfunction avoidWindowsReservedName(s: string): string {\n  const dot = s.indexOf('.')\n  const base = dot === -1 ? s : s.slice(0, dot)\n  if (WINDOWS_RESERVED_NAMES.has(base.toUpperCase())) {\n    return REPLACEMENT + s\n  }\n  return s\n}\n\ntype LengthUnit = 'utf8' | 'utf16' | 'bytes-pre-encode'\n\nfunction cap(s: string, max: number, unit: LengthUnit): string {\n  if (max <= 0) {\n    throw new FilenameSanitizationError('maxBytes must be positive')\n  }\n  if (unit === 'utf16') {\n    if (s.length <= max) return s\n    return s.slice(0, max)\n  }\n  if (unit === 'bytes-pre-encode') {\n    if (utf8.encode(s).byteLength <= max) return s\n    return truncateToByteCap(s, max)\n  }\n  if (utf8.encode(s).byteLength <= max) return s\n  return truncateToByteCap(s, max)\n}\n\nfunction truncateToByteCap(s: string, max: number): string {\n  // Walk by code points so we never split a multi-byte sequence in\n  // the middle. Whole-grapheme handling (ZWJ-joined emoji) is a\n  // documented non-goal; we only protect against UTF-8 boundary\n  // splits here.\n  let out = ''\n  let used = 0\n  for (const cp of s) {\n    const n = utf8.encode(cp).byteLength\n    if (used + n > max) break\n    out += cp\n    used += n\n  }\n  if (out.length === 0) {\n    throw new FilenameSanitizationError('maxBytes too small for a single code point')\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;AA6EA,IAAM,cAAc;AAIpB,IAAM,iBAAiB;AAGvB,IAAM,yBAAyB;AAE/B,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EACrB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAChE;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAClE,CAAC;AAGD,IAAM,mBAAmB;AAGzB,IAAM,iBAAiB;AAEvB,IAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,cAAc,IAAqB;AAC1C,SAAQ,MAAM,KAAK,MAAM,MAAS,OAAO;AAC3C;AAEA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,WAAO,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,GAAmB;AACpD,MAAI,QAAQ;AACZ,MAAI,MAAM,EAAE;AACZ,SAAO,QAAQ,KAAK;AAClB,UAAM,KAAK,EAAE,KAAK;AAClB,QAAI,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC7D;AAAA,EACF;AACA,SAAO,MAAM,OAAO;AAClB,UAAM,KAAK,EAAE,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,EAAE,WAAW,MAAM,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC/D;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAWO,SAAS,iBAAiB,MAAc,MAAuC;AACpF,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,0BAA0B,wBAAwB;AAAA,EAC9D;AACA,MAAI,KAAK,SAAS,IAAI,GAAG;AACvB,UAAM,IAAI,0BAA0B,sBAAsB;AAAA,EAC5D;AAEA,MAAI,IAAI,KAAK,UAAU,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AAExD,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,YAAY,GAAG,IAAI;AAAA,EAC5B;AAEA,MAAI,0BAA0B,CAAC;AAE/B,UAAQ,KAAK,SAAS;AAAA,IACpB,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,KAAM,OAAO;AAAA,IAC9E,KAAK;AAAa,aAAO,IAAI,cAAc,CAAC,GAAI,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,SAAS,CAAC,GAAS,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,MAAM,kBAAkB;AAAA,IACzF,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,MAAM,MAAM;AAAA,EAC/E;AACF;AAIA,SAAS,WAAW,GAAmB;AAErC,QAAM,UAAU,EAAE,QAAQ,OAAO,WAAW;AAC5C,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AACvC,MAAI,UAAU,EAAE,QAAQ,wBAAwB,WAAW;AAC3D,YAAU,kBAAkB,OAAO;AAEnC,YAAU,QAAQ,QAAQ,WAAW,EAAE;AACvC,YAAU,kBAAkB,OAAO;AACnC,SAAO,yBAAyB,OAAO;AACzC;AAEA,SAAS,cAAc,GAAmB;AACxC,MAAI,UAAU,aAAa,CAAC;AAC5B,MAAI,iBAAiB,KAAK,OAAO,GAAG;AAClC,cAAU,cAAc;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,SAAS,GAAmB;AACnC,MAAI,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAClC,YAAU,kBAAkB,OAAO;AACnC,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AAIvC,MAAI,MAAM;AACV,aAAW,MAAM,GAAG;AAClB,QAAI,eAAe,KAAK,EAAE,GAAG;AAAE,aAAO;AAAI;AAAA,IAAS;AACnD,UAAM,QAAQ,KAAK,OAAO,EAAE;AAC5B,eAAW,KAAK,OAAO;AACrB,aAAO,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AAGrC,SAAO,aAAa,EAAE,QAAQ,QAAQ,EAAE,CAAC;AAC3C;AAEA,SAAS,YAAY,GAAW,MAAuC;AACrE,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI,0BAA0B,kCAAkC;AAAA,EACxE;AAEA,QAAM,MAAM,EAAE,YAAY,GAAG;AAC7B,MAAI,MAAM,KAAK,MAAM,EAAE,SAAS,GAAG;AACjC,UAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,QAAI,sBAAsB,KAAK,GAAG,GAAG;AACnC,aAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,YAAY,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAC3E,UAAM,IAAI,0BAA0B,oCAAoC;AAAA,EAC1E;AACA,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,IAAI,0BAA0B,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,GAAmB;AACnD,QAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,QAAM,OAAO,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG;AAC5C,MAAI,uBAAuB,IAAI,KAAK,YAAY,CAAC,GAAG;AAClD,WAAO,cAAc;AAAA,EACvB;AACA,SAAO;AACT;AAIA,SAAS,IAAI,GAAW,KAAa,MAA0B;AAC7D,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,0BAA0B,2BAA2B;AAAA,EACjE;AACA,MAAI,SAAS,SAAS;AACpB,QAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,WAAO,EAAE,MAAM,GAAG,GAAG;AAAA,EACvB;AACA,MAAI,SAAS,oBAAoB;AAC/B,QAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,WAAO,kBAAkB,GAAG,GAAG;AAAA,EACjC;AACA,MAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,SAAO,kBAAkB,GAAG,GAAG;AACjC;AAEA,SAAS,kBAAkB,GAAW,KAAqB;AAKzD,MAAI,MAAM;AACV,MAAI,OAAO;AACX,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,KAAK,OAAO,EAAE,EAAE;AAC1B,QAAI,OAAO,IAAI,IAAK;AACpB,WAAO;AACP,YAAQ;AAAA,EACV;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,0BAA0B,4CAA4C;AAAA,EAClF;AACA,SAAO;AACT;","names":[]}