@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-4ZSGSRBI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/blobs/mime-magic.ts","../src/with-shape/blobs/blob-set.ts"],"sourcesContent":["/**\n * Lightweight MIME type detection from magic bytes (file signatures).\n *\n * Designed for the blob store's auto-detection feature. Operates on the first 16 bytes of\n * plaintext — no filesystem access, no filename guessing.\n *\n * ## Detection strategies\n *\n * 1. **Prefix match** — magic bytes at offset 0 (most formats).\n * 2. **Offset match** — magic bytes at a fixed offset > 0 (ISOBMFF: offset 4).\n * 3. **Compound match** — two separate byte sequences at different offsets\n *    (RIFF-based: bytes 0-3 + bytes 8-11).\n *\n * ## Formats excluded (require offset > 16 bytes)\n *\n * - TAR (`ustar` at offset 257)\n * - ISO 9660 (`CD001` at offset 32769)\n *\n * @module\n */\n\n// ─── Types ───────────────────────────────────────────────────────────────\n\ninterface MagicRule {\n  /** IANA MIME type (or widely-used x- type). */\n  readonly mime: string\n  /** Human-readable format name for diagnostics. */\n  readonly format: string\n  /** Magic bytes to match, as a Uint8Array. */\n  readonly bytes: Uint8Array\n  /** Byte offset where the magic starts. Default 0. */\n  readonly offset?: number\n  /**\n   * For compound checks (RIFF, FORM): a second byte sequence that must\n   * also match at `secondaryOffset`.\n   */\n  readonly secondaryBytes?: Uint8Array\n  /** Offset of the secondary match. */\n  readonly secondaryOffset?: number\n  /** If true, the format is already compressed — skip gzip in blob.put(). */\n  readonly preCompressed?: true\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────\n\n/** Convert a hex string like `'FF D8 FF'` to Uint8Array. */\nfunction hex(s: string): Uint8Array {\n  return new Uint8Array(s.split(' ').map((b) => parseInt(b, 16)))\n}\n\n// ─── Magic rules ─────────────────────────────────────────────────────────\n//\n// Ordered by detection priority: more specific (longer) signatures first\n// within the same offset group, so that e.g. RAR v5 (8 bytes) is tested\n// before RAR v4 (7 bytes).\n//\n// Sources verified against:\n//   - Gary Kessler's File Signatures Table\n//   - Wikipedia \"List of file signatures\"\n//   - IANA MIME type registry\n//   - Individual format specifications (PNG RFC 2083, PDF ISO 32000, etc.)\n//\n// Each entry includes the original CSV row number for traceability.\n\nconst MAGIC_RULES: readonly MagicRule[] = [\n  // ── Images ───────────────────────────────────────────────────────────\n\n  // #2  PNG — full 8-byte signature (RFC 2083)\n  { mime: 'image/png', format: 'PNG', bytes: hex('89 50 4E 47 0D 0A 1A 0A'), preCompressed: true },\n\n  // #1  JPEG — FF D8 FF (third byte is start of APP marker, always FF)\n  { mime: 'image/jpeg', format: 'JPEG', bytes: hex('FF D8 FF'), preCompressed: true },\n\n  // #7  WebP — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = WEBP\n  {\n    mime: 'image/webp',\n    format: 'WebP',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('57 45 42 50'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  // #5  TIFF (little-endian) — II + version 42\n  { mime: 'image/tiff', format: 'TIFF', bytes: hex('49 49 2A 00') },\n\n  // #6  TIFF (big-endian) — MM + version 42\n  { mime: 'image/tiff', format: 'TIFF', bytes: hex('4D 4D 00 2A') },\n\n  // #3  GIF — GIF8 (covers GIF87a and GIF89a)\n  { mime: 'image/gif', format: 'GIF', bytes: hex('47 49 46 38'), preCompressed: true },\n\n  // #4  BMP — BM\n  { mime: 'image/bmp', format: 'BMP', bytes: hex('42 4D') },\n\n  //  PSD — 8BPS\n  { mime: 'image/vnd.adobe.photoshop', format: 'PSD', bytes: hex('38 42 50 53') },\n\n  // #8  ICO — 00 00 01 00 (note: 00 00 02 00 is CUR cursor format)\n  { mime: 'image/x-icon', format: 'ICO', bytes: hex('00 00 01 00') },\n\n  // #9  HEIC — ISOBMFF: ftyp at offset 4, brand \"heic\" at offset 8\n  {\n    mime: 'image/heic',\n    format: 'HEIC',\n    bytes: hex('66 74 79 70'),\n    offset: 4,\n    secondaryBytes: hex('68 65 69 63'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  // ── Documents ────────────────────────────────────────────────────────\n\n  //  PDF — %PDF\n  { mime: 'application/pdf', format: 'PDF', bytes: hex('25 50 44 46') },\n\n  //  RTF — {\\rtf\n  { mime: 'application/rtf', format: 'RTF', bytes: hex('7B 5C 72 74 66') },\n\n  // ── Archives & compression ───────────────────────────────────────────\n\n  //  RAR v5 — 8-byte signature (test before RAR v4)\n  { mime: 'application/vnd.rar', format: 'RAR v5', bytes: hex('52 61 72 21 1A 07 01 00'), preCompressed: true },\n\n  //  RAR v4 — 7-byte signature\n  { mime: 'application/vnd.rar', format: 'RAR v4', bytes: hex('52 61 72 21 1A 07 00'), preCompressed: true },\n\n  //  7-Zip — 6-byte signature\n  { mime: 'application/x-7z-compressed', format: '7Z', bytes: hex('37 7A BC AF 27 1C'), preCompressed: true },\n\n  //  XZ — 6-byte stream header\n  { mime: 'application/x-xz', format: 'XZ', bytes: hex('FD 37 7A 58 5A 00'), preCompressed: true },\n\n  //  ZIP — PK\\x03\\x04 (local file header)\n  { mime: 'application/zip', format: 'ZIP', bytes: hex('50 4B 03 04'), preCompressed: true },\n\n  //  GZIP — 1F 8B\n  { mime: 'application/gzip', format: 'GZIP', bytes: hex('1F 8B'), preCompressed: true },\n\n  //  BZIP2 — BZh\n  { mime: 'application/x-bzip2', format: 'BZIP2', bytes: hex('42 5A 68'), preCompressed: true },\n\n  //  LZIP — LZIP\n  { mime: 'application/x-lzip', format: 'LZIP', bytes: hex('4C 5A 49 50'), preCompressed: true },\n\n  // ── Audio ────────────────────────────────────────────────────────────\n\n  //  WAV — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = WAVE\n  {\n    mime: 'audio/wav',\n    format: 'WAV',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('57 41 56 45'),\n    secondaryOffset: 8,\n  },\n\n  //  AIFF — FORM compound: bytes 0-3 = FORM, bytes 8-11 = AIFF\n  {\n    mime: 'audio/aiff',\n    format: 'AIFF',\n    bytes: hex('46 4F 52 4D'),\n    secondaryBytes: hex('41 49 46 46'),\n    secondaryOffset: 8,\n  },\n\n  //  FLAC — fLaC\n  { mime: 'audio/flac', format: 'FLAC', bytes: hex('66 4C 61 43') },\n\n  //  OGG — OggS (container — may hold Vorbis, Opus, Theora, etc.)\n  { mime: 'application/ogg', format: 'OGG', bytes: hex('4F 67 67 53') },\n\n  //  MIDI — MThd\n  { mime: 'audio/midi', format: 'MIDI', bytes: hex('4D 54 68 64') },\n\n  //  MP3 (ID3-tagged) — ID3\n  { mime: 'audio/mpeg', format: 'MP3', bytes: hex('49 44 33'), preCompressed: true },\n\n  // ── Video ────────────────────────────────────────────────────────────\n\n  //  AVI — RIFF compound: bytes 0-3 = RIFF, bytes 8-11 = AVI\\x20\n  {\n    mime: 'video/x-msvideo',\n    format: 'AVI',\n    bytes: hex('52 49 46 46'),\n    secondaryBytes: hex('41 56 49 20'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  //  WMV/ASF — 8-byte ASF header GUID prefix\n  { mime: 'video/x-ms-wmv', format: 'WMV', bytes: hex('30 26 B2 75 8E 66 CF 11'), preCompressed: true },\n\n  //  MKV/WebM — EBML header (Matroska container)\n  { mime: 'video/x-matroska', format: 'MKV', bytes: hex('1A 45 DF A3'), preCompressed: true },\n\n  //  FLV — FLV\n  { mime: 'video/x-flv', format: 'FLV', bytes: hex('46 4C 56'), preCompressed: true },\n\n  //  MOV — ISOBMFF: ftyp at offset 4, brand \"qt  \" at offset 8\n  {\n    mime: 'video/quicktime',\n    format: 'MOV',\n    bytes: hex('66 74 79 70'),\n    offset: 4,\n    secondaryBytes: hex('71 74 20 20'),\n    secondaryOffset: 8,\n    preCompressed: true,\n  },\n\n  //  MP4 — ISOBMFF: ftyp at offset 4 (brands vary: isom, mp41, mp42, etc.)\n  //     Tested AFTER MOV and HEIC so their specific brands match first.\n  { mime: 'video/mp4', format: 'MP4', bytes: hex('66 74 79 70'), offset: 4, preCompressed: true },\n\n  // ── Executables & binaries ───────────────────────────────────────────\n\n  //  SQLite — \"SQLite 3\" (first 8 bytes of the 16-byte header)\n  { mime: 'application/vnd.sqlite3', format: 'SQLite', bytes: hex('53 51 4C 69 74 65 20 33') },\n\n  //  WASM — \\0asm\n  { mime: 'application/wasm', format: 'WASM', bytes: hex('00 61 73 6D') },\n\n  //  ELF — \\x7FELF\n  { mime: 'application/x-elf', format: 'ELF', bytes: hex('7F 45 4C 46') },\n\n  //  PE (EXE/DLL) — MZ\n  { mime: 'application/vnd.microsoft.portable-executable', format: 'PE', bytes: hex('4D 5A') },\n\n  //  Mach-O — all four single-arch variants\n  { mime: 'application/x-mach-binary', format: 'Mach-O 64 LE', bytes: hex('CF FA ED FE') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 64 BE', bytes: hex('FE ED FA CF') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 32 LE', bytes: hex('CE FA ED FE') },\n  { mime: 'application/x-mach-binary', format: 'Mach-O 32 BE', bytes: hex('FE ED FA CE') },\n\n  //  Java Class — CA FE BA BE\n  //     Note: collides with Mach-O Universal Binary. Disambiguated by checking\n  //     bytes 4-7: Java class version is >= 0x002D (45), while fat binary\n  //     arch count is a small number (typically 0x00000002).\n  //     We place Java after Mach-O single-arch entries so the more common\n  //     Mach-O variants match first. The CA FE BA BE collision between Java\n  //     and Mach-O fat binary is resolved by the caller if needed.\n  { mime: 'application/java-vm', format: 'Java Class', bytes: hex('CA FE BA BE') },\n\n  //  DEX — dex\\n (Android Dalvik Executable)\n  { mime: 'application/vnd.android.dex', format: 'DEX', bytes: hex('64 65 78 0A') },\n\n  // ── Package formats ──────────────────────────────────────────────────\n\n  //  DEB — !<arch> (ar archive; DEB-specific member follows)\n  { mime: 'application/vnd.debian.binary-package', format: 'DEB', bytes: hex('21 3C 61 72 63 68 3E') },\n\n  //  RPM — ED AB EE DB\n  { mime: 'application/x-rpm', format: 'RPM', bytes: hex('ED AB EE DB') },\n\n  //  CAB — MSCF\n  { mime: 'application/vnd.ms-cab-compressed', format: 'CAB', bytes: hex('4D 53 43 46'), preCompressed: true },\n\n  // ── Capture & Flash ──────────────────────────────────────────────────\n\n  //  PCAP (little-endian) — D4 C3 B2 A1\n  { mime: 'application/vnd.tcpdump.pcap', format: 'PCAP', bytes: hex('D4 C3 B2 A1') },\n\n  //  PCAP (big-endian) — A1 B2 C3 D4\n  { mime: 'application/vnd.tcpdump.pcap', format: 'PCAP BE', bytes: hex('A1 B2 C3 D4') },\n\n  //  PCAPNG — Section Header Block\n  { mime: 'application/x-pcapng', format: 'PCAPNG', bytes: hex('0A 0D 0D 0A') },\n\n  //  SWF — all three variants (uncompressed, zlib, LZMA)\n  { mime: 'application/x-shockwave-flash', format: 'SWF', bytes: hex('46 57 53') },\n  { mime: 'application/x-shockwave-flash', format: 'SWF zlib', bytes: hex('43 57 53'), preCompressed: true },\n  { mime: 'application/x-shockwave-flash', format: 'SWF LZMA', bytes: hex('5A 57 53'), preCompressed: true },\n\n  // ── Data formats ─────────────────────────────────────────────────────\n\n  //  Parquet — PAR1 (no registered IANA MIME; using Apache's informal type)\n  { mime: 'application/vnd.apache.parquet', format: 'Parquet', bytes: hex('50 41 52 31') },\n\n  //  Avro Object Container — Obj\\x01\n  { mime: 'application/avro', format: 'Avro', bytes: hex('4F 62 6A 01') },\n\n  //  NES ROM — NES\\x1A (iNES header)\n  { mime: 'application/x-nintendo-nes-rom', format: 'NES ROM', bytes: hex('4E 45 53 1A') },\n] as const\n\n// ─── MP3 sync word ───────────────────────────────────────────────────────\n//\n// MP3 files without an ID3 tag start with a frame sync word where the top\n// 11 bits are set: 0xFFE0 mask. The ID3 signature (49 44 33) is handled\n// as a normal rule above. The sync-word check is a fallback tested in\n// `detectMimeType` after all rules.\n\nfunction isMp3SyncWord(byte0: number, byte1: number): boolean {\n  return byte0 === 0xff && (byte1 & 0xe0) === 0xe0\n}\n\n// ─── Detection ───────────────────────────────────────────────────────────\n\n/**\n * Detect MIME type from the first bytes of a file.\n *\n * @param header - The first 16 bytes (or more) of the plaintext. Passing\n *   fewer than 16 bytes may miss compound and offset-based matches.\n * @returns Detected MIME type, or `'application/octet-stream'` if unknown.\n */\nexport function detectMimeType(header: Uint8Array): string {\n  const result = detectMagic(header)\n  return result?.mime ?? 'application/octet-stream'\n}\n\n/**\n * Detect MIME type and whether the format is already compressed.\n *\n * Used by `BlobSet.put()` to decide whether to skip gzip compression.\n *\n * @param header - The first 16 bytes (or more) of the plaintext.\n * @returns `{ mime, preCompressed }` or `null` if no match.\n */\nexport function detectMagic(\n  header: Uint8Array,\n): { mime: string; format: string; preCompressed: boolean } | null {\n  for (const rule of MAGIC_RULES) {\n    if (matchRule(header, rule)) {\n      return {\n        mime: rule.mime,\n        format: rule.format,\n        preCompressed: rule.preCompressed ?? false,\n      }\n    }\n  }\n\n  // Fallback: MP3 sync word (no ID3 tag)\n  if (header.length >= 2 && isMp3SyncWord(header[0]!, header[1]!)) {\n    return { mime: 'audio/mpeg', format: 'MP3', preCompressed: true }\n  }\n\n  return null\n}\n\n/**\n * Check whether a format is already compressed (should skip gzip).\n *\n * @param mimeType - A MIME type string.\n * @returns `true` if the format is known to be pre-compressed.\n */\nexport function isPreCompressed(mimeType: string): boolean {\n  return PRE_COMPRESSED_MIMES.has(mimeType)\n}\n\n// ─── Internal matching ───────────────────────────────────────────────────\n\nfunction matchRule(header: Uint8Array, rule: MagicRule): boolean {\n  const offset = rule.offset ?? 0\n  const end = offset + rule.bytes.length\n\n  // Not enough data for the primary match\n  if (header.length < end) return false\n\n  // Primary byte sequence\n  for (let i = 0; i < rule.bytes.length; i++) {\n    if (header[offset + i] !== rule.bytes[i]) return false\n  }\n\n  // Secondary byte sequence (compound check)\n  if (rule.secondaryBytes && rule.secondaryOffset !== undefined) {\n    const sEnd = rule.secondaryOffset + rule.secondaryBytes.length\n    if (header.length < sEnd) return false\n    for (let i = 0; i < rule.secondaryBytes.length; i++) {\n      if (header[rule.secondaryOffset + i] !== rule.secondaryBytes[i]) return false\n    }\n  }\n\n  return true\n}\n\n// ─── Pre-compressed MIME set ─────────────────────────────────────────────\n//\n// Built from the rules above. Used by `isPreCompressed()` for callers who\n// already know the MIME type (e.g. from a Content-Type header) and want to\n// skip the magic-byte detection step.\n\nconst PRE_COMPRESSED_MIMES = new Set<string>(\n  MAGIC_RULES.filter((r) => r.preCompressed).map((r) => r.mime),\n)\n","import type {\n  NoydbStore,\n  EncryptedEnvelope,\n  BlobObject,\n  SlotRecord,\n  SlotInfo,\n  VersionRecord,\n  BlobPutOptions,\n  BlobResponseOptions,\n} from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { ObjectProjection } from './object-projection.js'\nimport type { BlobFieldsConfig } from './blob-compaction.js'\nimport {\n  encrypt,\n  openEnvelopeJson,\n  hmacSha256Hex,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  bufferToBase64,\n  base64ToBuffer,\n  generateDEK,\n  wrapCek,\n  unwrapCek,\n  sha256Hex,\n  type EnclaveKey,\n} from '../../kernel/enclave/index.js'\nimport { ConflictError, NotFoundError } from '../../kernel/errors.js'\nimport { detectMagic, isPreCompressed } from './mime-magic.js'\n\n// ─── Internal collection names ─────────────────────────────────────────\n\n/**\n * DEK slot name for vault-shared blob data. Calling `getDEK('_blob')`\n * auto-creates a blob DEK the first time — same lazy-creation mechanism\n * used for any user-defined collection.\n */\nexport const BLOB_COLLECTION = '_blob'\n\n/** Stores `BlobObject` metadata envelopes, keyed by eTag. */\nexport const BLOB_INDEX_COLLECTION = '_blob_index'\n\n/**\n * Stores encrypted chunk envelopes, keyed by `{eTag}/{chunkIndex}`.\n * NOT loaded into the in-memory query layer. Fetched on demand by\n * `BlobSet.get()` / `BlobSet.response()`.\n */\nexport const BLOB_CHUNKS_COLLECTION = '_blob_chunks'\n\n/** Prefix for per-collection slot metadata collections. */\nexport const BLOB_SLOTS_PREFIX = '_blob_slots_'\n\n/** Prefix for per-collection version records. */\nexport const BLOB_VERSIONS_PREFIX = '_blob_versions_'\n\n/**\n * Default chunk size: 256 KB raw bytes.\n * After AES-GCM (same size) + base64 (~33% inflation) → ~342 KB per\n * envelope, safely within DynamoDB's 400 KB item limit.\n */\nexport const DEFAULT_CHUNK_SIZE = 256 * 1024\n\n/** Maximum CAS retry attempts for refCount and slot metadata updates. */\nconst MAX_CAS_RETRIES = 5\n\n// ─── Compression helpers ───────────────────────────────────────────────\n\nasync function compressBytes(\n  data: Uint8Array,\n): Promise<{ bytes: Uint8Array; algorithm: 'gzip' | 'none' }> {\n  if (typeof CompressionStream === 'undefined') {\n    return { bytes: data, algorithm: 'none' }\n  }\n  // Pipe through the stream so `readable` is drained CONCURRENTLY with the\n  // write. The await-write-then-read form deadlocks once the output exceeds the\n  // stream's internal buffer (the writer backpressures waiting for a reader that\n  // hasn't started yet).\n  const piped = new Response(data as Uint8Array<ArrayBuffer>).body!.pipeThrough(new CompressionStream('gzip'))\n  const buf = await new Response(piped).arrayBuffer()\n  return { bytes: new Uint8Array(buf), algorithm: 'gzip' }\n}\n\nasync function decompressBytes(data: Uint8Array): Promise<Uint8Array> {\n  if (typeof DecompressionStream === 'undefined') {\n    throw new Error(\n      '[noy-db] DecompressionStream not available — cannot decompress blob chunk',\n    )\n  }\n  // Concurrent read via pipeThrough — the await-write-then-read form deadlocks\n  // when the DECOMPRESSED output exceeds the stream buffer (~16 KB): small\n  // compressed input → large output → backpressure.\n  const piped = new Response(data as Uint8Array<ArrayBuffer>).body!.pipeThrough(new DecompressionStream('gzip'))\n  const buf = await new Response(piped).arrayBuffer()\n  return new Uint8Array(buf)\n}\n\nfunction concatChunks(chunks: Uint8Array[]): Uint8Array {\n  const total = chunks.reduce((s, c) => s + c.byteLength, 0)\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const c of chunks) {\n    out.set(c, offset)\n    offset += c.byteLength\n  }\n  return out\n}\n\n/** Build the AAD binding for chunk integrity: \"{eTag}:{chunkIndex}:{chunkCount}\" */\nfunction chunkAAD(eTag: string, chunkIndex: number, chunkCount: number): Uint8Array {\n  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`)\n}\n\n// ─── BlobSet ──────────────────────────────────────────────────────────\n\n/**\n * Handle for reading, writing, versioning, and deleting binary blobs\n * on a specific record.\n *\n * Obtained via `collection.blob(id)`. No I/O is performed until you\n * call a method.\n *\n * ## Storage layout\n *\n * ```\n * _blob_index/{eTag}                            BlobObject metadata (vault-shared DEK)\n * _blob_chunks/{eTag}/{chunkIndex}              Encrypted chunk data (vault-shared DEK + AAD)\n * _blob_slots_{collection}/{recordId}           Slot map (parent collection DEK)\n * _blob_versions_{collection}/{recordId}/{slot}/{label}  Published versions (parent collection DEK)\n * ```\n *\n * ## Deduplication\n *\n * `put()` computes `eTag = HMAC-SHA-256(blobDEK, plaintext)` — keyed so the\n * store cannot predict eTags for known content. If another record already\n * uploaded the same bytes, the chunks are reused and `refCount` is incremented.\n *\n * ## Chunk integrity\n *\n * Each chunk is encrypted with AES-256-GCM using AAD = `{eTag}:{index}:{count}`,\n * preventing chunk reorder, substitution, and truncation attacks.\n */\nexport class BlobSet {\n  private readonly store: NoydbStore\n  private readonly vault: string\n  private readonly collection: string\n  private readonly recordId: string\n  private readonly getDEK: (name: string) => Promise<EnclaveKey>\n  private readonly encrypted: boolean\n  private readonly userId: string | undefined\n  private readonly maxBlobBytes: number | undefined\n  private readonly erasableBlobs: boolean\n  private readonly debugPlaintext: boolean\n  private readonly objectStore: ObjectProjection | undefined\n  private readonly blobFields: BlobFieldsConfig | undefined\n\n  constructor(opts: {\n    store: NoydbStore\n    vault: string\n    collection: string\n    recordId: string\n    getDEK: (name: string) => Promise<EnclaveKey>\n    encrypted: boolean\n    userId?: string\n    maxBlobBytes?: number\n    erasableBlobs?: boolean\n    debugPlaintext?: boolean\n    objectStore?: ObjectProjection\n    blobFields?: BlobFieldsConfig\n  }) {\n    this.store = opts.store\n    this.vault = opts.vault\n    this.collection = opts.collection\n    this.recordId = opts.recordId\n    this.getDEK = opts.getDEK\n    this.encrypted = opts.encrypted\n    this.userId = opts.userId\n    this.maxBlobBytes = opts.maxBlobBytes\n    this.erasableBlobs = opts.erasableBlobs === true\n    this.debugPlaintext = opts.debugPlaintext === true\n    this.objectStore = opts.objectStore\n    this.blobFields = opts.blobFields\n  }\n\n  /**\n   * Resolve the key the blob's CHUNKS are encrypted under.\n   *\n   * - `_cek` present (erasable blob) → unwrap the per-blob content CEK under\n   *   the `_blob` DEK. Deleting the BlobObject (at `refCount → 0`) makes this\n   *   key unrecoverable → the chunks are crypto-shredded.\n   * - `_cek` absent (legacy) → the `_blob` DEK encrypts chunks directly.\n   * - unencrypted vault → `null` (chunks stored as plaintext base64).\n   */\n  private async resolveChunkKey(blob: Pick<BlobObject, '_cek'>): Promise<EnclaveKey | null> {\n    if (!this.encrypted) return null\n    const blobDEK = await this.getDEK(BLOB_COLLECTION)\n    return blob._cek !== undefined ? await unwrapCek(blob._cek, blobDEK) : blobDEK\n  }\n\n  /** The internal collection that holds slot metadata for this collection's blobs. */\n  private get slotsCollection(): string {\n    return `${BLOB_SLOTS_PREFIX}${this.collection}`\n  }\n\n  /** The internal collection that holds published versions for this collection's blobs. */\n  private get versionsCollection(): string {\n    return `${BLOB_VERSIONS_PREFIX}${this.collection}`\n  }\n\n  // ─── Slot Metadata I/O (CAS-protected) ─────────────────────────────\n\n  private async loadSlots(): Promise<{\n    slots: Record<string, SlotRecord>\n    version: number\n  }> {\n    const envelope = await this.store.get(this.vault, this.slotsCollection, this.recordId)\n    if (!envelope) return { slots: {}, version: 0 }\n\n    if (!this.encrypted) {\n      return {\n        slots: JSON.parse(envelope._data) as Record<string, SlotRecord>,\n        version: envelope._v,\n      }\n    }\n\n    const dek = await this.getDEK(this.collection)\n    const json = await openEnvelopeJson(envelope, dek)\n    return {\n      slots: JSON.parse(json) as Record<string, SlotRecord>,\n      version: envelope._v,\n    }\n  }\n\n  private async saveSlots(\n    slots: Record<string, SlotRecord>,\n    currentVersion: number,\n  ): Promise<void> {\n    const json = JSON.stringify(slots)\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(this.collection)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: currentVersion + 1,\n        _ts: now,\n        _iv: iv,\n        _data: data,\n      }\n    } else {\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: currentVersion + 1,\n        _ts: now,\n        _iv: '',\n        _data: json,\n      }\n    }\n\n    await this.store.put(\n      this.vault,\n      this.slotsCollection,\n      this.recordId,\n      envelope,\n      currentVersion > 0 ? currentVersion : undefined,\n    )\n  }\n\n  /**\n   * CAS retry loop for slot metadata updates. Re-reads slots on conflict\n   * and re-applies the mutation function.\n   */\n  private async casUpdateSlots(\n    mutate: (slots: Record<string, SlotRecord>) => Record<string, SlotRecord> | null,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const { slots, version } = await this.loadSlots()\n      const updated = mutate(slots)\n      if (updated === null) return // no-op\n      try {\n        await this.saveSlots(updated, version)\n        return\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n  }\n\n  // ─── Blob Index I/O (versioned for CAS refCount) ──────────────────\n\n  private async loadBlobObject(eTag: string): Promise<{ blob: BlobObject; version: number } | null> {\n    const envelope = await this.store.get(this.vault, BLOB_INDEX_COLLECTION, eTag)\n    if (!envelope) return null\n\n    if (!this.encrypted) {\n      return { blob: JSON.parse(envelope._data) as BlobObject, version: envelope._v }\n    }\n\n    const dek = await this.getDEK(BLOB_COLLECTION)\n    const json = await openEnvelopeJson(envelope, dek)\n    return { blob: JSON.parse(json) as BlobObject, version: envelope._v }\n  }\n\n  private async writeBlobObject(blob: BlobObject, expectedVersion?: number): Promise<void> {\n    const json = JSON.stringify(blob)\n    const now = new Date().toISOString()\n    const newVersion = (expectedVersion ?? 0) + 1\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(BLOB_COLLECTION)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: '', _data: json }\n    }\n\n    await this.store.put(\n      this.vault,\n      BLOB_INDEX_COLLECTION,\n      blob.eTag,\n      envelope,\n      expectedVersion,\n    )\n  }\n\n  /**\n   * CAS retry loop for refCount changes on a BlobObject.\n   */\n  private async casUpdateRefCount(eTag: string, delta: number): Promise<number> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const result = await this.loadBlobObject(eTag)\n      if (!result) throw new NotFoundError(`BlobObject ${eTag} not found`)\n      const { blob, version } = result\n      const updated: BlobObject = { ...blob, refCount: blob.refCount + delta }\n      try {\n        await this.writeBlobObject(updated, version)\n        return updated.refCount\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n    throw new ConflictError(-1) // exhausted retries\n  }\n\n  /**\n   * Release `n` references to a blob and reclaim it at refCount 0.\n   *\n   * The single reclaim choke point for every reference-drop path — slot\n   * delete/overwrite, published-version delete, and `forget()` shred — so the\n   * refCount-0 policy is uniform:\n   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE\n   *    copy of the wrapped content CEK → chunks permanently undecryptable) and\n   *    reclaim the chunks. The crypto-shred is EAGER on every path: GDPR erasure\n   *    must not wait on orphan retention.\n   *  - **legacy blob** (no `_cek`) → reclaimed only when `reclaimLegacy` (the\n   *    `forget()` erasure path); otherwise left for deferred GC so the existing\n   *    `BlobLifecyclePolicy.orphanRetentionDays` semantics are preserved.\n   *\n   * @returns `'shredded'` (erasable, refCount 0, chunks dead) · `'retainedShared'`\n   *   (erasable, still referenced) · `'residue'` (legacy — not a crypto-shred).\n   */\n  private async releaseRef(\n    eTag: string,\n    n: number,\n    reclaimLegacy: boolean,\n  ): Promise<'shredded' | 'retainedShared' | 'residue'> {\n    const loaded = await this.loadBlobObject(eTag)\n    if (!loaded) return 'shredded' // already gone\n    const erasable = loaded.blob._cek !== undefined\n    const remaining = await this.casUpdateRefCount(eTag, -n)\n    if (remaining > 0) return erasable ? 'retainedShared' : 'residue'\n\n    if (erasable || reclaimLegacy) {\n      await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag)\n      for (let i = 0; i < loaded.blob.chunkCount; i++) {\n        await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`)\n      }\n    }\n    return erasable ? 'shredded' : 'residue'\n  }\n\n  /**\n   * Crypto-shred this record's blob attachments — called by\n   * `vault.forget()`.\n   *\n   * For each distinct eTag the record references (a record may attach the same\n   * content under several slot names → several refCount holds): decrement the\n   * blob's refCount by that many. When it reaches 0:\n   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE\n   *    recoverable copy of the wrapped content CEK → chunks permanently\n   *    undecryptable) and reclaim the chunk bytes. This is the crypto-shred.\n   *  - **legacy blob** (no `_cek`) → chunks are under the shared `_blob` DEK and\n   *    stay decryptable until byte-deleted; we delete the orphaned chunks +\n   *    index but report it as residue, not a cryptographic erasure.\n   * When refCount stays > 0 the content legitimately persists for its other\n   * owner — reported as `retainedShared` (or `residue` if legacy).\n   *\n   * Finally drops the record's slot map, severing the subject's link.\n   */\n  async shredAllForRecord(): Promise<{\n    shredded: string[]\n    retainedShared: string[]\n    residue: string[]\n  }> {\n    const { slots } = await this.loadSlots()\n    const slotNames = Object.keys(slots)\n    const shredded: string[] = []\n    const retainedShared: string[] = []\n    const residue: string[] = []\n    if (slotNames.length === 0) return { shredded, retainedShared, residue }\n\n    // Reference count from THIS record per eTag.\n    const holds = new Map<string, number>()\n    for (const name of slotNames) {\n      const eTag = slots[name]!.eTag\n      holds.set(eTag, (holds.get(eTag) ?? 0) + 1)\n    }\n\n    for (const [eTag, n] of holds) {\n      // Forget erasure reclaims legacy orphans too (the record is being erased),\n      // so reclaimLegacy = true — but only erasable blobs count as a crypto-shred.\n      const outcome = await this.releaseRef(eTag, n, true)\n      if (outcome === 'shredded') shredded.push(eTag)\n      else if (outcome === 'retainedShared') retainedShared.push(eTag)\n      else residue.push(eTag)\n    }\n\n    // Sever the subject's link: drop the record's slot map.\n    await this.store.delete(this.vault, this.slotsCollection, this.recordId)\n    return { shredded, retainedShared, residue }\n  }\n\n  /** CAS retry loop for an arbitrary BlobObject mutation. */\n  private async casUpdateBlobObject(\n    eTag: string,\n    mutate: (blob: BlobObject) => BlobObject,\n  ): Promise<void> {\n    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {\n      const result = await this.loadBlobObject(eTag)\n      if (!result) throw new NotFoundError(`BlobObject ${eTag} not found`)\n      try {\n        await this.writeBlobObject(mutate(result.blob), result.version)\n        return\n      } catch (err) {\n        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue\n        throw err\n      }\n    }\n    throw new ConflictError(-1) // exhausted retries\n  }\n\n  /**\n   * Migrate this record's LEGACY blobs (no `_cek`, chunks under the shared\n   * `_blob` DEK) to per-blob content CEKs so they become crypto-shreddable.\n   * Returns the eTags migrated vs. already-erasable.\n   *\n   * **Explicit maintenance pass** (mirrors the record-CEK migration posture):\n   * re-encrypts the existing compressed chunks IN PLACE under a fresh content\n   * CEK — preserving the eTag, chunkCount, chunkSize, and compression — then\n   * flips the `_cek` discriminant. Crash-safe + idempotent via `_cekPending`:\n   *   1. persist the wrapped content CEK in `_cekPending` (readers ignore it →\n   *      the blob stays readable under the `_blob` DEK; the key survives a crash);\n   *   2. re-encrypt each chunk under the content CEK (a resume reads an\n   *      already-migrated chunk under the content CEK, else under the `_blob` DEK);\n   *   3. promote `_cekPending` → `_cek` (atomic flip). Reads now use the CEK.\n   * A re-run after a crash resumes from whichever phase was reached.\n   *\n   * Dedup-safe: migrating a shared blob (refCount > 1) re-keys it for every\n   * referencer at once; a non-erasable collection still reads it (it unwraps\n   * `_cek` under the `_blob` DEK it holds).\n   */\n  async migrate(): Promise<{ migrated: string[]; alreadyErasable: string[] }> {\n    const migrated: string[] = []\n    const alreadyErasable: string[] = []\n    if (!this.encrypted) return { migrated, alreadyErasable }\n\n    const blobDEK = await this.getDEK(BLOB_COLLECTION)\n    const { slots } = await this.loadSlots()\n    const eTags = new Set(Object.values(slots).map((s) => s.eTag))\n\n    for (const eTag of eTags) {\n      const loaded = await this.loadBlobObject(eTag)\n      if (!loaded) continue\n      const blob = loaded.blob\n      if (blob._cek !== undefined) { alreadyErasable.push(eTag); continue }\n\n      // Phase 1 — persist the content CEK (resume reuses an existing pending one).\n      let contentCek: EnclaveKey\n      if (blob._cekPending !== undefined) {\n        contentCek = await unwrapCek(blob._cekPending, blobDEK)\n      } else {\n        contentCek = await generateDEK()\n        const wrapped = await wrapCek(contentCek, blobDEK)\n        await this.casUpdateBlobObject(eTag, (b) => ({ ...b, _cekPending: wrapped }))\n      }\n\n      // Phase 2 — re-encrypt each chunk under the content CEK, in place.\n      for (let i = 0; i < blob.chunkCount; i++) {\n        let raw: Uint8Array | null\n        try {\n          raw = await this.readChunk(eTag, i, blob.chunkCount, blobDEK)\n        } catch {\n          // Already re-encrypted under the content CEK (crash resume).\n          raw = await this.readChunk(eTag, i, blob.chunkCount, contentCek)\n        }\n        if (!raw) {\n          throw new NotFoundError(\n            `Blob chunk ${i}/${blob.chunkCount} missing for eTag \"${eTag}\" during migration`,\n          )\n        }\n        await this.writeChunk(eTag, i, blob.chunkCount, raw, contentCek)\n      }\n\n      // Phase 3 — promote _cekPending → _cek (atomic flip).\n      await this.casUpdateBlobObject(eTag, (b) => {\n        const { _cekPending, ...rest } = b\n        return _cekPending === undefined ? b : { ...rest, _cek: _cekPending }\n      })\n      migrated.push(eTag)\n    }\n    return { migrated, alreadyErasable }\n  }\n\n  // ─── Chunk I/O (with AAD binding) ─────────────────────────────────\n\n  private async writeChunk(\n    eTag: string,\n    index: number,\n    chunkCount: number,\n    chunk: Uint8Array,\n    dek: EnclaveKey | null,\n  ): Promise<void> {\n    const id = `${eTag}_${index}`\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (dek) {\n      const aad = chunkAAD(eTag, index, chunkCount)\n      const { iv, data } = await encryptBytesWithAAD(chunk, dek, aad)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: 1,\n        _ts: now,\n        _iv: '',\n        _data: bufferToBase64(chunk),\n      }\n    }\n\n    await this.store.put(this.vault, BLOB_CHUNKS_COLLECTION, id, envelope)\n  }\n\n  private async readChunk(\n    eTag: string,\n    index: number,\n    chunkCount: number,\n    dek: EnclaveKey | null,\n  ): Promise<Uint8Array | null> {\n    const envelope = await this.store.get(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${index}`)\n    if (!envelope) return null\n\n    if (dek) {\n      const aad = chunkAAD(eTag, index, chunkCount)\n      return await decryptBytesWithAAD(envelope._iv, envelope._data, dek, aad)\n    }\n\n    return base64ToBuffer(envelope._data)\n  }\n\n  // ─── Version record I/O ───────────────────────────────────────────\n\n  private versionKey(slotName: string, label: string): string {\n    return `${this.recordId}::${slotName}::${label}`\n  }\n\n  private async loadVersionRecord(slotName: string, label: string): Promise<VersionRecord | null> {\n    const key = this.versionKey(slotName, label)\n    const envelope = await this.store.get(this.vault, this.versionsCollection, key)\n    if (!envelope) return null\n\n    if (!this.encrypted) {\n      return JSON.parse(envelope._data) as VersionRecord\n    }\n\n    const dek = await this.getDEK(this.collection)\n    const json = await openEnvelopeJson(envelope, dek)\n    return JSON.parse(json) as VersionRecord\n  }\n\n  private async writeVersionRecord(slotName: string, record: VersionRecord): Promise<void> {\n    const key = this.versionKey(slotName, record.label)\n    const json = JSON.stringify(record)\n    const now = new Date().toISOString()\n    let envelope: EncryptedEnvelope\n\n    if (this.encrypted) {\n      const dek = await this.getDEK(this.collection)\n      const { iv, data } = await encrypt(json, dek)\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data }\n    } else {\n      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: '', _data: json }\n    }\n\n    await this.store.put(this.vault, this.versionsCollection, key, envelope)\n  }\n\n  private async deleteVersionRecord(slotName: string, label: string): Promise<void> {\n    const key = this.versionKey(slotName, label)\n    await this.store.delete(this.vault, this.versionsCollection, key)\n  }\n\n  // ─── Effective chunk size ─────────────────────────────────────────\n\n  private effectiveChunkSize(opts?: BlobPutOptions): number {\n    if (opts?.chunkSize) return opts.chunkSize\n    if (this.maxBlobBytes) return this.maxBlobBytes\n    return DEFAULT_CHUNK_SIZE\n  }\n\n  // ─── Fetch all chunks for a blob ──────────────────────────────────\n\n  private async fetchAllChunks(blob: BlobObject): Promise<Uint8Array> {\n    // Chunks are keyed under the per-blob content CEK (erasable) or directly\n    // under the `_blob` DEK (legacy) — resolveChunkKey discriminates on `_cek`.\n    const chunkKey = await this.resolveChunkKey(blob)\n    const chunks: Uint8Array[] = []\n\n    for (let i = 0; i < blob.chunkCount; i++) {\n      const chunk = await this.readChunk(blob.eTag, i, blob.chunkCount, chunkKey)\n      if (!chunk) {\n        throw new NotFoundError(\n          `Blob chunk ${i}/${blob.chunkCount} missing for eTag \"${blob.eTag}\" on record \"${this.recordId}\"`,\n        )\n      }\n      chunks.push(chunk)\n    }\n\n    const assembled = concatChunks(chunks)\n    return blob.compression === 'gzip' ? await decompressBytes(assembled) : assembled\n  }\n\n  // ─── Public API: Slot management ──────────────────────────────────\n\n  /**\n   * Upload bytes and attach them to this record under `slotName`.\n   *\n   * 1. Computes `eTag = HMAC-SHA-256(blobDEK, plaintext)` for keyed content-addressing.\n   * 2. Auto-detects MIME type from magic bytes if not provided.\n   * 3. If a blob with this eTag already exists, skips chunk upload (deduplication)\n   *    and CAS-increments refCount.\n   * 4. Otherwise: compresses → splits into chunks → encrypts each chunk with\n   *    AAD binding → writes `_blob_chunks` → writes `BlobObject` to `_blob_index`.\n   * 5. CAS-updates the slot metadata in `_blob_slots_{collection}`.\n   *    If overwriting an existing slot, decrements the old eTag's refCount.\n   */\n  async put(slotName: string, data: Uint8Array, opts?: BlobPutOptions): Promise<void> {\n    // External-projection path: the field is declared `external` and an\n    // ObjectProjection is configured → write the raw bytes as ONE native object\n    // (unencrypted, servable) and record an `external` slot (the catalog entry).\n    // Bypasses eTag/chunk/CEK/dedup entirely.\n    if (this.objectStore && this.blobFields?.[slotName]?.external) {\n      const policy = this.blobFields[slotName]\n      let contentType = opts?.mimeType\n      if (!contentType) {\n        const detected = detectMagic(data.subarray(0, 16))\n        contentType = detected?.mime ?? 'application/octet-stream'\n      }\n      const key = `${this.collection}/${this.recordId}/${slotName}`\n      const isPublic = policy.public === true\n      // Stamp a self-describing backlink onto the object's metadata (the\n      // \"secondary store\"): default opaque-token (no name leak).\n      const backlink = await this.buildBacklink(slotName, policy.backlink ?? 'opaque-token')\n      await this.objectStore.putObject(key, data, {\n        contentType,\n        public: isPublic,\n        ...(backlink.userMeta ? { userMeta: backlink.userMeta } : {}),\n      })\n\n      const uploaderUserId = opts?.uploadedBy ?? this.userId\n      let oldETag: string | undefined\n      await this.casUpdateSlots((slots) => {\n        oldETag = slots[slotName]?.eTag || undefined\n        // Preserve any previously-synced derived metadata across re-upload.\n        const prevMeta = slots[slotName]?.external?.meta\n        slots[slotName] = {\n          eTag: '',\n          external: {\n            key,\n            contentType,\n            ...(isPublic ? { public: true } : {}),\n            ...(backlink.token ? { backlink: backlink.token } : {}),\n            ...(prevMeta ? { meta: prevMeta } : {}),\n          },\n          filename: opts?.filename ?? slotName,\n          size: data.byteLength,\n          mimeType: contentType,\n          uploadedAt: new Date().toISOString(),\n          ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n        }\n        return slots\n      })\n      // If this slot previously held a chunk-based blob, release that eTag.\n      if (oldETag) {\n        await this.releaseRef(oldETag, 1, false).catch(() => {})\n      }\n      return\n    }\n\n    // Step 1 — keyed content-hash (plaintext, before compression)\n    const blobDEK = this.encrypted ? await this.getDEK(BLOB_COLLECTION) : null\n    const eTag = blobDEK\n      ? await hmacSha256Hex(blobDEK, data)\n      : await plainSha256Hex(data)\n\n    // Step 2 — MIME detection\n    let mimeType = opts?.mimeType\n    if (!mimeType) {\n      const detected = detectMagic(data.subarray(0, 16))\n      if (detected) mimeType = detected.mime\n    }\n\n    // Determine compression: explicit opt > auto-detect > default true\n    let shouldCompress: boolean\n    if (opts?.compress !== undefined) {\n      shouldCompress = opts.compress\n    } else if (mimeType && isPreCompressed(mimeType)) {\n      shouldCompress = false\n    } else {\n      shouldCompress = true\n    }\n    // Debug-plaintext: write the blob as a single un-gzipped object so the\n    // stored chunk's base64 `_data` decodes directly to the original bytes\n    // (`base64 -d`) — no gzip layer, no multi-chunk reassembly. (encrypt:false\n    // already stores chunks unencrypted; this drops the remaining indirection.)\n    if (this.debugPlaintext) shouldCompress = false\n\n    // Step 3 — deduplication check\n    const existingBlob = await this.loadBlobObject(eTag)\n\n    if (existingBlob) {\n      // eTag already exists — just increment refCount (CAS retry). Dedup is\n      // preserved across the content-CEK split: the chunks (and the BlobObject's\n      // `_cek`, if any) are reused as-is; a new referencer never re-encrypts.\n      await this.casUpdateRefCount(eTag, +1)\n    } else {\n      // Step 4 — compress\n      const { bytes: compressed, algorithm } = shouldCompress\n        ? await compressBytes(data)\n        : { bytes: data, algorithm: 'none' as const }\n\n      // Debug-plaintext stores the whole blob as one object (single chunk) so\n      // it is one directly-openable file in the store rather than N shards.\n      const chunkSize = this.debugPlaintext\n        ? Math.max(compressed.byteLength, 1)\n        : this.effectiveChunkSize(opts)\n      const chunkCount = Math.max(1, Math.ceil(compressed.byteLength / chunkSize))\n\n      // Erasable collection (`perRecordKeys`): mint a fresh per-blob content\n      // CEK and encrypt the chunks under it instead of the shared `_blob` DEK,\n      // so the BlobObject's wrapped `_cek` is the sole recoverable copy → a\n      // refCount-0 delete crypto-shreds the chunks. `eTag` (the dedup address)\n      // is still keyed off the `_blob` DEK, unchanged.\n      let chunkKey = blobDEK\n      let wrappedCek: string | undefined\n      if (blobDEK && this.erasableBlobs) {\n        const contentCek = await generateDEK()\n        wrappedCek = await wrapCek(contentCek, blobDEK)\n        chunkKey = contentCek\n      }\n\n      // Step 5 — write chunks FIRST with AAD binding (safe failure order)\n      for (let i = 0; i < chunkCount; i++) {\n        const start = i * chunkSize\n        await this.writeChunk(\n          eTag, i, chunkCount,\n          compressed.subarray(start, start + chunkSize),\n          chunkKey,\n        )\n      }\n\n      // Step 6 — write blob index entry after all chunks succeed\n      await this.writeBlobObject({\n        eTag,\n        size: data.byteLength,\n        compressedSize: compressed.byteLength,\n        compression: algorithm,\n        chunkSize,\n        chunkCount,\n        ...(mimeType !== undefined ? { mimeType } : {}),\n        createdAt: new Date().toISOString(),\n        refCount: 1,\n        ...(wrappedCek !== undefined ? { _cek: wrappedCek } : {}),\n      })\n    }\n\n    // Step 7 — CAS-update slot metadata\n    const uploaderUserId = opts?.uploadedBy ?? this.userId\n    await this.casUpdateSlots((slots) => {\n      const oldETag = slots[slotName]?.eTag\n      slots[slotName] = {\n        eTag,\n        filename: opts?.filename ?? slotName,\n        size: data.byteLength,\n        ...(mimeType !== undefined ? { mimeType } : {}),\n        uploadedAt: new Date().toISOString(),\n        ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n      }\n      // Schedule old eTag refCount decrement (non-blocking best-effort)\n      if (oldETag && oldETag !== eTag) {\n        this._deferredRefDecrement = oldETag\n      }\n      return slots\n    })\n\n    // Release the old eTag outside the CAS loop. An erasable blob dropping to\n    // refCount 0 here is crypto-shredded eagerly; a legacy one defers to GC.\n    if (this._deferredRefDecrement) {\n      const oldETag = this._deferredRefDecrement\n      this._deferredRefDecrement = undefined\n      await this.releaseRef(oldETag, 1, false).catch(() => {\n        // Best-effort — a missed decrement is reconciled by a later pass.\n      })\n    }\n  }\n\n  private _deferredRefDecrement: string | undefined\n\n  /**\n   * Fetch all bytes for the named slot.\n   * Returns `null` if the slot does not exist.\n   * Throws `NotFoundError` if the index entry exists but a chunk is missing.\n   */\n  async get(slotName: string): Promise<Uint8Array | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    if (slot.external) {\n      if (!this.objectStore) {\n        throw new NotFoundError(`Blob slot \"${slotName}\" is external but no objectStore is configured`)\n      }\n      return this.objectStore.getObject(slot.external.key)\n    }\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    return this.fetchAllChunks(result.blob)\n  }\n\n  /**\n   * A URL to fetch an `external` slot's object directly — presigned\n   * (time-limited) or public, per the projection. Returns `null` if the slot\n   * does not exist. Throws for a non-external slot (use `get()`/`response()`).\n   */\n  async url(slotName: string, opts?: { expiresInSeconds?: number }): Promise<string | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n    if (!slot.external) {\n      throw new NotFoundError(`Blob slot \"${slotName}\" is not external — url() is only for external fields`)\n    }\n    if (!this.objectStore) {\n      throw new NotFoundError(`Blob slot \"${slotName}\" is external but no objectStore is configured`)\n    }\n    return this.objectStore.objectUrl(slot.external.key, opts)\n  }\n\n  /**\n   * Build the backlink stamped onto an external object's metadata — the\n   * self-describing \"secondary store\" reference back to this record. See\n   * {@link BlobFieldPolicy.backlink}. Returns the `userMeta` to attach and, for\n   * `opaque-token`, the `token` to record on the slot.\n   */\n  private async buildBacklink(\n    slotName: string,\n    mode: 'opaque-token' | 'encrypted' | 'plain' | 'none',\n  ): Promise<{ userMeta?: Record<string, string>; token?: string }> {\n    if (mode === 'none') return {}\n    const ref = { vault: this.vault, collection: this.collection, record: this.recordId, field: slotName }\n    if (mode === 'plain') {\n      return {\n        userMeta: {\n          'noydb-vault': ref.vault,\n          'noydb-collection': ref.collection,\n          'noydb-record': ref.record,\n          'noydb-field': ref.field,\n        },\n      }\n    }\n    if (mode === 'encrypted' && this.encrypted) {\n      const dek = await this.getDEK(BLOB_COLLECTION)\n      const { iv, data } = await encrypt(JSON.stringify(ref), dek)\n      return { userMeta: { 'noydb-backlink-enc': `${iv}.${data}` } }\n    }\n    // opaque-token — also the fallback when `encrypted` is requested on a\n    // plaintext vault (no DEK to encrypt under).\n    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n    const token = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')\n    return { userMeta: { 'noydb-backlink': token }, token }\n  }\n\n  /**\n   * Adopt an EXISTING object in the projection into this slot **without\n   * re-uploading** — used by import/bootstrap to anchor objects already in the\n   * bucket. Writes the external slot record (the catalog entry).\n   */\n  async adoptExternal(\n    slotName: string,\n    ref: {\n      key: string\n      size?: number\n      contentType?: string\n      public?: boolean\n      backlink?: string\n      meta?: Record<string, unknown>\n    },\n  ): Promise<void> {\n    const uploaderUserId = this.userId\n    await this.casUpdateSlots((slots) => {\n      slots[slotName] = {\n        eTag: '',\n        external: {\n          key: ref.key,\n          ...(ref.contentType ? { contentType: ref.contentType } : {}),\n          ...(ref.public ? { public: true } : {}),\n          ...(ref.backlink ? { backlink: ref.backlink } : {}),\n          ...(ref.meta ? { meta: ref.meta } : {}),\n        },\n        filename: slotName,\n        size: ref.size ?? 0,\n        ...(ref.contentType ? { mimeType: ref.contentType } : {}),\n        uploadedAt: new Date().toISOString(),\n        ...(uploaderUserId !== undefined ? { uploadedBy: uploaderUserId } : {}),\n      }\n      return slots\n    })\n  }\n\n  /**\n   * Merge derived metadata (video `duration`, image `width`/`height`, arbitrary\n   * metatags) into an external slot's secondary metadata store. Typically called\n   * from an AWS-side processing callback (MediaConvert / ffprobe / Rekognition)\n   * once it has probed the object. No-op for a missing or non-external slot.\n   */\n  async setExternalMeta(slotName: string, meta: Record<string, unknown>): Promise<void> {\n    await this.casUpdateSlots((slots) => {\n      const slot = slots[slotName]\n      if (!slot?.external) return null\n      slots[slotName] = {\n        ...slot,\n        external: { ...slot.external, meta: { ...slot.external.meta, ...meta } },\n      }\n      return slots\n    })\n  }\n\n  /**\n   * Read an external slot's synced derived metadata (the secondary store).\n   * Returns `null` for a missing or non-external slot, `{}` if none synced yet.\n   */\n  async externalMeta(slotName: string): Promise<Record<string, unknown> | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot?.external) return null\n    return slot.external.meta ?? {}\n  }\n\n  /**\n   * List all slot entries for this record.\n   * Returns metadata only — no chunk data is loaded.\n   */\n  async list(): Promise<SlotInfo[]> {\n    const { slots } = await this.loadSlots()\n    return Object.entries(slots).map(([name, slot]) => ({ name, ...slot }))\n  }\n\n  /**\n   * Delete the named slot from this record.\n   * Decrements refCount on the blob. Chunks are GC'd by `vault.blobGC()`.\n   */\n  async delete(slotName: string): Promise<void> {\n    let eTagToRelease: string | undefined\n    let externalKeyToDelete: string | undefined\n\n    await this.casUpdateSlots((slots) => {\n      if (!(slotName in slots)) return null\n      const slot = slots[slotName]!\n      if (slot.external) externalKeyToDelete = slot.external.key\n      else eTagToRelease = slot.eTag\n      delete slots[slotName]\n      return slots\n    })\n\n    if (externalKeyToDelete && this.objectStore) {\n      // External objects are hard-deleted (no crypto-shred — they were never\n      // encrypted). CDN/replica cache TTLs may retain a copy; see the design.\n      await this.objectStore.deleteObject(externalKeyToDelete).catch(() => {})\n    }\n\n    if (eTagToRelease) {\n      // Erasable blobs are crypto-shredded at refCount 0 (this also covers\n      // compaction eviction, which routes through delete()); legacy blobs keep\n      // deferred-GC / orphan-retention semantics.\n      await this.releaseRef(eTagToRelease, 1, false).catch(() => {\n        // Best-effort — a missed decrement is reconciled by a later pass.\n      })\n    }\n  }\n\n  /**\n   * Return a native `Response` whose body streams the decrypted,\n   * decompressed blob bytes with full HTTP metadata headers.\n   *\n   * Note: implementation is buffered — all chunks are loaded into\n   * memory before being enqueued. True streaming deferred to.\n   *\n   * Returns `null` if the slot does not exist.\n   */\n  async response(slotName: string, opts?: BlobResponseOptions): Promise<Response | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    return this.buildResponse(slot, result.blob, opts)\n  }\n\n  /**\n   * Decrypt the slot and wrap the bytes in a browser ObjectURL ready\n   * to feed into `<img src>`, `<a href>`, etc. The caller MUST call\n   * `revoke()` when the URL is no longer needed — otherwise the URL\n   * (and the underlying decrypted Blob) are pinned for the lifetime\n   * of the document, which leaks memory in long-lived pages.\n   *\n   * Returns `null` when the slot does not exist.\n   *\n   * Throws when `URL.createObjectURL` is unavailable in the host\n   * environment (Node without DOM, restricted workers). Framework\n   * adapters — `useBlobURL` in `@noy-db/in-vue`, etc. — guard against\n   * this for SSR contexts and stay at `null` instead of propagating.\n   */\n  async objectURL(\n    slotName: string,\n    opts?: { mimeType?: string },\n  ): Promise<{ url: string; revoke: () => void } | null> {\n    if (typeof URL === 'undefined' || typeof URL.createObjectURL !== 'function') {\n      throw new Error(\n        'BlobSet.objectURL: URL.createObjectURL is unavailable in this environment. ' +\n        'Call this from the browser, or use BlobSet.get() and create the URL yourself.',\n      )\n    }\n    const bytes = await this.get(slotName)\n    if (!bytes) return null\n\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    const type = opts?.mimeType ?? slot?.mimeType ?? 'application/octet-stream'\n\n    // Pinning the underlying ArrayBuffer in a Blob is what backs the\n    // ObjectURL — once we createObjectURL the URL holds a strong ref\n    // to the Blob, so the local `blob` variable can fall out of scope.\n    // Copy through a fresh ArrayBuffer so TS narrows away the\n    // SharedArrayBuffer branch of `ArrayBufferLike` (Uint8Array is\n    // generic over the backing buffer type since TS 5.7).\n    const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer\n    const blob = new Blob([buffer], { type })\n    const url = URL.createObjectURL(blob)\n    let revoked = false\n    const revoke = (): void => {\n      if (revoked) return\n      revoked = true\n      URL.revokeObjectURL(url)\n    }\n    return { url, revoke }\n  }\n\n  // ─── Public API: Published versions (UC-3 amendment versioning) ───\n\n  /**\n   * Publish the current slot content as a named version snapshot.\n   *\n   * The published version holds an independent refCount reference to\n   * the blob. Even if the slot is later overwritten or deleted, the\n   * published version keeps the blob data alive.\n   *\n   * Publishing with an existing label overwrites it — if the eTags differ,\n   * refCounts are adjusted accordingly.\n   */\n  async publish(slotName: string, label: string): Promise<void> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) throw new NotFoundError(`Slot \"${slotName}\" not found on record \"${this.recordId}\"`)\n\n    // Check for existing version with this label\n    const existing = await this.loadVersionRecord(slotName, label)\n    if (existing && existing.eTag === slot.eTag) return // no-op: same blob\n\n    // Write the version record\n    const record: VersionRecord = {\n      label,\n      eTag: slot.eTag,\n      publishedAt: new Date().toISOString(),\n      ...(this.userId !== undefined ? { publishedBy: this.userId } : {}),\n    }\n    await this.writeVersionRecord(slotName, record)\n\n    // Increment refCount for the new version's eTag\n    await this.casUpdateRefCount(slot.eTag, +1)\n\n    // If overwriting an existing version with a different eTag, release the old\n    // one (crypto-shred at refCount 0 when erasable).\n    if (existing && existing.eTag !== slot.eTag) {\n      await this.releaseRef(existing.eTag, 1, false).catch(() => {})\n    }\n  }\n\n  /**\n   * Fetch bytes for a published version.\n   * Returns `null` if the version does not exist.\n   */\n  async getVersion(slotName: string, label: string): Promise<Uint8Array | null> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return null\n\n    const result = await this.loadBlobObject(record.eTag)\n    if (!result) return null\n\n    return this.fetchAllChunks(result.blob)\n  }\n\n  /**\n   * List all published versions for a slot.\n   */\n  async listVersions(slotName: string): Promise<VersionRecord[]> {\n    const prefix = `${this.recordId}::${slotName}::`\n    const allKeys = await this.store.list(this.vault, this.versionsCollection)\n    const matchingKeys = allKeys.filter((k) => k.startsWith(prefix))\n\n    const versions: VersionRecord[] = []\n    for (const key of matchingKeys) {\n      const envelope = await this.store.get(this.vault, this.versionsCollection, key)\n      if (!envelope) continue\n\n      if (!this.encrypted) {\n        versions.push(JSON.parse(envelope._data) as VersionRecord)\n      } else {\n        const dek = await this.getDEK(this.collection)\n        const json = await openEnvelopeJson(envelope, dek)\n        versions.push(JSON.parse(json) as VersionRecord)\n      }\n    }\n\n    return versions\n  }\n\n  /**\n   * Delete a published version. Decrements refCount on its blob.\n   */\n  async deleteVersion(slotName: string, label: string): Promise<void> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return\n\n    await this.deleteVersionRecord(slotName, label)\n    await this.releaseRef(record.eTag, 1, false).catch(() => {})\n  }\n\n  /**\n   * Return a `Response` for a published version — same as `response()`\n   * but reads from the version record's eTag instead of the current slot.\n   */\n  async responseVersion(\n    slotName: string,\n    label: string,\n    opts?: BlobResponseOptions,\n  ): Promise<Response | null> {\n    const record = await this.loadVersionRecord(slotName, label)\n    if (!record) return null\n\n    const result = await this.loadBlobObject(record.eTag)\n    if (!result) return null\n\n    // Build a synthetic SlotRecord from the version + blob data\n    const slotLike: SlotRecord = {\n      eTag: record.eTag,\n      filename: opts?.filename ?? `${slotName}-${label}`,\n      size: result.blob.size,\n      ...(result.blob.mimeType !== undefined ? { mimeType: result.blob.mimeType } : {}),\n      uploadedAt: record.publishedAt,\n      ...(record.publishedBy !== undefined ? { uploadedBy: record.publishedBy } : {}),\n    }\n\n    return this.buildResponse(slotLike, result.blob, opts)\n  }\n\n  // ─── Diagnostics ──────────────────────────────────────────────────\n\n  /**\n   * Return the `BlobObject` metadata for the named slot.\n   * Returns `null` if the slot or blob does not exist.\n   */\n  async blobInfo(slotName: string): Promise<BlobObject | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n    const result = await this.loadBlobObject(slot.eTag)\n    return result?.blob ?? null\n  }\n\n  // ─── Presigned URL (E5) ────────────────────────────────────────────\n\n  /**\n   * Generate a presigned URL for direct client download of the blob's\n   * ciphertext. Only works when the blob store supports `presignUrl`.\n   *\n   * **Important:** The URL returns encrypted data. The caller must\n   * decrypt client-side using `decryptResponse()` or a service worker.\n   *\n   * Returns `null` if the slot doesn't exist or the store doesn't support presigning.\n   */\n  async presignedUrl(slotName: string, expiresInSeconds = 3600): Promise<string | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    // Only works for single-chunk blobs where the store supports presigning\n    if (result.blob.chunkCount !== 1) return null\n    if (!this.store.presignUrl) return null\n\n    const chunkId = `${slot.eTag}_0`\n    return this.store.presignUrl(this.vault, '_blob_chunks', chunkId, expiresInSeconds)\n  }\n\n  /**\n   * Decrypt a ciphertext Response (e.g. from a presigned URL fetch)\n   * back into a plaintext Response with correct headers.\n   *\n   * Usage with service worker or client-side fetch:\n   * ```ts\n   * const url = await blobs.presignedUrl('invoice.pdf')\n   * const cipherResponse = await fetch(url)\n   * const plainResponse = await blobs.decryptResponse('invoice.pdf', cipherResponse)\n   * ```\n   */\n  async decryptResponse(slotName: string, cipherResponse: Response): Promise<Response | null> {\n    const { slots } = await this.loadSlots()\n    const slot = slots[slotName]\n    if (!slot) return null\n\n    const result = await this.loadBlobObject(slot.eTag)\n    if (!result) return null\n\n    // Parse the envelope from the ciphertext response\n    const text = await cipherResponse.text()\n    const envelope = JSON.parse(text) as { _iv: string; _data: string }\n\n    const blobDEK = this.encrypted ? await this.getDEK('_blob') : null\n    if (!blobDEK) {\n      return this.buildResponse(slot, result.blob, { inline: true })\n    }\n\n    // Decrypt the single chunk\n    const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount)\n    const { decryptBytesWithAAD: decryptAAD } = await import('../../kernel/enclave/index.js')\n    const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad)\n    const plaintext = result.blob.compression === 'gzip'\n      ? await decompressBytes(decrypted)\n      : decrypted\n\n    const body = new ReadableStream<Uint8Array>({\n      start(controller) {\n        controller.enqueue(plaintext)\n        controller.close()\n      },\n    })\n\n    const filename = slot.filename\n    return new Response(body, {\n      headers: {\n        'Content-Type': slot.mimeType ?? 'application/octet-stream',\n        'Content-Length': String(slot.size),\n        'ETag': `\"${slot.eTag}\"`,\n        'Content-Disposition': `inline; filename=\"${filename}\"`,\n        'Last-Modified': new Date(slot.uploadedAt).toUTCString(),\n      },\n    })\n  }\n\n  // ─── Internal: build Response from slot + blob ────────────────────\n\n  private async buildResponse(\n    slot: SlotRecord,\n    blob: BlobObject,\n    opts?: BlobResponseOptions,\n  ): Promise<Response> {\n    const fetchAllChunks = this.fetchAllChunks.bind(this)\n\n    // buffered — all chunks loaded into memory then enqueued.\n    const body = new ReadableStream<Uint8Array>({\n      async start(controller) {\n        try {\n          const output = await fetchAllChunks(blob)\n          controller.enqueue(output)\n          controller.close()\n        } catch (err) {\n          controller.error(err)\n        }\n      },\n    })\n\n    const filename = opts?.filename ?? slot.filename\n    const disposition = opts?.inline\n      ? `inline; filename=\"${filename}\"`\n      : `attachment; filename=\"${filename}\"`\n\n    return new Response(body, {\n      headers: {\n        'Content-Type': slot.mimeType ?? 'application/octet-stream',\n        'Content-Length': String(slot.size),\n        'ETag': `\"${slot.eTag}\"`,\n        'Content-Disposition': disposition,\n        'Last-Modified': new Date(slot.uploadedAt).toUTCString(),\n      },\n    })\n  }\n}\n\n// ─── Fallback for unencrypted mode ──────────────────────────────────────\n\nasync function plainSha256Hex(data: Uint8Array): Promise<string> {\n  return sha256Hex(data)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA8CA,SAAS,IAAI,GAAuB;AAClC,SAAO,IAAI,WAAW,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;AAChE;AAgBA,IAAM,cAAoC;AAAA;AAAA;AAAA,EAIxC,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG/F,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAGlF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA,EAGA,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAGnF,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,OAAO,EAAE;AAAA;AAAA,EAGxD,EAAE,MAAM,6BAA6B,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG9E,EAAE,MAAM,gBAAgB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGjE;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,QAAQ;AAAA,IACR,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA,EAKA,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGpE,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,gBAAgB,EAAE;AAAA;AAAA;AAAA,EAKvE,EAAE,MAAM,uBAAuB,QAAQ,UAAU,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG5G,EAAE,MAAM,uBAAuB,QAAQ,UAAU,OAAO,IAAI,sBAAsB,GAAG,eAAe,KAAK;AAAA;AAAA,EAGzG,EAAE,MAAM,+BAA+B,QAAQ,MAAM,OAAO,IAAI,mBAAmB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG1G,EAAE,MAAM,oBAAoB,QAAQ,MAAM,OAAO,IAAI,mBAAmB,GAAG,eAAe,KAAK;AAAA;AAAA,EAG/F,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAGzF,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,OAAO,GAAG,eAAe,KAAK;AAAA;AAAA,EAGrF,EAAE,MAAM,uBAAuB,QAAQ,SAAS,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAG5F,EAAE,MAAM,sBAAsB,QAAQ,QAAQ,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK7F;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,mBAAmB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGpE,EAAE,MAAM,cAAc,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGhE,EAAE,MAAM,cAAc,QAAQ,OAAO,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAKjF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA,EAGA,EAAE,MAAM,kBAAkB,QAAQ,OAAO,OAAO,IAAI,yBAAyB,GAAG,eAAe,KAAK;AAAA;AAAA,EAGpG,EAAE,MAAM,oBAAoB,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA,EAG1F,EAAE,MAAM,eAAe,QAAQ,OAAO,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA,EAGlF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,IAAI,aAAa;AAAA,IACxB,QAAQ;AAAA,IACR,gBAAgB,IAAI,aAAa;AAAA,IACjC,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA,EAIA,EAAE,MAAM,aAAa,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,QAAQ,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK9F,EAAE,MAAM,2BAA2B,QAAQ,UAAU,OAAO,IAAI,yBAAyB,EAAE;AAAA;AAAA,EAG3F,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,qBAAqB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,iDAAiD,QAAQ,MAAM,OAAO,IAAI,OAAO,EAAE;AAAA;AAAA,EAG3F,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA,EACvF,EAAE,MAAM,6BAA6B,QAAQ,gBAAgB,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASvF,EAAE,MAAM,uBAAuB,QAAQ,cAAc,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG/E,EAAE,MAAM,+BAA+B,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA;AAAA,EAKhF,EAAE,MAAM,yCAAyC,QAAQ,OAAO,OAAO,IAAI,sBAAsB,EAAE;AAAA;AAAA,EAGnG,EAAE,MAAM,qBAAqB,QAAQ,OAAO,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,qCAAqC,QAAQ,OAAO,OAAO,IAAI,aAAa,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAK3G,EAAE,MAAM,gCAAgC,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGlF,EAAE,MAAM,gCAAgC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGrF,EAAE,MAAM,wBAAwB,QAAQ,UAAU,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAG5E,EAAE,MAAM,iCAAiC,QAAQ,OAAO,OAAO,IAAI,UAAU,EAAE;AAAA,EAC/E,EAAE,MAAM,iCAAiC,QAAQ,YAAY,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA,EACzG,EAAE,MAAM,iCAAiC,QAAQ,YAAY,OAAO,IAAI,UAAU,GAAG,eAAe,KAAK;AAAA;AAAA;AAAA,EAKzG,EAAE,MAAM,kCAAkC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGvF,EAAE,MAAM,oBAAoB,QAAQ,QAAQ,OAAO,IAAI,aAAa,EAAE;AAAA;AAAA,EAGtE,EAAE,MAAM,kCAAkC,QAAQ,WAAW,OAAO,IAAI,aAAa,EAAE;AACzF;AASA,SAAS,cAAc,OAAe,OAAwB;AAC5D,SAAO,UAAU,QAAS,QAAQ,SAAU;AAC9C;AAWO,SAAS,eAAe,QAA4B;AACzD,QAAM,SAAS,YAAY,MAAM;AACjC,SAAO,QAAQ,QAAQ;AACzB;AAUO,SAAS,YACd,QACiE;AACjE,aAAW,QAAQ,aAAa;AAC9B,QAAI,UAAU,QAAQ,IAAI,GAAG;AAC3B,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,QACb,eAAe,KAAK,iBAAiB;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,UAAU,KAAK,cAAc,OAAO,CAAC,GAAI,OAAO,CAAC,CAAE,GAAG;AAC/D,WAAO,EAAE,MAAM,cAAc,QAAQ,OAAO,eAAe,KAAK;AAAA,EAClE;AAEA,SAAO;AACT;AAQO,SAAS,gBAAgB,UAA2B;AACzD,SAAO,qBAAqB,IAAI,QAAQ;AAC1C;AAIA,SAAS,UAAU,QAAoB,MAA0B;AAC/D,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,MAAM,SAAS,KAAK,MAAM;AAGhC,MAAI,OAAO,SAAS,IAAK,QAAO;AAGhC,WAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,QAAI,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,EAAG,QAAO;AAAA,EACnD;AAGA,MAAI,KAAK,kBAAkB,KAAK,oBAAoB,QAAW;AAC7D,UAAM,OAAO,KAAK,kBAAkB,KAAK,eAAe;AACxD,QAAI,OAAO,SAAS,KAAM,QAAO;AACjC,aAAS,IAAI,GAAG,IAAI,KAAK,eAAe,QAAQ,KAAK;AACnD,UAAI,OAAO,KAAK,kBAAkB,CAAC,MAAM,KAAK,eAAe,CAAC,EAAG,QAAO;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO;AACT;AAQA,IAAM,uBAAuB,IAAI;AAAA,EAC/B,YAAY,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC9D;;;AC1VO,IAAM,kBAAkB;AAGxB,IAAM,wBAAwB;AAO9B,IAAM,yBAAyB;AAG/B,IAAM,oBAAoB;AAG1B,IAAM,uBAAuB;AAO7B,IAAM,qBAAqB,MAAM;AAGxC,IAAM,kBAAkB;AAIxB,eAAe,cACb,MAC4D;AAC5D,MAAI,OAAO,sBAAsB,aAAa;AAC5C,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO;AAAA,EAC1C;AAKA,QAAM,QAAQ,IAAI,SAAS,IAA+B,EAAE,KAAM,YAAY,IAAI,kBAAkB,MAAM,CAAC;AAC3G,QAAM,MAAM,MAAM,IAAI,SAAS,KAAK,EAAE,YAAY;AAClD,SAAO,EAAE,OAAO,IAAI,WAAW,GAAG,GAAG,WAAW,OAAO;AACzD;AAEA,eAAe,gBAAgB,MAAuC;AACpE,MAAI,OAAO,wBAAwB,aAAa;AAC9C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,QAAQ,IAAI,SAAS,IAA+B,EAAE,KAAM,YAAY,IAAI,oBAAoB,MAAM,CAAC;AAC7G,QAAM,MAAM,MAAM,IAAI,SAAS,KAAK,EAAE,YAAY;AAClD,SAAO,IAAI,WAAW,GAAG;AAC3B;AAEA,SAAS,aAAa,QAAkC;AACtD,QAAM,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,YAAY,CAAC;AACzD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,QAAQ;AACtB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAGA,SAAS,SAAS,MAAc,YAAoB,YAAgC;AAClF,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,UAAU,EAAE;AACvE;AA+BO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAaT;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,aAAa,KAAK;AACvB,SAAK,WAAW,KAAK;AACrB,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,eAAe,KAAK;AACzB,SAAK,gBAAgB,KAAK,kBAAkB;AAC5C,SAAK,iBAAiB,KAAK,mBAAmB;AAC9C,SAAK,cAAc,KAAK;AACxB,SAAK,aAAa,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,gBAAgB,MAA4D;AACxF,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,UAAM,UAAU,MAAM,KAAK,OAAO,eAAe;AACjD,WAAO,KAAK,SAAS,SAAY,MAAM,UAAU,KAAK,MAAM,OAAO,IAAI;AAAA,EACzE;AAAA;AAAA,EAGA,IAAY,kBAA0B;AACpC,WAAO,GAAG,iBAAiB,GAAG,KAAK,UAAU;AAAA,EAC/C;AAAA;AAAA,EAGA,IAAY,qBAA6B;AACvC,WAAO,GAAG,oBAAoB,GAAG,KAAK,UAAU;AAAA,EAClD;AAAA;AAAA,EAIA,MAAc,YAGX;AACD,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,iBAAiB,KAAK,QAAQ;AACrF,QAAI,CAAC,SAAU,QAAO,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE;AAE9C,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,OAAO,KAAK,MAAM,SAAS,KAAK;AAAA,QAChC,SAAS,SAAS;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,UAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,WAAO;AAAA,MACL,OAAO,KAAK,MAAM,IAAI;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,OACA,gBACe;AACf,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI,iBAAiB;AAAA,QACrB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI,iBAAiB;AAAA,QACrB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,MAAM;AAAA,MACf,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,iBAAiB,IAAI,iBAAiB;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,QACe;AACf,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,KAAK,UAAU;AAChD,YAAM,UAAU,OAAO,KAAK;AAC5B,UAAI,YAAY,KAAM;AACtB,UAAI;AACF,cAAM,KAAK,UAAU,SAAS,OAAO;AACrC;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,eAAe,MAAqE;AAChG,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,uBAAuB,IAAI;AAC7E,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAiB,SAAS,SAAS,GAAG;AAAA,IAChF;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,UAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,WAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,SAAS,GAAG;AAAA,EACtE;AAAA,EAEA,MAAc,gBAAgB,MAAkB,iBAAyC;AACvF,UAAM,OAAO,KAAK,UAAU,IAAI;AAChC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,cAAc,mBAAmB,KAAK;AAC5C,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,YAAY,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC5F,OAAO;AACL,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,YAAY,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC5F;AAEA,UAAM,KAAK,MAAM;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,MAAc,OAAgC;AAC5E,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,cAAc,IAAI,YAAY;AACnE,YAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,YAAM,UAAsB,EAAE,GAAG,MAAM,UAAU,KAAK,WAAW,MAAM;AACvE,UAAI;AACF,cAAM,KAAK,gBAAgB,SAAS,OAAO;AAC3C,eAAO,QAAQ;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,cAAc,EAAE;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAc,WACZ,MACA,GACA,eACoD;AACpD,UAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,WAAW,OAAO,KAAK,SAAS;AACtC,UAAM,YAAY,MAAM,KAAK,kBAAkB,MAAM,CAAC,CAAC;AACvD,QAAI,YAAY,EAAG,QAAO,WAAW,mBAAmB;AAExD,QAAI,YAAY,eAAe;AAC7B,YAAM,KAAK,MAAM,OAAO,KAAK,OAAO,uBAAuB,IAAI;AAC/D,eAAS,IAAI,GAAG,IAAI,OAAO,KAAK,YAAY,KAAK;AAC/C,cAAM,KAAK,MAAM,OAAO,KAAK,OAAO,wBAAwB,GAAG,IAAI,IAAI,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AACA,WAAO,WAAW,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,oBAIH;AACD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,YAAY,OAAO,KAAK,KAAK;AACnC,UAAM,WAAqB,CAAC;AAC5B,UAAM,iBAA2B,CAAC;AAClC,UAAM,UAAoB,CAAC;AAC3B,QAAI,UAAU,WAAW,EAAG,QAAO,EAAE,UAAU,gBAAgB,QAAQ;AAGvE,UAAM,QAAQ,oBAAI,IAAoB;AACtC,eAAW,QAAQ,WAAW;AAC5B,YAAM,OAAO,MAAM,IAAI,EAAG;AAC1B,YAAM,IAAI,OAAO,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,IAC5C;AAEA,eAAW,CAAC,MAAM,CAAC,KAAK,OAAO;AAG7B,YAAM,UAAU,MAAM,KAAK,WAAW,MAAM,GAAG,IAAI;AACnD,UAAI,YAAY,WAAY,UAAS,KAAK,IAAI;AAAA,eACrC,YAAY,iBAAkB,gBAAe,KAAK,IAAI;AAAA,UAC1D,SAAQ,KAAK,IAAI;AAAA,IACxB;AAGA,UAAM,KAAK,MAAM,OAAO,KAAK,OAAO,KAAK,iBAAiB,KAAK,QAAQ;AACvE,WAAO,EAAE,UAAU,gBAAgB,QAAQ;AAAA,EAC7C;AAAA;AAAA,EAGA,MAAc,oBACZ,MACA,QACe;AACf,aAAS,UAAU,GAAG,UAAU,iBAAiB,WAAW;AAC1D,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,cAAc,IAAI,YAAY;AACnE,UAAI;AACF,cAAM,KAAK,gBAAgB,OAAO,OAAO,IAAI,GAAG,OAAO,OAAO;AAC9D;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAiB,UAAU,kBAAkB,EAAG;AACnE,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,cAAc,EAAE;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,UAAsE;AAC1E,UAAM,WAAqB,CAAC;AAC5B,UAAM,kBAA4B,CAAC;AACnC,QAAI,CAAC,KAAK,UAAW,QAAO,EAAE,UAAU,gBAAgB;AAExD,UAAM,UAAU,MAAM,KAAK,OAAO,eAAe;AACjD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,QAAQ,IAAI,IAAI,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAE7D,eAAW,QAAQ,OAAO;AACxB,YAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,UAAI,CAAC,OAAQ;AACb,YAAM,OAAO,OAAO;AACpB,UAAI,KAAK,SAAS,QAAW;AAAE,wBAAgB,KAAK,IAAI;AAAG;AAAA,MAAS;AAGpE,UAAI;AACJ,UAAI,KAAK,gBAAgB,QAAW;AAClC,qBAAa,MAAM,UAAU,KAAK,aAAa,OAAO;AAAA,MACxD,OAAO;AACL,qBAAa,MAAM,YAAY;AAC/B,cAAM,UAAU,MAAM,QAAQ,YAAY,OAAO;AACjD,cAAM,KAAK,oBAAoB,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,aAAa,QAAQ,EAAE;AAAA,MAC9E;AAGA,eAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAI;AACJ,YAAI;AACF,gBAAM,MAAM,KAAK,UAAU,MAAM,GAAG,KAAK,YAAY,OAAO;AAAA,QAC9D,QAAQ;AAEN,gBAAM,MAAM,KAAK,UAAU,MAAM,GAAG,KAAK,YAAY,UAAU;AAAA,QACjE;AACA,YAAI,CAAC,KAAK;AACR,gBAAM,IAAI;AAAA,YACR,cAAc,CAAC,IAAI,KAAK,UAAU,sBAAsB,IAAI;AAAA,UAC9D;AAAA,QACF;AACA,cAAM,KAAK,WAAW,MAAM,GAAG,KAAK,YAAY,KAAK,UAAU;AAAA,MACjE;AAGA,YAAM,KAAK,oBAAoB,MAAM,CAAC,MAAM;AAC1C,cAAM,EAAE,aAAa,GAAG,KAAK,IAAI;AACjC,eAAO,gBAAgB,SAAY,IAAI,EAAE,GAAG,MAAM,MAAM,YAAY;AAAA,MACtE,CAAC;AACD,eAAS,KAAK,IAAI;AAAA,IACpB;AACA,WAAO,EAAE,UAAU,gBAAgB;AAAA,EACrC;AAAA;AAAA,EAIA,MAAc,WACZ,MACA,OACA,YACA,OACA,KACe;AACf,UAAM,KAAK,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK;AACP,YAAM,MAAM,SAAS,MAAM,OAAO,UAAU;AAC5C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,oBAAoB,OAAO,KAAK,GAAG;AAC9D,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF,OAAO;AACL,iBAAW;AAAA,QACT,QAAQ;AAAA,QACR,IAAI;AAAA,QACJ,KAAK;AAAA,QACL,KAAK;AAAA,QACL,OAAO,eAAe,KAAK;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,wBAAwB,IAAI,QAAQ;AAAA,EACvE;AAAA,EAEA,MAAc,UACZ,MACA,OACA,YACA,KAC4B;AAC5B,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,wBAAwB,GAAG,IAAI,IAAI,KAAK,EAAE;AAC5F,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,KAAK;AACP,YAAM,MAAM,SAAS,MAAM,OAAO,UAAU;AAC5C,aAAO,MAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,IACzE;AAEA,WAAO,eAAe,SAAS,KAAK;AAAA,EACtC;AAAA;AAAA,EAIQ,WAAW,UAAkB,OAAuB;AAC1D,WAAO,GAAG,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,kBAAkB,UAAkB,OAA8C;AAC9F,UAAM,MAAM,KAAK,WAAW,UAAU,KAAK;AAC3C,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAC9E,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,KAAK,MAAM,SAAS,KAAK;AAAA,IAClC;AAEA,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,UAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAc,mBAAmB,UAAkB,QAAsC;AACvF,UAAM,MAAM,KAAK,WAAW,UAAU,OAAO,KAAK;AAClD,UAAM,OAAO,KAAK,UAAU,MAAM;AAClC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAI;AAEJ,QAAI,KAAK,WAAW;AAClB,YAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF,OAAO;AACL,iBAAW,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IACnF;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,KAAK,QAAQ;AAAA,EACzE;AAAA,EAEA,MAAc,oBAAoB,UAAkB,OAA8B;AAChF,UAAM,MAAM,KAAK,WAAW,UAAU,KAAK;AAC3C,UAAM,KAAK,MAAM,OAAO,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAAA,EAClE;AAAA;AAAA,EAIQ,mBAAmB,MAA+B;AACxD,QAAI,MAAM,UAAW,QAAO,KAAK;AACjC,QAAI,KAAK,aAAc,QAAO,KAAK;AACnC,WAAO;AAAA,EACT;AAAA;AAAA,EAIA,MAAc,eAAe,MAAuC;AAGlE,UAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI;AAChD,UAAM,SAAuB,CAAC;AAE9B,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,QAAQ,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,KAAK,YAAY,QAAQ;AAC1E,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,cAAc,CAAC,IAAI,KAAK,UAAU,sBAAsB,KAAK,IAAI,gBAAgB,KAAK,QAAQ;AAAA,QAChG;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAEA,UAAM,YAAY,aAAa,MAAM;AACrC,WAAO,KAAK,gBAAgB,SAAS,MAAM,gBAAgB,SAAS,IAAI;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,IAAI,UAAkB,MAAkB,MAAsC;AAKlF,QAAI,KAAK,eAAe,KAAK,aAAa,QAAQ,GAAG,UAAU;AAC7D,YAAM,SAAS,KAAK,WAAW,QAAQ;AACvC,UAAI,cAAc,MAAM;AACxB,UAAI,CAAC,aAAa;AAChB,cAAM,WAAW,YAAY,KAAK,SAAS,GAAG,EAAE,CAAC;AACjD,sBAAc,UAAU,QAAQ;AAAA,MAClC;AACA,YAAM,MAAM,GAAG,KAAK,UAAU,IAAI,KAAK,QAAQ,IAAI,QAAQ;AAC3D,YAAM,WAAW,OAAO,WAAW;AAGnC,YAAM,WAAW,MAAM,KAAK,cAAc,UAAU,OAAO,YAAY,cAAc;AACrF,YAAM,KAAK,YAAY,UAAU,KAAK,MAAM;AAAA,QAC1C;AAAA,QACA,QAAQ;AAAA,QACR,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC;AAED,YAAMA,kBAAiB,MAAM,cAAc,KAAK;AAChD,UAAI;AACJ,YAAM,KAAK,eAAe,CAAC,UAAU;AACnC,kBAAU,MAAM,QAAQ,GAAG,QAAQ;AAEnC,cAAM,WAAW,MAAM,QAAQ,GAAG,UAAU;AAC5C,cAAM,QAAQ,IAAI;AAAA,UAChB,MAAM;AAAA,UACN,UAAU;AAAA,YACR;AAAA,YACA;AAAA,YACA,GAAI,WAAW,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,YACnC,GAAI,SAAS,QAAQ,EAAE,UAAU,SAAS,MAAM,IAAI,CAAC;AAAA,YACrD,GAAI,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,UACvC;AAAA,UACA,UAAU,MAAM,YAAY;AAAA,UAC5B,MAAM,KAAK;AAAA,UACX,UAAU;AAAA,UACV,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACnC,GAAIA,oBAAmB,SAAY,EAAE,YAAYA,gBAAe,IAAI,CAAC;AAAA,QACvE;AACA,eAAO;AAAA,MACT,CAAC;AAED,UAAI,SAAS;AACX,cAAM,KAAK,WAAW,SAAS,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACzD;AACA;AAAA,IACF;AAGA,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,OAAO,eAAe,IAAI;AACtE,UAAM,OAAO,UACT,MAAM,cAAc,SAAS,IAAI,IACjC,MAAM,eAAe,IAAI;AAG7B,QAAI,WAAW,MAAM;AACrB,QAAI,CAAC,UAAU;AACb,YAAM,WAAW,YAAY,KAAK,SAAS,GAAG,EAAE,CAAC;AACjD,UAAI,SAAU,YAAW,SAAS;AAAA,IACpC;AAGA,QAAI;AACJ,QAAI,MAAM,aAAa,QAAW;AAChC,uBAAiB,KAAK;AAAA,IACxB,WAAW,YAAY,gBAAgB,QAAQ,GAAG;AAChD,uBAAiB;AAAA,IACnB,OAAO;AACL,uBAAiB;AAAA,IACnB;AAKA,QAAI,KAAK,eAAgB,kBAAiB;AAG1C,UAAM,eAAe,MAAM,KAAK,eAAe,IAAI;AAEnD,QAAI,cAAc;AAIhB,YAAM,KAAK,kBAAkB,MAAM,CAAE;AAAA,IACvC,OAAO;AAEL,YAAM,EAAE,OAAO,YAAY,UAAU,IAAI,iBACrC,MAAM,cAAc,IAAI,IACxB,EAAE,OAAO,MAAM,WAAW,OAAgB;AAI9C,YAAM,YAAY,KAAK,iBACnB,KAAK,IAAI,WAAW,YAAY,CAAC,IACjC,KAAK,mBAAmB,IAAI;AAChC,YAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,WAAW,aAAa,SAAS,CAAC;AAO3E,UAAI,WAAW;AACf,UAAI;AACJ,UAAI,WAAW,KAAK,eAAe;AACjC,cAAM,aAAa,MAAM,YAAY;AACrC,qBAAa,MAAM,QAAQ,YAAY,OAAO;AAC9C,mBAAW;AAAA,MACb;AAGA,eAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,cAAM,QAAQ,IAAI;AAClB,cAAM,KAAK;AAAA,UACT;AAAA,UAAM;AAAA,UAAG;AAAA,UACT,WAAW,SAAS,OAAO,QAAQ,SAAS;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAGA,YAAM,KAAK,gBAAgB;AAAA,QACzB;AAAA,QACA,MAAM,KAAK;AAAA,QACX,gBAAgB,WAAW;AAAA,QAC3B,aAAa;AAAA,QACb;AAAA,QACA;AAAA,QACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,QAC7C,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,UAAU;AAAA,QACV,GAAI,eAAe,SAAY,EAAE,MAAM,WAAW,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH;AAGA,UAAM,iBAAiB,MAAM,cAAc,KAAK;AAChD,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,UAAU,MAAM,QAAQ,GAAG;AACjC,YAAM,QAAQ,IAAI;AAAA,QAChB;AAAA,QACA,UAAU,MAAM,YAAY;AAAA,QAC5B,MAAM,KAAK;AAAA,QACX,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,QAC7C,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,GAAI,mBAAmB,SAAY,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA,MACvE;AAEA,UAAI,WAAW,YAAY,MAAM;AAC/B,aAAK,wBAAwB;AAAA,MAC/B;AACA,aAAO;AAAA,IACT,CAAC;AAID,QAAI,KAAK,uBAAuB;AAC9B,YAAM,UAAU,KAAK;AACrB,WAAK,wBAAwB;AAC7B,YAAM,KAAK,WAAW,SAAS,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAErD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,MAAM,IAAI,UAA8C;AACtD,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,QAAI,KAAK,UAAU;AACjB,UAAI,CAAC,KAAK,aAAa;AACrB,cAAM,IAAI,cAAc,cAAc,QAAQ,gDAAgD;AAAA,MAChG;AACA,aAAO,KAAK,YAAY,UAAU,KAAK,SAAS,GAAG;AAAA,IACrD;AAEA,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,eAAe,OAAO,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAI,UAAkB,MAA8D;AACxF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI,cAAc,cAAc,QAAQ,4DAAuD;AAAA,IACvG;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI,cAAc,cAAc,QAAQ,gDAAgD;AAAA,IAChG;AACA,WAAO,KAAK,YAAY,UAAU,KAAK,SAAS,KAAK,IAAI;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,cACZ,UACA,MACgE;AAChE,QAAI,SAAS,OAAQ,QAAO,CAAC;AAC7B,UAAM,MAAM,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,YAAY,QAAQ,KAAK,UAAU,OAAO,SAAS;AACrG,QAAI,SAAS,SAAS;AACpB,aAAO;AAAA,QACL,UAAU;AAAA,UACR,eAAe,IAAI;AAAA,UACnB,oBAAoB,IAAI;AAAA,UACxB,gBAAgB,IAAI;AAAA,UACpB,eAAe,IAAI;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,eAAe,KAAK,WAAW;AAC1C,YAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAC7C,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,GAAG,GAAG,GAAG;AAC3D,aAAO,EAAE,UAAU,EAAE,sBAAsB,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE;AAAA,IAC/D;AAGA,UAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,UAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC/E,WAAO,EAAE,UAAU,EAAE,kBAAkB,MAAM,GAAG,MAAM;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cACJ,UACA,KAQe;AACf,UAAM,iBAAiB,KAAK;AAC5B,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,QAAQ,IAAI;AAAA,QAChB,MAAM;AAAA,QACN,UAAU;AAAA,UACR,KAAK,IAAI;AAAA,UACT,GAAI,IAAI,cAAc,EAAE,aAAa,IAAI,YAAY,IAAI,CAAC;AAAA,UAC1D,GAAI,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,UACrC,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,UACjD,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,QACvC;AAAA,QACA,UAAU;AAAA,QACV,MAAM,IAAI,QAAQ;AAAA,QAClB,GAAI,IAAI,cAAc,EAAE,UAAU,IAAI,YAAY,IAAI,CAAC;AAAA,QACvD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,GAAI,mBAAmB,SAAY,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA,MACvE;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBAAgB,UAAkB,MAA8C;AACpF,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,YAAM,OAAO,MAAM,QAAQ;AAC3B,UAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,YAAM,QAAQ,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,UAAU,EAAE,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG,KAAK,SAAS,MAAM,GAAG,KAAK,EAAE;AAAA,MACzE;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAA2D;AAC5E,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,WAAO,KAAK,SAAS,QAAQ,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAA4B;AAChC,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,WAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,UAAiC;AAC5C,QAAI;AACJ,QAAI;AAEJ,UAAM,KAAK,eAAe,CAAC,UAAU;AACnC,UAAI,EAAE,YAAY,OAAQ,QAAO;AACjC,YAAM,OAAO,MAAM,QAAQ;AAC3B,UAAI,KAAK,SAAU,uBAAsB,KAAK,SAAS;AAAA,UAClD,iBAAgB,KAAK;AAC1B,aAAO,MAAM,QAAQ;AACrB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,uBAAuB,KAAK,aAAa;AAG3C,YAAM,KAAK,YAAY,aAAa,mBAAmB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACzE;AAEA,QAAI,eAAe;AAIjB,YAAM,KAAK,WAAW,eAAe,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAE3D,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,UAAkB,MAAsD;AACrF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,cAAc,MAAM,OAAO,MAAM,IAAI;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,UACJ,UACA,MACqD;AACrD,QAAI,OAAO,QAAQ,eAAe,OAAO,IAAI,oBAAoB,YAAY;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,KAAK,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AAEnB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,UAAM,OAAO,MAAM,YAAY,MAAM,YAAY;AAQjD,UAAM,SAAS,MAAM,OAAO,MAAM,MAAM,YAAY,MAAM,aAAa,MAAM,UAAU;AACvF,UAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,KAAK,CAAC;AACxC,UAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,QAAI,UAAU;AACd,UAAM,SAAS,MAAY;AACzB,UAAI,QAAS;AACb,gBAAU;AACV,UAAI,gBAAgB,GAAG;AAAA,IACzB;AACA,WAAO,EAAE,KAAK,OAAO;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,QAAQ,UAAkB,OAA8B;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,SAAS,QAAQ,0BAA0B,KAAK,QAAQ,GAAG;AAG9F,UAAM,WAAW,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC7D,QAAI,YAAY,SAAS,SAAS,KAAK,KAAM;AAG7C,UAAM,SAAwB;AAAA,MAC5B;AAAA,MACA,MAAM,KAAK;AAAA,MACX,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,GAAI,KAAK,WAAW,SAAY,EAAE,aAAa,KAAK,OAAO,IAAI,CAAC;AAAA,IAClE;AACA,UAAM,KAAK,mBAAmB,UAAU,MAAM;AAG9C,UAAM,KAAK,kBAAkB,KAAK,MAAM,CAAE;AAI1C,QAAI,YAAY,SAAS,SAAS,KAAK,MAAM;AAC3C,YAAM,KAAK,WAAW,SAAS,MAAM,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,UAAkB,OAA2C;AAC5E,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAS,MAAM,KAAK,eAAe,OAAO,IAAI;AACpD,QAAI,CAAC,OAAQ,QAAO;AAEpB,WAAO,KAAK,eAAe,OAAO,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,UAA4C;AAC7D,UAAM,SAAS,GAAG,KAAK,QAAQ,KAAK,QAAQ;AAC5C,UAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK,OAAO,KAAK,kBAAkB;AACzE,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC;AAE/D,UAAM,WAA4B,CAAC;AACnC,eAAW,OAAO,cAAc;AAC9B,YAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,oBAAoB,GAAG;AAC9E,UAAI,CAAC,SAAU;AAEf,UAAI,CAAC,KAAK,WAAW;AACnB,iBAAS,KAAK,KAAK,MAAM,SAAS,KAAK,CAAkB;AAAA,MAC3D,OAAO;AACL,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,UAAU;AAC7C,cAAM,OAAO,MAAM,iBAAiB,UAAU,GAAG;AACjD,iBAAS,KAAK,KAAK,MAAM,IAAI,CAAkB;AAAA,MACjD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,UAAkB,OAA8B;AAClE,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ;AAEb,UAAM,KAAK,oBAAoB,UAAU,KAAK;AAC9C,UAAM,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBACJ,UACA,OACA,MAC0B;AAC1B,UAAM,SAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK;AAC3D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAS,MAAM,KAAK,eAAe,OAAO,IAAI;AACpD,QAAI,CAAC,OAAQ,QAAO;AAGpB,UAAM,WAAuB;AAAA,MAC3B,MAAM,OAAO;AAAA,MACb,UAAU,MAAM,YAAY,GAAG,QAAQ,IAAI,KAAK;AAAA,MAChD,MAAM,OAAO,KAAK;AAAA,MAClB,GAAI,OAAO,KAAK,aAAa,SAAY,EAAE,UAAU,OAAO,KAAK,SAAS,IAAI,CAAC;AAAA,MAC/E,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,gBAAgB,SAAY,EAAE,YAAY,OAAO,YAAY,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,KAAK,cAAc,UAAU,OAAO,MAAM,IAAI;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,UAA8C;AAC3D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAa,UAAkB,mBAAmB,MAA8B;AACpF,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,OAAO,KAAK,eAAe,EAAG,QAAO;AACzC,QAAI,CAAC,KAAK,MAAM,WAAY,QAAO;AAEnC,UAAM,UAAU,GAAG,KAAK,IAAI;AAC5B,WAAO,KAAK,MAAM,WAAW,KAAK,OAAO,gBAAgB,SAAS,gBAAgB;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,gBAAgB,UAAkB,gBAAoD;AAC1F,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU;AACvC,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,MAAM,KAAK,eAAe,KAAK,IAAI;AAClD,QAAI,CAAC,OAAQ,QAAO;AAGpB,UAAM,OAAO,MAAM,eAAe,KAAK;AACvC,UAAM,WAAW,KAAK,MAAM,IAAI;AAEhC,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,OAAO,OAAO,IAAI;AAC9D,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,cAAc,MAAM,OAAO,MAAM,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC/D;AAGA,UAAM,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO,KAAK,UAAU;AACzD,UAAM,EAAE,qBAAqB,WAAW,IAAI,MAAM,OAAO,uBAA+B;AACxF,UAAM,YAAY,MAAM,WAAW,SAAS,KAAK,SAAS,OAAO,SAAS,GAAG;AAC7E,UAAM,YAAY,OAAO,KAAK,gBAAgB,SAC1C,MAAM,gBAAgB,SAAS,IAC/B;AAEJ,UAAM,OAAO,IAAI,eAA2B;AAAA,MAC1C,MAAM,YAAY;AAChB,mBAAW,QAAQ,SAAS;AAC5B,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF,CAAC;AAED,UAAM,WAAW,KAAK;AACtB,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB,KAAK,YAAY;AAAA,QACjC,kBAAkB,OAAO,KAAK,IAAI;AAAA,QAClC,QAAQ,IAAI,KAAK,IAAI;AAAA,QACrB,uBAAuB,qBAAqB,QAAQ;AAAA,QACpD,iBAAiB,IAAI,KAAK,KAAK,UAAU,EAAE,YAAY;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAIA,MAAc,cACZ,MACA,MACA,MACmB;AACnB,UAAM,iBAAiB,KAAK,eAAe,KAAK,IAAI;AAGpD,UAAM,OAAO,IAAI,eAA2B;AAAA,MAC1C,MAAM,MAAM,YAAY;AACtB,YAAI;AACF,gBAAM,SAAS,MAAM,eAAe,IAAI;AACxC,qBAAW,QAAQ,MAAM;AACzB,qBAAW,MAAM;AAAA,QACnB,SAAS,KAAK;AACZ,qBAAW,MAAM,GAAG;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,WAAW,MAAM,YAAY,KAAK;AACxC,UAAM,cAAc,MAAM,SACtB,qBAAqB,QAAQ,MAC7B,yBAAyB,QAAQ;AAErC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB,KAAK,YAAY;AAAA,QACjC,kBAAkB,OAAO,KAAK,IAAI;AAAA,QAClC,QAAQ,IAAI,KAAK,IAAI;AAAA,QACrB,uBAAuB;AAAA,QACvB,iBAAiB,IAAI,KAAK,KAAK,UAAU,EAAE,YAAY;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAIA,eAAe,eAAe,MAAmC;AAC/D,SAAO,UAAU,IAAI;AACvB;","names":["uploaderUserId"]}

package/dist/chunk-5GAX2QOH.js

@@ -1,132 +0,0 @@
-import {
-  readPath
-} from "./chunk-KCG3BHFG.js";
-
-// src/with-lookup/indexing/eager-indexes.ts
-var CollectionIndexes = class {
-  indexes = /* @__PURE__ */ new Map();
-  /**
-   * Declare an index. Subsequent record additions are tracked under it.
-   * Calling this twice for the same field is a no-op (idempotent).
-   */
-  declare(field) {
-    if (this.indexes.has(field)) return;
-    this.indexes.set(field, { field, buckets: /* @__PURE__ */ new Map() });
-  }
-  /** True if the given field has a declared index. */
-  has(field) {
-    return this.indexes.has(field);
-  }
-  /** All declared field names, in declaration order. */
-  fields() {
-    return [...this.indexes.keys()];
-  }
-  /**
-   * Build all declared indexes from a snapshot of records.
-   * Called once per hydration. O(N × indexes.size).
-   */
-  build(records) {
-    for (const idx of this.indexes.values()) {
-      idx.buckets.clear();
-      for (const { id, record } of records) {
-        addToIndex(idx, id, record);
-      }
-    }
-  }
-  /**
-   * Insert or update a single record across all indexes.
-   * Called by `Collection.put()` after the encrypted write succeeds.
-   *
-   * If `previousRecord` is provided, the record is removed from any old
-   * buckets first — this is the update path. Pass `null` for fresh adds.
-   */
-  upsert(id, newRecord, previousRecord) {
-    if (this.indexes.size === 0) return;
-    if (previousRecord !== null) {
-      this.remove(id, previousRecord);
-    }
-    for (const idx of this.indexes.values()) {
-      addToIndex(idx, id, newRecord);
-    }
-  }
-  /**
-   * Remove a record from all indexes. Called by `Collection.delete()`
-   * (and as the first half of `upsert` for the update path).
-   */
-  remove(id, record) {
-    if (this.indexes.size === 0) return;
-    for (const idx of this.indexes.values()) {
-      removeFromIndex(idx, id, record);
-    }
-  }
-  /** Drop all index data. Called when the collection is invalidated. */
-  clear() {
-    for (const idx of this.indexes.values()) {
-      idx.buckets.clear();
-    }
-  }
-  /**
-   * Equality lookup: return the set of record ids whose `field` matches
-   * the given value. Returns `null` if no index covers the field — the
-   * caller should fall back to a linear scan.
-   *
-   * The returned Set is a reference to the index's internal storage —
-   * callers must NOT mutate it.
-   */
-  lookupEqual(field, value) {
-    const idx = this.indexes.get(field);
-    if (!idx) return null;
-    const key = stringifyKey(value);
-    return idx.buckets.get(key) ?? EMPTY_SET;
-  }
-  /**
-   * Set lookup: return the union of record ids whose `field` matches any
-   * of the given values. Returns `null` if no index covers the field.
-   */
-  lookupIn(field, values) {
-    const idx = this.indexes.get(field);
-    if (!idx) return null;
-    const out = /* @__PURE__ */ new Set();
-    for (const value of values) {
-      const key = stringifyKey(value);
-      const bucket = idx.buckets.get(key);
-      if (bucket) {
-        for (const id of bucket) out.add(id);
-      }
-    }
-    return out;
-  }
-};
-var EMPTY_SET = /* @__PURE__ */ new Set();
-function stringifyKey(value) {
-  if (value === null || value === void 0) return "\0NULL\0";
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  if (value instanceof Date) return value.toISOString();
-  return "\0OBJECT\0";
-}
-function addToIndex(idx, id, record) {
-  const value = readPath(record, idx.field);
-  if (value === null || value === void 0) return;
-  const key = stringifyKey(value);
-  let bucket = idx.buckets.get(key);
-  if (!bucket) {
-    bucket = /* @__PURE__ */ new Set();
-    idx.buckets.set(key, bucket);
-  }
-  bucket.add(id);
-}
-function removeFromIndex(idx, id, record) {
-  const value = readPath(record, idx.field);
-  if (value === null || value === void 0) return;
-  const key = stringifyKey(value);
-  const bucket = idx.buckets.get(key);
-  if (!bucket) return;
-  bucket.delete(id);
-  if (bucket.size === 0) idx.buckets.delete(key);
-}
-
-export {
-  CollectionIndexes
-};
-//# sourceMappingURL=chunk-5GAX2QOH.js.map

package/dist/chunk-5GAX2QOH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-lookup/indexing/eager-indexes.ts"],"sourcesContent":["/**\n * Secondary indexes for the query DSL.\n *\n * ships **in-memory hash indexes**:\n *   - Built during `Collection.ensureHydrated()` from the decrypted cache\n *   - Maintained incrementally on `put` and `delete`\n *   - Consulted by the query executor for `==` and `in` operators on\n *     indexed fields, falling back to a linear scan otherwise\n *   - Live entirely in memory — no adapter writes for the index itself\n *\n * Persistent encrypted index blobs (the spec's \"store as a separate\n * AES-256-GCM blob\" note) are deferred to a follow-up issue. The reasons\n * are documented in the PR body — short version: at the target\n * scale of 1K–50K records, building the index during hydrate is free,\n * so persistence buys nothing measurable.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\n\n/**\n * Index declaration accepted by `Collection`'s constructor.\n *\n * Accepts:\n *   - `string` — a single-field hash index (`'clientId'`)\n *   - `{ fields: [...] }` or `readonly string[]` — a composite index\n *     over an ordered field tuple. Only lazy-mode\n *     collections consume composite declarations today; eager mode\n *     silently treats a composite as equivalent to declaring each\n *     component field as its own single-field index.\n *\n * Additive variants (unique constraints, partial indexes) will land as\n * further union members without breaking existing declarations.\n */\nexport type IndexDef =\n  | string\n  | { readonly fields: readonly string[]; readonly unique?: boolean }\n  | readonly string[]\n\n/**\n * Internal representation of a built hash index.\n *\n * Maps stringified field values to the set of record ids whose value\n * for that field matches. Stringification keeps the index simple and\n * works uniformly for primitives (`'open'`, `'42'`, `'true'`).\n *\n * Records whose indexed field is `undefined` or `null` are NOT inserted\n * — `query().where('field', '==', undefined)` falls back to a linear\n * scan, which is the conservative behavior.\n */\nexport interface HashIndex {\n  readonly field: string\n  readonly buckets: Map<string, Set<string>>\n}\n\n/**\n * Container for all indexes on a single collection.\n *\n * Methods are pure with respect to the in-memory `buckets` Map — they\n * never touch the adapter or the keyring. The Collection class owns\n * lifecycle (build on hydrate, maintain on put/delete).\n */\nexport class CollectionIndexes {\n  private readonly indexes = new Map<string, HashIndex>()\n\n  /**\n   * Declare an index. Subsequent record additions are tracked under it.\n   * Calling this twice for the same field is a no-op (idempotent).\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { field, buckets: new Map() })\n  }\n\n  /** True if the given field has a declared index. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Build all declared indexes from a snapshot of records.\n   * Called once per hydration. O(N × indexes.size).\n   */\n  build<T>(records: ReadonlyArray<{ id: string; record: T }>): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n      for (const { id, record } of records) {\n        addToIndex(idx, id, record)\n      }\n    }\n  }\n\n  /**\n   * Insert or update a single record across all indexes.\n   * Called by `Collection.put()` after the encrypted write succeeds.\n   *\n   * If `previousRecord` is provided, the record is removed from any old\n   * buckets first — this is the update path. Pass `null` for fresh adds.\n   */\n  upsert<T>(id: string, newRecord: T, previousRecord: T | null): void {\n    if (this.indexes.size === 0) return\n    if (previousRecord !== null) {\n      this.remove(id, previousRecord)\n    }\n    for (const idx of this.indexes.values()) {\n      addToIndex(idx, id, newRecord)\n    }\n  }\n\n  /**\n   * Remove a record from all indexes. Called by `Collection.delete()`\n   * (and as the first half of `upsert` for the update path).\n   */\n  remove<T>(id: string, record: T): void {\n    if (this.indexes.size === 0) return\n    for (const idx of this.indexes.values()) {\n      removeFromIndex(idx, id, record)\n    }\n  }\n\n  /** Drop all index data. Called when the collection is invalidated. */\n  clear(): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n    }\n  }\n\n  /**\n   * Equality lookup: return the set of record ids whose `field` matches\n   * the given value. Returns `null` if no index covers the field — the\n   * caller should fall back to a linear scan.\n   *\n   * The returned Set is a reference to the index's internal storage —\n   * callers must NOT mutate it.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    const key = stringifyKey(value)\n    return idx.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup: return the union of record ids whose `field` matches any\n   * of the given values. Returns `null` if no index covers the field.\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const key = stringifyKey(value)\n      const bucket = idx.buckets.get(key)\n      if (bucket) {\n        for (const id of bucket) out.add(id)\n      }\n    }\n    return out\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\n\n/**\n * Stringify a value into a stable bucket key.\n *\n * `null`/`undefined` produce a sentinel that records will never match\n * (so we never index nullish values — `where('x', '==', null)` falls back\n * to a linear scan). Numbers, booleans, strings, and Date objects are\n * coerced via `String()`. Objects produce a sentinel that no real record\n * will match — querying with object values is a code smell.\n */\nfunction stringifyKey(value: unknown): string {\n  if (value === null || value === undefined) return '\\0NULL\\0'\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  return '\\0OBJECT\\0'\n}\n\nfunction addToIndex<T>(idx: HashIndex, id: string, record: T): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = stringifyKey(value)\n  let bucket = idx.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    idx.buckets.set(key, bucket)\n  }\n  bucket.add(id)\n}\n\nfunction removeFromIndex<T>(idx: HashIndex, id: string, record: T): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = stringifyKey(value)\n  const bucket = idx.buckets.get(key)\n  if (!bucket) return\n  bucket.delete(id)\n  // Clean up empty buckets so the Map doesn't accumulate dead keys.\n  if (bucket.size === 0) idx.buckets.delete(key)\n}\n"],"mappings":";;;;;AA6DO,IAAM,oBAAN,MAAwB;AAAA,EACZ,UAAU,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,OAAO,SAAS,oBAAI,IAAI,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAS,SAAyD;AAChE,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAClB,iBAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,mBAAW,KAAK,IAAI,MAAM;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAU,IAAY,WAAc,gBAAgC;AAClE,QAAI,KAAK,QAAQ,SAAS,EAAG;AAC7B,QAAI,mBAAmB,MAAM;AAC3B,WAAK,OAAO,IAAI,cAAc;AAAA,IAChC;AACA,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,iBAAW,KAAK,IAAI,SAAS;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAU,IAAY,QAAiB;AACrC,QAAI,KAAK,QAAQ,SAAS,EAAG;AAC7B,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,sBAAgB,KAAK,IAAI,MAAM;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA,QAAc;AACZ,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,YAAY,OAAe,OAA4C;AACrE,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,OAAe,QAAwD;AAC9E,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,UAAI,QAAQ;AACV,mBAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAW/C,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO;AACT;AAEA,SAAS,WAAc,KAAgB,IAAY,QAAiB;AAClE,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,QAAI,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO,IAAI,EAAE;AACf;AAEA,SAAS,gBAAmB,KAAgB,IAAY,QAAiB;AACvE,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,aAAa,KAAK;AAC9B,QAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO,OAAO,EAAE;AAEhB,MAAI,OAAO,SAAS,EAAG,KAAI,QAAQ,OAAO,GAAG;AAC/C;","names":[]}

package/dist/chunk-5SAZMBW7.js

@@ -1,202 +0,0 @@
-import {
-  openEnvelopeJson
-} from "./chunk-XHD3L3JO.js";
-import {
-  encrypt
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-import {
-  ConflictError,
-  SequenceContentionError,
-  SequenceNotEnabledError,
-  SequenceOfflineError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-commit/sequence/strategy.ts
-var NO_SEQUENCE = {
-  createStore() {
-    throw new SequenceNotEnabledError();
-  }
-};
-
-// src/with-commit/sequence/index.ts
-var SEQUENCE_COLLECTION = "_sequences";
-var MAX_NEXT_ATTEMPTS = 16;
-var SEQ_FORMAT_TOKEN = /\{([^{}]*)\}/g;
-var SEQ_PAD_TOKEN = /^seq:0(\d+)$/;
-var SEQ_PARTITION_TOKEN = /^partition\.(\d+)$/;
-function compileSequenceFormat(format, series, partition) {
-  const parts = partition ?? [];
-  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {
-    const token = m[1] ?? "";
-    if (token === "seq") continue;
-    if (SEQ_PAD_TOKEN.test(token)) continue;
-    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
-    if (partMatch) {
-      const idx = Number(partMatch[1]);
-      if (idx >= parts.length) {
-        throw new ValidationError(
-          `sequence("${series}"): format token "{${token}}" references partition index ${idx}, but only ${parts.length} partition component(s) were supplied.`
-        );
-      }
-      continue;
-    }
-    throw new ValidationError(
-      `sequence("${series}"): format contains unknown token "{${token}}". Accepted tokens: {seq}, {seq:0N}, {partition.i}.`
-    );
-  }
-  return (serial) => format.replace(SEQ_FORMAT_TOKEN, (full, token) => {
-    if (token === "seq") return String(serial);
-    const padMatch = SEQ_PAD_TOKEN.exec(token);
-    if (padMatch) return String(serial).padStart(Number(padMatch[1]), "0");
-    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
-    if (partMatch) return String(parts[Number(partMatch[1])]);
-    return full;
-  });
-}
-function resolveSequenceKey(series, opts) {
-  const partition = opts?.partition;
-  if (!partition || partition.length === 0) return series;
-  const parts = partition.map((p) => {
-    if (typeof p === "number" && !Number.isFinite(p)) {
-      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`);
-    }
-    const s = String(p);
-    if (s === "") {
-      throw new ValidationError("sequence partition component must not be empty");
-    }
-    return encodeURIComponent(s);
-  });
-  return `${series}\0${parts.join("/")}`;
-}
-async function sleepBackoff(attempt) {
-  const ceil = Math.min(2 ** attempt, 32);
-  const ms = Math.floor(Math.random() * ceil);
-  await new Promise((r) => setTimeout(r, ms));
-}
-var SequenceStore = class {
-  adapter;
-  vault;
-  encrypted;
-  getDEK;
-  actor;
-  /**
-   * Memoized DEK promise. The `_sequences` collection DEK is created on
-   * first access; without sharing one promise, a burst of concurrent
-   * `next()` calls would each trigger DEK creation and diverge (one
-   * writer's ciphertext unreadable by another). One shared promise → one
-   * DEK.
-   */
-  dekPromise = null;
-  constructor(opts) {
-    this.adapter = opts.adapter;
-    this.vault = opts.vault;
-    this.encrypted = opts.encrypted;
-    this.getDEK = opts.getDEK;
-    this.actor = opts.actor;
-  }
-  /** A handle bound to one sequence name. */
-  handle(name) {
-    return {
-      next: () => this.next(name),
-      peek: () => this.peek(name),
-      seedTo: (n) => this.seedTo(name, n)
-    };
-  }
-  assertOnline() {
-    if (this.adapter.capabilities?.casAtomic !== true) {
-      throw new SequenceOfflineError();
-    }
-  }
-  dek() {
-    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION);
-    return this.dekPromise;
-  }
-  async read(name) {
-    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
-    if (!env) return { env: null, value: 0 };
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
-    const state = JSON.parse(json);
-    return { env, value: state.value };
-  }
-  async encryptState(state, version) {
-    const json = JSON.stringify(state);
-    if (!this.encrypted) {
-      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
-    }
-    const { iv, data } = await encrypt(json, await this.dek());
-    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
-  }
-  async peek(name) {
-    return (await this.read(name)).value;
-  }
-  async next(name) {
-    this.assertOnline();
-    let lastConflict;
-    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
-      const { env, value } = await this.read(name);
-      const nextValue = value + 1;
-      const expectedVersion = env?._v ?? 0;
-      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1);
-      try {
-        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
-        return nextValue;
-      } catch (err) {
-        if (err instanceof ConflictError) {
-          lastConflict = err;
-          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
-          continue;
-        }
-        throw err;
-      }
-    }
-    void lastConflict;
-    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
-  }
-  async seedTo(name, n) {
-    this.assertOnline();
-    if (n <= 0) return;
-    let lastConflict;
-    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
-      const { env, value } = await this.read(name);
-      if (value >= n) return;
-      const expectedVersion = env?._v ?? 0;
-      const envelope = await this.encryptState({ value: n }, expectedVersion + 1);
-      try {
-        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
-        return;
-      } catch (err) {
-        if (err instanceof ConflictError) {
-          lastConflict = err;
-          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
-          continue;
-        }
-        throw err;
-      }
-    }
-    void lastConflict;
-    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
-  }
-};
-
-// src/with-commit/sequence/active.ts
-function withSequence() {
-  return {
-    createStore(opts) {
-      return new SequenceStore(opts);
-    }
-  };
-}
-
-export {
-  withSequence,
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey,
-  SequenceStore
-};
-//# sourceMappingURL=chunk-5SAZMBW7.js.map

package/dist/chunk-5TZZUL5X.js

@@ -1,30 +0,0 @@
-import {
-  PortabilityNotEnabledError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/portability/strategy.ts
-var NO_PORTABILITY = {
-  async exportAccessibleData() {
-    throw new PortabilityNotEnabledError();
-  },
-  async withdrawAccessibleData() {
-    throw new PortabilityNotEnabledError();
-  },
-  async requestWithdrawal() {
-    throw new PortabilityNotEnabledError();
-  },
-  async listWithdrawalRequests() {
-    throw new PortabilityNotEnabledError();
-  },
-  async approveWithdrawal() {
-    throw new PortabilityNotEnabledError();
-  },
-  async rejectWithdrawal() {
-    throw new PortabilityNotEnabledError();
-  }
-};
-
-export {
-  NO_PORTABILITY
-};
-//# sourceMappingURL=chunk-5TZZUL5X.js.map