@noy-db/hub 0.3.0-pre.4 → 0.3.0-pre.6

package/dist/team/index.d.ts

@@ -1,5 +1,5 @@
-import { je as TeamStrategy, cT as NoydbStore, cF as UnlockedKeyring } from '../index-D4GQe1Rx.js';
-export { e1 as BundleRecipient, fz as EnrollAuthenticatorOptions, fA as EnrollAuthenticatorWrappingDEKsOptions, fB as EnrollAuthenticatorWrappingKEKOptions, gy as ListUsersOptions, h3 as NO_TEAM, hl as PaperRecoveryEntry, hx as PresenceHandle, h$ as RecoverPassphraseInput, i0 as RecoverPassphraseResult, i1 as RecoverUserOptions, i4 as RecoveryProof, ih as RotatePassphraseInput, iP as SlotRewrapCeremony, iQ as SlotRewrapContext, iZ as SyncEngine, j5 as SyncTransaction, jd as TeamNotEnabledError, jr as UpdateAuthenticatorOptions, jI as WrappedDeksBlob, jT as buildRecipientKeyringFile, jU as burnPaperRecoveryEntry, l7 as changeSecret, l8 as createOwnerKeyring, j_ as deriveMagicLinkContentKey, k2 as enrollAuthenticator, l9 as ensureCollectionDEK, k6 as evaluateExportCapability, k8 as evaluateImportCapability, kb as findAuthenticator, la as grant, kc as hasExportCapability, kd as hasImportCapability, kg as isMagicLinkGrantExpired, kp as listMagicLinkGrants, kq as listUsers, kr as listUsersWithEnvelopes, lb as loadKeyring, ku as loadPaperRecoveryEntries, kx as magicLinkGrantRecordId, ky as mintPaperRecoveryEntry, kA as mintWrappedDeksBlob, lc as persistKeyring, kF as readMagicLinkGrantRecord, km as recoverPassphrase, kH as recoverUser, kL as removeAuthenticator, ld as revoke, kR as revokeMagicLinkGrant, kn as rotatePassphrase, kT as savePaperRecoveryEntries, kX as unwrapDeksFromBlob, kY as unwrapDeksFromPaperEntry, k_ as unwrapMagicLinkGrant, le as updateAuthenticator, lf as updateKeyringIdentity, l6 as writeMagicLinkGrant } from '../index-D4GQe1Rx.js';
+import { je as TeamStrategy, cT as NoydbStore, cF as UnlockedKeyring } from '../index-B-LKCpm6.js';
+export { e1 as BundleRecipient, fz as EnrollAuthenticatorOptions, fA as EnrollAuthenticatorWrappingDEKsOptions, fB as EnrollAuthenticatorWrappingKEKOptions, gy as ListUsersOptions, h3 as NO_TEAM, hl as PaperRecoveryEntry, hx as PresenceHandle, h$ as RecoverPassphraseInput, i0 as RecoverPassphraseResult, i1 as RecoverUserOptions, i4 as RecoveryProof, ih as RotatePassphraseInput, iP as SlotRewrapCeremony, iQ as SlotRewrapContext, iZ as SyncEngine, j5 as SyncTransaction, jd as TeamNotEnabledError, jr as UpdateAuthenticatorOptions, jI as WrappedDeksBlob, jT as buildRecipientKeyringFile, jU as burnPaperRecoveryEntry, l7 as changeSecret, l8 as createOwnerKeyring, j_ as deriveMagicLinkContentKey, k2 as enrollAuthenticator, l9 as ensureCollectionDEK, k6 as evaluateExportCapability, k8 as evaluateImportCapability, kb as findAuthenticator, la as grant, kc as hasExportCapability, kd as hasImportCapability, kg as isMagicLinkGrantExpired, kp as listMagicLinkGrants, kq as listUsers, kr as listUsersWithEnvelopes, lb as loadKeyring, ku as loadPaperRecoveryEntries, kx as magicLinkGrantRecordId, ky as mintPaperRecoveryEntry, kA as mintWrappedDeksBlob, lc as persistKeyring, kF as readMagicLinkGrantRecord, km as recoverPassphrase, kH as recoverUser, kL as removeAuthenticator, ld as revoke, kR as revokeMagicLinkGrant, kn as rotatePassphrase, kT as savePaperRecoveryEntries, kX as unwrapDeksFromBlob, kY as unwrapDeksFromPaperEntry, k_ as unwrapMagicLinkGrant, le as updateAuthenticator, lf as updateKeyringIdentity, l6 as writeMagicLinkGrant } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
@@ -19,6 +19,33 @@ import '@noy-db/attestation';
 
 declare function withTeam(): TeamStrategy;
 
+/**
+ * Secret-bearing reserved collections — the `_`-prefixed reserved collections
+ * whose record CONTENTS are directly-usable secrets (transport OAuth tokens,
+ * connection strings, API keys), as opposed to the *operational* reserved
+ * collections (`_ledger`, `_history`, `_sync`, …) whose contents are metadata
+ * (collection names, record ids, ciphertext hashes).
+ *
+ * This distinction matters at two trust-boundary seams:
+ *
+ *  1. `vault.collection()` — a secret-bearing reserved name must never be
+ *     reachable through the generic public collection handle. It is served
+ *     ONLY by its dedicated, role-gated API (e.g. `_sync_credentials` →
+ *     `getCredential`/`putCredential`, which enforce owner/admin access).
+ *
+ *  2. `grant()` DEK propagation — a sub-admin grantee (operator, viewer,
+ *     client, custodian) must NOT receive a secret-bearing collection's DEK.
+ *     Operational reserved DEKs still propagate to every role (grantees must
+ *     write ledger/history entries on every mutation), but handing a
+ *     sub-admin the `_sync_credentials` DEK would let them decrypt the firm's
+ *     transport secrets — a plaintext leak, not a metadata leak.
+ *
+ * Kept dependency-free so both the kernel (`vault.ts`) and the team layer
+ * (`keyring.ts`) can import it without an import cycle.
+ */
+/** Reserved collection holding per-adapter sync transport secrets. */
+declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
+
 /**
  * _sync_credentials reserved collection —
  *
@@ -58,8 +85,6 @@ declare function withTeam(): TeamStrategy;
  * against the caller's keyring role at call time.
  */
 
-/** The reserved collection name. Never collides with user collections. */
-declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 /**
  * An OAuth/auth token stored in `_sync_credentials`.
  *

package/dist/team/index.js

@@ -1,12 +1,11 @@
 import {
-  SYNC_CREDENTIALS_COLLECTION,
   credentialStatus,
   deleteCredential,
   getCredential,
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-TVRQ3RYH.js";
+} from "../chunk-ZHK3F5RB.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -24,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-K5P46KB3.js";
+} from "../chunk-UZZFV3O3.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -33,15 +32,16 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-LPRPVCNY.js";
+} from "../chunk-3UUXDQPM.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-OFBFAVLI.js";
+} from "../chunk-YXGIPYH4.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-BMQOH7MM.js";
+import "../chunk-26FSVNBL.js";
 import {
+  SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
   changeSecret,
   createOwnerKeyring,
@@ -57,19 +57,19 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-VAWY44JW.js";
-import "../chunk-TB5RNNJ4.js";
-import "../chunk-OVO2RZAE.js";
+} from "../chunk-WAL4MRBK.js";
+import "../chunk-C6A2DPRE.js";
+import "../chunk-7AGLCOYE.js";
 import "../chunk-QKVILR7N.js";
+import "../chunk-5UOPIPZC.js";
+import "../chunk-UWZ7O4NR.js";
 import "../chunk-LN22XH4B.js";
-import "../chunk-PGFY7IRW.js";
-import "../chunk-TCIUO62Z.js";
-import "../chunk-UOEWDCUX.js";
+import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-TLJOJBZD.js";
+import "../chunk-5HZULLHE.js";
 import {
   TeamNotEnabledError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.d.ts

@@ -1,4 +1,4 @@
-export { lm as NO_TIERS, ln as TiersContext, ji as TiersNotEnabledError, lo as TiersStrategy, lp as assertDeclaredTier, lq as assertTiersEnabled, lr as classifySealedShred, ls as demote, lt as elevate, lu as getAtTier, lv as listAtTier, lw as putAtTier, lx as withTiers } from '../index-D4GQe1Rx.js';
+export { lm as NO_TIERS, ln as TiersContext, ji as TiersNotEnabledError, lo as TiersStrategy, lp as assertDeclaredTier, lq as assertTiersEnabled, lr as classifySealedShred, ls as demote, lt as elevate, lu as getAtTier, lv as listAtTier, lw as putAtTier, lx as withTiers } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/tiers/index.js

@@ -9,19 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-VMJ5URU7.js";
-import "../chunk-BMQOH7MM.js";
-import "../chunk-OVO2RZAE.js";
+} from "../chunk-7A7LTSJR.js";
+import "../chunk-26FSVNBL.js";
+import "../chunk-7AGLCOYE.js";
 import "../chunk-QKVILR7N.js";
+import "../chunk-5UOPIPZC.js";
+import "../chunk-UWZ7O4NR.js";
 import "../chunk-LN22XH4B.js";
-import "../chunk-PGFY7IRW.js";
-import "../chunk-TCIUO62Z.js";
-import "../chunk-UOEWDCUX.js";
+import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-TLJOJBZD.js";
+import "../chunk-5HZULLHE.js";
 import {
   TiersNotEnabledError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.d.ts

@@ -1,4 +1,4 @@
-export { dq as BundleVersionConflictError, f0 as ConflictError, cV as EncryptedEnvelope, gx as ListPageResult, h4 as NetworkError, ha as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iW as StoreCapabilities, iX as StoreCapabilityError, iY as StoreTime, jm as TxOp, jB as VaultSnapshot } from '../index-D4GQe1Rx.js';
+export { dq as BundleVersionConflictError, f0 as ConflictError, cV as EncryptedEnvelope, gx as ListPageResult, h4 as NetworkError, ha as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iW as StoreCapabilities, iX as StoreCapabilityError, iY as StoreTime, jm as TxOp, jB as VaultSnapshot } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/to/index.js

@@ -5,7 +5,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/{transition-guard-C4hvR-Ac.d.ts → transition-guard-CzqWwVGP.d.ts}

@@ -1,4 +1,4 @@
-import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-D4GQe1Rx.js';
+import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-B-LKCpm6.js';
 
 /**
  * Register a guard for a collection. Guards run on every `put()` /

package/dist/tx/index.d.ts

@@ -1,5 +1,5 @@
-import { jj as TransactionInvariant, lh as TxStrategy } from '../index-D4GQe1Rx.js';
-export { li as AmendmentTxOptions, jl as TxCollection, e4 as TxContext, jn as TxVault, kS as runTransaction } from '../index-D4GQe1Rx.js';
+import { jj as TransactionInvariant, lh as TxStrategy } from '../index-B-LKCpm6.js';
+export { li as AmendmentTxOptions, jl as TxCollection, e4 as TxContext, jn as TxVault, kS as runTransaction } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-T65UZXR6.js";
+} from "../chunk-FCOZ7DEC.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-U23JUUPX.js";
+import "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-DJHNSTIR.js");
+      const { GuardExecutor } = await import("../executor-KZ4B3PRT.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-U23JUUPX.js";
+} from "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{validators-Ctgkj5qd.d.ts → validators-Bdiv0ucK.d.ts}

@@ -1,4 +1,4 @@
-import { dO as ClassifiedEntry, dL as ClassifiedFieldSpec, dP as ClassifiedGroup } from './index-D4GQe1Rx.js';
+import { dO as ClassifiedEntry, dL as ClassifiedFieldSpec, dP as ClassifiedGroup } from './index-B-LKCpm6.js';
 
 /**
  * Configuration/write errors for classified fields. @module

package/dist/{vault-diff-B1Ir6EGs.d.ts → vault-diff-BbZngJUP.d.ts}

@@ -1,4 +1,4 @@
-import { V as Vault, cE as DiffEntry } from './index-D4GQe1Rx.js';
+import { V as Vault, cE as DiffEntry } from './index-B-LKCpm6.js';
 
 /**
  * Vault-level diff orchestrator.

package/dist/{verify-YB5LQHNA.js → verify-CAYGXYNO.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-PGFY7IRW.js";
+} from "./chunk-5UOPIPZC.js";
 import {
   dualReadSealedSlot
-} from "./chunk-TCIUO62Z.js";
+} from "./chunk-UWZ7O4NR.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-TLJOJBZD.js";
+} from "./chunk-5HZULLHE.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-U23JUUPX.js";
+} from "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -136,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-YB5LQHNA.js.map
+//# sourceMappingURL=verify-CAYGXYNO.js.map

package/dist/{walk-5C3GPKT2.js → walk-CVNXFUEF.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-TQ3REHVF.js";
 import {
   derivePersistedSchema
-} from "./chunk-ULIHDPKL.js";
+} from "./chunk-55LSDABW.js";
 import {
   loadPersistedSchema
-} from "./chunk-CPXPHQGX.js";
-import "./chunk-OVO2RZAE.js";
+} from "./chunk-BYS45GOJ.js";
+import "./chunk-7AGLCOYE.js";
 import "./chunk-QKVILR7N.js";
+import "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
 import "./chunk-LN22XH4B.js";
-import "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
-import "./chunk-UOEWDCUX.js";
+import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-TLJOJBZD.js";
-import "./chunk-U23JUUPX.js";
+import "./chunk-5HZULLHE.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-5C3GPKT2.js.map
+//# sourceMappingURL=walk-CVNXFUEF.js.map

package/dist/with/index.d.ts

@@ -1,6 +1,6 @@
 export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { cF as UnlockedKeyring, cG as ExportFormat } from '../index-D4GQe1Rx.js';
-export { cH as BusHandler, cI as GateDeleteEvent, cJ as GateEventMap, cK as GateHandler, cL as GatePoint, cM as GatePutEvent, cN as LifecycleEventMap, cO as LifecyclePoint, cP as ServiceBus, cQ as SubsystemBus } from '../index-D4GQe1Rx.js';
+import { cF as UnlockedKeyring, cG as ExportFormat } from '../index-B-LKCpm6.js';
+export { cH as BusHandler, cI as GateDeleteEvent, cJ as GateEventMap, cK as GateHandler, cL as GatePoint, cM as GatePutEvent, cN as LifecycleEventMap, cO as LifecyclePoint, cP as ServiceBus, cQ as SubsystemBus } from '../index-B-LKCpm6.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '@noy-db/attestation';

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-P3V7JTB6.js";
-import "../chunk-VAWY44JW.js";
-import "../chunk-TB5RNNJ4.js";
-import "../chunk-OVO2RZAE.js";
+} from "../chunk-NL4HVTNO.js";
+import "../chunk-WAL4MRBK.js";
+import "../chunk-C6A2DPRE.js";
+import "../chunk-7AGLCOYE.js";
 import "../chunk-QKVILR7N.js";
+import "../chunk-5UOPIPZC.js";
+import "../chunk-UWZ7O4NR.js";
 import "../chunk-LN22XH4B.js";
-import "../chunk-PGFY7IRW.js";
-import "../chunk-TCIUO62Z.js";
-import "../chunk-UOEWDCUX.js";
+import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-TLJOJBZD.js";
-import "../chunk-U23JUUPX.js";
+import "../chunk-5HZULLHE.js";
+import "../chunk-OJ64XMPJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/{with-materialized-view-Bp65kKdQ.d.ts → with-materialized-view-BmKXygt2.d.ts}

@@ -1,4 +1,4 @@
-import { cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle } from './index-D4GQe1Rx.js';
+import { cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle } from './index-B-LKCpm6.js';
 
 /**
  * Register a materialized view: a declared query whose result is

package/dist/{with-overlayed-view-BRhdQNrK.d.ts → with-overlayed-view-Bnwe7E75.d.ts}

@@ -1,4 +1,4 @@
-import { ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle } from './index-D4GQe1Rx.js';
+import { ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle } from './index-B-LKCpm6.js';
 
 /**
  * Register a read-shadow overlay: bind an MV-owned base collection to

package/dist/{with-rollup-bQRPc3y1.d.ts → with-rollup-JXTxc9cu.d.ts}

@@ -1,4 +1,4 @@
-import { c2 as DerivationStrategy, cb as DerivationStrategyHandle } from './index-D4GQe1Rx.js';
+import { c2 as DerivationStrategy, cb as DerivationStrategyHandle } from './index-B-LKCpm6.js';
 
 /**
  * Register a deterministic derivation: one source collection → one or

package/dist/{withdraw-accessible-JMX2TCPX.js → withdraw-accessible-5ALN3ZGM.js}

@@ -4,19 +4,19 @@ import {
   freezeSnapshotOnly,
   randomId,
   withdrawAccessibleData
-} from "./chunk-TYGW5TOR.js";
-import "./chunk-P2LDXRGP.js";
-import "./chunk-EWR7HL3K.js";
-import "./chunk-3QRQOBS7.js";
-import "./chunk-OVO2RZAE.js";
+} from "./chunk-RIZQZKU6.js";
+import "./chunk-C2ZKWL37.js";
+import "./chunk-C57J6AWN.js";
+import "./chunk-I7GTYPWF.js";
+import "./chunk-7AGLCOYE.js";
 import "./chunk-QKVILR7N.js";
+import "./chunk-5UOPIPZC.js";
+import "./chunk-UWZ7O4NR.js";
 import "./chunk-LN22XH4B.js";
-import "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
-import "./chunk-UOEWDCUX.js";
+import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-TLJOJBZD.js";
-import "./chunk-U23JUUPX.js";
+import "./chunk-5HZULLHE.js";
+import "./chunk-OJ64XMPJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   FROZEN_SNAPSHOTS_COLLECTION,
@@ -25,4 +25,4 @@ export {
   randomId,
   withdrawAccessibleData
 };
-//# sourceMappingURL=withdraw-accessible-JMX2TCPX.js.map
+//# sourceMappingURL=withdraw-accessible-5ALN3ZGM.js.map

package/dist/withdraw-accessible-5ALN3ZGM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.3.0-pre.4",
+  "version": "0.3.0-pre.6",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -124,6 +124,10 @@
       "types": "./dist/classified/index.d.ts",
       "default": "./dist/classified/index.js"
     },
+    "./satellites": {
+      "types": "./dist/satellites/index.d.ts",
+      "default": "./dist/satellites/index.js"
+    },
     "./tiers": {
       "types": "./dist/tiers/index.d.ts",
       "default": "./dist/tiers/index.js"
@@ -196,14 +200,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.3.0-pre.4"
+    "@noy-db/attestation": "0.3.0-pre.6"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.3.0-pre.4"
+    "@noy-db/on-shamir": "0.3.0-pre.6"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/api-JOXUNSKP.js

@@ -1,20 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-A5DYVMDR.js";
-import "./chunk-TB5RNNJ4.js";
-import "./chunk-OVO2RZAE.js";
-import "./chunk-QKVILR7N.js";
-import "./chunk-LN22XH4B.js";
-import "./chunk-PGFY7IRW.js";
-import "./chunk-TCIUO62Z.js";
-import "./chunk-UOEWDCUX.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-TLJOJBZD.js";
-import "./chunk-U23JUUPX.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-JOXUNSKP.js.map

package/dist/chunk-CPXPHQGX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/persisted-schemas/storage.ts"],"sourcesContent":["/**\n * Read / write the per-collection persisted-schema envelope. Mirrors the\n * standard noy-db record envelope shape and is **AES-GCM encrypted with\n * the collection's DEK** — the schema body (field names, enum values,\n * constraints) is sensitive metadata, so it gets the same encryption\n * envelope as the records it describes.\n *\n * Storage layout:\n *\n *   <vault>/_schemas/<collection>   →   EncryptedEnvelope\n *\n * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}\n * is the same key the collection uses for its records.\n *\n * @module\n */\n\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\n\n/** Reserved collection name where persisted schemas live. */\nexport const SCHEMAS_COLLECTION = '_schemas' as const\n\n/**\n * Read and decrypt the persisted-schema envelope for one collection.\n * Returns `undefined` when no envelope has been written or when decryption\n * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse\n * failures surface as `undefined`, mirroring `_meta/handle`'s contract.\n */\nexport async function loadPersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEnvelope | undefined> {\n  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  if (!envelope) return undefined\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as PersistedSchemaEnvelope\n    if (parsed._noydb_schema !== 1) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist a schema envelope for one collection. Always\n * overwrites any prior write (callers gate on hash equality before calling\n * to avoid no-op writes).\n */\nexport async function savePersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n  payload: PersistedSchemaEnvelope,\n): Promise<void> {\n  const json = JSON.stringify(payload)\n  const { iv, data } = await encrypt(json, dek)\n  const prior = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n  }\n  await store.put(vault, SCHEMAS_COLLECTION, collection, env)\n}\n"],"mappings":";;;;;;;;;;;AAuBO,IAAM,qBAAqB;AAQlC,eAAsB,oBACpB,OACA,OACA,YACA,KAC8C;AAC9C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACtE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,oBACpB,OACA,OACA,YACA,KACA,SACe;AACf,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACnE,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,OAAO,oBAAoB,YAAY,GAAG;AAC5D;","names":[]}

package/dist/chunk-KYY7L72M.js

@@ -1,106 +0,0 @@
-import {
-  canonicalize,
-  derivePersistedSchema
-} from "./chunk-ULIHDPKL.js";
-import {
-  loadPersistedSchema,
-  savePersistedSchema
-} from "./chunk-CPXPHQGX.js";
-
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek);
-  if (stored && isEquivalent(stored, fresh)) {
-    return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-  }
-  let decision = { action: "allow" };
-  const strategies = opts.strategies ?? [];
-  if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-    const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-    decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-  }
-  if (decision.action !== "allow") {
-    return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-  }
-  const toSave = stored?.classified !== void 0 ? { ...fresh, classified: stored.classified } : fresh;
-  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave);
-  return { written: true, skipped: false, envelope: toSave, decision };
-}
-async function persistClassifiedMarker(opts) {
-  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek);
-  if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
-  const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
-    _noydb_schema: 1,
-    kind: "Unknown",
-    jsonSchema: null,
-    hash: null,
-    derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    classified: opts.marker
-  };
-  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload);
-}
-function markersEqual(a, b) {
-  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
-}
-function sameSet(a, b) {
-  if (a.length !== b.length) return false;
-  const s = new Set(a);
-  return b.every((x) => s.has(x));
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
-}
-
-export {
-  persistSchemaIfNeeded,
-  persistClassifiedMarker
-};
-//# sourceMappingURL=chunk-KYY7L72M.js.map

package/dist/chunk-KYY7L72M.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchema, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek)\n\n  if (stored && isEquivalent(stored, fresh)) {\n    return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n  }\n\n  // Changed (or first registration). Run update strategies only when we\n  // have a comparable JSON-Schema baseline and strategies were registered.\n  let decision: UpdateDecision = { action: 'allow' }\n  const strategies = opts.strategies ?? []\n  if (\n    stored &&\n    strategies.length > 0 &&\n    stored.kind === fresh.kind &&\n    isPlainObject(stored.jsonSchema) &&\n    isPlainObject(fresh.jsonSchema)\n  ) {\n    const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n    decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n  }\n\n  if (decision.action !== 'allow') {\n    // reject (or cutover): do NOT overwrite the baseline — the\n    // old schema stays the source of truth until the change is resolved.\n    return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n  }\n\n  // Preserve a previously-persisted classified marker (C-A / R10) — the schema\n  // derivation knows nothing about it, so a naive overwrite here would drop the\n  // config-drift guard's cross-session signal.\n  const toSave: PersistedSchemaEnvelope =\n    stored?.classified !== undefined ? { ...fresh, classified: stored.classified } : fresh\n  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave)\n  return { written: true, skipped: false, envelope: toSave, decision }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek)\n  if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n  const payload: PersistedSchemaEnvelope =\n    stored !== undefined\n      ? { ...stored, classified: opts.marker }\n      : {\n          _noydb_schema: 1,\n          kind: 'Unknown',\n          jsonSchema: null,\n          hash: null,\n          derivedAt: new Date().toISOString(),\n          classified: opts.marker,\n        }\n  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACuBA,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AACxD,QAAM,SAAS,MAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,GAAG;AAE9F,MAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,WAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,EAC1F;AAIA,MAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,QAAM,aAAa,KAAK,cAAc,CAAC;AACvC,MACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,UAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,eAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,EAC5F;AAEA,MAAI,SAAS,WAAW,SAAS;AAG/B,WAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,EAC/E;AAKA,QAAM,SACJ,QAAQ,eAAe,SAAY,EAAE,GAAG,OAAO,YAAY,OAAO,WAAW,IAAI;AACnF,QAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,MAAM;AACvF,SAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AACrE;AASA,eAAsB,wBAAwB,MAM5B;AAChB,QAAM,SAAS,MAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,GAAG;AAC9F,MAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,QAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,IACE,eAAe;AAAA,IACf,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY,KAAK;AAAA,EACnB;AACN,QAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,OAAO;AAC1F;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}