@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/post-register-HAWO3O7O.js

@@ -0,0 +1,55 @@
+import {
+  hashFields
+} from "./chunk-7ITPJFGC.js";
+import {
+  SatelliteConfigError
+} from "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/marker.ts
+async function ensureSatelliteMarker(store, vaultName, spec, dek) {
+  const next = { base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined };
+  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
+  const prior = persisted?.satellite;
+  if (prior) {
+    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {
+      throw new SatelliteConfigError(
+        `R-S9: satellite "${spec.satellite}" re-declared divergently from its persisted pairing marker (persisted base="${prior.base}" fieldsHash=${prior.fieldsHash}; declared base="${next.base}" fieldsHash=${next.fieldsHash}). Evolve the marker deliberately, don't redeclare.`
+      );
+    }
+    return;
+  }
+  const { persistSatelliteMarker } = await import("./register-VCKOBWKT.js");
+  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
+}
+
+// src/with-shape/satellites/post-register.ts
+async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry) {
+  try {
+    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite));
+  } catch (err) {
+    registry.poison(spec.satellite, err.message);
+    return;
+  }
+  if (baseSchema !== void 0) {
+    try {
+      const { derivePersistedSchema } = await import("./derive-BGUHU663.js");
+      const envelope = await derivePersistedSchema(baseSchema);
+      const properties = envelope.jsonSchema?.["properties"];
+      const baseFields = Object.keys(properties ?? {});
+      const overlap = spec.fields.filter((f) => baseFields.includes(f));
+      if (overlap.length > 0) {
+        registry.poison(
+          spec.satellite,
+          `R-S1: satellite "${spec.satellite}" fields overlap the base schema: ${overlap.join(", ")} \u2014 routing must be unambiguous.`
+        );
+      }
+    } catch {
+    }
+  }
+}
+export {
+  postRegister
+};
+//# sourceMappingURL=post-register-HAWO3O7O.js.map

package/dist/post-register-HAWO3O7O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/marker.ts","../src/with-shape/satellites/post-register.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { SatelliteConfigError } from '../../kernel/errors.js'\nimport { hashFields } from './validate.js'\nimport type { PairingMarker, SatelliteSpec } from './types.js'\n\n/**\n * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.\n * First declaration writes { base, fieldsHash, joined }; later declarations\n * must match exactly or are refused (R-S9). Lazy imports keep the satellite\n * spine tree-shakeable (config-drift.ts pattern).\n */\nexport async function ensureSatelliteMarker(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec, dek: EnclaveKey,\n): Promise<void> {\n  const next: PairingMarker = { base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined }\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek)\n  const prior = persisted?.satellite\n  if (prior) {\n    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {\n      throw new SatelliteConfigError(\n        `R-S9: satellite \"${spec.satellite}\" re-declared divergently from its persisted pairing marker ` +\n        `(persisted base=\"${prior.base}\" fieldsHash=${prior.fieldsHash}; declared base=\"${next.base}\" fieldsHash=${next.fieldsHash}). ` +\n        `Evolve the marker deliberately, don't redeclare.`,\n      )\n    }\n    return\n  }\n  const { persistSatelliteMarker } = await import('../persisted-schemas/register.js')\n  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next })\n}\n","import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { SatelliteSpec } from './types.js'\nimport type { SatelliteRegistry } from './registry.js'\nimport { ensureSatelliteMarker } from './marker.js'\n\n/** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */\nexport async function postRegister(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec,\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n  baseSchema: unknown, registry: SatelliteRegistry,\n): Promise<void> {\n  try {\n    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite))\n  } catch (err) {\n    registry.poison(spec.satellite, (err as Error).message); return\n  }\n  if (baseSchema !== undefined) {\n    try {\n      const { derivePersistedSchema } = await import('../persisted-schemas/derive.js')\n      const envelope = await derivePersistedSchema(baseSchema)\n      const properties = (envelope.jsonSchema as Record<string, unknown> | null)?.['properties'] as Record<string, unknown> | undefined\n      const baseFields: string[] = Object.keys(properties ?? {})\n      const overlap = spec.fields.filter(f => baseFields.includes(f))\n      if (overlap.length > 0) {\n        registry.poison(spec.satellite,\n          `R-S1: satellite \"${spec.satellite}\" fields overlap the base schema: ${overlap.join(', ')} — routing must be unambiguous.`)\n      }\n    } catch { /* non-derivable validator → cross-check unavailable, by design (spec R-S5) */ }\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,eAAsB,sBACpB,OAAmB,WAAmB,MAAqB,KAC5C;AACf,QAAM,OAAsB,EAAE,MAAM,KAAK,MAAM,YAAY,WAAW,KAAK,MAAM,GAAG,QAAQ,KAAK,OAAO;AACxG,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,KAAK,WAAW,GAAG;AACjF,QAAM,QAAQ,WAAW;AACzB,MAAI,OAAO;AACT,QAAI,MAAM,SAAS,KAAK,QAAQ,MAAM,eAAe,KAAK,eAAe,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACxH,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,SAAS,gFACd,MAAM,IAAI,gBAAgB,MAAM,UAAU,oBAAoB,KAAK,IAAI,gBAAgB,KAAK,UAAU;AAAA,MAE5H;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,wBAAkC;AAClF,QAAM,uBAAuB,EAAE,OAAO,OAAO,WAAW,gBAAgB,KAAK,WAAW,KAAK,QAAQ,KAAK,CAAC;AAC7G;;;ACxBA,eAAsB,aACpB,OAAmB,WAAmB,MACtC,QACA,YAAqB,UACN;AACf,MAAI;AACF,UAAM,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,aAAS,OAAO,KAAK,WAAY,IAAc,OAAO;AAAG;AAAA,EAC3D;AACA,MAAI,eAAe,QAAW;AAC5B,QAAI;AACF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,sBAAgC;AAC/E,YAAM,WAAW,MAAM,sBAAsB,UAAU;AACvD,YAAM,aAAc,SAAS,aAAgD,YAAY;AACzF,YAAM,aAAuB,OAAO,KAAK,cAAc,CAAC,CAAC;AACzD,YAAM,UAAU,KAAK,OAAO,OAAO,OAAK,WAAW,SAAS,CAAC,CAAC;AAC9D,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS;AAAA,UAAO,KAAK;AAAA,UACnB,oBAAoB,KAAK,SAAS,qCAAqC,QAAQ,KAAK,IAAI,CAAC;AAAA,QAAiC;AAAA,MAC9H;AAAA,IACF,QAAQ;AAAA,IAAiF;AAAA,EAC3F;AACF;","names":[]}

package/dist/public-envelope-NJVB7LPA.js

@@ -0,0 +1,32 @@
+import {
+  DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
+  PUBLIC_ENVELOPE_FIELDS,
+  resolveSchema
+} from "./chunk-WXSYDNBT.js";
+import {
+  PUBLIC_ENVELOPE_RECORD_ID,
+  isPublicEnvelope,
+  loadPublicEnvelope,
+  pickLocale,
+  readPublicEnvelope,
+  resolveLocale,
+  savePublicEnvelope,
+  validatePublicEnvelopeInput
+} from "./chunk-5XIPOCQC.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
+  PUBLIC_ENVELOPE_FIELDS,
+  PUBLIC_ENVELOPE_RECORD_ID,
+  isPublicEnvelope,
+  loadPublicEnvelope,
+  pickLocale,
+  readPublicEnvelope,
+  resolveLocale,
+  resolveSchema,
+  savePublicEnvelope,
+  validatePublicEnvelopeInput
+};
+//# sourceMappingURL=public-envelope-NJVB7LPA.js.map

package/dist/purge-scope-FGNNLWHD.js

@@ -0,0 +1,24 @@
+import "./chunk-PZ5AY32C.js";
+
+// src/with-audit/forget/purge-scope.ts
+function partitionSealedCekKeys(keys, prefix, scopedPurge, declared) {
+  const matches = keys.filter((key) => key.startsWith(prefix));
+  if (!scopedPurge || declared) return { toPurge: matches, skippedCount: 0 };
+  return { toPurge: [], skippedCount: matches.length };
+}
+function shouldSkipBlobScan(scopedPurge, declared) {
+  return scopedPurge && !declared;
+}
+function bumpResidueCount(map, collection, count) {
+  if (count > 0) map.set(collection, (map.get(collection) ?? 0) + count);
+}
+function residueNoticesFromMap(map, reason) {
+  return [...map].map(([collection, count]) => ({ reason, collection, count }));
+}
+export {
+  bumpResidueCount,
+  partitionSealedCekKeys,
+  residueNoticesFromMap,
+  shouldSkipBlobScan
+};
+//# sourceMappingURL=purge-scope-FGNNLWHD.js.map

package/dist/purge-scope-FGNNLWHD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/forget/purge-scope.ts"],"sourcesContent":["/**\n * #633 — scoped-purge partitioning for the opt-in `scopedPurge` forget-strategy\n * knob (`strategy.ts`'s `SubjectDeclaration.scopedPurge`). Pure helpers only —\n * no store I/O, no `Vault`/`Collection` imports — kept out of `kernel/vault.ts`\n * (exact zero-slack `kernel-surface` ceiling) and free of any circular-import\n * risk with the kernel spine.\n *\n * The two `forget()` purge sites (`_sealed_cek` listing, blob shred) stay\n * UNCONDITIONAL by default (byte-identical to pre-#633 behavior); when\n * `scopedPurge` is `true`, each site calls into this module to decide what to\n * purge vs. what to leave in place + report as residue, keyed off a\n * per-collection declaration signal the caller (vault.ts) resolves itself:\n *   - sealed-CEK arm: `coll._via?.hasAtRestHooks === true` — the classified\n *     via binding's at-rest hooks (the \"richer\" declaration; a bare\n *     `sensitive` collection with NO classified binder does not count — it can\n *     still call `sealRecordToHost()` ad hoc, which is exactly the\n *     under-approximation #633 calls out).\n *   - blob arm: `this.blobFieldsRegistry.has(ref.collection)` — a collection\n *     can call `.blob(id)` regardless of this declaration (same\n *     under-approximation), which is why the default stays unconditional.\n *\n * @module\n */\nimport type { ScopedPurgeResidueReason } from './strategy.js'\n\n/**\n * Partitions an already-fetched vault-wide `_sealed_cek` key listing into\n * keys to purge vs. a skipped count, for ONE ref's `<collection>/<id>/`\n * prefix. No new store call — `keys` is the SAME listing the unconditional\n * path already fetched. Default parity: when `scopedPurge` is false, or\n * `declared` is true, every matching key is returned for purge and\n * `skippedCount` is 0 — byte-identical to the unconditional behavior.\n */\nexport function partitionSealedCekKeys(\n  keys: readonly string[],\n  prefix: string,\n  scopedPurge: boolean,\n  declared: boolean,\n): { readonly toPurge: readonly string[]; readonly skippedCount: number } {\n  const matches = keys.filter((key) => key.startsWith(prefix))\n  if (!scopedPurge || declared) return { toPurge: matches, skippedCount: 0 }\n  return { toPurge: [], skippedCount: matches.length }\n}\n\n/**\n * True when the blob arm should skip `ref.collection` entirely — no\n * `.blob(id).shredAllForRecord()` call AND no `_blob_slots_<collection>`\n * residue-detection `list()` call either (the perf win: scoped mode never\n * pays for a per-collection scan on a collection that never declared\n * `blobFields`).\n */\nexport function shouldSkipBlobScan(scopedPurge: boolean, declared: boolean): boolean {\n  return scopedPurge && !declared\n}\n\n/** Adds `count` (if positive) to `collection`'s running total in `map` — the\n *  per-collection residue accumulator both purge sites share. */\nexport function bumpResidueCount(map: Map<string, number>, collection: string, count: number): void {\n  if (count > 0) map.set(collection, (map.get(collection) ?? 0) + count)\n}\n\n/** Flattens an accumulated per-collection count map into `ForgetResult.scopedPurgeResidue` notices\n *  tagged with `reason`. Empty map → empty array (the unconditional-default case). */\nexport function residueNoticesFromMap(\n  map: ReadonlyMap<string, number>,\n  reason: ScopedPurgeResidueReason,\n): { readonly reason: ScopedPurgeResidueReason; readonly collection: string; readonly count: number }[] {\n  return [...map].map(([collection, count]) => ({ reason, collection, count }))\n}\n"],"mappings":";;;AAiCO,SAAS,uBACd,MACA,QACA,aACA,UACwE;AACxE,QAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,CAAC;AAC3D,MAAI,CAAC,eAAe,SAAU,QAAO,EAAE,SAAS,SAAS,cAAc,EAAE;AACzE,SAAO,EAAE,SAAS,CAAC,GAAG,cAAc,QAAQ,OAAO;AACrD;AASO,SAAS,mBAAmB,aAAsB,UAA4B;AACnF,SAAO,eAAe,CAAC;AACzB;AAIO,SAAS,iBAAiB,KAA0B,YAAoB,OAAqB;AAClG,MAAI,QAAQ,EAAG,KAAI,IAAI,aAAa,IAAI,IAAI,UAAU,KAAK,KAAK,KAAK;AACvE;AAIO,SAAS,sBACd,KACA,QACsG;AACtG,SAAO,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,QAAQ,YAAY,MAAM,EAAE;AAC9E;","names":[]}

package/dist/query/index.js

@@ -7,10 +7,10 @@ import {
   buildLiveQuery,
   executePlan,
   resetJoinWarnings
-} from "../chunk-UIU2THRG.js";
+} from "../chunk-H6CZSDWK.js";
 import {
   CollectionIndexes
-} from "../chunk-I3TIKTJO.js";
+} from "../chunk-KPZS5QAQ.js";
 import {
   Aggregation,
   GROUPBY_MAX_CARDINALITY,
@@ -31,22 +31,24 @@ import {
   reducerBuilder,
   resetGroupByWarnings,
   sum
-} from "../chunk-LV7M27WM.js";
+} from "../chunk-IGJHJYM6.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
-} from "../chunk-M2YKN37S.js";
-import "../chunk-5LUY7UTV.js";
+} from "../chunk-IGJCYUT5.js";
+import "../chunk-BE7N3AXA.js";
+import "../chunk-ARSAMO24.js";
 import {
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
   DanglingReferenceError,
+  FieldNotQueryableError,
   GroupCardinalityError,
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   Aggregation,
@@ -56,6 +58,7 @@ export {
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_JOIN_MAX_ROWS,
   DanglingReferenceError,
+  FieldNotQueryableError,
   GROUPBY_MAX_CARDINALITY,
   GROUPBY_WARN_CARDINALITY,
   GroupCardinalityError,

package/dist/read-only-facade-CHCKSEPD.js

@@ -0,0 +1,8 @@
+import {
+  ReadOnlyVaultFacade
+} from "./chunk-JK733I5V.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ReadOnlyVaultFacade
+};
+//# sourceMappingURL=read-only-facade-CHCKSEPD.js.map

package/dist/register-VCKOBWKT.js

@@ -0,0 +1,23 @@
+import {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+} from "./chunk-WGV4CUZT.js";
+import "./chunk-QLLKLFE2.js";
+import "./chunk-C7NTK5I3.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+};
+//# sourceMappingURL=register-VCKOBWKT.js.map

package/dist/registry-72UKJ2L4.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-OFJ5GPNA.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-72UKJ2L4.js.map

package/dist/registry-BZFLJNEH.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-BEIRE5K4.js";
+import "./chunk-7QIXUSDQ.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-BZFLJNEH.js.map

package/dist/registry-YJEYSYI5.js

@@ -0,0 +1,19 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-3G4KMVUN.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-YJEYSYI5.js.map

package/dist/request-withdrawal-6MJRMFHF.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-SRVQHVNX.js";
+import "./chunk-7NS43EXZ.js";
+import "./chunk-BCYQA5BK.js";
+import "./chunk-K62IUKOD.js";
+import "./chunk-5XIPOCQC.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-6MJRMFHF.js.map

package/dist/reveal-BOY7XYFH.js

@@ -0,0 +1,38 @@
+import {
+  isTombstone
+} from "./chunk-FQQF23MC.js";
+import {
+  dualReadSealedSlot
+} from "./chunk-SYMS4546.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import {
+  ClassifiedRevealError
+} from "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/kernel/enclave/classify/reveal.ts
+async function revealSealedField(ctx, id, field) {
+  const env = await ctx.getEnvelope(id);
+  if (env === null || isTombstone(env, ctx.encrypted)) {
+    throw new ClassifiedRevealError(ctx.collection, field, `record "${id}" not found in "${ctx.collection}"`);
+  }
+  if (!ctx.encrypted) {
+    const record = JSON.parse(env._data || "{}");
+    if (!(field in record)) {
+      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for "${field}"`);
+    }
+    return record[field];
+  }
+  const blob = env._sealed?.[field];
+  if (blob === void 0) {
+    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for "${field}"`);
+  }
+  const cek = await ctx.resolveCek(env);
+  const dek = await ctx.getDEK();
+  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek));
+}
+export {
+  revealSealedField
+};
+//# sourceMappingURL=reveal-BOY7XYFH.js.map

package/dist/reveal-BOY7XYFH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted)) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,GAAG;AACnD,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/revoke-4KUNSVJC.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-XFXUTFWQ.js";
+import "./chunk-D3EFFFOL.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-4KUNSVJC.js.map

package/dist/satellites/index.js

@@ -0,0 +1,8 @@
+import {
+  SatelliteConfigError
+} from "../chunk-FH542DDY.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  SatelliteConfigError
+};
+//# sourceMappingURL=index.js.map

package/dist/sealed-record/index.js

@@ -1,32 +1,38 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-UV5MFVO3.js";
+} from "../chunk-CIKY6I4W.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek
-} from "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-UL5LW66V.js");
+      const { sealRecordToHost } = await import("../enclave-VXAQD4XJ.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-UL5LW66V.js");
+      const { revokeSealedRecord } = await import("../enclave-VXAQD4XJ.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-UL5LW66V.js");
+      const { rotateRecordCek } = await import("../enclave-VXAQD4XJ.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/sealed-record/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: { readonly _iv: string; readonly _data: string },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;ACoCA,eAAsB,iBACpB,mBACA,gBACA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AACvD,SAAO,QAAQ,eAAe,KAAK,eAAe,OAAO,GAAG;AAC9D;","names":[]}
+{"version":3,"sources":["../../src/with-audit/sealed-record/active.ts","../../src/with-audit/sealed-record/index.ts"],"sourcesContent":["/**\n * Enable the sealed-record (grantor-side) capability.\n * Pass to `createNoydb({ sealedRecordStrategy: withSealedRecord() })` to make a\n * vault's `sealRecordToHost` / `revokeSealedRecord` / `rotateRecordCek` methods\n * live. The `record-keys` grantor engine is dynamically imported here, so it is\n * reached only via opt-in.\n */\nimport type { SealedRecordStrategy } from './strategy.js'\n\nexport function withSealedRecord(): SealedRecordStrategy {\n  return {\n    async sealRecordToHost(ctx, collection, id, hostSealer, opts) {\n      const { sealRecordToHost } = await import('../../kernel/enclave/index.js')\n      return sealRecordToHost(ctx, collection, id, hostSealer, opts)\n    },\n    async revokeSealedRecord(ctx, collection, id, pid, opts) {\n      const { revokeSealedRecord } = await import('../../kernel/enclave/index.js')\n      return revokeSealedRecord(ctx, collection, id, pid, opts)\n    },\n    async rotateRecordCek(ctx, collection, id) {\n      const { rotateRecordCek } = await import('../../kernel/enclave/index.js')\n      return rotateRecordCek(ctx, collection, id)\n    },\n  }\n}\n","/**\n * `@noy-db/hub/sealed-record` — host-side opener for record-scoped CEK\n * sealing.\n *\n * The **grantor** side (sealing a record's CEK to a host, revoking, and hard\n * rotation) lives on `Vault` (`vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`) because it needs the\n * collection DEK. This subpath exposes the **recipient host** side:\n * {@link openSealedRecord} reconstructs a single record's plaintext from\n * (a) the sealed-CEK delivery envelope, (b) the record's encrypted envelope\n * body, and (c) the host's own unsealer — and **nothing else**. The host never\n * touches a vault DEK and can decrypt exactly the one bound record.\n *\n * @module\n */\n\nimport { decrypt, base64ToBuffer, importCek } from '../../kernel/enclave/index.js'\nimport {\n  SealedRecordExpiredError,\n  SealedRecordMismatchError,\n} from '../../kernel/errors.js'\nimport type {\n  SealedCekDeliveryEnvelope,\n  SealedCekBinding,\n} from './types.js'\n\nexport type { SealedCekDeliveryEnvelope, SealedCekBinding } from './types.js'\nexport { SealedRecordExpiredError, SealedRecordMismatchError } from '../../kernel/errors.js'\nexport { withSealedRecord } from './active.js'\nexport { NO_SEALED_RECORD, type SealedRecordStrategy } from './strategy.js'\nexport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Host-side: decrypt a single record whose CEK was sealed to this host by a\n * vault grantor via `vault.sealRecordToHost()`.\n *\n * Verification order (security-critical — do NOT reorder past the unseal):\n *  1. **Fast-path expiry** — reject on the delivery envelope's clear-text\n *     `expiresAt` before doing any (potentially expensive) unseal work. This is\n *     a hint only.\n *  2. **Unseal** the `payload` with the host's `recipientSealer.unseal` →\n *     parse the {@link SealedCekBinding}.\n *  3. **Binding match** — the binding's `{collection, id}` MUST equal the\n *     expected pair, else {@link SealedRecordMismatchError}. This is the\n *     host-denial boundary (a CEK sealed for record A cannot open record B).\n *  4. **Authoritative expiry** — re-check `binding.expiresAt` (the copy that\n *     cannot be forged by editing the delivery envelope), else\n *     {@link SealedRecordExpiredError}.\n *  5. **Decrypt** the record body under the unsealed CEK. A CEK from a\n *     PRE-rotation seal applied to a POST-rotation live envelope passes (1)-(4)\n *     but fails the AES-GCM auth tag → `TamperedError` from `decrypt`.\n *\n * @param sealedCekEnvelope The `SealedCekDeliveryEnvelope` written by the grantor.\n * @param recordEnvelope    The record's `{ _iv, _data }` (the encrypted body).\n * @param recipientSealer   The host's unsealer (`{ unseal(bytes) }`) — e.g. a\n *                          KMS-backed sealer or `MemoryRecipientSealer`.\n * @param expectedCollection Collection the caller believes `recordEnvelope` is in.\n * @param expectedId         Record id the caller believes `recordEnvelope` is.\n * @returns The decrypted record body as a JSON string.\n */\nexport async function openSealedRecord(\n  sealedCekEnvelope: SealedCekDeliveryEnvelope,\n  recordEnvelope: { readonly _iv: string; readonly _data: string },\n  recipientSealer: { unseal(bytes: Uint8Array): Promise<Uint8Array> },\n  expectedCollection: string,\n  expectedId: string,\n): Promise<string> {\n  // (1) Fast-path expiry on the (unauthenticated) delivery envelope. Fail\n  // CLOSED (M-4): a malformed/empty `expiresAt` parses to NaN — treat it as\n  // expired rather than letting `NaN <= now` (which is `false`) skip the check.\n  const fastT = Date.parse(sealedCekEnvelope.expiresAt)\n  if (!Number.isFinite(fastT) || fastT <= Date.now()) {\n    throw new SealedRecordExpiredError(sealedCekEnvelope.expiresAt)\n  }\n\n  // (2) Unseal → parse binding.\n  const payloadBytes = base64ToBuffer(sealedCekEnvelope.payload)\n  const openedBytes = await recipientSealer.unseal(payloadBytes)\n  const binding = JSON.parse(new TextDecoder().decode(openedBytes)) as SealedCekBinding\n\n  // (3) Binding match — host-denial boundary.\n  if (binding.collection !== expectedCollection || binding.id !== expectedId) {\n    throw new SealedRecordMismatchError(\n      { collection: expectedCollection, id: expectedId },\n      { collection: binding.collection, id: binding.id },\n    )\n  }\n\n  // (4) Authoritative expiry — the copy that cannot be forged on the envelope.\n  // Fail CLOSED (M-4): a malformed/empty `expiresAt` → NaN → treat as expired.\n  const t = Date.parse(binding.expiresAt)\n  if (!Number.isFinite(t) || t <= Date.now()) {\n    throw new SealedRecordExpiredError(binding.expiresAt)\n  }\n\n  // (5) Import the raw CEK + decrypt the body. Wrong-key (pre-rotation CEK vs\n  // post-rotation body) surfaces as TamperedError from decrypt's GCM tag check.\n  const cek = await importCek(base64ToBuffer(binding.cek))\n  return decrypt(recordEnvelope._iv, recordEnvelope._data, cek)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,mBAAyC;AACvD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,YAAY,IAAI,YAAY,MAAM;AAC5D,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA+B;AACzE,aAAO,iBAAiB,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IAC/D;AAAA,IACA,MAAM,mBAAmB,KAAK,YAAY,IAAI,KAAK,MAAM;AACvD,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAA+B;AAC3E,aAAO,mBAAmB,KAAK,YAAY,IAAI,KAAK,IAAI;AAAA,IAC1D;AAAA,IACA,MAAM,gBAAgB,KAAK,YAAY,IAAI;AACzC,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,wBAA+B;AACxE,aAAO,gBAAgB,KAAK,YAAY,EAAE;AAAA,IAC5C;AAAA,EACF;AACF;;;ACoCA,eAAsB,iBACpB,mBACA,gBACA,iBACA,oBACA,YACiB;AAIjB,QAAM,QAAQ,KAAK,MAAM,kBAAkB,SAAS;AACpD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,yBAAyB,kBAAkB,SAAS;AAAA,EAChE;AAGA,QAAM,eAAe,eAAe,kBAAkB,OAAO;AAC7D,QAAM,cAAc,MAAM,gBAAgB,OAAO,YAAY;AAC7D,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AAGhE,MAAI,QAAQ,eAAe,sBAAsB,QAAQ,OAAO,YAAY;AAC1E,UAAM,IAAI;AAAA,MACR,EAAE,YAAY,oBAAoB,IAAI,WAAW;AAAA,MACjD,EAAE,YAAY,QAAQ,YAAY,IAAI,QAAQ,GAAG;AAAA,IACnD;AAAA,EACF;AAIA,QAAM,IAAI,KAAK,MAAM,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,yBAAyB,QAAQ,SAAS;AAAA,EACtD;AAIA,QAAM,MAAM,MAAM,UAAU,eAAe,QAAQ,GAAG,CAAC;AACvD,SAAO,QAAQ,eAAe,KAAK,eAAe,OAAO,GAAG;AAC9D;","names":[]}