@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.11

package/dist/chunk-A5BDDEXK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/query/live.ts","../src/with-lookup/aggregate/strategy.ts","../src/kernel/query/builder.ts","../src/kernel/query/scan-builder.ts"],"sourcesContent":["/**\n * Reactive query primitive — `query.live()`.\n *\n * produces a `LiveQuery<T>` that re-runs the query and\n * updates its `value` whenever any source feeding it (the left\n * collection AND every right-side collection a join leg points at)\n * mutates.\n *\n * Framework-agnostic by design. The Vue layer wraps a `LiveQuery`\n * in a Vue `Ref<T[]>` by subscribing once and copying `value` into\n * the ref on every notification. React/Solid/Svelte adapters do the\n * same with their own primitives. Core never depends on a UI\n * framework.\n *\n * **Error semantics.** A `.live()` query may throw at re-run time —\n * a strict-mode `DanglingReferenceError` is the most common case\n * (a right-side record was deleted out-of-band, leaving a left\n * row's FK pointing at nothing). When the re-run throws, the\n * `LiveQuery` catches the error and stores it in the `error`\n * field; it does NOT propagate the throw out of the source's\n * change handler, because doing so would tear down whatever\n * upstream emitter is dispatching. Listeners check `error` after\n * each notification and render an error state in the UI.\n *\n * **Dedup of right-side subscriptions.** A multi-FK chain that\n * joins the same target twice (e.g.\n * `.join('billingClientId').join('shippingClientId')`, both\n * pointing at `clients`) only subscribes to that target once. We\n * dedup by target collection name, on the assumption that\n * `resolveSource(name)` returns a single subscribable source per\n * vault + name. Vault's `resolveSource` reads from\n * `collectionCache` so this assumption holds.\n *\n * **What .live() does NOT do in v1:**\n *   - No granular delta updates — the whole query re-runs on every\n *     change. Granular delta tracking is a v2 optimization once\n *     the API is stable.\n *   - No batching of bursty changes — one event in, one re-run\n *     out. Batching with microtask coalescing is a v2 enhancement.\n *   - No async notifications — every notification is synchronous\n *     within the source's change handler.\n *   - No re-planning under live mutations — the planner picks once\n *     at subscription time and reuses the same plan for every\n *     re-run.\n */\n\n/**\n * The reactive primitive returned by `Query.live()`.\n *\n * Listeners can read the current `value` snapshot at any time and\n * subscribe to changes via `.subscribe(cb)`. The `error` field\n * carries the most recent re-run error, if any — read it after\n * each notification to render error state.\n *\n * Always call `stop()` when the live query is no longer needed.\n * Without it, the upstream change-stream subscriptions stay live\n * forever and the query keeps re-running on every mutation.\n */\nexport interface LiveQuery<T> {\n  /**\n   * Current snapshot of the query result. Updated in place on\n   * every upstream change. The reference returned is the same\n   * `readonly T[]` array — consumers that want change detection by\n   * reference should copy: `const arr = [...live.value]`.\n   */\n  readonly value: readonly T[]\n  /**\n   * Most recent re-run error, or `null` on success. Set when the\n   * executor throws (e.g. `DanglingReferenceError` in strict mode\n   * after a right-side delete). Cleared on the next successful\n   * re-run.\n   */\n  readonly error: Error | null\n  /**\n   * Register a notification callback. Fires AFTER `value` and\n   * `error` have been updated for a given upstream change.\n   * Returns an unsubscribe function.\n   *\n   * The first call to `subscribe` does NOT fire the callback\n   * immediately — call sites that want the initial value should\n   * read `live.value` directly before subscribing.\n   */\n  subscribe(cb: () => void): () => void\n  /**\n   * Tear down every upstream subscription and clear the listener\n   * set. Idempotent — calling twice is safe. After `stop()`, the\n   * query no longer re-runs and `subscribe()` becomes a no-op\n   * (the returned unsubscribe is still callable and is also a\n   * no-op).\n   */\n  stop(): void\n}\n\n/**\n * Internal subscription handle for an upstream source — left or\n * right side. The contract is just `subscribe(cb): unsubscribe`,\n * matching the existing `QuerySource.subscribe` and the new\n * `JoinableSource.subscribe` (added in ).\n */\nexport interface LiveUpstream {\n  subscribe(cb: () => void): () => void\n}\n\n/**\n * Build a LiveQuery from a `recompute` callback (typically the\n * Query's bound `toArray`) and a list of upstream sources to\n * subscribe to.\n *\n * The recompute fires once synchronously to populate the initial\n * value, then re-fires every time any upstream notifies. Errors\n * thrown by recompute are caught and stored in `error` instead of\n * propagating — see the file docstring for the rationale.\n */\nexport function buildLiveQuery<T>(\n  recompute: () => T[],\n  upstreams: readonly LiveUpstream[],\n): LiveQuery<T> {\n  return new LiveQueryImpl<T>(recompute, upstreams)\n}\n\nclass LiveQueryImpl<T> implements LiveQuery<T> {\n  private _value: readonly T[] = []\n  private _error: Error | null = null\n  private readonly listeners = new Set<() => void>()\n  private readonly unsubs: Array<() => void> = []\n  private stopped = false\n\n  constructor(\n    private readonly recompute: () => T[],\n    upstreams: readonly LiveUpstream[],\n  ) {\n    // Initial compute. If this throws, the constructor still\n    // succeeds — we want consumers to be able to render an error\n    // state from `live.error` rather than wrapping every\n    // `query.live()` call in a try/catch.\n    this.refresh()\n    for (const upstream of upstreams) {\n      try {\n        this.unsubs.push(upstream.subscribe(this.onUpstreamChange))\n      } catch (err) {\n        // Upstream subscription failed — record it as the live\n        // error and continue with the upstreams that did work.\n        // The LiveQuery is now degraded (won't re-fire on this\n        // upstream's changes) but isn't broken; consumers can\n        // detect this via `live.error`.\n        this._error = err instanceof Error ? err : new Error(String(err))\n      }\n    }\n  }\n\n  get value(): readonly T[] {\n    return this._value\n  }\n\n  get error(): Error | null {\n    return this._error\n  }\n\n  /**\n   * Bound change handler — used as the callback passed to every\n   * upstream's subscribe. Bound via class field so the `this`\n   * context survives the indirect call from arbitrary upstreams.\n   */\n  private readonly onUpstreamChange = (): void => {\n    this.refresh()\n    for (const cb of this.listeners) {\n      try {\n        cb()\n      } catch {\n        // Listener errors are isolated — one buggy consumer\n        // doesn't break the others or tear down the live query.\n      }\n    }\n  }\n\n  private refresh(): void {\n    if (this.stopped) return\n    try {\n      this._value = this.recompute()\n      this._error = null\n    } catch (err) {\n      this._error = err instanceof Error ? err : new Error(String(err))\n      // Don't clobber the previous value on error — consumers\n      // typically want to keep showing the last known good state\n      // alongside the error message rather than flashing to an\n      // empty list.\n    }\n  }\n\n  subscribe(cb: () => void): () => void {\n    if (this.stopped) return () => {}\n    this.listeners.add(cb)\n    return () => this.listeners.delete(cb)\n  }\n\n  stop(): void {\n    if (this.stopped) return\n    this.stopped = true\n    for (const unsub of this.unsubs) {\n      try {\n        unsub()\n      } catch {\n        // Unsub errors are swallowed — at this point we're tearing\n        // down anyway and the failure is noise.\n      }\n    }\n    this.unsubs.length = 0\n    this.listeners.clear()\n  }\n}\n","/**\n * Strategy seam between the core Query / ScanBuilder chain and the\n * optional aggregate / groupBy service. Core imports\n * `AggregateStrategy` as a TYPE-ONLY symbol and `NO_AGGREGATE` as a\n * tiny runtime stub.\n *\n * The heavy machinery — `Aggregation`, `GroupedQuery`, the\n * reducer-step logic — is only reachable from `withAggregate()` in\n * `./active.ts`, which is only exported through the\n * `@noy-db/hub/aggregate` subpath. Consumers that don't import the\n * subpath ship none of the ~886 LOC.\n *\n * @internal\n */\n\nimport type {\n  Aggregation,\n  AggregateSpec,\n  AggregateResult,\n  AggregationUpstream,\n} from './aggregation.js'\nimport type { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { ViaPipeline } from '../../kernel/via/pipeline.js'\n\n/**\n * Seam interface. `@internal` — will promote to public only when the\n * aggregate service is extracted into its own package.\n *\n * @internal\n */\nexport interface AggregateStrategy {\n  /**\n   * Build an `Aggregation<R>` for `Query.aggregate(spec)`. `executeRecords`\n   * is a closure that produces the matching record set when the\n   * aggregation runs. NO_AGGREGATE throws; the active strategy\n   * constructs a real `Aggregation`.\n   */\n  aggregate<Spec extends AggregateSpec>(\n    executeRecords: () => readonly unknown[],\n    spec: Spec,\n    upstreams: readonly AggregationUpstream[],\n  ): Aggregation<AggregateResult<Spec>>\n\n  /**\n   * Build a `GroupedQuery<T, F, S>` for `Query.groupBy(field)`. Same\n   * closure / upstream inputs as `aggregate` plus the group key field.\n   */\n  groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    field: F,\n    upstreams: readonly AggregationUpstream[],\n    dictLabelResolver?: (\n      key: string,\n      locale: string,\n      fallback?: string | readonly string[],\n    ) => Promise<string | undefined>,\n    via?: ViaPipeline,\n  ): GroupedQuery<T, F, S, M>\n\n  /**\n   * Variadic-keyed sibling — builds a `GroupedQueryN<T, F, S>` for\n   * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`\n   * projection only applies to single-field groupings, which dispatch\n   * through `groupBy` above.\n   */\n  groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    fields: F,\n    upstreams: readonly AggregationUpstream[],\n    via?: ViaPipeline,\n  ): GroupedQueryN<T, F, S, M>\n\n  /**\n   * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.\n   * Takes an async iterable of decrypted records + the spec and\n   * returns the reduced result.\n   */\n  scanAggregate<Spec extends AggregateSpec>(\n    iter: AsyncIterable<unknown>,\n    spec: Spec,\n  ): Promise<AggregateResult<Spec>>\n}\n\nconst NOT_ENABLED = new Error(\n  'Aggregate / groupBy is not enabled on this Noydb instance. ' +\n  'Import `{ withAggregate }` from \"@noy-db/hub/aggregate\" and pass it to ' +\n  '`createNoydb({ aggregateStrategy: withAggregate() })`.',\n)\n\n/**\n * No-aggregate stub. Every `.aggregate()` / `.groupBy()` / streaming\n * `scan().aggregate()` call throws with a pointer at the subpath. The\n * real `Aggregation` / `GroupedQuery` classes are never referenced at\n * runtime, so the bundler drops the ~886 LOC.\n *\n * @internal\n */\nexport const NO_AGGREGATE: AggregateStrategy = {\n  aggregate() { throw NOT_ENABLED },\n  groupBy() { throw NOT_ENABLED },\n  groupByN() { throw NOT_ENABLED },\n  scanAggregate() { throw NOT_ENABLED },\n}\n","/**\n * Chainable, immutable query builder.\n *\n * Each builder operation returns a NEW Query — the underlying plan is never\n * mutated. This makes plans safe to share, cache, and serialize.\n */\n\nimport type { QueryField } from '../types.js'\nimport type { Clause, CrossJoinClause, FieldClause, FilterClause, GroupClause, Operator, WherePredicateClause } from './predicate.js'\nimport { evaluateClause, hasFnClause } from './predicate.js'\nimport type { CollectionIndexes } from '../../with-lookup/indexing/eager-indexes.js'\nimport type { JoinableSource, JoinContext, JoinLeg, JoinStrategy } from './join.js'\nimport { applyJoins } from './join.js'\nimport { CrossJoinTooLargeError, CrossJoinSourceUnknownError, FieldNotQueryableError } from '../errors.js'\nimport type { LiveQuery, LiveUpstream } from './live.js'\nimport { buildLiveQuery } from './live.js'\nimport type { AggregateSpec, AggregateResult, AggregationUpstream, Aggregation } from '../../with-lookup/aggregate/aggregation.js'\nimport type { ReducerBuilder } from '../../with-lookup/aggregate/reducers.js'\nimport { reducerBuilder } from '../../with-lookup/aggregate/reducers.js'\nimport type { GroupedQuery, GroupedQueryN } from '../../with-lookup/aggregate/groupby.js'\nimport { NO_AGGREGATE, type AggregateStrategy } from '../../with-lookup/aggregate/strategy.js'\nimport type { ViaPipeline } from '../via/pipeline.js'\n\nexport interface OrderBy {\n  readonly field: string\n  readonly direction: 'asc' | 'desc'\n  /**\n   * Sort key for a `dictKey`/`staticDict` field: `'value'` (default)\n   * sorts by the stored code; `'label'` sorts by the code's resolved label at\n   * the query locale (`toArray({ locale })`, or a `staticDict` `displayLocale`).\n   * Falls back to the code when no label resolves.\n   */\n  readonly by?: 'value' | 'label'\n}\n\n/**\n * A complete query plan: zero-or-more clauses, optional ordering, pagination,\n * and optional joins.\n *\n * Plans are JSON-serializable as long as no FilterClause is present and no\n * join leg carries a manual `strategy` override (JoinLeg itself is plain\n * data, so it serializes cleanly).\n *\n * Plans are intentionally NOT parametric on T — see `predicate.ts` FilterClause\n * for the variance reasoning. The public `Query<T>` API attaches the type tag.\n */\nexport interface QueryPlan {\n  readonly clauses: readonly Clause[]\n  readonly orderBy: readonly OrderBy[]\n  readonly limit: number | undefined\n  readonly offset: number\n  /**\n   * Zero-or-more join legs to apply after where/orderBy/limit/offset.\n   * Each leg attaches a resolved right-side record (or null) under its\n   * alias. See `query/join.ts` for the full semantics.\n   */\n  readonly joins: readonly JoinLeg[]\n}\n\nconst EMPTY_PLAN: QueryPlan = {\n  clauses: [],\n  orderBy: [],\n  limit: undefined,\n  offset: 0,\n  joins: [],\n}\n\n/** Default row ceiling for cross-join expansion. Matches JoinTooLargeError's ceiling. */\nexport const DEFAULT_CROSS_JOIN_MAX_ROWS = 50_000\n\n/**\n * Source of records that a query executes against.\n *\n * The interface is non-parametric to keep variance friendly: callers cast\n * their typed source (e.g. `QuerySource<Invoice>`) into this opaque shape.\n *\n * `getIndexes` and `lookupById` are optional fast-path hooks. When both are\n * present and a where clause matches an indexed field, the executor uses\n * the index to skip a linear scan. Sources without these methods (or with\n * `getIndexes` returning `null`) always fall back to a linear scan.\n */\nexport interface QuerySource<T> {\n  /** Snapshot of all current records. The query never mutates this array. */\n  snapshot(): readonly T[]\n  /** Subscribe to mutations; returns an unsubscribe function. */\n  subscribe?(cb: () => void): () => void\n  /** Index store for the indexed-fast-path. Optional. */\n  getIndexes?(): CollectionIndexes | null\n  /** O(1) record lookup by id, used to materialize index hits. */\n  lookupById?(id: string): T | undefined\n  /**\n   * The backing collection's compiled Via pipeline (money now; more Via\n   * features later), used to rewrite `where()` operands, decode results,\n   * order, and rewrite aggregate reducers for covered fields.\n   */\n  via?: ViaPipeline\n  /**\n   * Id-paired snapshot for `Query._idArray()` (the `retrieve({within})`\n   * id projection). Optional: only collection-backed queries supply it.\n   */\n  snapshotEntries?(): readonly { id: string; record: T }[]\n}\n\ninterface InternalSource {\n  snapshot(): readonly unknown[]\n  subscribe?(cb: () => void): () => void\n  getIndexes?(): CollectionIndexes | null\n  lookupById?(id: string): unknown\n  via?: ViaPipeline\n  snapshotEntries?(): readonly { id: string; record: unknown }[]\n}\n\n/**\n * The chainable builder. All methods return a new Query — the original\n * remains unchanged. Terminal methods (`toArray`, `first`, `count`,\n * `subscribe`) execute the plan against the source.\n *\n * Type parameter T flows through the public API for ergonomics, but the\n * internal storage uses `unknown` so Collection<T> stays covariant.\n *\n * The optional `joinContext` is attached when the Query is constructed\n * via `Collection.query()` (Collection passes in a context built from\n * the Vault's join resolver). A Query constructed via `new Query`\n * directly — e.g. from tests with a plain-object source — has no\n * joinContext, and calling `.join()` on it throws with an actionable\n * error. See `query/join.ts` for the full design.\n */\n/**\n * Declared deterministic predicate. Carries the consumer's\n * stable `hash` (for function-body identity), the function itself,\n * and is keyed by name when registered on a `Query<T>` via\n * `_withPredicates()`.\n */\nexport interface DeclaredPredicate {\n  hash: string\n  fn: (record: unknown, ctx?: unknown) => boolean\n}\n\nexport class Query<T, S extends keyof T = never, Q extends keyof T & string = never, M extends keyof T & string = never> {\n  private readonly source: InternalSource\n  private readonly plan: QueryPlan\n  private readonly joinContext: JoinContext | undefined\n  private readonly aggregateStrategy: AggregateStrategy\n  private readonly predicates: ReadonlyMap<string, DeclaredPredicate> | undefined\n\n  constructor(\n    source: QuerySource<T>,\n    plan: QueryPlan = EMPTY_PLAN,\n    joinContext?: JoinContext,\n    aggregateStrategy: AggregateStrategy = NO_AGGREGATE,\n    predicates?: ReadonlyMap<string, DeclaredPredicate>,\n  ) {\n    this.source = source as InternalSource\n    this.plan = plan\n    this.joinContext = joinContext\n    this.aggregateStrategy = aggregateStrategy\n    this.predicates = predicates\n  }\n\n  /**\n   * @internal — accessor for the materialized-view dependency\n   * analyzer. Not part of the public API; consumers should use the\n   * builder methods, not inspect the plan directly.\n   */\n  _plan(): QueryPlan {\n    return this.plan\n  }\n\n  /**\n   * @internal — accessor for the materialized-view dependency\n   * analyzer. Returns the join resolution context (or `undefined` for\n   * queries constructed without a Collection backing).\n   */\n  _joinContext(): JoinContext | undefined {\n    return this.joinContext\n  }\n\n  /**\n   * @internal — clone this Query with a declared-predicate map\n   * attached. Used by the materialized-view registry to enable\n   * `.wherePredicate(name, ctx?)` for the MV's query callback.\n   * Consumers don't call this directly.\n   */\n  _withPredicates(predicates: ReadonlyMap<string, DeclaredPredicate>): Query<T, S, Q, M> {\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      this.plan,\n      this.joinContext,\n      this.aggregateStrategy,\n      predicates,\n    )\n  }\n\n  /**\n   * @internal — the ids of records matching this query's plan,\n   * recovered by reference identity: `executePlanWithSource` returns the\n   * ORIGINAL snapshot record references (money-decode and joins are applied\n   * later, in `toArray`), so each matched record is found in the id-paired\n   * `snapshotEntries()` map. Used by `collection.retrieve({ within })`.\n   * Throws if the source is not collection-backed (no `snapshotEntries`).\n   */\n  _idArray(): string[] {\n    const entries = this.source.snapshotEntries?.()\n    if (entries === undefined) {\n      throw new Error(\n        'Query._idArray(): the query source has no snapshotEntries(); ' +\n          'retrieve({ within }) requires a collection-backed query (collection.query()).',\n      )\n    }\n    if (this.plan.clauses.some(c => c.type === 'crossJoin')) {\n      throw new Error(\n        'Query._idArray(): retrieve({ within }) does not support crossJoin queries ' +\n          '(cross-join produces new row objects, breaking id recovery). ' +\n          'Use where/filter/and/or, or a projection .join().',\n      )\n    }\n    const refToId = new Map<unknown, string>()\n    for (const { id, record } of entries) refToId.set(record, id)\n    const matched = executePlanWithSource(this.source, this.plan, this.joinContext)\n    const ids: string[] = []\n    for (const r of matched) {\n      const id = refToId.get(r)\n      if (id !== undefined) ids.push(id)\n    }\n    return ids\n  }\n\n  /**\n   * Filter by a registered deterministic predicate. Requires\n   * the Query to have been augmented with a predicates map (typically\n   * via the materialized-view registry — bare Queries constructed\n   * outside an MV throw on `.wherePredicate()`).\n   *\n   * `ctx` is an optional opaque value passed verbatim to the predicate\n   * function. Both `predicateHash` (from the registration) and a\n   * canonical-JSON hash of `ctx` fold into the MV's `queryHash`, so\n   * either changing forces refresh on next visit.\n   */\n  wherePredicate(name: string, ctx?: unknown): Query<T, S, Q, M> {\n    if (!this.predicates) {\n      throw new Error(\n        `.wherePredicate(\"${name}\"): no predicates registered on this Query. ` +\n          `Function-based predicates require the Query to be obtained from ` +\n          `inside a materialized-view query() callback whose strategy declares ` +\n          `\\`predicates: { ${name}: { hash, fn } }\\`.`,\n      )\n    }\n    const decl = this.predicates.get(name)\n    if (!decl) {\n      throw new Error(\n        `.wherePredicate(\"${name}\"): predicate not registered. ` +\n          `Available: ${[...this.predicates.keys()].join(', ') || '(none)'}.`,\n      )\n    }\n    const clause: WherePredicateClause = {\n      type: 'wherePredicate',\n      name,\n      ctx,\n      predicateHash: decl.hash,\n      ctxHash: canonicalCtxHash(ctx),\n      fn: decl.fn,\n    }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, clauses: [...this.plan.clauses, clause] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Add a field comparison. Multiple where() calls are AND-combined.\n   *\n   * A declared money field compares in MAJOR units: the operand\n   * (`10000`, `'10000.00'`, or `{ amount, currency }` in multi mode) is\n   * quantized into stored scaled-int space at build time and evaluated\n   * BigInt-exact per record. A malformed operand or a string operator\n   * (`contains`/`startsWith`) throws here, at the call site.\n   *\n   * Consults the Via pipeline's posture before building a clause (#629\n   * Task 8): a field whose posture is `queryable: 'none'` (e.g. a\n   * `blobFields` slot) throws `FieldNotQueryableError` here, at the call\n   * site. Every other posture is unaffected — the existing per-binding\n   * `buildClause` machinery runs exactly as before.\n   */\n  where(field: QueryField<T, S, Q>, op: Operator, value: unknown): Query<T, S, Q, M> {\n    const via = this.source.via\n    if (via?.postureFor(field)?.queryable === 'none') throw new FieldNotQueryableError(field)\n    const viaClause = via?.buildClause(field, op, value)\n    const clause: FieldClause = viaClause\n      ? {\n          type: 'field',\n          field,\n          op,\n          value,\n          via: {\n            brand: viaClause.brand,\n            payload: viaClause.payload,\n            evaluate: (actual: unknown, evalOp: string) => via!.evaluateClause(viaClause, actual, evalOp),\n            indexValue: via!.indexProbe(viaClause, op),\n          },\n        }\n      : { type: 'field', field, op, value }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, clauses: [...this.plan.clauses, clause] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Logical OR group. Pass a callback that builds a sub-query.\n   * Each clause inside the callback is OR-combined; the group itself\n   * joins the parent plan with AND.\n   */\n  or(builder: (q: Query<T, S, Q, M>) => Query<T, S, Q, M>): Query<T, S, Q, M> {\n    const sub = builder(\n      new Query<T, S, Q, M>(this.source as QuerySource<T>, EMPTY_PLAN, this.joinContext, this.aggregateStrategy, this.predicates),\n    )\n    const group: GroupClause = {\n      type: 'group',\n      op: 'or',\n      clauses: sub.plan.clauses,\n    }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, clauses: [...this.plan.clauses, group] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Logical AND group. Same shape as `or()` but every clause inside the group\n   * must match. Useful for explicit grouping inside a larger OR.\n   */\n  and(builder: (q: Query<T, S, Q, M>) => Query<T, S, Q, M>): Query<T, S, Q, M> {\n    const sub = builder(\n      new Query<T, S, Q, M>(this.source as QuerySource<T>, EMPTY_PLAN, this.joinContext, this.aggregateStrategy, this.predicates),\n    )\n    const group: GroupClause = {\n      type: 'group',\n      op: 'and',\n      clauses: sub.plan.clauses,\n    }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, clauses: [...this.plan.clauses, group] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /** Escape hatch: add an arbitrary predicate function. Not serializable. */\n  filter(fn: (record: T) => boolean): Query<T, S, Q, M> {\n    const clause: FilterClause = {\n      type: 'filter',\n      fn: fn as (record: unknown) => boolean,\n    }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, clauses: [...this.plan.clauses, clause] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Sort by a field. Subsequent calls are tie-breakers. Pass\n   * `{ by: 'label' }` to sort a `dictKey`/`staticDict` field by its resolved\n   * label at the query locale instead of the stored code.\n   *\n   * Consults the Via pipeline's posture (#629 Task 8): a field whose posture\n   * is `queryable: 'none'` throws `FieldNotQueryableError` here, at the call\n   * site — same gate as `where()`.\n   */\n  orderBy(field: QueryField<T, S>, direction: 'asc' | 'desc' = 'asc', opts?: { by?: 'value' | 'label' }): Query<T, S, Q, M> {\n    if (this.source.via?.postureFor(field)?.queryable === 'none') throw new FieldNotQueryableError(field)\n    const entry: OrderBy = opts?.by === 'label' ? { field, direction, by: 'label' } : { field, direction }\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, orderBy: [...this.plan.orderBy, entry] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /** Cap the result size. */\n  limit(n: number): Query<T, S, Q, M> {\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, limit: n },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /** Skip the first N matching records (after ordering). */\n  offset(n: number): Query<T, S, Q, M> {\n    return new Query<T, S, Q, M>(\n      this.source as QuerySource<T>,\n      { ...this.plan, offset: n },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Resolve a `ref()`-declared foreign key and attach the right-side\n   * record under `opts.as`. — eager, single-FK, intra-\n   * vault joins.\n   *\n   * ```ts\n   * const rows = invoices.query()\n   *   .where('status', '==', 'open')\n   *   .join('clientId', { as: 'client' })\n   *   .toArray()\n   * // → [{ id, amount, client: { id, name, ... } }, ...]\n   * ```\n   *\n   * Preconditions:\n   *   - The Query must have a `joinContext` (constructed via\n   *     `Collection.query()`, not `new Query`).\n   *   - `field` must have a matching `refs: { [field]: ref('<target>') }`\n   *     declaration on the left collection.\n   *   - The target collection must be reachable via the vault\n   *     (either currently open or openable on demand).\n   *\n   * Strategy:\n   *   - Nested-loop against `lookupById` when the target source\n   *     provides it (the common path for Collection targets).\n   *   - Hash join otherwise, or when `{ strategy: 'hash' }` is\n   *     explicitly passed for test purposes.\n   *\n   * Ref-mode semantics on dangling refs (left record has a non-null\n   * FK value pointing at a right-side id that doesn't exist):\n   *   - `strict`  → throws `DanglingReferenceError` with the full\n   *     field / target / refId context.\n   *   - `warn`    → attaches `null` and emits a one-shot warning per\n   *     unique dangling pair.\n   *   - `cascade` → attaches `null` silently. Cascade is a\n   *     delete-time mode; dangling refs visible at read time are\n   *     either mid-flight cascades or pre-existing orphans, not a\n   *     DSL-level error.\n   *\n   * A left-side record whose FK field is `null` / `undefined` is NOT\n   * a dangling ref — it's \"no reference at all\", always allowed\n   * regardless of mode.\n   *\n   * The return type widens `T` with `Record<As, R | null>`. The `R`\n   * parameter is optional — supply it explicitly for type-checked\n   * access to the joined fields:\n   *\n   * ```ts\n   * invoices.query().join<'client', Client>('clientId', { as: 'client' })\n   * //                 ^^^^^^^^^^^^^^^^^^^ alias literal + right-side type\n   * ```\n   *\n   * Without the generic, the joined field is typed as `unknown`, which\n   * still works but requires a cast to access its properties.\n   *\n   * Joins stay intra-vault by construction — cross-vault\n   * correlation goes through `Noydb.queryAcross`, not\n   * `.join()`.\n   */\n  join<As extends string, R = unknown>(\n    field: QueryField<T, S>,\n    opts: { as: As; strategy?: JoinStrategy; maxRows?: number },\n  ): Query<T & Record<As, R | null>, S, Q, M> {\n    if (!this.joinContext) {\n      throw new Error(\n        `Query.join() requires a join context. Use collection.query() ` +\n          `to construct a join-capable Query instead of the Query constructor ` +\n          `directly (the direct constructor is only used for tests with ` +\n          `plain-object sources).`,\n      )\n    }\n    const descriptor = this.joinContext.resolveRef(field)\n    // Check for dictKey join when no ref() is declared\n    const isDictJoinField = !descriptor && this.joinContext.resolveDictSource?.(field) != null\n    if (!descriptor && !isDictJoinField) {\n      throw new Error(\n        `Query.join(): no ref() declared for field \"${field}\" on collection ` +\n          `\"${this.joinContext.leftCollection}\". Add ` +\n          `refs: { ${field}: ref('<target-collection>') } to the collection ` +\n          `options, then retry. See the ref() docs for the full list of modes.`,\n      )\n    }\n    const leg: JoinLeg = descriptor\n      ? {\n          field,\n          as: opts.as,\n          target: descriptor.target,\n          mode: descriptor.mode,\n          strategy: opts.strategy,\n          maxRows: opts.maxRows,\n          //  constraint #1 — always 'all' in. Do not remove.\n          partitionScope: 'all',\n        }\n      : {\n          // Dict join leg\n          field,\n          as: opts.as,\n          target: field, // dict name = field name for dictKey\n          mode: 'strict',\n          strategy: opts.strategy,\n          maxRows: opts.maxRows,\n          partitionScope: 'all',\n          isDictJoin: true,\n        }\n    return new Query<T & Record<As, R | null>, S, Q, M>(\n      this.source as unknown as QuerySource<T & Record<As, R | null>>,\n      { ...this.plan, joins: [...this.plan.joins, leg] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Cartesian-product cross-join against `target` collection. Each result row\n   * carries the original `T` fields plus `result[as]` populated from every\n   * right-side row (or the filtered subset when `on:` is supplied).\n   *\n   * **Order matters:** `.where().crossJoin()` filters BEFORE expanding (cheaper);\n   * `.crossJoin().where('alias.field', ...)` filters AFTER (required when the\n   * where clause references the aliased fields).\n   *\n   * **Cost ceiling:** `CrossJoinTooLargeError` fires before allocation when\n   * `leftRows × rightRows` (or the cumulative lateral count) exceeds the limit.\n   * Default: 50,000 rows. Override per-clause with `{ maxRows: N }`.\n   *\n   * **`on:` shapes:**\n   *   - `on: (left) => TTarget[]`              — subset form (most efficient)\n   *   - `on: (left) => (right) => boolean`     — predicate form\n   *   - `on: { predicate: 'name' }`            — MV-safe, hash-tracked form\n   *     (requires the Query to have been augmented via `_withPredicates`)\n   *\n   * Requires a JoinContext (constructed via `collection.query()`).\n   */\n  crossJoin<TTarget = unknown, As extends string = string>(\n    target: string,\n    opts: {\n      as: As\n      on?:\n        | ((left: T) => unknown[] | ((right: TTarget) => boolean))\n        | { readonly predicate: string }\n      maxRows?: number\n    },\n  ): Query<T & { [K in As]: TTarget }, S, Q, M> {\n    if (!this.joinContext) {\n      throw new Error(\n        `Query.crossJoin(\"${target}\"): requires a join context. ` +\n          `Use collection.query() to construct a cross-join-capable Query instead of ` +\n          `the Query constructor directly.`,\n      )\n    }\n\n    let onFn: CrossJoinClause['on']\n    let onPredicateName: string | undefined\n\n    if (opts.on !== undefined) {\n      if (typeof opts.on === 'function') {\n        onFn = opts.on as CrossJoinClause['on']\n        if (this.predicates) {\n          console.warn(\n            `Query.crossJoin(\"${target}\", { on: callback }): inline on: callback inside a ` +\n              `withMaterializedView query() disables queryHash drift detection for this cross-join. ` +\n              `Use on: { predicate: '<name>' } to enable it.`,\n          )\n        }\n      } else {\n        const predName = (opts.on as { predicate: string }).predicate\n        if (!this.predicates) {\n          throw new Error(\n            `Query.crossJoin(\"${target}\", { on: { predicate: \"${predName}\" } }): ` +\n              `the { predicate } form requires a predicates map. ` +\n              `Use this form inside a withMaterializedView query() callback that declares ` +\n              `predicates: { ${predName}: { hash, fn } }.`,\n          )\n        }\n        const decl = this.predicates.get(predName)\n        if (!decl) {\n          throw new Error(\n            `Query.crossJoin(\"${target}\"): predicate \"${predName}\" not registered. ` +\n              `Available: ${[...this.predicates.keys()].join(', ') || '(none)'}.`,\n          )\n        }\n        const as = opts.as\n        const predicateFn = decl.fn\n        onFn = (_left: unknown): ((right: unknown) => boolean) =>\n          (right: unknown) =>\n            predicateFn({ ...(_left as Record<string, unknown>), [as]: right })\n        onPredicateName = predName\n      }\n    }\n\n    const clause: CrossJoinClause = {\n      type: 'crossJoin',\n      target,\n      as: opts.as,\n      ...(onFn !== undefined && { on: onFn }),\n      ...(onPredicateName !== undefined && { onPredicateName }),\n      ...(opts.maxRows !== undefined && { maxRows: opts.maxRows }),\n    }\n\n    return new Query<T & { [K in As]: TTarget }, S, Q, M>(\n      this.source as unknown as QuerySource<T & { [K in As]: TTarget }>,\n      { ...this.plan, clauses: [...this.plan.clauses, clause] },\n      this.joinContext,\n      this.aggregateStrategy,\n      this.predicates,\n    )\n  }\n\n  /**\n   * Execute the plan and return the matching records. When the plan\n   * carries any join legs, they are applied after `where` / `orderBy`\n   * / `limit` / `offset` narrow the left set. See the `.join()` doc\n   * for the ordering rationale.\n   *\n   * `opts.locale` resolves JOINED right-side i18n fields at the\n   * `join` layer to that locale; without it, the owning collection's default\n   * locale applies, and a locale-less query leaves joined i18n fields raw.\n   * (Left/base i18n fields are resolved by `get`/`list`, not here.)\n   */\n  toArray(opts?: { locale?: string }): T[] {\n    // Decode Via-covered fields (e.g. money: stored scaled-int → canonical\n    // decimal) so query().toArray() matches get()/sum(), which already\n    // apply the same decode. Decode the left/base records before joins\n    // (right-side aliased fields belong to other collections and are out\n    // of this source's Via scope).\n    const base = this.decodeVia(executePlanWithSource(this.source, this.plan, this.joinContext, opts?.locale))\n    if (this.plan.joins.length === 0) return base as T[]\n    if (!this.joinContext) {\n      // Unreachable in practice — .join() throws if joinContext is\n      // missing — but belt-and-braces for direct plan construction.\n      throw new Error(\n        `Query.toArray(): plan carries ${this.plan.joins.length} join leg(s) ` +\n          `but no JoinContext is attached. This usually means the Query was ` +\n          `constructed via the raw Query constructor with a plan that had joins ` +\n          `pre-populated. Use collection.query().join(...) instead.`,\n      )\n    }\n    return applyJoins(base, this.plan.joins, this.joinContext, opts?.locale) as T[]\n  }\n\n  /**\n   * Decode this source's Via-covered fields on read (e.g. money: stored\n   * scaled-int → canonical decimal), so `query().toArray()` agrees with\n   * `get()`/`sum()` on the value. No-op when the source's Via pipeline\n   * declares no result decode.\n   *\n   * The query layer carries no locale context, so money decodes with\n   * `'raw'` — canonical decimal, WITHOUT fabricating locale-formatted\n   * `<field>Formatted` / `<field>Number` virtuals. Producing a\n   * guessed-locale string here would reintroduce a \"two read paths\n   * disagree\" failure on the virtual field (e.g. it-IT via `get()` vs\n   * en-US here). Consumers who need formatted money read through\n   * `get()`/`list()` with a locale.\n   */\n  private decodeVia(records: readonly unknown[]): unknown[] {\n    const via = this.source.via\n    if (!via || !via.hasResultDecode) return records as unknown[]\n    return records.map(r => via.decodeResults(r))\n  }\n\n  /** Return the first matching record, or null. Joins are applied. `opts.locale` resolves joined i18n fields. */\n  first(opts?: { locale?: string }): T | null {\n    const arr = this.limit(1).toArray(opts)\n    return arr[0] ?? null\n  }\n\n  /**\n   * Return the number of matching records (after where/filter,\n   * before limit). **Joins are NOT applied** — count() reports the\n   * left-side cardinality, because joins in are projection-only\n   * (they attach an aliased field; they never filter). Running joins\n   * here just to discard the aliases would be wasteful, and in strict\n   * mode it could throw `DanglingReferenceError` for a call whose\n   * intent is purely to count.\n   */\n  count(): number {\n    if (this.plan.clauses.some(c => c.type === 'crossJoin')) {\n      if (!this.joinContext) {\n        throw new Error(\n          `Query.count(): plan contains crossJoin clauses but no JoinContext is attached.`,\n        )\n      }\n      return executeClausePipeline(this.source, this.plan.clauses, this.joinContext).length\n    }\n    // Use the same index-aware candidate machinery as toArray(); skip the\n    // index-driving clause from re-evaluation. The length BEFORE limit/offset\n    // is what `count()` documents.\n    const { candidates, remainingClauses } = candidateRecords(this.source, this.plan.clauses)\n    if (remainingClauses.length === 0) return candidates.length\n    return filterRecords(candidates, remainingClauses, fnViewDecoder(this.source)).length\n  }\n\n  /**\n   * Reduce the matching records through a named set of reducers.\n   * the aggregation terminal.\n   *\n   * ```ts\n   * const { total, n, avgAmount } = invoices.query()\n   *   .where('status', '==', 'open')\n   *   .aggregate({\n   *     total:     sum('amount'),\n   *     n:         count(),\n   *     avgAmount: avg('amount'),\n   *   })\n   *   .run()\n   * ```\n   *\n   * Returns an `Aggregation<R>` wrapper with two terminals:\n   *   - `.run(): R` — synchronous one-shot reduction\n   *   - `.live(): LiveAggregation<R>` — reactive primitive that\n   *     re-runs the reduction whenever the source notifies of a\n   *     change. Always call `live.stop()` when finished.\n   *\n   * The reducer spec is bound here once and reused by both\n   * terminals — this is why `.aggregate()` returns a wrapper instead\n   * of being a direct terminal. Consumers who only need the static\n   * value read `.run()`; consumers wiring a reactive UI read\n   * `.live()`.\n   *\n   * Joins are intentionally NOT applied to aggregations in —\n   * the same logic as `.count()`. Joins in are projection-only\n   * (they attach an aliased field and never filter), so running\n   * them just to throw the aliases away would be wasteful. If you\n   * need a reducer that reads a joined field, open an issue —\n   * aggregations-across-joins is explicitly out of scope for v1.\n   *\n   * Every reducer factory accepts an optional `{ seed }` parameter\n   * that is plumbed through the protocol but unused by the\n   * executor — that's  constraint #2. When partition-aware\n   * aggregation lands, the seed will carry running state across\n   * partition boundaries without an API break.\n   *\n   * KNOWN GAP (sealed fields, bare-spec form): `where`/`orderBy`/`groupBy`\n   * refuse a `sensitive` field at compile time, but a reducer over a sensitive\n   * field in the BARE-SPEC form (e.g. `aggregate({ x: sum('ssn') })`) is NOT\n   * refused — the reducer factories (`sum`/`min`/`max`/…) are standalone\n   * `(field: string)` functions with no collection-type context. This form is\n   * preserved as-is for backward compatibility.\n   *\n   * The BUILDER form closes this gap: `aggregate(b => ({ x: b.sum('field') }))`\n   * types the builder's field parameter as `QueryField<T, S>`, refusing any\n   * `sensitive` field at compile time. Use the builder form for new code that\n   * aggregates over a collection with sensitive fields.\n   *\n   */\n  aggregate<Spec extends AggregateSpec>(spec: Spec): Aggregation<AggregateResult<Spec>>\n  aggregate<Spec extends AggregateSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Aggregation<AggregateResult<Spec>>\n  aggregate<Spec extends AggregateSpec>(\n    specOrBuild: Spec | ((b: ReducerBuilder<T, S, M>) => Spec),\n  ): Aggregation<AggregateResult<Spec>> {\n    let spec = typeof specOrBuild === 'function'\n      ? (specOrBuild as (b: ReducerBuilder<T, S, M>) => Spec)((reducerBuilder as unknown) as ReducerBuilder<T, S, M>)\n      : specOrBuild\n    // Rewrite sum/min/max over Via-covered fields (e.g. money) into exact\n    // BigInt reducers before the strategy runs (covers static run() and\n    // live/MV paths).\n    spec = this.source.via?.wrapReducers(spec) ?? spec\n    // Closure over the current query. Produces the record set that\n    // the aggregation reduces — same pipeline as `count()`, skipping\n    // limit/offset because aggregation is over the full match set,\n    // not a paginated slice. (A paginated aggregation would be a\n    // different operation; see docs for rationale.)\n    const source = this.source\n    const clauses = this.plan.clauses\n    const joinCtx = this.joinContext\n    const hasCrossJoins = clauses.some(c => c.type === 'crossJoin')\n    const executeRecords = (): readonly unknown[] => {\n      if (hasCrossJoins) {\n        if (!joinCtx) throw new Error('Query.aggregate(): crossJoin requires a join context')\n        return executeClausePipeline(source, clauses, joinCtx)\n      }\n      const { candidates, remainingClauses } = candidateRecords(source, clauses)\n      return remainingClauses.length === 0\n        ? candidates\n        : filterRecords(candidates, remainingClauses, fnViewDecoder(source))\n    }\n\n    // Upstream for live mode — only the left source subscribes.\n    // Joined aggregations are out of scope for (see above), so\n    // there are no right-side change streams to merge in.\n    const upstreams: AggregationUpstream[] = []\n    if (source.subscribe) {\n      const subscribe = source.subscribe.bind(source)\n      upstreams.push({ subscribe: (cb: () => void) => subscribe(cb) })\n    }\n\n    return this.aggregateStrategy.aggregate<Spec>(executeRecords, spec, upstreams)\n  }\n\n  /**\n   * Partition matching records into buckets keyed by a field, then\n   * terminate with `.aggregate(spec)` to compute per-bucket\n   * reducers..\n   *\n   * ```ts\n   * const byClient = invoices.query()\n   *   .where('status', '==', 'open')\n   *   .groupBy('clientId')\n   *   .aggregate({ total: sum('amount'), n: count() })\n   *   .run()\n   * // → [ { clientId: 'c1', total: 5250, n: 3 }, … ]\n   * ```\n   *\n   * Result rows carry the group key value under the grouping field\n   * name plus every reducer output from the spec. Buckets are\n   * emitted in first-seen order — consumers who want a specific\n   * ordering should `.sort()` downstream.\n   *\n   * **Cardinality caps:** a one-shot warning fires at 10_000\n   * distinct groups; `GroupCardinalityError` throws at 100_000.\n   * Grouping on a high-uniqueness field like `id` or `createdAt` is\n   * almost always a query mistake — the error message names the\n   * field and observed cardinality and suggests narrowing with\n   * `.where()` first.\n   *\n   * **Null / undefined keys:** records with a missing or explicitly\n   * `null` group field get their own buckets. `Map`-based\n   * partitioning distinguishes `undefined` from `null`, so the two\n   * cases do NOT merge. Consumers who want them merged should\n   * coalesce upstream with `.filter()`.\n   *\n   * **Joins are not applied** — same rationale as `.count()` and\n   * `.aggregate()`. Joined fields in are projection-only, so\n   * running a join inside a grouping pipeline would be wasteful and\n   * could trigger `DanglingReferenceError` in strict mode for a\n   * call whose intent is purely to bucket-and-reduce. Grouping by\n   * a joined field is explicitly out of scope for — file an\n   * issue if a real consumer needs it.\n   *\n   * **Filter clauses (`.filter(fn)`):** grouped queries still\n   * support filter clauses in the underlying plan — they run in\n   * the same candidate/filter pipeline that `.aggregate()` uses.\n   * The performance caveat is the same: filter clauses cost O(N)\n   * per record and can't be index-accelerated.\n   */\n  // The `field` param is `QueryField<T, S>` so a sealed (`sensitive`) field is\n  // refused — grouping BY a sensitive field leaks its value distribution as\n  // group-key labels. With `S = never` this is exactly `string` (zero churn).\n  groupBy<F extends QueryField<T, S>>(field: F): GroupedQuery<T, F, S, M>\n  groupBy<F extends readonly [QueryField<T, S>, QueryField<T, S>, ...QueryField<T, S>[]]>(\n    ...fields: F\n  ): GroupedQueryN<T, F, S, M>\n  groupBy(...fields: readonly string[]): GroupedQuery<T, string, S, M> | GroupedQueryN<T, readonly string[], S, M> {\n    if (fields.length === 0) {\n      throw new Error('.groupBy() requires at least one field')\n    }\n    // Same record-producing closure as .aggregate() — grouped and\n    // non-grouped aggregations execute over the same candidate set.\n    // We inline the closure here instead of sharing a helper so the\n    // builder stays allocation-friendly for the hot path.\n    const source = this.source\n    const clauses = this.plan.clauses\n    const joinCtx = this.joinContext\n    const hasCrossJoins = clauses.some(c => c.type === 'crossJoin')\n    const executeRecords = (): readonly unknown[] => {\n      if (hasCrossJoins) {\n        if (!joinCtx) throw new Error('Query.groupBy(): crossJoin requires a join context')\n        return executeClausePipeline(source, clauses, joinCtx)\n      }\n      const { candidates, remainingClauses } = candidateRecords(source, clauses)\n      return remainingClauses.length === 0\n        ? candidates\n        : filterRecords(candidates, remainingClauses, fnViewDecoder(source))\n    }\n\n    const upstreams: AggregationUpstream[] = []\n    if (source.subscribe) {\n      const subscribe = source.subscribe.bind(source)\n      upstreams.push({ subscribe: (cb: () => void) => subscribe(cb) })\n    }\n\n    // Dict-label resolution is single-field only — the <field>Label\n    // projection has no meaningful shape for composite keys.\n    if (fields.length === 1) {\n      const field = fields[0]!\n      const dictLabelResolver = buildDictLabelResolver(this.joinContext, field)\n      return this.aggregateStrategy.groupBy<T, string, S, M>(\n        executeRecords,\n        field,\n        upstreams,\n        dictLabelResolver,\n        this.source.via,\n      )\n    }\n    return this.aggregateStrategy.groupByN<T, readonly string[], S, M>(\n      executeRecords,\n      fields,\n      upstreams,\n      this.source.via,\n    )\n  }\n\n  /**\n   * Re-run the query whenever the source notifies of changes.\n   * Returns an unsubscribe function. The callback receives the latest result.\n   * Throws if the source does not support subscriptions.\n   *\n   * **For joined queries, prefer `.live()`** — `subscribe()`\n   * only re-fires on LEFT-side changes, so joined data can be\n   * stale if the right side mutates between emissions. `.live()`\n   * merges change streams from every join target.\n   */\n  subscribe(cb: (result: T[]) => void): () => void {\n    if (!this.source.subscribe) {\n      throw new Error('Query source does not support subscriptions. Pass a source with a subscribe() method.')\n    }\n    cb(this.toArray())\n    return this.source.subscribe(() => cb(this.toArray()))\n  }\n\n  /**\n   * Reactive terminal — returns a `LiveQuery<T>` that re-runs the\n   * query and updates its `value` whenever any source feeding it\n   * mutates..\n   *\n   * For non-joined queries, `.live()` is a convenience over the\n   * existing `.subscribe()` callback shape: a hand-rolled reactive\n   * primitive with `value` / `error` fields and a `subscribe(cb)`\n   * notification channel. Frame-agnostic — Vue / React / Solid\n   * adapters wrap it in their own primitive.\n   *\n   * For joined queries, `.live()` additionally subscribes to every\n   * join target's change stream. Mutations on a right-side\n   * collection (insert / update / delete of a client referenced by\n   * an invoice) re-fire the live query and re-evaluate every\n   * dependent left row. Right-side targets are deduped by\n   * collection name, so a chain that joins the same target twice\n   * (e.g. billing client + shipping client → both 'clients') only\n   * subscribes once.\n   *\n   * **Ref-mode behavior on right-side disappearance** — matches the\n   * eager `.toArray()` contract from :\n   *   - `strict`  → re-run throws `DanglingReferenceError`. The\n   *     LiveQuery catches the throw, stores it in `live.error`, and\n   *     notifies listeners (the throw does NOT propagate out of\n   *     the source's change handler — that would tear down the\n   *     emitter). Consumers check `live.error` after each\n   *     notification and render an error state in the UI.\n   *   - `warn`    → joined value flips to `null`; the existing\n   *     warn-channel deduplication keeps repeated re-runs from\n   *     spamming the console.\n   *   - `cascade` → no special handling needed; the cascade-\n   *     delete mechanism propagates the right-side delete into the\n   *     left collection on the next tick, and the live query\n   *     naturally re-fires with the orphaned left rows gone.\n   *\n   * Always call `live.stop()` when finished — it tears down every\n   * upstream subscription. The Vue layer's `onUnmounted` hook\n   * should call `stop()` automatically; raw consumers must do it\n   * themselves.\n   *\n   * **Limitations:**\n   *   - No granular delta updates — the whole query re-runs on\n   *     every change.\n   *   - No microtask batching — bursty changes produce one re-run\n   *     per change.\n   *   - No re-planning under live mutations — the planner picks\n   *     once at subscription time and reuses the same plan.\n   *   - Streaming live joins are deferred.\n   */\n  live(): LiveQuery<T> {\n    const upstreams: LiveUpstream[] = []\n\n    // Left-side change stream — every live query subscribes to\n    // its source if the source supports subscriptions.\n    if (this.source.subscribe) {\n      const leftSubscribe = this.source.subscribe.bind(this.source)\n      upstreams.push({\n        subscribe: (cb: () => void) => leftSubscribe(cb),\n      })\n    }\n\n    // Right-side change streams — only for joined queries. Dedup\n    // by target name so a chain joining the same target twice\n    // doesn't double-subscribe and double-fire on every right-side\n    // mutation.\n    if (this.plan.joins.length > 0 && this.joinContext) {\n      const subscribed = new Set<string>()\n      for (const leg of this.plan.joins) {\n        if (subscribed.has(leg.target)) continue\n        subscribed.add(leg.target)\n        const rightSource = this.joinContext.resolveSource(leg.target)\n        if (rightSource?.subscribe) {\n          const rightSubscribe = rightSource.subscribe.bind(rightSource)\n          upstreams.push({\n            subscribe: (cb: () => void) => rightSubscribe(cb),\n          })\n        }\n      }\n    }\n\n    // Cross-join right-side change streams — symmetric with FK joins above.\n    if (this.joinContext) {\n      const subscribedCross = new Set<string>()\n      for (const clause of this.plan.clauses) {\n        if (clause.type !== 'crossJoin') continue\n        if (subscribedCross.has(clause.target)) continue\n        subscribedCross.add(clause.target)\n        const rightSource = this.joinContext.resolveSource(clause.target)\n        if (rightSource?.subscribe) {\n          const rightSubscribe = rightSource.subscribe.bind(rightSource)\n          upstreams.push({\n            subscribe: (cb: () => void) => rightSubscribe(cb),\n          })\n        }\n      }\n    }\n\n    // The recompute is just toArray bound to this query — same\n    // pipeline as eager execution, including join application.\n    return buildLiveQuery<T>(() => this.toArray(), upstreams)\n  }\n\n  /**\n   * Return the plan as a JSON-friendly object. FilterClause entries are\n   * stripped (their `fn` cannot be serialized) and replaced with\n   * { type: 'filter', fn: '[function]' } so devtools can still see them.\n   */\n  toPlan(): unknown {\n    return serializePlan(this.plan)\n  }\n}\n\n/**\n * Index-aware execution: try the indexed fast path first, fall back to a\n * full scan otherwise. Mirrors `executePlan` for the public surface but\n * takes a `QuerySource` so it can consult `getIndexes()` and `lookupById()`.\n */\nfunction executePlanWithSource(\n  source: InternalSource,\n  plan: QueryPlan,\n  joinContext?: JoinContext,\n  locale?: string,\n): unknown[] {\n  const hasCrossJoins = plan.clauses.some(c => c.type === 'crossJoin')\n\n  let result: unknown[]\n  if (hasCrossJoins) {\n    if (!joinContext) {\n      throw new Error(\n        `Query.toArray(): plan contains crossJoin clauses but no JoinContext is attached. ` +\n          `Use collection.query() instead of new Query() for cross-join support.`,\n      )\n    }\n    result = executeClausePipeline(source, plan.clauses, joinContext)\n  } else {\n    // Index-aware fast path: only the clauses NOT consumed by the index need\n    // re-evaluation. For a single-clause query against an indexed field,\n    // `remainingClauses` is empty and we skip per-record predicate evaluation.\n    const { candidates, remainingClauses } = candidateRecords(source, plan.clauses)\n    result =\n      remainingClauses.length === 0\n        ? [...candidates]\n        : filterRecords(candidates, remainingClauses, fnViewDecoder(source))\n  }\n\n  if (plan.orderBy.length > 0) {\n    // dictKey label-sort: for any `orderBy(..., { by: 'label' })`, build a\n    // sync code→label resolver at the query locale so the sort compares\n    // labels. `source.via` also feeds the #650 Task 7 matrix-tier fallback\n    // (fields `joinContext.resolveDictSource` doesn't bridge).\n    const labelMaps = buildOrderLabelMaps(plan.orderBy, joinContext, locale, source.via)\n    result = sortRecords(result, plan.orderBy, source.via, labelMaps)\n  }\n  if (plan.offset > 0) {\n    result = result.slice(plan.offset)\n  }\n  if (plan.limit !== undefined) {\n    result = result.slice(0, plan.limit)\n  }\n  return result\n}\n\ninterface CandidateResult {\n  /** The reduced candidate set, materialized to record objects. */\n  readonly candidates: readonly unknown[]\n  /** The clauses that the index could not satisfy and must still be evaluated. */\n  readonly remainingClauses: readonly Clause[]\n}\n\n/**\n * Pick a candidate record set using the index store when possible.\n *\n * Strategy: scan the top-level clauses for the FIRST `==` or `in` clause\n * against an indexed field. If found, use the index to materialize a\n * candidate set and return the OTHER clauses as `remainingClauses`. The\n * caller skips re-evaluating the index-driving clause because the index\n * is authoritative for that field.\n *\n * This is a deliberately simple planner. A future optimizer could pick\n * the most selective index, intersect multiple indexes, or push composite\n * keys through. For the single-index fast path is good enough.\n */\nfunction candidateRecords(source: InternalSource, clauses: readonly Clause[]): CandidateResult {\n  const indexes = source.getIndexes?.()\n  if (!indexes || !source.lookupById || clauses.length === 0) {\n    return { candidates: source.snapshot(), remainingClauses: clauses }\n  }\n  // Bind the lookup method through an arrow so it doesn't drift from\n  // its `this` context — keeps the unbound-method lint rule happy.\n  const lookupById = (id: string): unknown => source.lookupById?.(id)\n\n  for (let i = 0; i < clauses.length; i++) {\n    const clause = clauses[i]!\n    if (clause.type !== 'field') continue\n    if (!indexes.has(clause.field)) continue\n    // A Via-covered clause (e.g. money) only carries a build-time\n    // evaluator payload for per-record comparison by default — `buildClause`\n    // does not rewrite `clause.value` into the index's stored representation\n    // (e.g. multi-currency money operands are `{ amount, currency }`\n    // objects; the index would stringify their keys to a no-match\n    // sentinel). A binding MAY additionally supply `indexValue` (#625,\n    // via `ViaBinding.indexProbe`) — the STORED-form operand for a direct\n    // probe (fixed-mode money `==`/`in` today). When it's absent, skip the\n    // index fast path for this clause; the fallback scan evaluates it via\n    // `clause.via.evaluate`. MIXED-ERA DATA (money, #672 fixed, incl. the\n    // #672 review's C1 finding): the index bucket this probe hits is no\n    // longer keyed by the RAW stored string — EAGER-mode `CollectionIndexes`\n    // canonicalizes money keys through `ViaPipeline.canonicalizeIndexKey` at\n    // EVERY bucket-mutation site (`build`, `upsert`, `remove`), not just\n    // build/rebuild, so a legacy non-canonical scaled value (predates the\n    // field's money() declaration) lands in — and stays in — the SAME bucket\n    // a canonical probe looks up, across later put()/delete() too. LAZY\n    // mode's `PersistedCollectionIndex` gained the SAME guarantee (#677) —\n    // its bucket-mutation sites (`ingest`/`upsert`/`remove`) canonicalize\n    // through the same `ViaPipeline.canonicalizeIndexKey`, and its probe\n    // path (`lazy-builder.ts`'s `resolveCandidateIds()`) canonicalizes the\n    // `==`/`in` lookup value before calling `lookupEqual`/`lookupIn` — see\n    // `moneyIndexProbe`'s doc comment (via-money/where.ts) for the full\n    // story — lazy mode's post-filter is now Via-aware too (#684), so\n    // end-to-end `lazyQuery().where()` money parity with this eager path\n    // holds at every scale (`orderBy` ordering parity remains open, #695).\n    if (clause.via && clause.via.indexValue === undefined) continue\n    const probeValue = clause.via ? clause.via.indexValue : clause.value\n\n    let ids: ReadonlySet<string> | null = null\n    if (clause.op === '==') {\n      ids = indexes.lookupEqual(clause.field, probeValue)\n    } else if (clause.op === 'in' && Array.isArray(probeValue)) {\n      ids = indexes.lookupIn(clause.field, probeValue)\n    }\n\n    if (ids !== null) {\n      // Found an index-eligible clause: materialize the candidate set and\n      // remove this clause from the remaining list.\n      const remaining: Clause[] = []\n      for (let j = 0; j < clauses.length; j++) {\n        if (j !== i) remaining.push(clauses[j]!)\n      }\n      return {\n        candidates: materializeIds(ids, lookupById),\n        remainingClauses: remaining,\n      }\n    }\n    // Not index-eligible — keep scanning in case a later clause is a\n    // better candidate.\n  }\n\n  // No clause was index-eligible — fall back to a full scan.\n  return { candidates: source.snapshot(), remainingClauses: clauses }\n}\n\nfunction materializeIds(\n  ids: ReadonlySet<string>,\n  lookupById: (id: string) => unknown,\n): unknown[] {\n  const out: unknown[] = []\n  for (const id of ids) {\n    const record = lookupById(id)\n    if (record !== undefined) out.push(record)\n  }\n  return out\n}\n\n/**\n * Execute a plan against a snapshot of records.\n * Pure function — same input, same output, no side effects.\n *\n * Records are typed as `unknown` because plans are non-parametric; callers\n * cast the return type at the API surface (see `Query.toArray()`).\n */\nexport function executePlan(records: readonly unknown[], plan: QueryPlan): unknown[] {\n  if (plan.clauses.some(c => c.type === 'crossJoin')) {\n    throw new Error(\n      `executePlan(): does not support crossJoin clauses. ` +\n        `executePlan is a stateless pure function — it cannot resolve cross-join right-side ` +\n        `collections. Use Query.toArray() (via collection.query()) instead.`,\n    )\n  }\n  let result = filterRecords(records, plan.clauses)\n  if (plan.orderBy.length > 0) {\n    result = sortRecords(result, plan.orderBy)\n  }\n  if (plan.offset > 0) {\n    result = result.slice(plan.offset)\n  }\n  if (plan.limit !== undefined) {\n    result = result.slice(0, plan.limit)\n  }\n  return result\n}\n\n/**\n * Build the per-record DECODED view factory for user-callback clauses\n * (`filter` / `wherePredicate`) — those callbacks must see the canonical\n * shape (e.g. money's decimal string), never a Via-transformed stored\n * form. Field clauses are NOT affected: their operands were pre-built\n * into raw stored space at build time. Returns undefined when the\n * source's Via pipeline declares no result decode.\n */\nfunction fnViewDecoder(source: InternalSource): ((r: unknown) => unknown) | undefined {\n  const via = source.via\n  if (!via || !via.hasResultDecode) return undefined\n  return r => via.decodeResults(r)\n}\n\nfunction filterRecords(\n  records: readonly unknown[],\n  clauses: readonly Clause[],\n  decodeForFns?: (r: unknown) => unknown,\n): unknown[] {\n  if (clauses.length === 0) return [...records]\n  // Decode once per record, and only when a callback clause will consume it.\n  const needsFnView = decodeForFns !== undefined && hasFnClause(clauses)\n  const out: unknown[] = []\n  for (const r of records) {\n    const fnView = needsFnView ? decodeForFns(r) : undefined\n    let matches = true\n    for (const clause of clauses) {\n      if (!evaluateClause(r, clause, fnView)) {\n        matches = false\n        break\n      }\n    }\n    if (matches) out.push(r)\n  }\n  return out\n}\n\n/**\n * Walk the clause list in declaration order, batching filter clauses and\n * expanding on crossJoin clauses. Falls back to `candidateRecords + filterRecords`\n * (index fast-path) when no crossJoin clauses are present.\n *\n * Precondition: `joinContext` must be non-null when any `CrossJoinClause` is in `clauses`.\n */\nfunction executeClausePipeline(\n  source: InternalSource,\n  clauses: readonly Clause[],\n  joinContext: JoinContext,\n): unknown[] {\n  let rel: unknown[] = [...source.snapshot()]\n  let filterBatch: Clause[] = []\n  const decodeForFns = fnViewDecoder(source)\n\n  for (const clause of clauses) {\n    if (clause.type === 'crossJoin') {\n      if (filterBatch.length > 0) {\n        rel = filterRecords(rel, filterBatch, decodeForFns)\n        filterBatch = []\n      }\n      const rightSource = joinContext.resolveSource(clause.target)\n      if (!rightSource) {\n        throw new CrossJoinSourceUnknownError(clause.target, joinContext.leftCollection)\n      }\n      rel = applyCrossJoin(rel, clause, rightSource)\n    } else {\n      filterBatch.push(clause)\n    }\n  }\n\n  if (filterBatch.length > 0) {\n    rel = filterRecords(rel, filterBatch, decodeForFns)\n  }\n\n  return rel\n}\n\n/**\n * Expand `leftRel` by cross-joining with `rightSource`. Enforces the cost ceiling\n * BEFORE allocating the expanded relation (full cartesian) or cumulatively\n * (lateral form). Throws `CrossJoinTooLargeError` on breach.\n */\nfunction applyCrossJoin(\n  leftRel: unknown[],\n  clause: CrossJoinClause,\n  rightSource: JoinableSource,\n): unknown[] {\n  const rightRows = rightSource.snapshot()\n  const maxRows = clause.maxRows ?? DEFAULT_CROSS_JOIN_MAX_ROWS\n  const { as } = clause\n\n  if (!clause.on) {\n    const product = leftRel.length * rightRows.length\n    if (product > maxRows) {\n      throw new CrossJoinTooLargeError({ target: clause.target, expected: product, limit: maxRows })\n    }\n    const expanded: unknown[] = []\n    for (const left of leftRel) {\n      const leftObj = left as Record<string, unknown>\n      for (const right of rightRows) {\n        expanded.push({ ...leftObj, [as]: right })\n      }\n    }\n    return expanded\n  }\n\n  // Lateral — ceiling is cumulative (post-filter count)\n  const expanded: unknown[] = []\n  let cumulative = 0\n  for (const left of leftRel) {\n    const callbackResult = clause.on(left)\n    let filteredRight: readonly unknown[]\n    if (Array.isArray(callbackResult)) {\n      filteredRight = callbackResult\n    } else {\n      filteredRight = (rightRows as unknown[]).filter(\n        callbackResult as (r: unknown) => boolean,\n      )\n    }\n    cumulative += filteredRight.length\n    if (cumulative > maxRows) {\n      throw new CrossJoinTooLargeError({\n        target: clause.target,\n        expected: cumulative,\n        limit: maxRows,\n      })\n    }\n    const leftObj = left as Record<string, unknown>\n    for (const right of filteredRight) {\n      expanded.push({ ...leftObj, [as]: right })\n    }\n  }\n  return expanded\n}\n\nfunction sortRecords(\n  records: unknown[],\n  orderBy: readonly OrderBy[],\n  via?: ViaPipeline,\n  labelMaps?: Map<string, (code: string) => string | undefined>,\n): unknown[] {\n  // Stable sort: Array.prototype.sort is required to be stable since ES2019.\n  return [...records].sort((a, b) => {\n    for (const { field, direction, by } of orderBy) {\n      let av = readField(a, field)\n      let bv = readField(b, field)\n      // dictKey/lookup label-sort: compare resolved labels (fallback to the\n      // code when unresolved), so e.g. honorific codes sort by their locale label.\n      const labelResolver = by === 'label' ? labelMaps?.get(field) : undefined\n      if (labelResolver) {\n        av = (typeof av === 'string' ? labelResolver(av) : undefined) ?? av\n        bv = (typeof bv === 'string' ? labelResolver(bv) : undefined) ?? bv\n        const cmp = compareValues(av, bv)\n        if (cmp !== 0) return direction === 'asc' ? cmp : -cmp\n        continue\n      }\n      // A Via-covered field (e.g. money) may store a representation the\n      // generic comparator would order wrong (money's scaled-integer\n      // strings sort lexically, not numerically: '9882' > '10004'). Ask\n      // the pipeline for an exact ordering first; fall back to the\n      // generic comparator when no binding covers the field.\n      const viaCmp = via?.compareForOrder(field, av, bv)\n      const cmp = viaCmp !== undefined ? viaCmp : compareValues(av, bv)\n      if (cmp !== 0) return direction === 'asc' ? cmp : -cmp\n    }\n    return 0\n  })\n}\n\n/**\n * dictKey/lookup label-sort: for each `orderBy(..., { by: 'label' })`\n * field, build a sync per-key label RESOLVER at the query `locale` (falling\n * back to a `staticDict` `displayLocale`). Two sources, tried in order:\n *\n * 1. `joinContext.resolveDictSource(field)` — the pre-existing dict-registry\n *    bridge (unchanged from before #650 Task 7): covers dictKey/staticDict\n *    AND their native `dict()`/`lookup(static)`/`lookup(reserved)` aliases\n *    (`registry.ts`'s `collectLookupDictCompat` bridges those tiers into the\n *    same vault registries this reads). Builds an EAGER `code -> label` map\n *    from the source's full snapshot, same as always.\n * 2. `via.resolveOrderLabel(field, key, locale)` (#650 Task 7) — the\n *    fallback for lookup fields the bridge above doesn't cover (matrix/\n *    collection tier — no vault registry backs it). Per-key, LAZY (no full\n *    snapshot enumeration API at this layer), memoized per field so a\n *    repeated key within one sort doesn't re-resolve.\n *\n * Fields with neither source available are skipped — the sort then falls\n * back to the raw stored code for them.\n */\nfunction buildOrderLabelMaps(\n  orderBy: readonly OrderBy[],\n  joinContext: JoinContext | undefined,\n  locale: string | undefined,\n  via: ViaPipeline | undefined,\n): Map<string, (code: string) => string | undefined> | undefined {\n  let maps: Map<string, (code: string) => string | undefined> | undefined\n  for (const { field, by } of orderBy) {\n    if (by !== 'label') continue\n    const dictSource = joinContext?.resolveDictSource?.(field)\n    if (dictSource) {\n      const loc = locale ?? dictSource.displayLocale\n      if (loc === undefined) continue\n      const codeToLabel = new Map<string, string>()\n      for (const entry of dictSource.snapshot()) {\n        const k = (entry as Record<string, unknown>)['key']\n        const labels = (entry as Record<string, unknown>)['labels'] as Record<string, string> | undefined\n        const label = labels?.[loc]\n        if (typeof k === 'string' && typeof label === 'string') codeToLabel.set(k, label)\n      }\n      ;(maps ??= new Map()).set(field, (code: string) => codeToLabel.get(code))\n      continue\n    }\n    if (via) {\n      const cache = new Map<string, string | undefined>()\n      ;(maps ??= new Map()).set(field, (code: string) => {\n        if (!cache.has(code)) cache.set(code, via.resolveOrderLabel(field, code, locale))\n        return cache.get(code)\n      })\n    }\n  }\n  return maps\n}\n\nfunction readField(record: unknown, field: string): unknown {\n  if (record === null || record === undefined) return undefined\n  if (!field.includes('.')) {\n    return (record as Record<string, unknown>)[field]\n  }\n  const segments = field.split('.')\n  let cursor: unknown = record\n  for (const segment of segments) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\nfunction compareValues(a: unknown, b: unknown): number {\n  // Nullish goes last in asc order.\n  if (a === undefined || a === null) return b === undefined || b === null ? 0 : 1\n  if (b === undefined || b === null) return -1\n  if (typeof a === 'number' && typeof b === 'number') return a - b\n  if (typeof a === 'string' && typeof b === 'string') return a < b ? -1 : a > b ? 1 : 0\n  if (a instanceof Date && b instanceof Date) return a.getTime() - b.getTime()\n  // Mixed/unsupported types: treat as equal so the sort stays stable.\n  // (Deliberate choice — we don't try to coerce arbitrary objects to strings.)\n  return 0\n}\n\nfunction serializePlan(plan: QueryPlan): unknown {\n  return {\n    clauses: plan.clauses.map(serializeClause),\n    orderBy: plan.orderBy,\n    limit: plan.limit,\n    offset: plan.offset,\n    joins: plan.joins,\n  }\n}\n\nfunction serializeClause(clause: Clause): unknown {\n  if (clause.type === 'filter') {\n    return { type: 'filter', fn: '[function]' }\n  }\n  if (clause.type === 'wherePredicate') {\n    // Strip the live `fn` reference (non-serializable) but keep the\n    // identity-carrying fields so distinct predicates still serialize\n    // distinctly. `predicateHash` + `ctxHash` are the hash identity;\n    // `name` is the named predicate reference. This matters because\n    // A previous fall-through (return clause) exposed the live fn and produced\n    // identical serializations for distinct predicates with different ctx values.\n    return {\n      type: 'wherePredicate',\n      name: clause.name,\n      ctx: clause.ctx,\n      predicateHash: clause.predicateHash,\n      ctxHash: clause.ctxHash,\n      fn: '[function]',\n    }\n  }\n  if (clause.type === 'group') {\n    return {\n      type: 'group',\n      op: clause.op,\n      clauses: clause.clauses.map(serializeClause),\n    }\n  }\n  if (clause.type === 'crossJoin') {\n    return {\n      type: 'crossJoin',\n      target: clause.target,\n      as: clause.as,\n      on: clause.on ? '[function]' : undefined,\n      onPredicateName: clause.onPredicateName,\n      maxRows: clause.maxRows,\n    }\n  }\n  return clause\n}\n\n/**\n * Compute a stable hash of a `ctx` value supplied to\n * `.wherePredicate(name, ctx)`. Canonical-JSON: keys sorted at each\n * level so `{a, b}` and `{b, a}` hash to the same value. Undefined ctx\n * hashes to the empty string. The hash is sync because it just runs\n * a cheap djb2-style fold — used at builder time, not security-sensitive.\n *\n * @internal\n */\nfunction canonicalCtxHash(ctx: unknown): string {\n  if (ctx === undefined) return \"\"\n  const canonical = JSON.stringify(ctx, (_key, value) => {\n    if (value && typeof value === \"object\" && !Array.isArray(value)) {\n      const sorted: Record<string, unknown> = {}\n      for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n        sorted[k] = (value as Record<string, unknown>)[k]\n      }\n      return sorted\n    }\n    return value\n  })\n  // djb2 fold over the canonical string; converted to hex.\n  let h = 5381\n  for (let i = 0; i < canonical.length; i++) {\n    h = ((h << 5) + h) ^ canonical.charCodeAt(i)\n  }\n  return (h >>> 0).toString(16).padStart(8, \"0\")\n}\n\n/**\n * Build a dict-label resolver for `Query.groupBy(field)` when the\n * grouping field is a `dictKey`. Extracted from the inline closure\n * inside `groupBy` so the multi-key path (which has no meaningful\n * `<field>Label` shape) can skip it cleanly. Pure refactor — no\n * behaviour change for the single-field path.\n *\n * Returns `undefined` when:\n *   - the join context lacks a `resolveDictSource` hook, or\n *   - no dictionary source is registered for `field`.\n *\n * @internal\n */\nfunction buildDictLabelResolver(\n  joinCtx: JoinContext | undefined,\n  field: string,\n):\n  | ((key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>)\n  | undefined {\n  if (!joinCtx?.resolveDictSource) return undefined\n  const dictSource = joinCtx.resolveDictSource(field)\n  if (!dictSource) return undefined\n  const snapshot = dictSource.snapshot()\n  // A staticDict-backed source carries a `displayLocale`; use it as the\n  // locale default when the query is locale-less, so `{ by: 'label' }` still\n  // resolves under a locale-less read. Plain _dict_* sources omit it.\n  const displayLocale = dictSource.displayLocale\n  const dictMap = new Map<string, Record<string, string>>()\n  for (const entry of snapshot) {\n    const k = (entry as Record<string, unknown>)['key']\n    const labels = (entry as Record<string, unknown>)['labels']\n    if (typeof k === 'string' && labels && typeof labels === 'object') {\n      dictMap.set(k, labels as Record<string, string>)\n    }\n  }\n  return async (\n    key: string,\n    locale: string,\n    fallback?: string | readonly string[],\n  ): Promise<string | undefined> => {\n    const effLocale = locale || displayLocale\n    if (!effLocale) return undefined\n    const labels = dictMap.get(key)\n    if (!labels) return undefined\n    if (labels[effLocale] !== undefined) return labels[effLocale]\n    const chain = Array.isArray(fallback)\n      ? (fallback as readonly string[])\n      : fallback\n        ? [fallback as string]\n        : []\n    for (const fb of chain) {\n      if (fb === 'any') {\n        const any = Object.values(labels)[0]\n        if (any !== undefined) return any\n      } else if (labels[fb] !== undefined) {\n        return labels[fb]\n      }\n    }\n    return undefined\n  }\n}\n","/**\n * Streaming scan builder with filter + aggregate support.\n *\n * `Collection.scan()` now returns a `ScanBuilder<T>` that\n * implements `AsyncIterable<T>` (for existing `for await … of`\n * consumers) AND exposes chainable `.where()` / `.filter()` clauses\n * plus a `.aggregate(spec)` async terminal that reduces the scan\n * stream through the same reducer protocol as `Query.aggregate()`\n *.\n *\n * **Memory model:** O(reducers), not O(records). The aggregate\n * terminal initializes one state per reducer, iterates through the\n * scan one record at a time via `for await`, applies every reducer's\n * `step` per record, and never collects the stream into an array.\n * This is what makes `scan().aggregate()` suitable for collections\n * that don't fit in memory — the bound is a code-level invariant\n * visible in the function body, not a runtime assertion.\n *\n * **Paginated iteration:** the builder holds a `pageProvider`\n * closure that maps `(cursor, limit) → Promise<page>`, plumbed by\n * `Collection.scan()` to `collection.listPage(...)`. The page\n * iterator walks cursors forward until exhaustion, same as the\n * previous async-generator `scan()` did.\n *\n * **Backward compatibility:** existing `for await (const rec of\n * collection.scan()) { … }` code continues to work because\n * `ScanBuilder` implements `[Symbol.asyncIterator]`. The previous\n * signature returned an `AsyncIterableIterator<T>` (which has both\n * `[Symbol.asyncIterator]` and `.next()`). We verified at grep time\n * that no call sites use `.next()` on the scan result directly, so\n * the narrowed interface is safe.\n *\n * **Immutability:** each `.where()` / `.filter()` call returns a\n * fresh builder sharing the same page provider and page size. This\n * lets a base scan be reused for multiple parallel aggregations:\n *\n * ```ts\n * const scan = invoices.scan()\n * const [open, paid] = await Promise.all([\n *   scan.where('status', '==', 'open').aggregate({ n: count() }),\n *   scan.where('status', '==', 'paid').aggregate({ n: count() }),\n * ])\n * ```\n *\n * Note that each aggregation pays a full scan — there's no shared\n * iteration across the two. Multi-way aggregation in a single pass\n * is out of scope; consumers who need it should build a compound spec\n * and run a single `.aggregate({ openN, paidN })` at the DSL level.\n *\n * **Out of scope for (tracked separately):**\n *   - `scan().aggregate().live()` — unbounded scan + change-stream\n *     reconciliation is a design problem, not just a code one\n *   - `scan().groupBy().aggregate()` — high-cardinality grouping on\n *     huge collections would re-introduce the O(groups) memory\n *     problem that aggregate fixes\n *   - Parallel scan across pages — race-safe page cursor contracts\n *     are not in the adapter API yet\n *   - `scan().join(...)` — tracked under  (streaming join)\n */\n\nimport type { QueryField } from '../types.js'\nimport type { ReducerBuilder } from '../../with-lookup/aggregate/reducers.js'\nimport { reducerBuilder } from '../../with-lookup/aggregate/reducers.js'\nimport type { Clause, FieldClause, Operator } from './predicate.js'\nimport { evaluateClause, hasFnClause, readPath } from './predicate.js'\nimport type {\n  AggregateSpec,\n  AggregateResult,\n} from '../../with-lookup/aggregate/aggregation.js'\nimport type { JoinContext, JoinLeg, JoinableSource } from './join.js'\nimport { DanglingReferenceError, FieldNotQueryableError } from '../errors.js'\nimport type { ViaPipeline } from '../via/pipeline.js'\n\n/**\n * Page provider — the Collection-shaped hook the builder calls to\n * walk cursors forward. Kept as a structural interface so tests can\n * wire up a synthetic provider without pulling in the full\n * Collection class. Collection's `listPage` matches this shape\n * exactly.\n */\nexport interface ScanPageProvider<T> {\n  listPage(opts: {\n    cursor?: string\n    limit?: number\n  }): Promise<{ items: T[]; nextCursor: string | null }>\n}\n\nconst DEFAULT_SCAN_PAGE_SIZE = 100\n\n/**\n * Chainable streaming scan. Implements `AsyncIterable<T>` for\n * drop-in use with `for await … of`; adds `.where()` / `.filter()`\n * chainable clauses and a `.aggregate(spec)` async terminal.\n *\n * The builder is immutable per operation — each chained call\n * returns a fresh `ScanBuilder` sharing the same page provider and\n * page size. The original builder is never mutated, so it's safe\n * to reuse across multiple parallel consumers.\n */\nexport class ScanBuilder<T, S extends keyof T = never, M extends keyof T & string = never> implements AsyncIterable<T> {\n  private readonly pageProvider: ScanPageProvider<T>\n  private readonly pageSize: number\n  private readonly clauses: readonly Clause[]\n  /**\n   * Zero-or-more join legs to apply per record as the stream flows.\n   * Each leg attaches the resolved right-side record (or null) under\n   * its alias. — streaming joins.\n   *\n   * Joins are evaluated AFTER clauses, so a `where()` filtered-out\n   * record never triggers a right-side lookup. This is the same\n   * ordering as `Query.toArray()` (clauses first, joins after) and\n   * keeps the streaming path from doing wasted work.\n   */\n  private readonly joins: readonly JoinLeg[]\n  /**\n   * Join resolution context. Required for `.join()` to translate a\n   * field name into a target collection + ref mode and to resolve\n   * the right-side `JoinableSource`. Optional because tests\n   * construct ScanBuilder directly with synthetic page providers\n   * that don't know about ref() — calling `.join()` without a\n   * context throws with an actionable error.\n   */\n  private readonly joinContext: JoinContext | undefined\n  /**\n   * The backing collection's compiled Via pipeline (money now; more Via\n   * features later). When it declares a result decode, yielded records\n   * are decoded (e.g. money: stored scaled-int → canonical decimal) so\n   * `scan()` agrees with `get()`/`list()`/`query().toArray()`. Decoded\n   * with `'raw'` (canonical decimal, no locale-formatted virtuals) since\n   * the scan stream carries no locale context, mirroring `Query.toArray()`.\n   */\n  private readonly via: ViaPipeline | undefined\n\n  constructor(\n    pageProvider: ScanPageProvider<T>,\n    pageSize: number = DEFAULT_SCAN_PAGE_SIZE,\n    clauses: readonly Clause[] = [],\n    joins: readonly JoinLeg[] = [],\n    joinContext?: JoinContext,\n    via?: ViaPipeline,\n  ) {\n    this.pageProvider = pageProvider\n    this.pageSize = pageSize\n    this.clauses = clauses\n    this.joins = joins\n    this.joinContext = joinContext\n    this.via = via\n  }\n\n  /**\n   * Decode this scan's Via-covered fields on a record (e.g. money: stored\n   * scaled-int → canonical decimal). No-op when the Via pipeline declares\n   * no result decode. See {@link via}.\n   */\n  private decodeVia(record: T): T {\n    if (!this.via || !this.via.hasResultDecode) return record\n    return this.via.decodeResults(record) as T\n  }\n\n  /**\n   * Add a field comparison. Runs per record as the scan stream\n   * flows through, so non-matching records are dropped before they\n   * reach `.aggregate()` or the iteration consumer. Multiple\n   * `.where()` calls are AND-combined — same semantics as\n   * `Query.where()`.\n   *\n   * Clauses cannot use the secondary-index fast path here because\n   * the scan sources records from the adapter's paginator, not from\n   * the in-memory cache where indexes live. Index-accelerated scans\n   * are a future optimization — the current implementation\n   * evaluates clauses per record in O(1) per clause.\n   *\n   * Consults the Via pipeline's posture before building a clause (#629\n   * Task 8): a field whose posture is `queryable: 'none'` throws\n   * `FieldNotQueryableError` here, at the call site — same gate as\n   * `Query.where()`.\n   */\n  where(field: QueryField<T, S>, op: Operator, value: unknown): ScanBuilder<T, S, M> {\n    // A Via-covered field (e.g. money) compares in major units, BigInt-exact\n    // in scaled space — same build-time operand rewrite as Query.where().\n    const via = this.via\n    if (via?.postureFor(field as string)?.queryable === 'none') throw new FieldNotQueryableError(field as string)\n    const viaClause = via?.buildClause(field as string, op, value)\n    const clause: FieldClause = viaClause\n      ? {\n          type: 'field',\n          field: field as string,\n          op,\n          value,\n          via: {\n            brand: viaClause.brand,\n            payload: viaClause.payload,\n            evaluate: (actual: unknown, evalOp: string) => via!.evaluateClause(viaClause, actual, evalOp),\n          },\n        }\n      : { type: 'field', field: field as string, op, value }\n    return new ScanBuilder<T, S, M>(\n      this.pageProvider,\n      this.pageSize,\n      [...this.clauses, clause],\n      this.joins,\n      this.joinContext,\n      this.via,\n    )\n  }\n\n  /**\n   * Escape hatch: add an arbitrary predicate function. Same\n   * non-serializable caveat as `Query.filter()` — filter clauses\n   * don't round-trip through `toPlan()`. Prefer `.where()` when\n   * possible.\n   */\n  filter(fn: (record: T) => boolean): ScanBuilder<T, S, M> {\n    const clause: Clause = {\n      type: 'filter',\n      fn: fn as (record: unknown) => boolean,\n    }\n    return new ScanBuilder<T, S, M>(\n      this.pageProvider,\n      this.pageSize,\n      [...this.clauses, clause],\n      this.joins,\n      this.joinContext,\n      this.via,\n    )\n  }\n\n  /**\n   * Resolve a `ref()`-declared foreign key per record as the scan\n   * stream flows, attaching the right-side record (or null) under\n   * `opts.as`. — streaming joins over `scan()`.\n   *\n   * ```ts\n   * for await (const inv of invoices.scan().join('clientId', { as: 'client' })) {\n   *   await processInvoice(inv) // inv.client is attached\n   * }\n   *\n   * // Or terminate with .aggregate() for streaming joined aggregation\n   * const { total } = await invoices.scan()\n   *   .where('status', '==', 'open')\n   *   .join('clientId', { as: 'client' })\n   *   .aggregate({ total: sum('amount') })\n   * ```\n   *\n   * **The key difference from eager `.join()`:** the LEFT\n   * side streams page-by-page from the adapter and is never\n   * materialized. Memory ceiling on the left is O(pageSize), not\n   * O(rowCount). This is what makes streaming joins suitable for\n   * collections that exceed the eager join's 50_000-row ceiling.\n   *\n   * **Right-side strategy** is auto-selected per leg:\n   *   - **Indexed** — right source exposes `lookupById`, so each\n   *     left row costs O(1). This is the common path for\n   *     Collection right sides, which back `lookupById` with a Map\n   *     lookup over the in-memory cache. The right collection must\n   *     be in eager mode (the same constraint as eager join's\n   *     `querySourceForJoin` from ).\n   *   - **Hash** — right source has only `snapshot()`. Build a\n   *     `Map<id, record>` once at iteration start, probe per left\n   *     row. Same correctness, same per-row cost as the indexed\n   *     path; the difference is the upfront cost of materializing\n   *     the right side once.\n   *\n   * Both strategies hold the right side in memory for the duration\n   * of the iteration. The \"streaming\" property applies to the LEFT\n   * side only — true left-and-right streaming joins (where neither\n   * side fits in memory) require a sort-merge join planner that's\n   * out of scope for.\n   *\n   * **Ref-mode semantics** match eager `.join()` exactly:\n   *   - `strict`  → throws `DanglingReferenceError` mid-stream\n   *     when a left record points at a non-existent right id.\n   *     The throw aborts the async iterator — consumers should\n   *     wrap the `for await` in try/catch if they want to recover.\n   *   - `warn`    → attaches `null` and emits a one-shot warning\n   *     per unique dangling pair (deduped via the same warn\n   *     channel as eager join).\n   *   - `cascade` → attaches `null` silently. A delete-time mode;\n   *     dangling refs at read time are mid-flight or pre-existing\n   *     orphans, not a DSL error.\n   *\n   * Left records with null/undefined FK values attach `null`\n   * regardless of mode — same \"no reference at all\" policy as\n   * eager join and write-time `enforceRefsOnPut`.\n   *\n   * **Multi-FK chaining** is supported via repeated `.join()`\n   * calls: each leg resolves an independent ref. Each leg\n   * independently picks its right-side strategy and applies its\n   * own ref mode.\n   *\n   * **Joins are NOT applied** to a `.aggregate()` terminal that\n   * doesn't reference joined fields — wait, that's not quite\n   * right. The streaming path actually DOES apply joins before\n   * `.aggregate()` because the join attaches a field that the\n   * spec might reference. Unlike `Query.aggregate()` (which skips\n   * joins entirely as a projection-only short-circuit), the\n   * streaming aggregation can't know whether the spec touches a\n   * joined field, so it always applies joins. Consumers who want\n   * unjoined streaming aggregation should leave `.join()` off the\n   * chain — the chain is composable for a reason.\n   *\n   *  constraint #1 — every JoinLeg carries `partitionScope:\n   * 'all'` plumbed through but never read by. Same seam as\n   * eager join.\n   */\n  join<As extends string, R = unknown>(\n    field: QueryField<T, S>,\n    opts: { as: As },\n  ): ScanBuilder<T & Record<As, R | null>, S, M> {\n    if (!this.joinContext) {\n      throw new Error(\n        `ScanBuilder.join() requires a join context. Use ` +\n          `collection.scan() to construct a join-capable scan instead ` +\n          `of the ScanBuilder constructor directly (the direct ` +\n          `constructor is only used for tests with synthetic page ` +\n          `providers).`,\n      )\n    }\n    const descriptor = this.joinContext.resolveRef(field)\n    if (!descriptor) {\n      throw new Error(\n        `ScanBuilder.join(): no ref() declared for field \"${field}\" on ` +\n          `collection \"${this.joinContext.leftCollection}\". Add ` +\n          `refs: { ${field}: ref('<target-collection>') } to the ` +\n          `collection options, then retry.`,\n      )\n    }\n    const leg: JoinLeg = {\n      field,\n      as: opts.as,\n      target: descriptor.target,\n      mode: descriptor.mode,\n      strategy: undefined,\n      maxRows: undefined,\n      //  constraint #1 — always 'all' in, never read by\n      // the streaming executor. partition-aware scan joins\n      // will populate this from where() predicates without\n      // changing the planner shape.\n      partitionScope: 'all',\n    }\n    return new ScanBuilder<T & Record<As, R | null>, S, M>(\n      this.pageProvider as unknown as ScanPageProvider<T & Record<As, R | null>>,\n      this.pageSize,\n      this.clauses,\n      [...this.joins, leg],\n      this.joinContext,\n      this.via,\n    )\n  }\n\n  /**\n   * Iterate the scan as an async iterable. Walks the page\n   * provider's cursors forward until exhaustion, applying every\n   * clause per record — only matching records are yielded.\n   *\n   * Backward-compatible with the previous async-generator `scan()`\n   * return type for `for await … of` consumers.\n   */\n  async *[Symbol.asyncIterator](): AsyncIterator<T> {\n    // One-time setup: resolve every join leg's right-side source\n    // and pick its strategy (lookupById per row vs hash from\n    // snapshot once). Both are O(left) per record after setup; the\n    // difference is the upfront cost of hashing the right side\n    // when there's no lookupById.\n    //\n    // Hash maps live for the lifetime of the iteration, so memory\n    // for the right side is O(rightRowCount) per leg. Memory for\n    // the left side stays O(pageSize) regardless — that's the\n    // streaming property we're after.\n    const joinResolvers = this.joins.length === 0 ? null : this.buildJoinResolvers()\n\n    let page = await this.pageProvider.listPage({ limit: this.pageSize })\n    while (true) {\n      for (const record of page.items) {\n        // Filter on the raw stored record (same order as Query.toArray:\n        // clauses first), then decode Via-covered fields (e.g. money, to\n        // the canonical decimal) before yielding so scan() never leaks the\n        // internal stored representation.\n        if (!this.recordMatches(record)) continue\n        const decoded = this.decodeVia(record)\n        if (joinResolvers === null) {\n          yield decoded\n        } else {\n          // Apply every join leg in declaration order. Each\n          // leg attaches a field — the result of one leg becomes\n          // the input to the next. Multi-FK chaining is\n          // supported by construction.\n          let attached: unknown = decoded\n          for (const resolver of joinResolvers) {\n            attached = this.applyOneJoinStreaming(attached, resolver)\n          }\n          yield attached as T\n        }\n      }\n      if (page.nextCursor === null) return\n      page = await this.pageProvider.listPage({\n        cursor: page.nextCursor,\n        limit: this.pageSize,\n      })\n    }\n  }\n\n  /**\n   * Per-leg right-side resolution state. Built once at iteration\n   * start and reused for every left record. Two strategies:\n   *\n   *   - `lookupById`: present when the right source exposes the\n   *     hook directly (typical Collection right side). Per-row\n   *     cost is O(1).\n   *   - `hashByPrimaryKey`: built from `snapshot()` when no\n   *     lookupById. Per-row cost is O(1) after the upfront O(N)\n   *     materialization. Same as eager join's hash strategy.\n   *\n   * `warnedKeys` is the per-leg dedup set for ref-mode 'warn'. We\n   * key on `field→target:refId` so the same dangling pair only\n   * warns once per iteration. The dedup is per-iteration, not\n   * per-process — a long-running scan that re-iterates would warn\n   * again, which is the desired behavior (the data may have\n   * changed between iterations).\n   */\n  private buildJoinResolvers(): Array<{\n    leg: JoinLeg\n    source: JoinableSource\n    lookupById: ((id: string) => unknown) | null\n    hashByPrimaryKey: ReadonlyMap<string, unknown> | null\n    warnedKeys: Set<string>\n  }> {\n    if (!this.joinContext) {\n      // Unreachable — .join() throws if joinContext is missing.\n      // Belt-and-braces because the iterator is invoked via\n      // Symbol.asyncIterator on a builder that may have been\n      // constructed via the direct constructor with pre-populated\n      // joins.\n      throw new Error(\n        `ScanBuilder iterator: ${this.joins.length} join leg(s) ` +\n          `present but no JoinContext attached. Use collection.scan() ` +\n          `to construct a join-capable scan.`,\n      )\n    }\n    const resolvers: Array<{\n      leg: JoinLeg\n      source: JoinableSource\n      lookupById: ((id: string) => unknown) | null\n      hashByPrimaryKey: ReadonlyMap<string, unknown> | null\n      warnedKeys: Set<string>\n    }> = []\n    for (const leg of this.joins) {\n      const source = this.joinContext.resolveSource(leg.target)\n      if (!source) {\n        throw new Error(\n          `ScanBuilder.join() cannot resolve target collection ` +\n            `\"${leg.target}\" (referenced from field \"${leg.field}\" on ` +\n            `\"${this.joinContext.leftCollection}\"). Make sure the target ` +\n            `collection has been opened via vault.collection() ` +\n            `at least once before iterating the scan.`,\n        )\n      }\n      // Strategy selection: prefer lookupById when available\n      // (O(1) per row, no upfront cost), fall back to hashing\n      // snapshot() once otherwise.\n      let lookupById: ((id: string) => unknown) | null = null\n      let hashByPrimaryKey: ReadonlyMap<string, unknown> | null = null\n      if (source.lookupById) {\n        // Bind through an arrow so the lookupById's `this`\n        // doesn't drift — same pattern as the eager join's\n        // strategy resolver.\n        const fn = source.lookupById.bind(source)\n        lookupById = (id: string): unknown => fn(id)\n      } else {\n        const map = new Map<string, unknown>()\n        for (const record of source.snapshot()) {\n          const rawId = readPath(record, 'id')\n          const key = coerceRefKey(rawId)\n          if (key !== null) map.set(key, record)\n        }\n        hashByPrimaryKey = map\n      }\n      resolvers.push({\n        leg,\n        source,\n        lookupById,\n        hashByPrimaryKey,\n        warnedKeys: new Set<string>(),\n      })\n    }\n    return resolvers\n  }\n\n  /**\n   * Resolve a single join leg for one left record and return the\n   * left record with the joined field attached under\n   * `leg.as`. Pure function over `(left, resolver)`; never\n   * mutates the input.\n   *\n   * Ref-mode dispatch matches eager `applyJoins` from :\n   *   - null/undefined FK → attach null silently (always allowed)\n   *   - dangling FK + strict → throw `DanglingReferenceError`\n   *   - dangling FK + warn → attach null, warn-once per pair\n   *   - dangling FK + cascade → attach null silently\n   */\n  private applyOneJoinStreaming(\n    left: unknown,\n    resolver: {\n      leg: JoinLeg\n      source: JoinableSource\n      lookupById: ((id: string) => unknown) | null\n      hashByPrimaryKey: ReadonlyMap<string, unknown> | null\n      warnedKeys: Set<string>\n    },\n  ): unknown {\n    if (left === null || typeof left !== 'object') {\n      // Pathological input; matches eager join's defensive return.\n      return left\n    }\n    const { leg } = resolver\n    const rawId = readPath(left, leg.field)\n    const refKey = coerceRefKey(rawId)\n    let right: unknown = undefined\n    if (refKey !== null) {\n      if (resolver.lookupById !== null) {\n        right = resolver.lookupById(refKey)\n      } else if (resolver.hashByPrimaryKey !== null) {\n        right = resolver.hashByPrimaryKey.get(refKey)\n      }\n    }\n\n    const merged: Record<string, unknown> = {\n      ...(left as Record<string, unknown>),\n    }\n    if (right === undefined) {\n      // No matching record. Distinguish \"no ref at all\" (null FK)\n      // from \"dangling ref\" (FK pointed at nothing).\n      if (refKey !== null && leg.mode === 'strict') {\n        throw new DanglingReferenceError({\n          field: leg.field,\n          target: leg.target,\n          refId: refKey,\n          message:\n            `ScanBuilder.join() strict dangling: record references ` +\n            `\"${leg.target}:${refKey}\" via field \"${leg.field}\", but no ` +\n            `such record exists. Use ref() mode 'warn' or 'cascade' if ` +\n            `dangling refs are acceptable, or run ` +\n            `vault.checkIntegrity() to find and fix the orphans.`,\n        })\n      }\n      if (refKey !== null && leg.mode === 'warn') {\n        const dedupKey = `${leg.field}→${leg.target}:${refKey}`\n        if (!resolver.warnedKeys.has(dedupKey)) {\n          resolver.warnedKeys.add(dedupKey)\n          console.warn(\n            `[noy-db] ScanBuilder.join() encountered dangling ref in ` +\n              `'warn' mode: field \"${leg.field}\" → \"${leg.target}:` +\n              `${refKey}\" not found. Attaching null.`,\n          )\n        }\n      }\n      // strict already threw above; warn falls through here; cascade\n      // hits this path silently.\n      merged[leg.as] = null\n    } else {\n      merged[leg.as] = right\n    }\n    return merged\n  }\n\n  /**\n   * Reduce the scan stream through a named set of reducers and\n   * return the final aggregated shape.\n   *\n   * Memory is O(reducers): one mutable state slot per spec key.\n   * Records flow through the pipeline one at a time via\n   * `for await` and are discarded after their `step()` is applied\n   * — never collected into an array. This is the distinguishing\n   * property from `Query.aggregate()`, which materializes the full\n   * match set first.\n   *\n   * Reuses the same reducer protocol as `Query.aggregate()`,\n   * so `count()`, `sum(field)`, `avg(field)`, `min(field)`,\n   * `max(field)` all work unchanged. The `{ seed }` parameter\n   * plumbing from  constraint #2 is honored transparently — the\n   * factories ignore it in and the scan executor never\n   * touches the per-reducer state construction.\n   *\n   * **Returns a Promise**, unlike `Query.aggregate().run()` which\n   * is synchronous. The scan is inherently async because it walks\n   * adapter pages, so the terminal has to be too. Consumers\n   * destructure with await:\n   *\n   * ```ts\n   * const { total, n } = await invoices.scan()\n   *   .where('year', '==', 2025)\n   *   .aggregate({ total: sum('amount'), n: count() })\n   * ```\n   *\n   * **No `.live()` in.** `scan().aggregate().live()` would\n   * require reconciling an unbounded streaming iteration with a\n   * change-stream subscription — a design problem, not just a code\n   * one. Consumers with huge collections and live needs should\n   * narrow with `.where()` enough to fit in the 50k `query()`\n   * limit and use `query().aggregate().live()` instead.\n   *\n   * Consults the Via pipeline's posture before reducing (#629 Task 8 review\n   * fix wave 1): a reducer over a field whose posture is `queryable: 'none'`\n   * throws `FieldNotQueryableError` here, metadata-only — via\n   * `ViaPipeline.refuseUnqueryableReducers`, NOT the full `wrapReducers`\n   * (which would also activate money's exact-reducer rewrite, a path this\n   * method has never run and must not start running as a side effect of\n   * this gate).\n   */\n  async aggregate<Spec extends AggregateSpec>(spec: Spec): Promise<AggregateResult<Spec>>\n  async aggregate<Spec extends AggregateSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Promise<AggregateResult<Spec>>\n  async aggregate<Spec extends AggregateSpec>(\n    specOrBuild: Spec | ((b: ReducerBuilder<T, S, M>) => Spec),\n  ): Promise<AggregateResult<Spec>> {\n    // Opt-in builder form `aggregate(b => spec)`: `b`'s field args are\n    // `QueryField<T, S>`, refusing sensitive fields (the standalone-spec form\n    // stays unrefused for back-compat), and `sum`/`min`/`max` over a declared\n    // `moneyFields` (`M`) member return a `MoneyString`. Mirrors `Query.aggregate`.\n    const spec: Spec = typeof specOrBuild === 'function'\n      ? (specOrBuild as (b: ReducerBuilder<T, S, M>) => Spec)(reducerBuilder as unknown as ReducerBuilder<T, S, M>)\n      : specOrBuild\n    this.via?.refuseUnqueryableReducers(spec)\n    const keys = Object.keys(spec)\n    // Per-reducer state. Exactly |keys| entries, never grows with\n    // the record count — that's the O(reducers) memory guarantee.\n    const state: Record<string, unknown> = {}\n    for (const key of keys) {\n      state[key] = spec[key]!.init()\n    }\n\n    // Record-by-record streaming step. `for await (… of this)`\n    // invokes the Symbol.asyncIterator above, which honors the\n    // clause list, so filtered-out records never reach the step\n    // loop — they're dropped at the iterator boundary.\n    for await (const record of this) {\n      for (const key of keys) {\n        state[key] = spec[key]!.step(state[key], record)\n      }\n    }\n\n    const result: Record<string, unknown> = {}\n    for (const key of keys) {\n      result[key] = spec[key]!.finalize(state[key])\n    }\n    return result as AggregateResult<Spec>\n  }\n\n  /**\n   * Evaluate the clause list against a single record. Linear in\n   * the clause count; short-circuits on first false. Clauses on a\n   * scan are always re-evaluated per record — no index-accelerated\n   * path, because the stream sources records from the adapter\n   * paginator, not from the in-memory cache where indexes live.\n   */\n  private recordMatches(record: T): boolean {\n    if (this.clauses.length === 0) return true\n    // User-callback clauses (filter) see the DECODED view (e.g. money's\n    // canonical decimal); field clauses keep the raw record — their\n    // operands are pre-built into stored space. Decoded at most once per\n    // record, only when a callback clause exists.\n    const fnView =\n      this.via?.hasResultDecode && hasFnClause(this.clauses)\n        ? this.decodeVia(record)\n        : undefined\n    for (const clause of this.clauses) {\n      if (!evaluateClause(record, clause, fnView)) return false\n    }\n    return true\n  }\n}\n\n/**\n * Coerce an unknown FK value into a lookup key string.\n *\n * Mirror of the same helper in `query/join.ts` — kept local to\n * `scan-builder.ts` to avoid pulling the eager join executor's\n * surface area into this file. Strings and numbers convert to\n * string keys; everything else (objects, arrays, booleans, null,\n * undefined) returns null and is treated as \"no ref at all\".\n *\n * Matches the write-time `enforceRefsOnPut` policy: nullish ref\n * values are never dangling, regardless of mode.\n */\nfunction coerceRefKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiHO,SAAS,eACd,WACA,WACc;AACd,SAAO,IAAI,cAAiB,WAAW,SAAS;AAClD;AAEA,IAAM,gBAAN,MAA+C;AAAA,EAO7C,YACmB,WACjB,WACA;AAFiB;AAOjB,SAAK,QAAQ;AACb,eAAW,YAAY,WAAW;AAChC,UAAI;AACF,aAAK,OAAO,KAAK,SAAS,UAAU,KAAK,gBAAgB,CAAC;AAAA,MAC5D,SAAS,KAAK;AAMZ,aAAK,SAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAAA,EApBmB;AAAA,EAPX,SAAuB,CAAC;AAAA,EACxB,SAAuB;AAAA,EACd,YAAY,oBAAI,IAAgB;AAAA,EAChC,SAA4B,CAAC;AAAA,EACtC,UAAU;AAAA,EAyBlB,IAAI,QAAsB;AACxB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,QAAsB;AACxB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOiB,mBAAmB,MAAY;AAC9C,SAAK,QAAQ;AACb,eAAW,MAAM,KAAK,WAAW;AAC/B,UAAI;AACF,WAAG;AAAA,MACL,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAgB;AACtB,QAAI,KAAK,QAAS;AAClB,QAAI;AACF,WAAK,SAAS,KAAK,UAAU;AAC7B,WAAK,SAAS;AAAA,IAChB,SAAS,KAAK;AACZ,WAAK,SAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAAA,IAKlE;AAAA,EACF;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,KAAK,QAAS,QAAO,MAAM;AAAA,IAAC;AAChC,SAAK,UAAU,IAAI,EAAE;AACrB,WAAO,MAAM,KAAK,UAAU,OAAO,EAAE;AAAA,EACvC;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAS;AAClB,SAAK,UAAU;AACf,eAAW,SAAS,KAAK,QAAQ;AAC/B,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAGR;AAAA,IACF;AACA,SAAK,OAAO,SAAS;AACrB,SAAK,UAAU,MAAM;AAAA,EACvB;AACF;;;AC9HA,IAAM,cAAc,IAAI;AAAA,EACtB;AAGF;AAUO,IAAM,eAAkC;AAAA,EAC7C,YAAY;AAAE,UAAM;AAAA,EAAY;AAAA,EAChC,UAAU;AAAE,UAAM;AAAA,EAAY;AAAA,EAC9B,WAAW;AAAE,UAAM;AAAA,EAAY;AAAA,EAC/B,gBAAgB;AAAE,UAAM;AAAA,EAAY;AACtC;;;AC3CA,IAAM,aAAwB;AAAA,EAC5B,SAAS,CAAC;AAAA,EACV,SAAS,CAAC;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,OAAO,CAAC;AACV;AAGO,IAAM,8BAA8B;AAsEpC,IAAM,QAAN,MAAM,OAA4G;AAAA,EACtG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,QACA,OAAkB,YAClB,aACA,oBAAuC,cACvC,YACA;AACA,SAAK,SAAS;AACd,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,oBAAoB;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAmB;AACjB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAwC;AACtC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,YAAuE;AACrF,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,WAAqB;AACnB,UAAM,UAAU,KAAK,OAAO,kBAAkB;AAC9C,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,QAAI,KAAK,KAAK,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW,GAAG;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,UAAU,oBAAI,IAAqB;AACzC,eAAW,EAAE,IAAI,OAAO,KAAK,QAAS,SAAQ,IAAI,QAAQ,EAAE;AAC5D,UAAM,UAAU,sBAAsB,KAAK,QAAQ,KAAK,MAAM,KAAK,WAAW;AAC9E,UAAM,MAAgB,CAAC;AACvB,eAAW,KAAK,SAAS;AACvB,YAAM,KAAK,QAAQ,IAAI,CAAC;AACxB,UAAI,OAAO,OAAW,KAAI,KAAK,EAAE;AAAA,IACnC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,eAAe,MAAc,KAAkC;AAC7D,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,IAAI;AAAA,QACR,oBAAoB,IAAI,mMAGH,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,UAAM,OAAO,KAAK,WAAW,IAAI,IAAI;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR,oBAAoB,IAAI,4CACR,CAAC,GAAG,KAAK,WAAW,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,MACpE;AAAA,IACF;AACA,UAAM,SAA+B;AAAA,MACnC,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,eAAe,KAAK;AAAA,MACpB,SAAS,iBAAiB,GAAG;AAAA,MAC7B,IAAI,KAAK;AAAA,IACX;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM,EAAE;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,OAA4B,IAAc,OAAmC;AACjF,UAAM,MAAM,KAAK,OAAO;AACxB,QAAI,KAAK,WAAW,KAAK,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAK;AACxF,UAAM,YAAY,KAAK,YAAY,OAAO,IAAI,KAAK;AACnD,UAAM,SAAsB,YACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,QACnB,UAAU,CAAC,QAAiB,WAAmB,IAAK,eAAe,WAAW,QAAQ,MAAM;AAAA,QAC5F,YAAY,IAAK,WAAW,WAAW,EAAE;AAAA,MAC3C;AAAA,IACF,IACA,EAAE,MAAM,SAAS,OAAO,IAAI,MAAM;AACtC,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM,EAAE;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAG,SAAyE;AAC1E,UAAM,MAAM;AAAA,MACV,IAAI,OAAkB,KAAK,QAA0B,YAAY,KAAK,aAAa,KAAK,mBAAmB,KAAK,UAAU;AAAA,IAC5H;AACA,UAAM,QAAqB;AAAA,MACzB,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,SAAS,IAAI,KAAK;AAAA,IACpB;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,KAAK,EAAE;AAAA,MACvD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,SAAyE;AAC3E,UAAM,MAAM;AAAA,MACV,IAAI,OAAkB,KAAK,QAA0B,YAAY,KAAK,aAAa,KAAK,mBAAmB,KAAK,UAAU;AAAA,IAC5H;AACA,UAAM,QAAqB;AAAA,MACzB,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,SAAS,IAAI,KAAK;AAAA,IACpB;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,KAAK,EAAE;AAAA,MACvD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,IAA+C;AACpD,UAAM,SAAuB;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM,EAAE;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,QAAQ,OAAyB,YAA4B,OAAO,MAAsD;AACxH,QAAI,KAAK,OAAO,KAAK,WAAW,KAAK,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAK;AACpG,UAAM,QAAiB,MAAM,OAAO,UAAU,EAAE,OAAO,WAAW,IAAI,QAAQ,IAAI,EAAE,OAAO,UAAU;AACrG,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,KAAK,EAAE;AAAA,MACvD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,GAA8B;AAClC,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,MACzB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,GAA8B;AACnC,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,QAAQ,EAAE;AAAA,MAC1B,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4DA,KACE,OACA,MAC0C;AAC1C,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AACA,UAAM,aAAa,KAAK,YAAY,WAAW,KAAK;AAEpD,UAAM,kBAAkB,CAAC,cAAc,KAAK,YAAY,oBAAoB,KAAK,KAAK;AACtF,QAAI,CAAC,cAAc,CAAC,iBAAiB;AACnC,YAAM,IAAI;AAAA,QACR,8CAA8C,KAAK,oBAC7C,KAAK,YAAY,cAAc,kBACxB,KAAK;AAAA,MAEpB;AAAA,IACF;AACA,UAAM,MAAe,aACjB;AAAA,MACE;AAAA,MACA,IAAI,KAAK;AAAA,MACT,QAAQ,WAAW;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,SAAS,KAAK;AAAA;AAAA,MAEd,gBAAgB;AAAA,IAClB,IACA;AAAA;AAAA,MAEE;AAAA,MACA,IAAI,KAAK;AAAA,MACT,QAAQ;AAAA;AAAA,MACR,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,SAAS,KAAK;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,IACd;AACJ,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,OAAO,CAAC,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE;AAAA,MACjD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,UACE,QACA,MAO4C;AAC5C,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR,oBAAoB,MAAM;AAAA,MAG5B;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AAEJ,QAAI,KAAK,OAAO,QAAW;AACzB,UAAI,OAAO,KAAK,OAAO,YAAY;AACjC,eAAO,KAAK;AACZ,YAAI,KAAK,YAAY;AACnB,kBAAQ;AAAA,YACN,oBAAoB,MAAM;AAAA,UAG5B;AAAA,QACF;AAAA,MACF,OAAO;AACL,cAAM,WAAY,KAAK,GAA6B;AACpD,YAAI,CAAC,KAAK,YAAY;AACpB,gBAAM,IAAI;AAAA,YACR,oBAAoB,MAAM,0BAA0B,QAAQ,sJAGzC,QAAQ;AAAA,UAC7B;AAAA,QACF;AACA,cAAM,OAAO,KAAK,WAAW,IAAI,QAAQ;AACzC,YAAI,CAAC,MAAM;AACT,gBAAM,IAAI;AAAA,YACR,oBAAoB,MAAM,kBAAkB,QAAQ,gCACpC,CAAC,GAAG,KAAK,WAAW,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,UACpE;AAAA,QACF;AACA,cAAM,KAAK,KAAK;AAChB,cAAM,cAAc,KAAK;AACzB,eAAO,CAAC,UACN,CAAC,UACC,YAAY,EAAE,GAAI,OAAmC,CAAC,EAAE,GAAG,MAAM,CAAC;AACtE,0BAAkB;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,SAA0B;AAAA,MAC9B,MAAM;AAAA,MACN;AAAA,MACA,IAAI,KAAK;AAAA,MACT,GAAI,SAAS,UAAa,EAAE,IAAI,KAAK;AAAA,MACrC,GAAI,oBAAoB,UAAa,EAAE,gBAAgB;AAAA,MACvD,GAAI,KAAK,YAAY,UAAa,EAAE,SAAS,KAAK,QAAQ;AAAA,IAC5D;AAEA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM,EAAE;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,QAAQ,MAAiC;AAMvC,UAAM,OAAO,KAAK,UAAU,sBAAsB,KAAK,QAAQ,KAAK,MAAM,KAAK,aAAa,MAAM,MAAM,CAAC;AACzG,QAAI,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACzC,QAAI,CAAC,KAAK,aAAa;AAGrB,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,KAAK,MAAM,MAAM;AAAA,MAIzD;AAAA,IACF;AACA,WAAO,WAAW,MAAM,KAAK,KAAK,OAAO,KAAK,aAAa,MAAM,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,UAAU,SAAwC;AACxD,UAAM,MAAM,KAAK,OAAO;AACxB,QAAI,CAAC,OAAO,CAAC,IAAI,gBAAiB,QAAO;AACzC,WAAO,QAAQ,IAAI,OAAK,IAAI,cAAc,CAAC,CAAC;AAAA,EAC9C;AAAA;AAAA,EAGA,MAAM,MAAsC;AAC1C,UAAM,MAAM,KAAK,MAAM,CAAC,EAAE,QAAQ,IAAI;AACtC,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,QAAgB;AACd,QAAI,KAAK,KAAK,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW,GAAG;AACvD,UAAI,CAAC,KAAK,aAAa;AACrB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO,sBAAsB,KAAK,QAAQ,KAAK,KAAK,SAAS,KAAK,WAAW,EAAE;AAAA,IACjF;AAIA,UAAM,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,KAAK,QAAQ,KAAK,KAAK,OAAO;AACxF,QAAI,iBAAiB,WAAW,EAAG,QAAO,WAAW;AACrD,WAAO,cAAc,YAAY,kBAAkB,cAAc,KAAK,MAAM,CAAC,EAAE;AAAA,EACjF;AAAA,EAyDA,UACE,aACoC;AACpC,QAAI,OAAO,OAAO,gBAAgB,aAC7B,YAAsD,cAAqD,IAC5G;AAIJ,WAAO,KAAK,OAAO,KAAK,aAAa,IAAI,KAAK;AAM9C,UAAM,SAAS,KAAK;AACpB,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,UAAU,KAAK;AACrB,UAAM,gBAAgB,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW;AAC9D,UAAM,iBAAiB,MAA0B;AAC/C,UAAI,eAAe;AACjB,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,sDAAsD;AACpF,eAAO,sBAAsB,QAAQ,SAAS,OAAO;AAAA,MACvD;AACA,YAAM,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,QAAQ,OAAO;AACzE,aAAO,iBAAiB,WAAW,IAC/B,aACA,cAAc,YAAY,kBAAkB,cAAc,MAAM,CAAC;AAAA,IACvE;AAKA,UAAM,YAAmC,CAAC;AAC1C,QAAI,OAAO,WAAW;AACpB,YAAM,YAAY,OAAO,UAAU,KAAK,MAAM;AAC9C,gBAAU,KAAK,EAAE,WAAW,CAAC,OAAmB,UAAU,EAAE,EAAE,CAAC;AAAA,IACjE;AAEA,WAAO,KAAK,kBAAkB,UAAgB,gBAAgB,MAAM,SAAS;AAAA,EAC/E;AAAA,EAuDA,WAAW,QAAsG;AAC/G,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAKA,UAAM,SAAS,KAAK;AACpB,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,UAAU,KAAK;AACrB,UAAM,gBAAgB,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW;AAC9D,UAAM,iBAAiB,MAA0B;AAC/C,UAAI,eAAe;AACjB,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,oDAAoD;AAClF,eAAO,sBAAsB,QAAQ,SAAS,OAAO;AAAA,MACvD;AACA,YAAM,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,QAAQ,OAAO;AACzE,aAAO,iBAAiB,WAAW,IAC/B,aACA,cAAc,YAAY,kBAAkB,cAAc,MAAM,CAAC;AAAA,IACvE;AAEA,UAAM,YAAmC,CAAC;AAC1C,QAAI,OAAO,WAAW;AACpB,YAAM,YAAY,OAAO,UAAU,KAAK,MAAM;AAC9C,gBAAU,KAAK,EAAE,WAAW,CAAC,OAAmB,UAAU,EAAE,EAAE,CAAC;AAAA,IACjE;AAIA,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,QAAQ,OAAO,CAAC;AACtB,YAAM,oBAAoB,uBAAuB,KAAK,aAAa,KAAK;AACxE,aAAO,KAAK,kBAAkB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK,OAAO;AAAA,MACd;AAAA,IACF;AACA,WAAO,KAAK,kBAAkB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,UAAU,IAAuC;AAC/C,QAAI,CAAC,KAAK,OAAO,WAAW;AAC1B,YAAM,IAAI,MAAM,uFAAuF;AAAA,IACzG;AACA,OAAG,KAAK,QAAQ,CAAC;AACjB,WAAO,KAAK,OAAO,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoDA,OAAqB;AACnB,UAAM,YAA4B,CAAC;AAInC,QAAI,KAAK,OAAO,WAAW;AACzB,YAAM,gBAAgB,KAAK,OAAO,UAAU,KAAK,KAAK,MAAM;AAC5D,gBAAU,KAAK;AAAA,QACb,WAAW,CAAC,OAAmB,cAAc,EAAE;AAAA,MACjD,CAAC;AAAA,IACH;AAMA,QAAI,KAAK,KAAK,MAAM,SAAS,KAAK,KAAK,aAAa;AAClD,YAAM,aAAa,oBAAI,IAAY;AACnC,iBAAW,OAAO,KAAK,KAAK,OAAO;AACjC,YAAI,WAAW,IAAI,IAAI,MAAM,EAAG;AAChC,mBAAW,IAAI,IAAI,MAAM;AACzB,cAAM,cAAc,KAAK,YAAY,cAAc,IAAI,MAAM;AAC7D,YAAI,aAAa,WAAW;AAC1B,gBAAM,iBAAiB,YAAY,UAAU,KAAK,WAAW;AAC7D,oBAAU,KAAK;AAAA,YACb,WAAW,CAAC,OAAmB,eAAe,EAAE;AAAA,UAClD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,QAAI,KAAK,aAAa;AACpB,YAAM,kBAAkB,oBAAI,IAAY;AACxC,iBAAW,UAAU,KAAK,KAAK,SAAS;AACtC,YAAI,OAAO,SAAS,YAAa;AACjC,YAAI,gBAAgB,IAAI,OAAO,MAAM,EAAG;AACxC,wBAAgB,IAAI,OAAO,MAAM;AACjC,cAAM,cAAc,KAAK,YAAY,cAAc,OAAO,MAAM;AAChE,YAAI,aAAa,WAAW;AAC1B,gBAAM,iBAAiB,YAAY,UAAU,KAAK,WAAW;AAC7D,oBAAU,KAAK;AAAA,YACb,WAAW,CAAC,OAAmB,eAAe,EAAE;AAAA,UAClD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAIA,WAAO,eAAkB,MAAM,KAAK,QAAQ,GAAG,SAAS;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAkB;AAChB,WAAO,cAAc,KAAK,IAAI;AAAA,EAChC;AACF;AAOA,SAAS,sBACP,QACA,MACA,aACA,QACW;AACX,QAAM,gBAAgB,KAAK,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW;AAEnE,MAAI;AACJ,MAAI,eAAe;AACjB,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,aAAS,sBAAsB,QAAQ,KAAK,SAAS,WAAW;AAAA,EAClE,OAAO;AAIL,UAAM,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,QAAQ,KAAK,OAAO;AAC9E,aACE,iBAAiB,WAAW,IACxB,CAAC,GAAG,UAAU,IACd,cAAc,YAAY,kBAAkB,cAAc,MAAM,CAAC;AAAA,EACzE;AAEA,MAAI,KAAK,QAAQ,SAAS,GAAG;AAK3B,UAAM,YAAY,oBAAoB,KAAK,SAAS,aAAa,QAAQ,OAAO,GAAG;AACnF,aAAS,YAAY,QAAQ,KAAK,SAAS,OAAO,KAAK,SAAS;AAAA,EAClE;AACA,MAAI,KAAK,SAAS,GAAG;AACnB,aAAS,OAAO,MAAM,KAAK,MAAM;AAAA,EACnC;AACA,MAAI,KAAK,UAAU,QAAW;AAC5B,aAAS,OAAO,MAAM,GAAG,KAAK,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAsBA,SAAS,iBAAiB,QAAwB,SAA6C;AAC7F,QAAM,UAAU,OAAO,aAAa;AACpC,MAAI,CAAC,WAAW,CAAC,OAAO,cAAc,QAAQ,WAAW,GAAG;AAC1D,WAAO,EAAE,YAAY,OAAO,SAAS,GAAG,kBAAkB,QAAQ;AAAA,EACpE;AAGA,QAAM,aAAa,CAAC,OAAwB,OAAO,aAAa,EAAE;AAElE,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,SAAS,QAAQ,CAAC;AACxB,QAAI,OAAO,SAAS,QAAS;AAC7B,QAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,EAAG;AA2BhC,QAAI,OAAO,OAAO,OAAO,IAAI,eAAe,OAAW;AACvD,UAAM,aAAa,OAAO,MAAM,OAAO,IAAI,aAAa,OAAO;AAE/D,QAAI,MAAkC;AACtC,QAAI,OAAO,OAAO,MAAM;AACtB,YAAM,QAAQ,YAAY,OAAO,OAAO,UAAU;AAAA,IACpD,WAAW,OAAO,OAAO,QAAQ,MAAM,QAAQ,UAAU,GAAG;AAC1D,YAAM,QAAQ,SAAS,OAAO,OAAO,UAAU;AAAA,IACjD;AAEA,QAAI,QAAQ,MAAM;AAGhB,YAAM,YAAsB,CAAC;AAC7B,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,YAAI,MAAM,EAAG,WAAU,KAAK,QAAQ,CAAC,CAAE;AAAA,MACzC;AACA,aAAO;AAAA,QACL,YAAY,eAAe,KAAK,UAAU;AAAA,QAC1C,kBAAkB;AAAA,MACpB;AAAA,IACF;AAAA,EAGF;AAGA,SAAO,EAAE,YAAY,OAAO,SAAS,GAAG,kBAAkB,QAAQ;AACpE;AAEA,SAAS,eACP,KACA,YACW;AACX,QAAM,MAAiB,CAAC;AACxB,aAAW,MAAM,KAAK;AACpB,UAAM,SAAS,WAAW,EAAE;AAC5B,QAAI,WAAW,OAAW,KAAI,KAAK,MAAM;AAAA,EAC3C;AACA,SAAO;AACT;AASO,SAAS,YAAY,SAA6B,MAA4B;AACnF,MAAI,KAAK,QAAQ,KAAK,OAAK,EAAE,SAAS,WAAW,GAAG;AAClD,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,MAAI,SAAS,cAAc,SAAS,KAAK,OAAO;AAChD,MAAI,KAAK,QAAQ,SAAS,GAAG;AAC3B,aAAS,YAAY,QAAQ,KAAK,OAAO;AAAA,EAC3C;AACA,MAAI,KAAK,SAAS,GAAG;AACnB,aAAS,OAAO,MAAM,KAAK,MAAM;AAAA,EACnC;AACA,MAAI,KAAK,UAAU,QAAW;AAC5B,aAAS,OAAO,MAAM,GAAG,KAAK,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAUA,SAAS,cAAc,QAA+D;AACpF,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,CAAC,IAAI,gBAAiB,QAAO;AACzC,SAAO,OAAK,IAAI,cAAc,CAAC;AACjC;AAEA,SAAS,cACP,SACA,SACA,cACW;AACX,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC,GAAG,OAAO;AAE5C,QAAM,cAAc,iBAAiB,UAAa,YAAY,OAAO;AACrE,QAAM,MAAiB,CAAC;AACxB,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,cAAc,aAAa,CAAC,IAAI;AAC/C,QAAI,UAAU;AACd,eAAW,UAAU,SAAS;AAC5B,UAAI,CAAC,eAAe,GAAG,QAAQ,MAAM,GAAG;AACtC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAS,KAAI,KAAK,CAAC;AAAA,EACzB;AACA,SAAO;AACT;AASA,SAAS,sBACP,QACA,SACA,aACW;AACX,MAAI,MAAiB,CAAC,GAAG,OAAO,SAAS,CAAC;AAC1C,MAAI,cAAwB,CAAC;AAC7B,QAAM,eAAe,cAAc,MAAM;AAEzC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS,aAAa;AAC/B,UAAI,YAAY,SAAS,GAAG;AAC1B,cAAM,cAAc,KAAK,aAAa,YAAY;AAClD,sBAAc,CAAC;AAAA,MACjB;AACA,YAAM,cAAc,YAAY,cAAc,OAAO,MAAM;AAC3D,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,4BAA4B,OAAO,QAAQ,YAAY,cAAc;AAAA,MACjF;AACA,YAAM,eAAe,KAAK,QAAQ,WAAW;AAAA,IAC/C,OAAO;AACL,kBAAY,KAAK,MAAM;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,cAAc,KAAK,aAAa,YAAY;AAAA,EACpD;AAEA,SAAO;AACT;AAOA,SAAS,eACP,SACA,QACA,aACW;AACX,QAAM,YAAY,YAAY,SAAS;AACvC,QAAM,UAAU,OAAO,WAAW;AAClC,QAAM,EAAE,GAAG,IAAI;AAEf,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,QAAQ,SAAS,UAAU;AAC3C,QAAI,UAAU,SAAS;AACrB,YAAM,IAAI,uBAAuB,EAAE,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,QAAQ,CAAC;AAAA,IAC/F;AACA,UAAMA,YAAsB,CAAC;AAC7B,eAAW,QAAQ,SAAS;AAC1B,YAAM,UAAU;AAChB,iBAAW,SAAS,WAAW;AAC7B,QAAAA,UAAS,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC;AAAA,MAC3C;AAAA,IACF;AACA,WAAOA;AAAA,EACT;AAGA,QAAM,WAAsB,CAAC;AAC7B,MAAI,aAAa;AACjB,aAAW,QAAQ,SAAS;AAC1B,UAAM,iBAAiB,OAAO,GAAG,IAAI;AACrC,QAAI;AACJ,QAAI,MAAM,QAAQ,cAAc,GAAG;AACjC,sBAAgB;AAAA,IAClB,OAAO;AACL,sBAAiB,UAAwB;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AACA,kBAAc,cAAc;AAC5B,QAAI,aAAa,SAAS;AACxB,YAAM,IAAI,uBAAuB;AAAA,QAC/B,QAAQ,OAAO;AAAA,QACf,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,UAAU;AAChB,eAAW,SAAS,eAAe;AACjC,eAAS,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,SACA,SACA,KACA,WACW;AAEX,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM;AACjC,eAAW,EAAE,OAAO,WAAW,GAAG,KAAK,SAAS;AAC9C,UAAI,KAAK,UAAU,GAAG,KAAK;AAC3B,UAAI,KAAK,UAAU,GAAG,KAAK;AAG3B,YAAM,gBAAgB,OAAO,UAAU,WAAW,IAAI,KAAK,IAAI;AAC/D,UAAI,eAAe;AACjB,cAAM,OAAO,OAAO,WAAW,cAAc,EAAE,IAAI,WAAc;AACjE,cAAM,OAAO,OAAO,WAAW,cAAc,EAAE,IAAI,WAAc;AACjE,cAAMC,OAAM,cAAc,IAAI,EAAE;AAChC,YAAIA,SAAQ,EAAG,QAAO,cAAc,QAAQA,OAAM,CAACA;AACnD;AAAA,MACF;AAMA,YAAM,SAAS,KAAK,gBAAgB,OAAO,IAAI,EAAE;AACjD,YAAM,MAAM,WAAW,SAAY,SAAS,cAAc,IAAI,EAAE;AAChE,UAAI,QAAQ,EAAG,QAAO,cAAc,QAAQ,MAAM,CAAC;AAAA,IACrD;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAsBA,SAAS,oBACP,SACA,aACA,QACA,KAC+D;AAC/D,MAAI;AACJ,aAAW,EAAE,OAAO,GAAG,KAAK,SAAS;AACnC,QAAI,OAAO,QAAS;AACpB,UAAM,aAAa,aAAa,oBAAoB,KAAK;AACzD,QAAI,YAAY;AACd,YAAM,MAAM,UAAU,WAAW;AACjC,UAAI,QAAQ,OAAW;AACvB,YAAM,cAAc,oBAAI,IAAoB;AAC5C,iBAAW,SAAS,WAAW,SAAS,GAAG;AACzC,cAAM,IAAK,MAAkC,KAAK;AAClD,cAAM,SAAU,MAAkC,QAAQ;AAC1D,cAAM,QAAQ,SAAS,GAAG;AAC1B,YAAI,OAAO,MAAM,YAAY,OAAO,UAAU,SAAU,aAAY,IAAI,GAAG,KAAK;AAAA,MAClF;AACA;AAAC,OAAC,SAAS,oBAAI,IAAI,GAAG,IAAI,OAAO,CAAC,SAAiB,YAAY,IAAI,IAAI,CAAC;AACxE;AAAA,IACF;AACA,QAAI,KAAK;AACP,YAAM,QAAQ,oBAAI,IAAgC;AACjD,OAAC,SAAS,oBAAI,IAAI,GAAG,IAAI,OAAO,CAAC,SAAiB;AACjD,YAAI,CAAC,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,IAAI,kBAAkB,OAAO,MAAM,MAAM,CAAC;AAChF,eAAO,MAAM,IAAI,IAAI;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAAiB,OAAwB;AAC1D,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,MAAM,SAAS,GAAG,GAAG;AACxB,WAAQ,OAAmC,KAAK;AAAA,EAClD;AACA,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,SAAkB;AACtB,aAAW,WAAW,UAAU;AAC9B,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAY,GAAoB;AAErD,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO,MAAM,UAAa,MAAM,OAAO,IAAI;AAC9E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI;AAC/D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACpF,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO,EAAE,QAAQ,IAAI,EAAE,QAAQ;AAG3E,SAAO;AACT;AAEA,SAAS,cAAc,MAA0B;AAC/C,SAAO;AAAA,IACL,SAAS,KAAK,QAAQ,IAAI,eAAe;AAAA,IACzC,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,EACd;AACF;AAEA,SAAS,gBAAgB,QAAyB;AAChD,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,EAAE,MAAM,UAAU,IAAI,aAAa;AAAA,EAC5C;AACA,MAAI,OAAO,SAAS,kBAAkB;AAOpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,eAAe,OAAO;AAAA,MACtB,SAAS,OAAO;AAAA,MAChB,IAAI;AAAA,IACN;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAS;AAC3B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI,OAAO;AAAA,MACX,SAAS,OAAO,QAAQ,IAAI,eAAe;AAAA,IAC7C;AAAA,EACF;AACA,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,IAAI,OAAO;AAAA,MACX,IAAI,OAAO,KAAK,eAAe;AAAA,MAC/B,iBAAiB,OAAO;AAAA,MACxB,SAAS,OAAO;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAWA,SAAS,iBAAiB,KAAsB;AAC9C,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,YAAY,KAAK,UAAU,KAAK,CAAC,MAAM,UAAU;AACrD,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,SAAkC,CAAC;AACzC,iBAAW,KAAK,OAAO,KAAK,KAAgC,EAAE,KAAK,GAAG;AACpE,eAAO,CAAC,IAAK,MAAkC,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AAED,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACzC,SAAM,KAAK,KAAK,IAAK,UAAU,WAAW,CAAC;AAAA,EAC7C;AACA,UAAQ,MAAM,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC/C;AAeA,SAAS,uBACP,SACA,OAGY;AACZ,MAAI,CAAC,SAAS,kBAAmB,QAAO;AACxC,QAAM,aAAa,QAAQ,kBAAkB,KAAK;AAClD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,WAAW,WAAW,SAAS;AAIrC,QAAM,gBAAgB,WAAW;AACjC,QAAM,UAAU,oBAAI,IAAoC;AACxD,aAAW,SAAS,UAAU;AAC5B,UAAM,IAAK,MAAkC,KAAK;AAClD,UAAM,SAAU,MAAkC,QAAQ;AAC1D,QAAI,OAAO,MAAM,YAAY,UAAU,OAAO,WAAW,UAAU;AACjE,cAAQ,IAAI,GAAG,MAAgC;AAAA,IACjD;AAAA,EACF;AACA,SAAO,OACL,KACA,QACA,aACgC;AAChC,UAAM,YAAY,UAAU;AAC5B,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,SAAS,QAAQ,IAAI,GAAG;AAC9B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,SAAS,MAAM,OAAW,QAAO,OAAO,SAAS;AAC5D,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAC/B,WACD,WACE,CAAC,QAAkB,IACnB,CAAC;AACP,eAAW,MAAM,OAAO;AACtB,UAAI,OAAO,OAAO;AAChB,cAAM,MAAM,OAAO,OAAO,MAAM,EAAE,CAAC;AACnC,YAAI,QAAQ,OAAW,QAAO;AAAA,MAChC,WAAW,OAAO,EAAE,MAAM,QAAW;AACnC,eAAO,OAAO,EAAE;AAAA,MAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AC9+CA,IAAM,yBAAyB;AAYxB,IAAM,cAAN,MAAM,aAA0G;AAAA,EACpG;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,EAEjB,YACE,cACA,WAAmB,wBACnB,UAA6B,CAAC,GAC9B,QAA4B,CAAC,GAC7B,aACA,KACA;AACA,SAAK,eAAe;AACpB,SAAK,WAAW;AAChB,SAAK,UAAU;AACf,SAAK,QAAQ;AACb,SAAK,cAAc;AACnB,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAU,QAAc;AAC9B,QAAI,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,gBAAiB,QAAO;AACnD,WAAO,KAAK,IAAI,cAAc,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAyB,IAAc,OAAsC;AAGjF,UAAM,MAAM,KAAK;AACjB,QAAI,KAAK,WAAW,KAAe,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAe;AAC5G,UAAM,YAAY,KAAK,YAAY,OAAiB,IAAI,KAAK;AAC7D,UAAM,SAAsB,YACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,QACnB,UAAU,CAAC,QAAiB,WAAmB,IAAK,eAAe,WAAW,QAAQ,MAAM;AAAA,MAC9F;AAAA,IACF,IACA,EAAE,MAAM,SAAS,OAAwB,IAAI,MAAM;AACvD,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,CAAC,GAAG,KAAK,SAAS,MAAM;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,IAAkD;AACvD,UAAM,SAAiB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,CAAC,GAAG,KAAK,SAAS,MAAM;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgFA,KACE,OACA,MAC6C;AAC7C,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MAKF;AAAA,IACF;AACA,UAAM,aAAa,KAAK,YAAY,WAAW,KAAK;AACpD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,oDAAoD,KAAK,oBACxC,KAAK,YAAY,cAAc,kBACnC,KAAK;AAAA,MAEpB;AAAA,IACF;AACA,UAAM,MAAe;AAAA,MACnB;AAAA,MACA,IAAI,KAAK;AAAA,MACT,QAAQ,WAAW;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,UAAU;AAAA,MACV,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKT,gBAAgB;AAAA,IAClB;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,CAAC,GAAG,KAAK,OAAO,GAAG;AAAA,MACnB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,QAAQ,OAAO,aAAa,IAAsB;AAWhD,UAAM,gBAAgB,KAAK,MAAM,WAAW,IAAI,OAAO,KAAK,mBAAmB;AAE/E,QAAI,OAAO,MAAM,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,SAAS,CAAC;AACpE,WAAO,MAAM;AACX,iBAAW,UAAU,KAAK,OAAO;AAK/B,YAAI,CAAC,KAAK,cAAc,MAAM,EAAG;AACjC,cAAM,UAAU,KAAK,UAAU,MAAM;AACrC,YAAI,kBAAkB,MAAM;AAC1B,gBAAM;AAAA,QACR,OAAO;AAKL,cAAI,WAAoB;AACxB,qBAAW,YAAY,eAAe;AACpC,uBAAW,KAAK,sBAAsB,UAAU,QAAQ;AAAA,UAC1D;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,KAAK,eAAe,KAAM;AAC9B,aAAO,MAAM,KAAK,aAAa,SAAS;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBQ,qBAML;AACD,QAAI,CAAC,KAAK,aAAa;AAMrB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,MAAM,MAAM;AAAA,MAG5C;AAAA,IACF;AACA,UAAM,YAMD,CAAC;AACN,eAAW,OAAO,KAAK,OAAO;AAC5B,YAAM,SAAS,KAAK,YAAY,cAAc,IAAI,MAAM;AACxD,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR,wDACM,IAAI,MAAM,6BAA6B,IAAI,KAAK,SAChD,KAAK,YAAY,cAAc;AAAA,QAGvC;AAAA,MACF;AAIA,UAAI,aAA+C;AACnD,UAAI,mBAAwD;AAC5D,UAAI,OAAO,YAAY;AAIrB,cAAM,KAAK,OAAO,WAAW,KAAK,MAAM;AACxC,qBAAa,CAAC,OAAwB,GAAG,EAAE;AAAA,MAC7C,OAAO;AACL,cAAM,MAAM,oBAAI,IAAqB;AACrC,mBAAW,UAAU,OAAO,SAAS,GAAG;AACtC,gBAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,gBAAM,MAAM,aAAa,KAAK;AAC9B,cAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,MAAM;AAAA,QACvC;AACA,2BAAmB;AAAA,MACrB;AACA,gBAAU,KAAK;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,oBAAI,IAAY;AAAA,MAC9B,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,sBACN,MACA,UAOS;AACT,QAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAE7C,aAAO;AAAA,IACT;AACA,UAAM,EAAE,IAAI,IAAI;AAChB,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,SAAS,aAAa,KAAK;AACjC,QAAI,QAAiB;AACrB,QAAI,WAAW,MAAM;AACnB,UAAI,SAAS,eAAe,MAAM;AAChC,gBAAQ,SAAS,WAAW,MAAM;AAAA,MACpC,WAAW,SAAS,qBAAqB,MAAM;AAC7C,gBAAQ,SAAS,iBAAiB,IAAI,MAAM;AAAA,MAC9C;AAAA,IACF;AAEA,UAAM,SAAkC;AAAA,MACtC,GAAI;AAAA,IACN;AACA,QAAI,UAAU,QAAW;AAGvB,UAAI,WAAW,QAAQ,IAAI,SAAS,UAAU;AAC5C,cAAM,IAAI,uBAAuB;AAAA,UAC/B,OAAO,IAAI;AAAA,UACX,QAAQ,IAAI;AAAA,UACZ,OAAO;AAAA,UACP,SACE,0DACI,IAAI,MAAM,IAAI,MAAM,gBAAgB,IAAI,KAAK;AAAA,QAIrD,CAAC;AAAA,MACH;AACA,UAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ;AAC1C,cAAM,WAAW,GAAG,IAAI,KAAK,SAAI,IAAI,MAAM,IAAI,MAAM;AACrD,YAAI,CAAC,SAAS,WAAW,IAAI,QAAQ,GAAG;AACtC,mBAAS,WAAW,IAAI,QAAQ;AAChC,kBAAQ;AAAA,YACN,+EACyB,IAAI,KAAK,aAAQ,IAAI,MAAM,IAC/C,MAAM;AAAA,UACb;AAAA,QACF;AAAA,MACF;AAGA,aAAO,IAAI,EAAE,IAAI;AAAA,IACnB,OAAO;AACL,aAAO,IAAI,EAAE,IAAI;AAAA,IACnB;AACA,WAAO;AAAA,EACT;AAAA,EAgDA,MAAM,UACJ,aACgC;AAKhC,UAAM,OAAa,OAAO,gBAAgB,aACrC,YAAqD,cAAoD,IAC1G;AACJ,SAAK,KAAK,0BAA0B,IAAI;AACxC,UAAM,OAAO,OAAO,KAAK,IAAI;AAG7B,UAAM,QAAiC,CAAC;AACxC,eAAW,OAAO,MAAM;AACtB,YAAM,GAAG,IAAI,KAAK,GAAG,EAAG,KAAK;AAAA,IAC/B;AAMA,qBAAiB,UAAU,MAAM;AAC/B,iBAAW,OAAO,MAAM;AACtB,cAAM,GAAG,IAAI,KAAK,GAAG,EAAG,KAAK,MAAM,GAAG,GAAG,MAAM;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,SAAkC,CAAC;AACzC,eAAW,OAAO,MAAM;AACtB,aAAO,GAAG,IAAI,KAAK,GAAG,EAAG,SAAS,MAAM,GAAG,CAAC;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAc,QAAoB;AACxC,QAAI,KAAK,QAAQ,WAAW,EAAG,QAAO;AAKtC,UAAM,SACJ,KAAK,KAAK,mBAAmB,YAAY,KAAK,OAAO,IACjD,KAAK,UAAU,MAAM,IACrB;AACN,eAAW,UAAU,KAAK,SAAS;AACjC,UAAI,CAAC,eAAe,QAAQ,QAAQ,MAAM,EAAG,QAAO;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AACF;AAcA,SAAS,aAAa,OAA+B;AACnD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;","names":["expanded","cmp"]}

package/dist/chunk-A7JJLVGH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/format.ts","../src/with-pod/bundle.ts"],"sourcesContent":["/**\n * `.noydb` container format — byte layout, header schema, validators.\n *\n *. Wraps a `vault.dump()` JSON string in a thin\n * binary container with a magic-byte prefix, a minimum-disclosure\n * unencrypted header, and a compressed body.\n *\n * **Byte layout** (read in order from offset 0):\n *\n * ```\n * +--------+--------+--------+--------+\n * |  N=78  |  D=68  |  B=66  |  1=49  |  Magic 'NDB1' (4 bytes)\n * +--------+--------+--------+--------+\n * | flags  | compr  |  header_length (uint32 BE)            |\n * +--------+--------+--------+--------+--------+--------+--------+\n * | header_length bytes of UTF-8 JSON header                       ...\n * +--------+--------+\n * | compressed body bytes                                            ...\n * ```\n *\n * Total fixed prefix before the header JSON is **10 bytes**:\n *   - 4 bytes magic\n *   - 1 byte flags\n *   - 1 byte compression algorithm\n *   - 4 bytes header length (uint32 big-endian)\n *\n * **Why a binary container** at all? `vault.dump()` already\n * produces a JSON string with encrypted records inside. Wrapping it\n * again seems redundant — but the wrap is what makes the file safe\n * to drop into cloud storage (Drive, Dropbox, iCloud) without\n * leaking the vault name and exporter identity through the\n * cloud's metadata API. The minimum-disclosure header is the only\n * thing visible without downloading and decompressing the body.\n * The dump JSON inside the body still contains the original\n * metadata, but that's only readable by someone who already has the\n * file bytes — the same person who could read the encrypted records\n * with the right passphrase.\n *\n * **Why minimum disclosure** in the header? Because consumers will\n * inevitably store these in services where the filename, file size,\n * and any unencrypted metadata are indexed for search. A field like\n * `vault: \"Acme Corp\"` would let an attacker (or a curious\n * cloud admin) enumerate which compartments exist and who exported\n * them, even with zero access to the encrypted body. The header\n * carries only what's needed to identify the file as a NOYDB\n * bundle and verify its integrity — nothing about the contents.\n */\n\nimport type { Cover } from '../with-party/directory/cover/types.js'\n\n/** Magic bytes 'NDB1' (ASCII), identifying a NOYDB bundle. */\nexport const NOYDB_BUNDLE_MAGIC = new Uint8Array([0x4e, 0x44, 0x42, 0x31])\n\n/** Total fixed prefix before the header JSON: 4+1+1+4 bytes. */\nexport const NOYDB_BUNDLE_PREFIX_BYTES = 10\n\n/** Current bundle format version. Bumped on layout changes. */\nexport const NOYDB_BUNDLE_FORMAT_VERSION = 1\n\n/**\n * Bitfield interpretation of the flags byte.\n *\n * Bit 0 — body is compressed (0 = raw, 1 = compressed)\n * Bit 1 — header carries an integrity hash over the body bytes\n * Bits 2-7 — reserved, must be 0 in\n */\nexport const FLAG_COMPRESSED = 0b0000_0001\nexport const FLAG_HAS_INTEGRITY_HASH = 0b0000_0010\n\n/**\n * Compression algorithm encoding for the byte at offset 5.\n *\n * `none` is admitted for round-trip testing and for callers that\n * want to bundle without compression (e.g. when piping into a\n * separately compressed transport). `gzip` is the universally\n * available baseline (Node 18+, all modern browsers). `brotli` is\n * preferred when the runtime supports it — typically 30-50% smaller\n * for JSON payloads — but Node 22+ / Chrome 124+ / Firefox 122+\n * are required, so the writer feature-detects at runtime and falls\n * back to gzip. The reader must handle all three.\n */\nexport const COMPRESSION_NONE = 0\nexport const COMPRESSION_GZIP = 1\nexport const COMPRESSION_BROTLI = 2\n\nexport type CompressionAlgo = 0 | 1 | 2\n\n/**\n * The unencrypted header carried in every `.noydb` bundle.\n *\n * **Minimum-disclosure rules:** these are the ONLY allowed keys.\n * Any other key in a parsed header causes\n * `validateBundleHeader` to throw. The set is kept short to\n * minimize attack surface from cloud-storage metadata indexing —\n * see the file-level doc comment for the rationale.\n *\n * Forbidden in particular:\n *   - `vault` / `_compartment` — would leak the tenant name\n *   - `exporter` / `_exported_by` — would leak user identity\n *   - `timestamp` / `_exported_at` — would leak activity timing\n *   - `kdfParams` / salt fields — would leak crypto config that\n *     could narrow brute-force search space\n *   - any field starting with `_` (reserved by the dump format)\n */\nexport interface NoydbPodHeader {\n  /** Bundle format version — bumped on layout changes. */\n  readonly formatVersion: number\n  /**\n   * Opaque ULID identifier — generated once per vault and\n   * stable across re-exports of the same vault. Does not\n   * leak any information about contents (the timestamp prefix is\n   * just monotonicity for sortability, not exporter activity —\n   * see `bundle/ulid.ts` for the design notes).\n   */\n  readonly handle: string\n  /** Compressed body length in bytes. Lets readers verify completeness without decompressing. */\n  readonly bodyBytes: number\n  /** SHA-256 of the compressed body bytes (lowercase hex). Lets readers verify integrity without decompressing. */\n  readonly bodySha256: string\n  /**\n   * Owner-curated cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`).\n   * Optional — present only when the source vault has a\n   * `_meta/public-envelope` document AND the writer's hub is opted\n   * into the feature. Treat as **untrusted hint**; the body's\n   * encrypted contents remain the source of truth.\n   *\n   * The JSON key keeps its frozen wire name `publicEnvelope` (#799\n   * renamed only the developer surface — existing bundles stay\n   * readable byte-for-byte).\n   *\n   * The cover deliberately widens the minimum-disclosure rule\n   * for explicit, owner-curated label fields (name, icon, …). Every\n   * other unknown header key still rejects at parse time.\n   */\n  readonly publicEnvelope?: Cover\n  /**\n   * Auto-unlock material indicator. When present, the bundle\n   * body wraps the dump JSON in a structure carrying per-user\n   * passphrases — either plaintext (`'unsealed'`, public-by-design)\n   * or sealed under a `SealingKeyProvider` (`'sealed'`, requires\n   * matching provider on the recipient side).\n   *\n   * Visible pre-decompression so cloud listing UIs can warn before\n   * download: \"this bundle opens itself for anyone holding the file\"\n   * (unsealed) or \"this bundle is sealed for a specific provider\"\n   * (sealed).\n   *\n   * Absent → the body is a raw `vault.dump()` JSON string (the\n   * the legacy shape; back-compatible).\n   */\n  readonly autoUnlock?: 'unsealed' | 'sealed'\n  /**\n   * Bundle's role in the source → destination lifecycle.\n   *   - omitted / 'snapshot' (default): backup/copy of an existing vault.\n   *   - 'extracted-partition': re-keyed projection awaiting adoption.\n   */\n  readonly bundleKind?: 'snapshot' | 'extracted-partition'\n  /**\n   * Transfer-seal INDICATOR — metadata only, no payload (the\n   * sealed DEKs live in the body). Present iff\n   * bundleKind === 'extracted-partition'.\n   */\n  readonly transferSeal?: {\n    readonly v: 1\n    readonly alg: 'aes-256-gcm-pre-shared'\n    readonly sealId: string\n  }\n}\n\n/** @deprecated Use `NoydbPodHeader`. */\nexport type NoydbBundleHeader = NoydbPodHeader\n\n/**\n * Allowlist of header keys. Any key not in this set is forbidden\n * and causes `validateBundleHeader` to throw. Kept as a Set for\n * O(1) lookup; the validator iterates over the parsed header and\n * checks each key against this set.\n */\nconst ALLOWED_HEADER_KEYS: ReadonlySet<string> = new Set([\n  'formatVersion',\n  'handle',\n  'bodyBytes',\n  'bodySha256',\n  'publicEnvelope',\n  'autoUnlock',\n  'bundleKind',\n  'transferSeal',\n])\n\n/**\n * Validate a parsed bundle header. Throws on any deviation from\n * the minimum-disclosure schema:\n *\n *   - Missing required field\n *   - Wrong type for any field\n *   - Any extra key not in `ALLOWED_HEADER_KEYS`\n *   - Unsupported `formatVersion`\n *   - Negative or non-integer `bodyBytes`\n *   - Malformed `handle` (must be 26-char Crockford base32)\n *   - Malformed `bodySha256` (must be 64-char lowercase hex)\n *\n * The error messages name the offending field so consumers can\n * fix the producer rather than the reader.\n */\nexport function validateBundleHeader(\n  parsed: unknown,\n): asserts parsed is NoydbPodHeader {\n  if (parsed === null || typeof parsed !== 'object') {\n    throw new Error(\n      `.noydb bundle header must be a JSON object, got ${parsed === null ? 'null' : typeof parsed}`,\n    )\n  }\n  // Disallow any unknown key — minimum disclosure means we reject\n  // forward-compat extension keys at the format layer; new fields\n  // require a format version bump and a new validator.\n  for (const key of Object.keys(parsed)) {\n    if (!ALLOWED_HEADER_KEYS.has(key)) {\n      throw new Error(\n        `.noydb bundle header contains forbidden key \"${key}\". ` +\n          `Only minimum-disclosure fields are allowed: ` +\n          `${[...ALLOWED_HEADER_KEYS].join(', ')}.`,\n      )\n    }\n  }\n  const h = parsed as Record<string, unknown>\n  if (typeof h['formatVersion'] !== 'number' || h['formatVersion'] !== NOYDB_BUNDLE_FORMAT_VERSION) {\n    throw new Error(\n      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION}, ` +\n        `got ${String(h['formatVersion'])}. The reader does not support ` +\n        `forward-compat versions; upgrade the reader to handle newer bundles.`,\n    )\n  }\n  if (typeof h['handle'] !== 'string' || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h['handle'])) {\n    throw new Error(\n      `.noydb bundle header.handle must be a 26-character Crockford base32 ULID, ` +\n        `got ${typeof h['handle'] === 'string' ? `\"${h['handle']}\"` : String(h['handle'])}.`,\n    )\n  }\n  if (typeof h['bodyBytes'] !== 'number' || !Number.isInteger(h['bodyBytes']) || h['bodyBytes'] < 0) {\n    throw new Error(\n      `.noydb bundle header.bodyBytes must be a non-negative integer, ` +\n        `got ${String(h['bodyBytes'])}.`,\n    )\n  }\n  if (typeof h['bodySha256'] !== 'string' || !/^[0-9a-f]{64}$/.test(h['bodySha256'])) {\n    throw new Error(\n      `.noydb bundle header.bodySha256 must be a 64-character lowercase hex string, ` +\n        `got ${typeof h['bodySha256'] === 'string' ? `\"${h['bodySha256']}\"` : String(h['bodySha256'])}.`,\n    )\n  }\n  if (h['publicEnvelope'] !== undefined) {\n    const env = h['publicEnvelope']\n    if (env === null || typeof env !== 'object' || Array.isArray(env)) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope must be a JSON object when present, got ${typeof env}.`,\n      )\n    }\n    const e = env as Record<string, unknown>\n    if (e['_noydb_public'] !== 1) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope._noydb_public must be 1, got ${String(e['_noydb_public'])}.`,\n      )\n    }\n    if (typeof e['version'] !== 'number' || !Number.isInteger(e['version']) || e['version'] < 1) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope.version must be a positive integer, got ${String(e['version'])}.`,\n      )\n    }\n  }\n  if (h['autoUnlock'] !== undefined) {\n    if (h['autoUnlock'] !== 'unsealed' && h['autoUnlock'] !== 'sealed') {\n      const got = typeof h['autoUnlock'] === 'string' ? `\"${h['autoUnlock']}\"` : typeof h['autoUnlock']\n      throw new Error(\n        `.noydb bundle header.autoUnlock must be 'unsealed' or 'sealed' when present, got ${got}.`,\n      )\n    }\n  }\n  if (h['bundleKind'] !== undefined) {\n    if (h['bundleKind'] !== 'snapshot' && h['bundleKind'] !== 'extracted-partition') {\n      const got = typeof h['bundleKind'] === 'string' ? `\"${h['bundleKind']}\"` : typeof h['bundleKind']\n      throw new Error(\n        `.noydb bundle header.bundleKind must be 'snapshot' or 'extracted-partition' when present, got ${got}.`,\n      )\n    }\n  }\n  if (h['transferSeal'] !== undefined) {\n    const ts = h['transferSeal']\n    if (ts === null || typeof ts !== 'object' || Array.isArray(ts)) {\n      throw new Error(`.noydb bundle header.transferSeal must be a JSON object when present, got ${typeof ts}.`)\n    }\n    const t = ts as Record<string, unknown>\n    if (t['v'] !== 1) {\n      throw new Error(`.noydb bundle header.transferSeal.v must be 1, got ${String(t['v'])}.`)\n    }\n    if (t['alg'] !== 'aes-256-gcm-pre-shared') {\n      throw new Error(`.noydb bundle header.transferSeal.alg must be 'aes-256-gcm-pre-shared', got ${String(t['alg'])}.`)\n    }\n    if (typeof t['sealId'] !== 'string' || t['sealId'].length === 0) {\n      throw new Error(`.noydb bundle header.transferSeal.sealId must be a non-empty string, got ${String(t['sealId'])}.`)\n    }\n  }\n  // Cross-field invariant: the seal indicator and the extracted-partition\n  // kind imply each other. An extracted partition is unlocked via its\n  // transfer seal; a seal without the kind is a malformed header.\n  const isExtracted = h['bundleKind'] === 'extracted-partition'\n  const hasSeal = h['transferSeal'] !== undefined\n  if (hasSeal && !isExtracted) {\n    throw new Error(\n      `.noydb bundle header.transferSeal requires bundleKind === 'extracted-partition'.`,\n    )\n  }\n  if (isExtracted && !hasSeal) {\n    throw new Error(\n      `.noydb bundle header with bundleKind === 'extracted-partition' must carry a transferSeal indicator.`,\n    )\n  }\n  // An extracted partition's unlock path IS the transfer seal. A parallel\n  // autoUnlock credential would create two unlock paths and weaken the\n  // one-time-seal guarantee. Reject the combination.\n  if (isExtracted && h['autoUnlock'] !== undefined) {\n    throw new Error(\n      `.noydb bundle header cannot carry both autoUnlock and bundleKind === 'extracted-partition' — `\n      + `an extracted partition is unlocked via its transfer seal, not an auto-credential.`,\n    )\n  }\n}\n\n/**\n * Encode a header object to UTF-8 JSON bytes after validating\n * minimum disclosure. Used by the writer to serialize the header\n * region of the container.\n */\nexport function encodeBundleHeader(header: NoydbPodHeader): Uint8Array {\n  validateBundleHeader(header)\n  // Stable key ordering — JSON.stringify with no replacer uses\n  // insertion order, which is fine here because we control the\n  // object construction. Stable ordering means two bundles with\n  // identical contents produce byte-identical headers.\n  const json = JSON.stringify({\n    formatVersion: header.formatVersion,\n    handle: header.handle,\n    bodyBytes: header.bodyBytes,\n    bodySha256: header.bodySha256,\n    ...(header.publicEnvelope !== undefined ? { publicEnvelope: header.publicEnvelope } : {}),\n    ...(header.autoUnlock !== undefined ? { autoUnlock: header.autoUnlock } : {}),\n    ...(header.bundleKind !== undefined ? { bundleKind: header.bundleKind } : {}),\n    ...(header.transferSeal !== undefined ? { transferSeal: header.transferSeal } : {}),\n  })\n  return new TextEncoder().encode(json)\n}\n\n/**\n * Parse a bundle header from its UTF-8 JSON bytes. Throws on\n * invalid JSON or any minimum-disclosure violation.\n */\nexport function decodeBundleHeader(bytes: Uint8Array): NoydbPodHeader {\n  const json = new TextDecoder('utf-8', { fatal: true }).decode(bytes)\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(json)\n  } catch (err) {\n    throw new Error(\n      `.noydb bundle header is not valid JSON: ${(err as Error).message}`,\n    )\n  }\n  validateBundleHeader(parsed)\n  return parsed\n}\n\n/**\n * Read a uint32 from `bytes` at `offset` in big-endian byte order.\n * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.\n * Used to decode the header length field; kept inline so the parser\n * doesn't depend on DataView allocation per call.\n */\nexport function readUint32BE(bytes: Uint8Array, offset: number): number {\n  return (\n    (bytes[offset]! << 24 >>> 0) +\n    (bytes[offset + 1]! << 16) +\n    (bytes[offset + 2]! << 8) +\n    bytes[offset + 3]!\n  )\n}\n\n/**\n * Write a uint32 to `bytes` at `offset` in big-endian byte order.\n * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.\n */\nexport function writeUint32BE(bytes: Uint8Array, offset: number, value: number): void {\n  bytes[offset] = (value >>> 24) & 0xff\n  bytes[offset + 1] = (value >>> 16) & 0xff\n  bytes[offset + 2] = (value >>> 8) & 0xff\n  bytes[offset + 3] = value & 0xff\n}\n\n/**\n * Verify the magic prefix of a bundle. Returns true if the first\n * 4 bytes match `NDB1`. Used by readers as a fast file-type check\n * before any further parsing.\n */\nexport function hasNoydbBundleMagic(bytes: Uint8Array): boolean {\n  if (bytes.length < NOYDB_BUNDLE_MAGIC.length) return false\n  for (let i = 0; i < NOYDB_BUNDLE_MAGIC.length; i++) {\n    if (bytes[i] !== NOYDB_BUNDLE_MAGIC[i]) return false\n  }\n  return true\n}\n","/**\n * `.noydb` container primitives — write, read, header-only read.\n *\n *. Wraps a `vault.dump()` JSON string in the\n * binary container described in `format.ts`.\n *\n * **Three primitives:**\n *\n *   - `writePod(vault, opts?)` — produces the\n *     full container bytes ready to write to disk or upload\n *   - `readPodHeader(bytes)` — parses just the header\n *     without decompressing the body, fast file-type and\n *     metadata read for cloud listing UIs\n *   - `readPod(bytes)` — full read: validates magic,\n *     header, integrity hash, and decompresses the body to\n *     return the original `dump()` JSON string for use with\n *     `vault.load()`\n *\n * **Compression strategy:** brotli when available (Node 22+,\n * Chrome 124+, Firefox 122+), gzip fallback elsewhere. The\n * algorithm choice is encoded in the format byte at offset 5,\n * so readers handle either transparently. Brotli wins ~30-50%\n * on JSON payloads with repeated keys (which vault dumps\n * are).\n *\n * **Why split read/load?** `readPod` returns the\n * *unwrapped JSON string*, not a Vault object. The caller\n * is responsible for piping that JSON into\n * `vault.load(json, passphrase)`. Splitting the layers\n * keeps the bundle module free of any crypto/passphrase\n * concerns — it's purely a format layer. The same `readPod`\n * call can also feed verification tools, format inspectors, or\n * archive utilities that don't care about decryption.\n */\n\nimport {\n  COMPRESSION_BROTLI,\n  COMPRESSION_GZIP,\n  COMPRESSION_NONE,\n  FLAG_COMPRESSED,\n  FLAG_HAS_INTEGRITY_HASH,\n  NOYDB_BUNDLE_FORMAT_VERSION,\n  NOYDB_BUNDLE_MAGIC,\n  NOYDB_BUNDLE_PREFIX_BYTES,\n  decodeBundleHeader,\n  encodeBundleHeader,\n  hasNoydbBundleMagic,\n  readUint32BE,\n  writeUint32BE,\n  type CompressionAlgo,\n  type NoydbPodHeader,\n} from './format.js'\nimport { sha256Hex as sha256HexBytes } from '../kernel/enclave/index.js'\nimport { BundleIntegrityError, BundleSealMismatchError, ValidationError } from '../kernel/errors.js'\nimport type { Vault } from '../kernel/vault.js'\nimport type { BundleRecipient } from '../with-party/team/keyring.js'\nimport { pickLocale } from '../with-party/directory/cover/storage.js'\nimport type { Cover } from '../with-party/directory/cover/types.js'\nimport type { SealingKeyProvider, RecipientSealer, RecipientHint } from '../with-party/team/managed-passphrase.js'\n\n// ─── Auto-credential types ────────────────────────────────────────────────────\n\n/**\n * The credential kinds that can be bundled for auto-unlock.\n * WebAuthn is intentionally excluded — it is hardware-bound and\n * cannot be embedded as a portable credential.\n */\nexport type AutoCredentialKind = 'passphrase' | 'password' | 'pin'\n\n/**\n * A typed credential for auto-unlock. Carries the credential `kind`\n * alongside the plaintext `value`, so consumers can dispatch the\n * correct login/prefill path rather than treating all credentials\n * as passphrases.\n *\n * `bundle.ts` is a pure format layer — it carries the credential\n * without interpreting it. The consumer is responsible for\n * dispatching on `kind`.\n */\nexport interface AutoCredential {\n  readonly kind: AutoCredentialKind\n  readonly value: string\n}\n\n/**\n * Options accepted by `writePod`.\n *\n * - `compression: 'auto'` (default) — try brotli, fall back to gzip\n * - `compression: 'brotli'` — force brotli, throw if unsupported\n * - `compression: 'gzip'` — force gzip\n * - `compression: 'none'` — no compression (round-trip testing only)\n *\n * **Slice filtering:**\n * - `collections` — allowlist of collection names to include. Internal\n *   collections (keyrings, ledger) and excluded user collections are\n *   dropped from the bundle. Records inside included collections are\n *   carried through verbatim.\n * - `since` — only records whose envelope `_ts` is on/after the given\n *   instant survive. Operates on the unencrypted envelope timestamp,\n *   so plaintext access to records is not required.\n *\n * Both filters intersect (AND). When neither is provided the bundle is\n * a whole-vault snapshot, identical to today's behaviour.\n */\nexport interface WritePodOptions {\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n  /** Allowlist of user-collection names to include. */\n  readonly collections?: readonly string[]\n  /**\n   * Drop records whose envelope `_ts` is strictly older than this\n   * instant. Accepts a `Date` or any ISO-8601 string parseable by\n   * `new Date()`.\n   */\n  readonly since?: Date | string\n  /**\n   * Plaintext-pipeline record predicate. Decrypts each record\n   * with the vault's per-collection DEK, runs the predicate, and\n   * keeps the original ciphertext for survivors (no re-encrypt —\n   * preserves zero-knowledge cleanly). Records the predicate returns\n   * `false` for are dropped from the bundle.\n   *\n   * Async predicates are supported. Mutating the record from inside\n   * the predicate is undefined behaviour.\n   */\n  readonly where?: (\n    record: unknown,\n    ctx: { collection: string; id: string },\n  ) => boolean | Promise<boolean>\n  /**\n   * Hierarchical-tier ceiling. Records whose envelope `_tier`\n   * is strictly greater than this number are dropped. Operates on the\n   * envelope `_tier` (no decryption needed) — vault.exportStream is\n   * referenced in the issue body for symmetry, but the tier value\n   * lives on the unencrypted envelope. Vault without tiers is a no-op.\n   */\n  readonly tierAtMost?: number\n  /**\n   * Single-recipient re-keying shorthand. When set, the\n   * bundle's keyring is replaced with one freshly-derived entry sealed\n   * with this passphrase. The recipient inherits the source keyring's\n   * userId, role, and permissions. Mutually exclusive with `recipients`.\n   */\n  readonly exportPassphrase?: string\n  /**\n   * Multi-recipient re-keying. Replaces the bundle's keyring\n   * map with one slot per recipient, each sealed with its own\n   * passphrase. DEKs are unwrapped from the source keyring once and\n   * re-wrapped per recipient — record ciphertext is unchanged.\n   *\n   * Mutually exclusive with `exportPassphrase`. When neither is set,\n   * the bundle inherits the source keyring as-is (today's behaviour,\n   * suited to personal backup-and-restore).\n   */\n  readonly recipients?: readonly BundleRecipient[]\n  /**\n   * Auto-unlock — unsealed per-user credentials.\n   *\n   * Generalises `autoPassphrases` to support any bundleable credential\n   * kind (`passphrase` | `password` | `pin`).\n   *\n   * Public-by-design: anyone holding the bundle bytes can read these\n   * plaintext credentials. Use for demo data, sample vaults,\n   * prospect onboarding.\n   *\n   * The `policy: 'public-by-design'` discriminant is mandatory. A\n   * bare `{ perUser }` without it is rejected at write time — the\n   * safety net against a careless call against a production vault.\n   *\n   * Mutually exclusive with `sealedCredentials`, `autoPassphrases`,\n   * and `sealedPassphrases`.\n   */\n  readonly autoCredentials?: {\n    readonly policy: 'public-by-design'\n    readonly perUser: Record<string, AutoCredential>\n  }\n  /**\n   * Auto-unlock — per-user credentials sealed under a\n   * {@link SealingKeyProvider}.\n   *\n   * Generalises `sealedPassphrases` to support any bundleable\n   * credential kind (`passphrase` | `password` | `pin`).\n   *\n   * The hub seals each user's plaintext credential under `provider`\n   * and embeds the resulting sealed envelopes in the bundle. The\n   * recipient must hold a provider with a matching `pid` (i.e.,\n   * `provider.id`) to auto-unseal on import.\n   *\n   * `mode: 'self-target'` — sender and recipient share the same\n   * provider identity (same iCloud Keychain entry, same\n   * MDM-provisioned bundle id, same KMS account, etc.).\n   *\n   * `mode: 'recipient-target'` — asymmetric sealing via a\n   * {@link RecipientSealer}. Each user entry carries a\n   * `credential` and a `hint` (the recipient's public material).\n   * The bundle can only be unsealed by the holder of the matching\n   * private key.\n   *\n   * Mutually exclusive with `autoCredentials`, `autoPassphrases`,\n   * and `sealedPassphrases`.\n   */\n  readonly sealedCredentials?:\n    | {\n        readonly mode: 'self-target'\n        readonly provider: SealingKeyProvider\n        readonly perUser: Record<string, AutoCredential>\n      }\n    | {\n        readonly mode: 'recipient-target'\n        readonly provider: RecipientSealer\n        readonly perUser: Record<string, { readonly credential: AutoCredential; readonly hint: RecipientHint }>\n      }\n  /**\n   * @deprecated Use `autoCredentials` instead.\n   *\n   * Auto-unlock — unsealed per-user passphrases.\n   *\n   * Public-by-design: anyone holding the bundle bytes can read these\n   * plaintext credentials. Use for demo data, sample vaults,\n   * prospect onboarding.\n   *\n   * The `policy: 'public-by-design'` discriminant is mandatory. A\n   * bare `{ perUser }` without it is rejected at write time — the\n   * safety net against a careless call against a production vault.\n   *\n   * Mutually exclusive with `autoCredentials`, `sealedCredentials`,\n   * and `sealedPassphrases`.\n   */\n  readonly autoPassphrases?: {\n    readonly policy: 'public-by-design'\n    readonly perUser: Record<string, string>\n  }\n  /**\n   * @deprecated Use `sealedCredentials` instead.\n   *\n   * Auto-unlock — per-user passphrases sealed under a\n   * {@link SealingKeyProvider} (self-target only).\n   *\n   * The hub seals each user's plaintext passphrase under `provider`\n   * and embeds the resulting sealed envelopes in the bundle. The\n   * recipient must hold a provider with a matching `pid` (i.e.,\n   * `provider.id`) to auto-unseal on import.\n   *\n   * `mode: 'self-target'` is the only mode for `sealedPassphrases` — sender\n   * and recipient share the same provider identity (same iCloud Keychain\n   * entry, same MDM-provisioned bundle id, same KMS account, etc.).\n   * For recipient-target sealing via the `RecipientSealer` interface,\n   * use `sealedCredentials` with `mode: 'recipient-target'` (§11.4).\n   *\n   * Mutually exclusive with `autoCredentials`, `sealedCredentials`,\n   * and `autoPassphrases`.\n   */\n  readonly sealedPassphrases?: {\n    readonly mode: 'self-target'\n    readonly provider: SealingKeyProvider\n    readonly perUser: Record<string, string>\n  }\n}\n\n/** @deprecated Use `WritePodOptions`. */\nexport type WriteNoydbBundleOptions = WritePodOptions\n\n/**\n * Result returned by `readPod`. The caller is expected to\n * pass `dumpJson` into `vault.load(json, passphrase)` to\n * actually restore a vault. Splitting the layers keeps the\n * bundle module free of crypto concerns — see file-level docs.\n */\nexport interface NoydbBundleReadResult {\n  readonly header: NoydbPodHeader\n  readonly dumpJson: string\n  /**\n   * Auto-unlock material. Present only when\n   * the header's `autoUnlock` flag is set AND the body's wrapped\n   * structure survived parsing. Values are typed credentials — either\n   * delivered plain (`kind: 'unsealed'`) or unsealed at read time\n   * using one of the supplied `sealingProviders` (`kind: 'sealed'`).\n   *\n   * Consumers dispatch on `cred.kind` to choose the correct login /\n   * prefill path. Pre-0.2 bundles (bare string entries) are coerced\n   * to `{ kind: 'passphrase', value }` on read for back-compat.\n   *\n   * For `kind: 'sealed'` bundles read without `sealingProviders`, the\n   * `value` field is the raw base64 sealed bytes — opaque to the\n   * consumer until unsealed elsewhere.\n   */\n  readonly autoUnlock?: {\n    readonly kind: 'unsealed' | 'sealed'\n    readonly perUser: Record<string, AutoCredential>\n  }\n}\n\n/**\n * Sealed credential entry as it appears in the bundle body's\n * `_autoUnlock.perUser` map when the bundle was written with\n * `sealedCredentials` (or the deprecated `sealedPassphrases`).\n * Provider's sealed output is base64-encoded; the `pid` is the\n * dispatch key matched against recipient-supplied\n * `SealingKeyProvider.id`. The `kind` carries the plaintext-tier\n * metadata so the consumer can dispatch on credential type without\n * unsealing first.\n *\n * Back-compat: `kind` is absent in older bundles — readers must\n * default to `'passphrase'` when not present.\n */\ninterface SealedAutoUnlockEntry {\n  readonly pid: string\n  readonly sealed: string\n  readonly alg: 'aes-256-gcm'\n  readonly kind?: AutoCredentialKind\n  /**\n   * Recipient-target only: the RecipientHint the sender used to seal.\n   * Carried for recipient verifiability (\"yes this was sealed against\n   * my published hint\"). Self-target entries omit it. Pre-0.2 readers\n   * ignore unknown fields, so this is back-compatible.\n   */\n  readonly hint?: RecipientHint\n}\n\n/**\n * Discriminated wrapper carried in the bundle body when the header's\n * `autoUnlock` flag is set. Without the flag, the body is the raw\n * `vault.dump()` JSON string.\n *\n * Back-compat: older bundles carry bare `string` values in the\n * unsealed `perUser` map. Readers must coerce those to\n * `{ kind: 'passphrase', value }`.\n */\ninterface AutoUnlockBody {\n  readonly _noydb_bundle_body: 1\n  readonly dump: string\n  readonly _autoUnlock:\n    | { readonly kind: 'unsealed'; readonly perUser: Record<string, AutoCredential | string> }\n    | { readonly kind: 'sealed'; readonly perUser: Record<string, SealedAutoUnlockEntry> }\n}\n\n/**\n * Options accepted by {@link readPod} for the\n * auto-unlock paths. Without these the reader behaves exactly as before\n * (header parsed; body returned as `dumpJson`).\n */\nexport interface ReadNoydbBundleOptions {\n  /**\n   * Recipient-side sealing providers used to unseal entries from\n   * `sealedPassphrases`. The reader picks the one whose `.id`\n   * matches each entry's `pid`. Multiple providers may be supplied\n   * (different users may seal under different identities).\n   *\n   * When unset and the bundle carries sealed envelopes, the\n   * `autoUnlock.perUser` map remains the SEALED entries unmodified\n   * — callers can inspect them or unseal elsewhere.\n   */\n  readonly sealingProviders?: readonly SealingKeyProvider[]\n  /**\n   * Opt-in trial mode for unsealing — when an entry's `pid` doesn't\n   * match a registered provider, try each provider whose alg\n   * matches. Default `false` (strict-pid dispatch per foundation\n   * §11.9.2). Surfaces extra credential prompts; use deliberately.\n   */\n  readonly attemptUnsealAcrossProviders?: boolean\n}\n\n// ─── Auto-unlock helpers ──────────────────────────────────────────────────────\n\n/**\n * Internal normalized form of the auto-unlock options, computed once\n * from the four public-facing fields (autoCredentials, sealedCredentials,\n * autoPassphrases, sealedPassphrases). Callers work against this shape\n * so the build + validate paths share a single normalizer.\n */\ninterface NormalizedAutoUnlock {\n  readonly mode: 'unsealed' | 'sealed-self' | 'sealed-recipient'\n  readonly provider?: SealingKeyProvider | RecipientSealer\n  readonly perUser: Record<string, AutoCredential>\n  /** Present only for `sealed-recipient`. Same key set as `perUser`. */\n  readonly hints?: Record<string, RecipientHint>\n}\n\n/**\n * Coerce a `Record<string, string>` (legacy passphrase-only map) into\n * a `Record<string, AutoCredential>` by tagging each entry as\n * `kind: 'passphrase'`. Used by the normalizer to promote the deprecated\n * `autoPassphrases`/`sealedPassphrases` sugar.\n */\nfunction toAutoCredentials(m: Record<string, string>): Record<string, AutoCredential> {\n  return Object.fromEntries(\n    Object.entries(m).map(([u, value]) => [u, { kind: 'passphrase' as const, value }]),\n  )\n}\n\n/**\n * Normalize the four auto-unlock option fields into a single\n * `NormalizedAutoUnlock` (or `null` when none is set). Enforces mutual\n * exclusion — exactly one of the four may be present. Promotes the\n * deprecated sugar fields to `AutoCredential` shape.\n *\n * Does NOT validate field-level constraints (policy marker, perUser\n * length, mode, provider presence, kind allowlist) — those are checked\n * in `validateAutoUnlockOptions` after normalization.\n */\nfunction normalizeAutoUnlock(opts: WritePodOptions): NormalizedAutoUnlock | null {\n  const set = [\n    opts.autoCredentials,\n    opts.sealedCredentials,\n    opts.autoPassphrases,\n    opts.sealedPassphrases,\n  ].filter(v => v !== undefined).length\n  if (set === 0) return null\n  if (set > 1) {\n    throw new ValidationError(\n      'writePod: only one of autoCredentials / sealedCredentials / '\n      + 'autoPassphrases / sealedPassphrases may be set.',\n    )\n  }\n  if (opts.autoCredentials !== undefined) {\n    return { mode: 'unsealed', perUser: opts.autoCredentials.perUser }\n  }\n  if (opts.autoPassphrases !== undefined) {\n    return { mode: 'unsealed', perUser: toAutoCredentials(opts.autoPassphrases.perUser) }\n  }\n  if (opts.sealedCredentials !== undefined) {\n    if (opts.sealedCredentials.mode === 'recipient-target') {\n      const perUser: Record<string, AutoCredential> = {}\n      const hints: Record<string, RecipientHint> = {}\n      for (const [userId, entry] of Object.entries(opts.sealedCredentials.perUser)) {\n        perUser[userId] = entry.credential\n        hints[userId] = entry.hint\n      }\n      return { mode: 'sealed-recipient', provider: opts.sealedCredentials.provider, perUser, hints }\n    }\n    return { mode: 'sealed-self', provider: opts.sealedCredentials.provider, perUser: opts.sealedCredentials.perUser }\n  }\n  // sealedPassphrases — only remaining option\n  return {\n    mode: 'sealed-self',\n    provider: opts.sealedPassphrases!.provider,\n    perUser: toAutoCredentials(opts.sealedPassphrases!.perUser),\n  }\n}\n\n/**\n * Validate the auto-unlock options and return the resulting header\n * `autoUnlock` value (or null when no auto-unlock requested).\n *\n * Takes the pre-computed `NormalizedAutoUnlock` so the caller (i.e.\n * `writePod`) can pass the same object to `buildAutoUnlockWrapper`\n * without a second `normalizeAutoUnlock` call.\n *\n * Validation per spec (§3):\n *   - (mutual exclusion already enforced by normalizeAutoUnlock)\n *   - unsealed path: `policy: 'public-by-design'` marker required\n *   - non-empty `perUser` maps\n *   - sealed path: provider present; both `mode: 'self-target'` and `mode: 'recipient-target'` accepted; recipient-target requires a `RecipientSealer` provider and per-user `hint` (§11.4)\n *   - every AutoCredential.kind ∈ {passphrase, password, pin}\n *     (WebAuthn is hardware-bound and cannot be bundled)\n *\n * Throws {@link ValidationError} on any violation.\n */\nfunction validateAutoUnlockOptions(\n  opts: WritePodOptions,\n  normalized: NormalizedAutoUnlock | null,\n): 'unsealed' | 'sealed' | null {\n  if (normalized === null) return null\n\n  const VALID_KINDS: ReadonlySet<string> = new Set(['passphrase', 'password', 'pin'])\n\n  // Validate every credential kind before any further checks.\n  for (const [userId, cred] of Object.entries(normalized.perUser)) {\n    if (!VALID_KINDS.has(cred.kind)) {\n      throw new ValidationError(\n        `writePod: credential for user '${userId}' has unsupported kind '${cred.kind}'. `\n        + 'auto-unlock supports passphrase/password/pin only; WebAuthn is hardware-bound '\n        + 'and cannot be bundled.',\n      )\n    }\n  }\n\n  if (normalized.mode === 'unsealed') {\n    // Read the policy marker from whichever active option carries it.\n    const policy = opts.autoCredentials?.policy ?? opts.autoPassphrases?.policy\n    if (policy !== 'public-by-design') {\n      throw new ValidationError(\n        'writePod: `autoCredentials` (or `autoPassphrases`) requires '\n        + '`policy: \"public-by-design\"`. '\n        + 'This is an explicit opt-in marker — bundling plaintext credentials is '\n        + 'safe only when those credentials are intended to be public (demo data, '\n        + 'sample vaults). For production credentials, use `sealedCredentials` instead.',\n      )\n    }\n    const userCount = Object.keys(normalized.perUser).length\n    if (userCount === 0) {\n      throw new ValidationError(\n        'writePod: `autoCredentials.perUser` (or `autoPassphrases.perUser`) '\n        + 'must have at least one entry.',\n      )\n    }\n    return 'unsealed'\n  }\n\n  // Sealed path — branch on mode.\n  if (normalized.mode === 'sealed-recipient') {\n    const provider = normalized.provider\n    if (provider === undefined || typeof (provider as RecipientSealer).publishRecipientHint !== 'function'\n        || typeof (provider as RecipientSealer).sealForRecipient !== 'function') {\n      throw new ValidationError(\n        'writePod: `sealedCredentials.provider` for mode \\'recipient-target\\' must be a '\n        + 'RecipientSealer (publishRecipientHint + sealForRecipient). Self-only providers '\n        + '(MemorySealingKeyProvider, at-macos-keychain, etc.) do not satisfy this contract.',\n      )\n    }\n    const hints = normalized.hints\n    if (hints === undefined) {\n      throw new Error('unreachable — sealed-recipient normalization must populate hints')\n    }\n    for (const userId of Object.keys(normalized.perUser)) {\n      const hint = hints[userId]\n      if (hint === undefined) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}']\\` missing required \\`hint\\` for mode 'recipient-target'.`,\n        )\n      }\n      if (hint.v !== 1) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.v\\` must be 1 (got ${String(hint.v)}).`,\n        )\n      }\n      if (typeof hint.pid !== 'string' || hint.pid.length === 0) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.pid\\` must be a non-empty string identifying the recipient.`,\n        )\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.alg\\` must be 'rsa-oaep-sha256' in slice 1 (got '${String(hint.alg)}').`,\n        )\n      }\n      // Note: hint.pid identifies the recipient, not the sender — no pid===sender.id check here.\n      // The sender holds a RecipientSealer that calls sealForRecipient(plaintext, hint);\n      // the hint's pid is the dispatch key on the reader side (matched against recipient providers).\n    }\n    const userCount = Object.keys(normalized.perUser).length\n    if (userCount === 0) {\n      throw new ValidationError(\n        'writePod: `sealedCredentials.perUser` must have at least one entry.',\n      )\n    }\n    return 'sealed'\n  }\n\n  // mode === 'sealed-self'\n  const selfTargetMode = opts.sealedCredentials?.mode ?? opts.sealedPassphrases?.mode\n  if (selfTargetMode !== 'self-target') {\n    throw new ValidationError(\n      `writePod: \\`sealedCredentials.mode\\` (or \\`sealedPassphrases.mode\\`) must be `\n      + `'self-target' or 'recipient-target' (got '${String(selfTargetMode)}').`,\n    )\n  }\n  if (normalized.provider === undefined) {\n    throw new ValidationError(\n      'writePod: `sealedCredentials.provider` (or `sealedPassphrases.provider`) '\n      + 'is required (a `SealingKeyProvider`).',\n    )\n  }\n  const userCount = Object.keys(normalized.perUser).length\n  if (userCount === 0) {\n    throw new ValidationError(\n      'writePod: `sealedCredentials.perUser` (or `sealedPassphrases.perUser`) '\n      + 'must have at least one entry.',\n    )\n  }\n  return 'sealed'\n}\n\n/**\n * Build the body wrapper carrying the dump + `_autoUnlock` blob.\n * Takes the pre-computed `NormalizedAutoUnlock` so both validate and\n * build work off the same normalized form (no double-normalize).\n */\nasync function buildAutoUnlockWrapper(\n  dumpJson: string,\n  normalized: NormalizedAutoUnlock,\n): Promise<AutoUnlockBody> {\n  if (normalized.mode === 'unsealed') {\n    return {\n      _noydb_bundle_body: 1,\n      dump: dumpJson,\n      _autoUnlock: {\n        kind: 'unsealed',\n        perUser: { ...normalized.perUser },\n      },\n    }\n  }\n  // Sealed path — branch on mode.\n  const provider = normalized.provider\n  if (provider === undefined) {\n    throw new Error('unreachable — validation should have caught this')\n  }\n  const sealedPerUser: Record<string, SealedAutoUnlockEntry> = {}\n  const encoder = new TextEncoder()\n\n  if (normalized.mode === 'sealed-recipient') {\n    const recipientSealer = provider as RecipientSealer\n    const hints = normalized.hints\n    if (hints === undefined) {\n      throw new Error('unreachable — sealed-recipient normalization must populate hints')\n    }\n    for (const [userId, cred] of Object.entries(normalized.perUser)) {\n      const hint = hints[userId]!\n      const sealed = await recipientSealer.sealForRecipient(encoder.encode(cred.value), hint)\n      sealedPerUser[userId] = {\n        pid: hint.pid,                  // use the recipient's pid, not the sender's\n        sealed: bytesToBase64(sealed),\n        alg: 'aes-256-gcm',\n        kind: cred.kind,\n        hint,\n      }\n    }\n  } else {\n    // mode === 'sealed-self'\n    const selfSealer = provider as SealingKeyProvider\n    for (const [userId, cred] of Object.entries(normalized.perUser)) {\n      const sealed = await selfSealer.seal(encoder.encode(cred.value))\n      sealedPerUser[userId] = {\n        pid: selfSealer.id,\n        sealed: bytesToBase64(sealed),\n        alg: 'aes-256-gcm',\n        kind: cred.kind,\n      }\n    }\n  }\n\n  return {\n    _noydb_bundle_body: 1,\n    dump: dumpJson,\n    _autoUnlock: { kind: 'sealed', perUser: sealedPerUser },\n  }\n}\n\n/**\n * Parse the body bytes when the header signaled an auto-unlock.\n * Returns the inner `dump` JSON string + the `_autoUnlock` blob;\n * throws if the wrapper structure is malformed.\n */\nfunction parseAutoUnlockBody(bodyString: string): { dump: string; blob: AutoUnlockBody['_autoUnlock'] } {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(bodyString)\n  } catch (err) {\n    throw new BundleIntegrityError(\n      'header declared autoUnlock but body could not be parsed as JSON wrapper: '\n      + (err instanceof Error ? err.message : String(err)),\n    )\n  }\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw new BundleIntegrityError('autoUnlock body is not a JSON object')\n  }\n  const obj = parsed as Record<string, unknown>\n  if (obj['_noydb_bundle_body'] !== 1) {\n    throw new BundleIntegrityError(\n      'autoUnlock body missing `_noydb_bundle_body: 1` discriminator',\n    )\n  }\n  if (typeof obj['dump'] !== 'string') {\n    throw new BundleIntegrityError('autoUnlock body must carry a string `dump` field')\n  }\n  const blob = obj['_autoUnlock']\n  if (typeof blob !== 'object' || blob === null) {\n    throw new BundleIntegrityError('autoUnlock body missing `_autoUnlock` blob')\n  }\n  const blobObj = blob as Record<string, unknown>\n  const kind = blobObj['kind']\n  if (kind !== 'unsealed' && kind !== 'sealed') {\n    throw new BundleIntegrityError(\n      `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`,\n    )\n  }\n  return {\n    dump: obj['dump'],\n    blob: blob as AutoUnlockBody['_autoUnlock'],\n  }\n}\n\n/**\n * Transfer-seal payload. The destination DEKs, exported to raw\n * bytes and AES-256-GCM-sealed *as a set* under the one-time transfer\n * key. `adoptPartition` unseals this; `createOwnerOnAdoptedPartition`\n * re-wraps the raw DEKs under the recipient's KEK.\n */\nexport interface TransferSealPayload {\n  readonly v: 1\n  readonly alg: 'aes-256-gcm-pre-shared'\n  readonly sealId: string\n  /** base64(AES-256-GCM(transferKey, JSON of { collection: base64(rawDEK) })) — iv ‖ ct ‖ tag. */\n  readonly payload: string\n}\n\n/**\n * Body wrapper for an extracted, transfer-sealed partition.\n * Sibling to {@link AutoUnlockBody}; selected by `header.bundleKind ===\n * 'extracted-partition'`. The inner `dump` is a re-keyed projection with\n * an empty `keyrings` map.\n */\nexport interface ExtractedPartitionBody {\n  readonly _noydb_bundle_body: 1\n  readonly dump: string\n  readonly _transferSeal: TransferSealPayload\n}\n\nexport function buildExtractedPartitionWrapper(\n  dumpJson: string,\n  seal: TransferSealPayload,\n): ExtractedPartitionBody {\n  return { _noydb_bundle_body: 1, dump: dumpJson, _transferSeal: seal }\n}\n\nexport function parseExtractedPartitionBody(\n  bodyString: string,\n): { dump: string; seal: TransferSealPayload } {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(bodyString)\n  } catch (err) {\n    throw new BundleIntegrityError(\n      'header declared extracted-partition but body could not be parsed as JSON wrapper: '\n      + (err instanceof Error ? err.message : String(err)),\n    )\n  }\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw new BundleIntegrityError('extracted-partition body is not a JSON object')\n  }\n  const obj = parsed as Record<string, unknown>\n  if (obj['_noydb_bundle_body'] !== 1) {\n    throw new BundleIntegrityError(\n      'extracted-partition body missing `_noydb_bundle_body: 1` discriminator',\n    )\n  }\n  if (typeof obj['dump'] !== 'string') {\n    throw new BundleIntegrityError('extracted-partition body must carry a string `dump` field')\n  }\n  const seal = obj['_transferSeal']\n  if (typeof seal !== 'object' || seal === null) {\n    throw new BundleIntegrityError('extracted-partition body missing `_transferSeal` blob')\n  }\n  const s = seal as Record<string, unknown>\n  if (s['v'] !== 1 || s['alg'] !== 'aes-256-gcm-pre-shared'\n      || typeof s['sealId'] !== 'string' || typeof s['payload'] !== 'string') {\n    throw new BundleIntegrityError('extracted-partition `_transferSeal` blob is malformed')\n  }\n  return { dump: obj['dump'], seal: seal as TransferSealPayload }\n}\n\n/**\n * Coerce an unsealed perUser entry to `AutoCredential`. Older bundles\n * store bare strings; newer bundles store `{ kind, value }` objects.\n */\nfunction coerceUnsealed(entry: AutoCredential | string): AutoCredential {\n  if (typeof entry === 'string') return { kind: 'passphrase', value: entry }\n  return entry\n}\n\n/**\n * Resolve the `_autoUnlock` blob into a typed per-user credential map.\n *\n * - For `kind: 'unsealed'`: pass through, coercing pre-0.2 bare strings\n *   to `{ kind: 'passphrase', value }`.\n * - For `kind: 'sealed'`: pick a `SealingKeyProvider` from\n *   `opts.sealingProviders` whose `.id` matches each entry's `pid`;\n *   unseal to `AutoCredential`. When no provider matches AND strict mode\n *   (default), throw `BundleSealMismatchError`. With\n *   `attemptUnsealAcrossProviders: true`, try each provider whose\n *   `alg` matches the envelope.\n *   Exception: if an unmatched entry carries a `hint` field (recipient-target\n *   entries), it passes through as `{ kind, value: base64sealed }` rather than\n *   throwing — multi-recipient bundles have N-1 unmatched entries from each\n *   recipient's perspective, and the consumer is expected to ignore entries\n *   not addressed to them.\n * - When `sealingProviders` is unset entirely on a `'sealed'` bundle,\n *   pass through the SEALED entries as `{ kind, value: base64sealed }` —\n *   the caller can inspect or unseal elsewhere.\n *\n * Pre-0.2 sealed entries missing `kind` default to `'passphrase'`.\n */\nasync function resolveAutoUnlock(\n  blob: AutoUnlockBody['_autoUnlock'],\n  opts: ReadNoydbBundleOptions,\n): Promise<{ kind: 'unsealed' | 'sealed'; perUser: Record<string, AutoCredential> }> {\n  if (blob.kind === 'unsealed') {\n    const resolved: Record<string, AutoCredential> = {}\n    for (const [userId, entry] of Object.entries(blob.perUser)) {\n      resolved[userId] = coerceUnsealed(entry)\n    }\n    return { kind: 'unsealed', perUser: resolved }\n  }\n  // Sealed path.\n  if (opts.sealingProviders === undefined || opts.sealingProviders.length === 0) {\n    // Inspection mode — pass the sealed payload through as a typed\n    // credential whose `value` is the opaque base64 sealed bytes.\n    // The caller is signalled by `kind: 'sealed'` on the outer result.\n    const passthrough: Record<string, AutoCredential> = {}\n    for (const [userId, entry] of Object.entries(blob.perUser)) {\n      passthrough[userId] = { kind: entry.kind ?? 'passphrase', value: entry.sealed }\n    }\n    return { kind: 'sealed', perUser: passthrough }\n  }\n  const providersByPid = new Map<string, SealingKeyProvider>()\n  for (const p of opts.sealingProviders) providersByPid.set(p.id, p)\n\n  const decoder = new TextDecoder()\n  const unsealedMap: Record<string, AutoCredential> = {}\n\n  for (const [userId, entry] of Object.entries(blob.perUser)) {\n    const credKind: AutoCredentialKind = entry.kind ?? 'passphrase'\n    const provider = providersByPid.get(entry.pid)\n    if (provider === undefined) {\n      if (opts.attemptUnsealAcrossProviders === true) {\n        // Try each provider; first that succeeds wins.\n        let opened: string | null = null\n        for (const candidate of opts.sealingProviders) {\n          try {\n            const plaintextBytes = await candidate.unseal(base64ToBytes(entry.sealed))\n            opened = decoder.decode(plaintextBytes)\n            break\n          } catch {\n            // try next\n          }\n        }\n        if (opened === null) {\n          if (entry.hint !== undefined) {\n            // Recipient-target entry not addressed to any held key — pass through sealed.\n            // Other recipients' entries in a multi-recipient bundle are opaque to us.\n            unsealedMap[userId] = { kind: credKind, value: entry.sealed }\n            continue\n          }\n          throw new BundleSealMismatchError(userId, entry.pid)\n        }\n        unsealedMap[userId] = { kind: credKind, value: opened }\n        continue\n      }\n      if (entry.hint !== undefined) {\n        // Recipient-target entry not addressed to any held key — pass through sealed.\n        // Multi-recipient bundles deliberately seal each user's entry under their own\n        // public key; a reader holding only alice's key will not match bob's pid.\n        unsealedMap[userId] = { kind: credKind, value: entry.sealed }\n        continue\n      }\n      throw new BundleSealMismatchError(userId, entry.pid)\n    }\n    const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed))\n    unsealedMap[userId] = { kind: credKind, value: decoder.decode(plaintextBytes) }\n  }\n  return { kind: 'sealed', perUser: unsealedMap }\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n  return btoa(binary)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n  const binary = atob(b64)\n  const out = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i)\n  return out\n}\n\n/**\n * Detect whether the runtime's `CompressionStream` supports brotli.\n *\n * Brotli requires Node 22+ / Chrome 124+ / Firefox 122+. The\n * detection runs the `CompressionStream` constructor in a\n * try/catch — unsupported formats throw `TypeError` synchronously,\n * making this a safe one-shot check that we cache for the\n * lifetime of the process.\n */\nlet cachedBrotliSupport: boolean | null = null\nfunction supportsBrotliCompression(): boolean {\n  if (cachedBrotliSupport !== null) return cachedBrotliSupport\n  try {\n    new CompressionStream('br' as CompressionFormat)\n    cachedBrotliSupport = true\n  } catch {\n    cachedBrotliSupport = false\n  }\n  return cachedBrotliSupport\n}\n\n/** Test-only: reset the brotli detection cache between tests. */\nexport function resetBrotliSupportCache(): void {\n  cachedBrotliSupport = null\n}\n\n/**\n * Pick the compression algorithm and the corresponding format byte\n * from a user option. Throws if the user explicitly requests brotli\n * on a runtime that doesn't support it — a silent fallback would\n * make the produced bundle smaller-than-expected and confuse\n * size-bound tests.\n */\nfunction selectCompression(option: WritePodOptions['compression']): {\n  format: CompressionAlgo\n  streamFormat: CompressionFormat | null\n} {\n  const choice = option ?? 'auto'\n  if (choice === 'none') return { format: COMPRESSION_NONE, streamFormat: null }\n  if (choice === 'gzip') return { format: COMPRESSION_GZIP, streamFormat: 'gzip' }\n  if (choice === 'brotli') {\n    if (!supportsBrotliCompression()) {\n      throw new Error(\n        `writePod({ compression: 'brotli' }) is not supported on this ` +\n          `runtime. Brotli requires Node 22+, Chrome 124+, or Firefox 122+. ` +\n          `Use { compression: 'auto' } to fall back to gzip silently, or ` +\n          `{ compression: 'gzip' } to be explicit.`,\n      )\n    }\n    return { format: COMPRESSION_BROTLI, streamFormat: 'br' as CompressionFormat }\n  }\n  // 'auto' — prefer brotli, fall back to gzip\n  if (supportsBrotliCompression()) {\n    return { format: COMPRESSION_BROTLI, streamFormat: 'br' as CompressionFormat }\n  }\n  return { format: COMPRESSION_GZIP, streamFormat: 'gzip' }\n}\n\n/**\n * Pump a Uint8Array through a CompressionStream / DecompressionStream\n * and collect the output. Both APIs are universally available in\n * Node 18+ and modern browsers; the only variance is which\n * formats they support, handled by `selectCompression` above.\n *\n * Implementation: build a single-chunk ReadableStream from the\n * input, pipe through the transform, then drain the resulting\n * ReadableStream into a single concatenated Uint8Array. This is\n * O(N) memory in the input + output sizes, which is fine for the\n * dump-sized payloads (typically <50MB) targets.\n */\nasync function pumpThroughStream(\n  input: Uint8Array,\n  stream: CompressionStream | DecompressionStream,\n): Promise<Uint8Array> {\n  const readable = new Blob([input as BlobPart]).stream().pipeThrough(stream)\n  const reader = readable.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n  for (;;) {\n    const { value, done } = await reader.read()\n    if (done) break\n    if (value) {\n      chunks.push(value as Uint8Array)\n      total += value.length\n    }\n  }\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    out.set(chunk, offset)\n    offset += chunk.length\n  }\n  return out\n}\n\n/**\n * SHA-256 hex digest of `bytes`. Used for the bundle integrity\n * hash carried in the header. Web Crypto API only — no Node\n * crypto module, no third-party hash library.\n *\n * The output format is lowercase hex (64 chars for SHA-256). The\n * format validator pins this — uppercase or mixed-case digests\n * are rejected, so the writer and reader agree on canonicalization.\n */\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n  // Copy into a fresh ArrayBuffer-backed Uint8Array. The\n  // underlying buffer of `bytes` may be SharedArrayBuffer (e.g.\n  // from a worker), which `subtle.digest` rejects via TypeScript's\n  // BufferSource type. Allocating a fresh ArrayBuffer-backed view\n  // sidesteps the type narrowing and is portable across all\n  // runtimes — the copy cost is O(N) but bundle bodies are\n  // typically <50MB, well below the threshold where the copy\n  // matters.\n  const copy = new Uint8Array(bytes.length)\n  copy.set(bytes)\n  return sha256HexBytes(copy)\n}\n\n/**\n * Concatenate any number of Uint8Arrays into a single new buffer.\n * Used to assemble the final bundle from its prefix + header +\n * body parts.\n */\nfunction concatBytes(parts: readonly Uint8Array[]): Uint8Array {\n  let total = 0\n  for (const p of parts) total += p.length\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const p of parts) {\n    out.set(p, offset)\n    offset += p.length\n  }\n  return out\n}\n\n/**\n * Replace the bundle's keyrings with freshly built recipient slots,\n * one per supplied recipient. No-op when neither `exportPassphrase`\n * nor `recipients` is set — the source keyring is inherited as-is.\n *\n * The single-passphrase shorthand creates a one-recipient list whose\n * id, role, and permissions inherit from the source vault — useful\n * for \"back up to a different passphrase\" without changing role\n * semantics. The multi-recipient form wraps each slot independently\n * with its declared role + permissions.\n *\n * @internal\n */\nasync function applyRecipientRewrap(\n  vault: Vault,\n  dumpJson: string,\n  opts: WritePodOptions,\n): Promise<string> {\n  if (opts.exportPassphrase === undefined && opts.recipients === undefined) {\n    return dumpJson\n  }\n\n  const recipients: readonly BundleRecipient[] =\n    opts.recipients ?? [\n      {\n        id: vault.userId,\n        passphrase: opts.exportPassphrase as string,\n        role: vault.role,\n      },\n    ]\n\n  const recipientKeyrings = await vault.buildBundleRecipientKeyrings(recipients)\n\n  const backup = JSON.parse(dumpJson) as { keyrings: unknown; [k: string]: unknown }\n  backup.keyrings = recipientKeyrings\n  return JSON.stringify(backup)\n}\n\n/**\n * Apply opt-in slice filters to a vault dump JSON string. Filters that\n * narrow the bundle without crossing the encryption boundary — both\n * operate on metadata (collection name, envelope `_ts`) and never need\n * to decrypt records. When neither filter is set, the dump is returned\n * unchanged so the no-arg path stays a pure passthrough.\n *\n * Internal-collection filtering: when a `collections` allowlist is\n * provided, the bundle still carries `_internal` (ledger entries) and\n * the keyrings — they're necessary for the receiver to verify and\n * unlock the bundle. The allowlist applies to the user-collection\n * map only.\n *\n * @internal\n */\nfunction applySliceFilters(\n  dumpJson: string,\n  opts: WritePodOptions,\n): string {\n  const collectionsFilter = opts.collections\n    ? new Set(opts.collections)\n    : null\n  const sinceMs =\n    opts.since !== undefined ? new Date(opts.since).getTime() : null\n  if (collectionsFilter === null && sinceMs === null) return dumpJson\n\n  // Parse, prune, re-serialize. The dump shape is stable\n  // (VaultBackup) so this is a one-off allocation; for vaults beyond\n  // the documented 1K–50K target a streaming variant would be a\n  // follow-up, but the simple parse path keeps the slice path\n  // type-safe and trivially auditable.\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, { _ts?: string }>>\n    [k: string]: unknown\n  }\n\n  if (backup.collections && typeof backup.collections === 'object') {\n    const next: Record<string, Record<string, unknown>> = {}\n    for (const [name, records] of Object.entries(backup.collections)) {\n      if (collectionsFilter && !collectionsFilter.has(name)) continue\n      if (sinceMs === null) {\n        next[name] = records\n        continue\n      }\n      const kept: Record<string, unknown> = {}\n      for (const [id, env] of Object.entries(records)) {\n        const envTs = env._ts ? new Date(env._ts).getTime() : NaN\n        if (Number.isFinite(envTs) && envTs >= sinceMs) {\n          kept[id] = env\n        }\n      }\n      next[name] = kept\n    }\n    backup.collections = next as typeof backup.collections\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Unconditionally drop satellite-collection records whose base row is dead\n * (absent or tombstoned — existence.ts rule 1) from a vault dump. Unlike\n * `applySliceFilters` / `applyPlaintextFilters`, this isn't opt-in: a\n * satellite envelope that outlived its base is dead ciphertext (plus its\n * wrapped keys) that should never leave the vault in a `.noydb` backup\n * (#591 Task 10 — closes the last enumerated existence-authority surface).\n *\n * Pairing info comes from the persisted `_schemas/<name>` marker rather\n * than the in-memory `SatelliteRegistry` — that registry is private to\n * `Vault` and the bundle-export path only has `Vault._introspectState()`\n * (adapter + vault name + per-collection DEK accessor), so it reads the\n * marker instead of widening the kernel's surface. See\n * `with-shape/satellites/dead-filter.ts`.\n *\n * No-ops (returns `dumpJson` unchanged) when the vault has no detectable\n * satellite collections at all, so vaults that never use satellites pay\n * no extra parse/reserialize cost. Also no-ops when `vault` doesn't\n * implement `_introspectState()` at all — some call sites pass a minimal\n * duck-typed vault-like object for unit tests (e.g.\n * `snapshots.test.ts`'s `makeMockVault`, which implements only\n * `getBundleHandle`/`dump`/`load`/`getCover`); a real `Vault`\n * always implements it.\n *\n * @internal\n */\nasync function applySatelliteLivenessFilter(\n  vault: Vault,\n  dumpJson: string,\n): Promise<string> {\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, unknown>>\n    [k: string]: unknown\n  }\n  if (!backup.collections || typeof backup.collections !== 'object') return dumpJson\n  if (typeof vault._introspectState !== 'function') return dumpJson\n\n  const { adapter, name, getDEK } = vault._introspectState()\n  const { liveBaseIdSetsForBundle } = await import('../with-shape/satellites/dead-filter.js')\n  const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK)\n  if (satLive.size === 0) return dumpJson\n\n  const next: Record<string, Record<string, unknown>> = {}\n  for (const [collName, records] of Object.entries(backup.collections)) {\n    const live = satLive.get(collName)\n    if (!live) { next[collName] = records; continue }\n    const kept: Record<string, unknown> = {}\n    for (const [id, env] of Object.entries(records)) {\n      if (live.has(id)) kept[id] = env\n    }\n    next[collName] = kept\n  }\n  backup.collections = next\n  return JSON.stringify(backup)\n}\n\n/**\n * Apply opt-in plaintext-tier filters\n * to a vault dump. Operates BEFORE `applySliceFilters` so the metadata\n * pass sees the trimmed record set.\n *\n * The filter never re-encrypts: surviving records carry their original\n * envelope unchanged. Failing records are dropped from the\n * `collections` map. Internal collections (ledger, deltas) and the\n * keyrings map are untouched.\n *\n * @internal\n */\nasync function applyPlaintextFilters(\n  vault: Vault,\n  dumpJson: string,\n  opts: WritePodOptions,\n): Promise<string> {\n  if (opts.where === undefined && opts.tierAtMost === undefined) {\n    return dumpJson\n  }\n\n  type Env = { _ts?: string; _tier?: number; _iv: string; _data: string }\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, Env>>\n    [k: string]: unknown\n  }\n  if (!backup.collections || typeof backup.collections !== 'object') {\n    return dumpJson\n  }\n\n  const tierCeiling = opts.tierAtMost\n  const where = opts.where\n\n  const next: Record<string, Record<string, Env>> = {}\n  for (const [collName, records] of Object.entries(backup.collections)) {\n    const kept: Record<string, Env> = {}\n    for (const [id, env] of Object.entries(records)) {\n      // Tier ceiling — runs FIRST so we don't waste a decrypt on\n      // records about to be dropped anyway. Envelope tier defaults to\n      // 0 when absent (matches Vault's tier-0 conventions).\n      if (tierCeiling !== undefined) {\n        const tier = env._tier ?? 0\n        if (tier > tierCeiling) continue\n      }\n      // Plaintext predicate — decrypt, run, keep on truthy. Errors\n      // from inside the predicate propagate (callers want to see why\n      // their filter blew up rather than getting a silent passthrough).\n      if (where !== undefined) {\n        const record = await vault._decryptEnvelopeForBundleFilter(\n          env as never,\n          collName,\n        )\n        const ok = await where(record, { collection: collName, id })\n        if (!ok) continue\n      }\n      kept[id] = env\n    }\n    next[collName] = kept\n  }\n  backup.collections = next\n  return JSON.stringify(backup)\n}\n\n/**\n * Write a `.noydb` bundle for the given vault.\n *\n * Pipeline:\n *   1. Resolve or create the compartment's stable bundle handle\n *      via `vault.getBundleHandle()` — same handle on\n *      every export from the same vault instance, so cloud\n *      adapters can use it as a primary key.\n *   2. `vault.dump()` → JSON string with encrypted records\n *      inside.\n *   3. UTF-8 encode the dump string.\n *   4. Compress (brotli if available, gzip fallback by default).\n *   5. Compute SHA-256 of the compressed body for integrity.\n *   6. Build the minimum-disclosure header from format version,\n *      handle, body length, body sha.\n *   7. Serialize: magic (4) + flags (1) + algo (1) + headerLen (4)\n *      + header JSON (N) + compressed body (M).\n *\n * The output is a single `Uint8Array`. Consumers writing to disk\n * pass it to `fs.writeFile`; consumers uploading to cloud storage\n * pass it as the request body. The `@noy-db/file` adapter wraps\n * this with a `saveBundle(path, vault)` helper.\n */\n/**\n * Assemble the final `.noydb` container bytes from a body JSON string +\n * header extras. Shared by `writePod` and `extractPartition`\n * so both producers go through one compress/hash/prefix path.\n *\n * @internal\n */\nexport async function assembleBundleContainer(opts: {\n  handle: string\n  bodyJsonStr: string\n  compression: WritePodOptions['compression']\n  /** Header fields beyond the always-present four. */\n  headerExtras?: Partial<Pick<NoydbPodHeader, 'publicEnvelope' | 'autoUnlock' | 'bundleKind' | 'transferSeal'>>\n}): Promise<Uint8Array> {\n  const dumpBytes = new TextEncoder().encode(opts.bodyJsonStr)\n  const { format, streamFormat } = selectCompression(opts.compression)\n  const body = streamFormat === null\n    ? dumpBytes\n    : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat))\n  const bodySha256 = await sha256Hex(body)\n\n  const header: NoydbPodHeader = {\n    formatVersion: NOYDB_BUNDLE_FORMAT_VERSION,\n    handle: opts.handle,\n    bodyBytes: body.length,\n    bodySha256,\n    ...(opts.headerExtras?.publicEnvelope !== undefined ? { publicEnvelope: opts.headerExtras.publicEnvelope } : {}),\n    ...(opts.headerExtras?.autoUnlock !== undefined ? { autoUnlock: opts.headerExtras.autoUnlock } : {}),\n    ...(opts.headerExtras?.bundleKind !== undefined ? { bundleKind: opts.headerExtras.bundleKind } : {}),\n    ...(opts.headerExtras?.transferSeal !== undefined ? { transferSeal: opts.headerExtras.transferSeal } : {}),\n  }\n  const headerBytes = encodeBundleHeader(header)\n\n  const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES)\n  prefix.set(NOYDB_BUNDLE_MAGIC, 0)\n  prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH\n  prefix[5] = format\n  writeUint32BE(prefix, 6, headerBytes.length)\n\n  return concatBytes([prefix, headerBytes, body])\n}\n\nexport async function writePod(\n  vault: Vault,\n  opts: WritePodOptions = {},\n): Promise<Uint8Array> {\n  if (opts.exportPassphrase !== undefined && opts.recipients !== undefined) {\n    throw new Error(\n      'writePod: pass either exportPassphrase or recipients, not both',\n    )\n  }\n\n  // Auto-unlock: normalize once, validate + build from the\n  // same NormalizedAutoUnlock object so there's no double-normalize call.\n  const normalizedAutoUnlock = normalizeAutoUnlock(opts)\n  const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock)\n\n  const handle = await vault.getBundleHandle()\n  const dumpJson = await vault.dump()\n\n  // Satellite existence-authority filter (#591 Task 10) — unconditional,\n  // runs before every other filter so dead-ciphertext satellite records\n  // never reach recipient rewrap or the opt-in filters below.\n  const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson)\n\n  // Re-keying: when caller supplied recipients (or the single-recipient\n  // shorthand), substitute the bundle's `keyrings` map with freshly\n  // built recipient slots before slice filters run.\n  const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts)\n  // Plaintext-tier filters run BEFORE\n  // the metadata-only slice — that way the metadata pass sees the\n  // already-trimmed record set and the two filter chains compose\n  // cleanly.\n  const plainFiltered = await applyPlaintextFilters(vault, rekeyed, opts)\n  const filtered = applySliceFilters(plainFiltered, opts)\n\n  // If no auto-unlock requested, body remains the raw dump JSON.\n  // Otherwise build the wrapped body containing the\n  // dump + `_autoUnlock` blob and serialize.\n  const bodyJsonStr = normalizedAutoUnlock === null\n    ? filtered\n    : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock))\n  // Snapshot the source vault's cover into the header when one is\n  // persisted. `Vault.getCover` tolerates a missing document and\n  // returns undefined, which we propagate as \"no cover in the\n  // header.\" Vaults without a `_meta/public-envelope` document\n  // (the frozen wire name) produce minimum-disclosure headers\n  // exactly like before, preserving back-compat.\n  const cover = await vault.getCover()\n\n  return assembleBundleContainer({\n    handle,\n    bodyJsonStr,\n    compression: opts.compression,\n    headerExtras: {\n      // `publicEnvelope` is the frozen wire key for the cover (#799).\n      ...(cover !== undefined ? { publicEnvelope: cover } : {}),\n      ...(autoUnlockMode !== null ? { autoUnlock: autoUnlockMode } : {}),\n    },\n  })\n}\n\n/** @deprecated Use `writePod`. */\nexport const writeNoydbBundle = writePod\n\n/**\n * Internal helper shared by both readers — parses just the prefix\n * + header region of a bundle without touching the body. Returns\n * the parsed header plus the offset where the body starts and the\n * compression algorithm needed to decompress it.\n *\n * Throws on any format violation: missing/invalid magic, truncated\n * prefix, header length larger than the file, or unknown\n * compression algorithm.\n */\nfunction parsePrefixAndHeader(bytes: Uint8Array): {\n  header: NoydbPodHeader\n  bodyOffset: number\n  algo: CompressionAlgo\n  flags: number\n} {\n  if (!hasNoydbBundleMagic(bytes)) {\n    throw new Error(\n      `Not a .noydb bundle: missing 'NDB1' magic prefix. The first 4 bytes ` +\n        `are ${[...bytes.slice(0, 4)].map((b) => b.toString(16).padStart(2, '0')).join(' ')}.`,\n    )\n  }\n  if (bytes.length < NOYDB_BUNDLE_PREFIX_BYTES) {\n    throw new Error(\n      `Truncated .noydb bundle: file is only ${bytes.length} bytes, ` +\n        `which is less than the ${NOYDB_BUNDLE_PREFIX_BYTES}-byte fixed prefix.`,\n    )\n  }\n  const flags = bytes[4]!\n  const algo = bytes[5]!\n  if (algo !== COMPRESSION_NONE && algo !== COMPRESSION_GZIP && algo !== COMPRESSION_BROTLI) {\n    throw new Error(\n      `.noydb bundle declares unknown compression algorithm ${algo}. ` +\n        `Known values: 0 (none), 1 (gzip), 2 (brotli).`,\n    )\n  }\n  const headerLength = readUint32BE(bytes, 6)\n  const bodyOffset = NOYDB_BUNDLE_PREFIX_BYTES + headerLength\n  if (bodyOffset > bytes.length) {\n    throw new Error(\n      `Truncated .noydb bundle: declared header length ${headerLength} ` +\n        `would extend past end of file (${bytes.length} bytes).`,\n    )\n  }\n  const headerBytes = bytes.slice(NOYDB_BUNDLE_PREFIX_BYTES, bodyOffset)\n  const header = decodeBundleHeader(headerBytes)\n  return { header, bodyOffset, algo: algo as CompressionAlgo, flags }\n}\n\n/**\n * Read just the bundle header — no body decompression, no\n * integrity verification. Intended for cloud-listing UIs that want\n * to show the handle and size before downloading the full body.\n *\n * Returns the same `NoydbPodHeader` shape as the writer, with\n * minimum-disclosure validation already applied.\n *\n * **Cost** — O(prefix + header bytes). The header is normally well\n * under 1 KB, but may grow to roughly 256 KB when a `publicEnvelope`\n * with an inline icon is present. Cloud-listing UIs that previously\n * assumed sub-KB header reads should account for this when sizing\n * range requests against bundles that may carry icons.\n */\nexport function readPodHeader(bytes: Uint8Array): NoydbPodHeader {\n  return parsePrefixAndHeader(bytes).header\n}\n\n/** @deprecated Use `readPodHeader`. */\nexport const readNoydbBundleHeader = readPodHeader\n\n/**\n * Read just the bundle's cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`)\n * — without verifying the body or even parsing the dump JSON. Pass\n * the raw bundle bytes; receive the owner-curated metadata or\n * `undefined` if the bundle was written without one.\n *\n * Locale-resolves any `name` / `description` map fields when `locale`\n * is supplied. Omitting `locale` returns the raw cover.\n *\n * Same security caveat as the on-vault read path — the cover is an\n * **untrusted hint** in v1; the encrypted body remains\n * the source of truth for vault contents.\n */\nexport function readPodCover(\n  bytes: Uint8Array,\n  opts: { readonly locale?: string } = {},\n): Cover | undefined {\n  const header = parsePrefixAndHeader(bytes).header\n  const env = header.publicEnvelope\n  if (!env) return undefined\n  if (opts.locale === undefined) return env\n  return {\n    ...env,\n    ...(env.name !== undefined ? { name: pickLocale(env.name, opts.locale, env.defaultLocale) } : {}),\n    ...(env.description !== undefined ? { description: pickLocale(env.description, opts.locale, env.defaultLocale) } : {}),\n  }\n}\n\n/** @deprecated Use `readPodCover` (#799 rename). */\nexport const readNoydbBundlePublicEnvelope = readPodCover\n\n/**\n * Read a full `.noydb` bundle: validate magic + header, verify\n * integrity hash over the body bytes, decompress, and return the\n * original `vault.dump()` JSON string ready to pass to\n * `vault.load()`.\n *\n * Throws `BundleIntegrityError` if the body's actual SHA-256 does\n * not match the value declared in the header. Distinct from a\n * format error so consumers can pattern-match in catch blocks\n * (corrupted-in-transit vs malformed-by-producer).\n *\n * Note: this function does NOT take a passphrase. The dump JSON\n * inside the body still contains encrypted records — restoring\n * the vault requires `vault.load(dumpJson, passphrase)`\n * after this call. Splitting the layers keeps the bundle module\n * free of crypto concerns and lets the same code feed format\n * inspectors that never decrypt anything.\n */\nexport async function readPod(\n  bytes: Uint8Array,\n  opts: ReadNoydbBundleOptions = {},\n): Promise<NoydbBundleReadResult> {\n  const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes)\n  const body = bytes.slice(bodyOffset)\n\n  // Length check before hash check — a length mismatch is the\n  // cheapest tamper signal and produces a more actionable error.\n  if (body.length !== header.bodyBytes) {\n    throw new BundleIntegrityError(\n      `body length ${body.length} does not match header.bodyBytes ` +\n        `${header.bodyBytes}. The bundle was truncated or padded ` +\n        `between write and read.`,\n    )\n  }\n\n  const actualSha = await sha256Hex(body)\n  if (actualSha !== header.bodySha256) {\n    throw new BundleIntegrityError(\n      `body sha256 ${actualSha} does not match header.bodySha256 ` +\n        `${header.bodySha256}. The bundle bytes were modified between ` +\n        `write and read — refuse to decompress.`,\n    )\n  }\n\n  let dumpBytes: Uint8Array\n  if (algo === COMPRESSION_NONE) {\n    dumpBytes = body\n  } else {\n    const streamFormat: CompressionFormat =\n      algo === COMPRESSION_BROTLI ? ('br' as CompressionFormat) : 'gzip'\n    try {\n      dumpBytes = await pumpThroughStream(body, new DecompressionStream(streamFormat))\n    } catch (err) {\n      throw new BundleIntegrityError(\n        `decompression failed: ${(err as Error).message}. The bundle ` +\n          `passed the integrity hash but the body is not valid ` +\n          `${streamFormat} data — likely a producer bug.`,\n      )\n    }\n  }\n\n  const bodyString = new TextDecoder('utf-8', { fatal: true }).decode(dumpBytes)\n\n  // When the header signals auto-unlock, the body is a\n  // JSON wrapper carrying the dump string + the auto-unlock blob.\n  // When absent, the body IS the raw dump JSON.\n  if (header.autoUnlock === undefined) {\n    return { header, dumpJson: bodyString }\n  }\n  const { dump, blob } = parseAutoUnlockBody(bodyString)\n  const autoUnlock = await resolveAutoUnlock(blob, opts)\n  return { header, dumpJson: dump, autoUnlock }\n}\n\n/** @deprecated Use `readPod`. */\nexport const readNoydbBundle = readPod\n"],"mappings":";;;;;;;;;;;;;AAmDO,IAAM,qBAAqB,IAAI,WAAW,CAAC,IAAM,IAAM,IAAM,EAAI,CAAC;AAGlE,IAAM,4BAA4B;AAGlC,IAAM,8BAA8B;AASpC,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAchC,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AA+FlC,IAAM,sBAA2C,oBAAI,IAAI;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAiBM,SAAS,qBACd,QACkC;AAClC,MAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,UAAM,IAAI;AAAA,MACR,mDAAmD,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,IAC7F;AAAA,EACF;AAIA,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,oBAAoB,IAAI,GAAG,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,gDAAgD,GAAG,kDAE9C,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,eAAe,MAAM,YAAY,EAAE,eAAe,MAAM,6BAA6B;AAChG,UAAM,IAAI;AAAA,MACR,8CAA8C,2BAA2B,SAChE,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,IAErC;AAAA,EACF;AACA,MAAI,OAAO,EAAE,QAAQ,MAAM,YAAY,CAAC,2BAA2B,KAAK,EAAE,QAAQ,CAAC,GAAG;AACpF,UAAM,IAAI;AAAA,MACR,iFACS,OAAO,EAAE,QAAQ,MAAM,WAAW,IAAI,EAAE,QAAQ,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI,OAAO,EAAE,WAAW,MAAM,YAAY,CAAC,OAAO,UAAU,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,IAAI,GAAG;AACjG,UAAM,IAAI;AAAA,MACR,sEACS,OAAO,EAAE,WAAW,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,MAAI,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,iBAAiB,KAAK,EAAE,YAAY,CAAC,GAAG;AAClF,UAAM,IAAI;AAAA,MACR,oFACS,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY,CAAC,CAAC;AAAA,IACjG;AAAA,EACF;AACA,MAAI,EAAE,gBAAgB,MAAM,QAAW;AACrC,UAAM,MAAM,EAAE,gBAAgB;AAC9B,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI;AAAA,QACR,+EAA+E,OAAO,GAAG;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,IAAI;AACV,QAAI,EAAE,eAAe,MAAM,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,oEAAoE,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,OAAO,EAAE,SAAS,MAAM,YAAY,CAAC,OAAO,UAAU,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG;AAC3F,YAAM,IAAI;AAAA,QACR,+EAA+E,OAAO,EAAE,SAAS,CAAC,CAAC;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,YAAY,MAAM,QAAW;AACjC,QAAI,EAAE,YAAY,MAAM,cAAc,EAAE,YAAY,MAAM,UAAU;AAClE,YAAM,MAAM,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY;AAChG,YAAM,IAAI;AAAA,QACR,oFAAoF,GAAG;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,YAAY,MAAM,QAAW;AACjC,QAAI,EAAE,YAAY,MAAM,cAAc,EAAE,YAAY,MAAM,uBAAuB;AAC/E,YAAM,MAAM,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY;AAChG,YAAM,IAAI;AAAA,QACR,iGAAiG,GAAG;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,cAAc,MAAM,QAAW;AACnC,UAAM,KAAK,EAAE,cAAc;AAC3B,QAAI,OAAO,QAAQ,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,GAAG;AAC9D,YAAM,IAAI,MAAM,6EAA6E,OAAO,EAAE,GAAG;AAAA,IAC3G;AACA,UAAM,IAAI;AACV,QAAI,EAAE,GAAG,MAAM,GAAG;AAChB,YAAM,IAAI,MAAM,sDAAsD,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG;AAAA,IACzF;AACA,QAAI,EAAE,KAAK,MAAM,0BAA0B;AACzC,YAAM,IAAI,MAAM,+EAA+E,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG;AAAA,IACpH;AACA,QAAI,OAAO,EAAE,QAAQ,MAAM,YAAY,EAAE,QAAQ,EAAE,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,4EAA4E,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG;AAAA,IACpH;AAAA,EACF;AAIA,QAAM,cAAc,EAAE,YAAY,MAAM;AACxC,QAAM,UAAU,EAAE,cAAc,MAAM;AACtC,MAAI,WAAW,CAAC,aAAa;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,CAAC,SAAS;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,eAAe,EAAE,YAAY,MAAM,QAAW;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,QAAoC;AACrE,uBAAqB,MAAM;AAK3B,QAAM,OAAO,KAAK,UAAU;AAAA,IAC1B,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,YAAY,OAAO;AAAA,IACnB,GAAI,OAAO,mBAAmB,SAAY,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,OAAO,eAAe,SAAY,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,IAC3E,GAAI,OAAO,eAAe,SAAY,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,IAC3E,GAAI,OAAO,iBAAiB,SAAY,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,EACnF,CAAC;AACD,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AACtC;AAMO,SAAS,mBAAmB,OAAmC;AACpE,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AACnE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,2CAA4C,IAAc,OAAO;AAAA,IACnE;AAAA,EACF;AACA,uBAAqB,MAAM;AAC3B,SAAO;AACT;AAQO,SAAS,aAAa,OAAmB,QAAwB;AACtE,UACG,MAAM,MAAM,KAAM,OAAO,MACzB,MAAM,SAAS,CAAC,KAAM,OACtB,MAAM,SAAS,CAAC,KAAM,KACvB,MAAM,SAAS,CAAC;AAEpB;AAMO,SAAS,cAAc,OAAmB,QAAgB,OAAqB;AACpF,QAAM,MAAM,IAAK,UAAU,KAAM;AACjC,QAAM,SAAS,CAAC,IAAK,UAAU,KAAM;AACrC,QAAM,SAAS,CAAC,IAAK,UAAU,IAAK;AACpC,QAAM,SAAS,CAAC,IAAI,QAAQ;AAC9B;AAOO,SAAS,oBAAoB,OAA4B;AAC9D,MAAI,MAAM,SAAS,mBAAmB,OAAQ,QAAO;AACrD,WAAS,IAAI,GAAG,IAAI,mBAAmB,QAAQ,KAAK;AAClD,QAAI,MAAM,CAAC,MAAM,mBAAmB,CAAC,EAAG,QAAO;AAAA,EACjD;AACA,SAAO;AACT;;;ACvBA,SAAS,kBAAkB,GAA2D;AACpF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,cAAuB,MAAM,CAAC,CAAC;AAAA,EACnF;AACF;AAYA,SAAS,oBAAoB,MAAoD;AAC/E,QAAM,MAAM;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP,EAAE,OAAO,OAAK,MAAM,MAAS,EAAE;AAC/B,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,MAAM,GAAG;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,MAAI,KAAK,oBAAoB,QAAW;AACtC,WAAO,EAAE,MAAM,YAAY,SAAS,KAAK,gBAAgB,QAAQ;AAAA,EACnE;AACA,MAAI,KAAK,oBAAoB,QAAW;AACtC,WAAO,EAAE,MAAM,YAAY,SAAS,kBAAkB,KAAK,gBAAgB,OAAO,EAAE;AAAA,EACtF;AACA,MAAI,KAAK,sBAAsB,QAAW;AACxC,QAAI,KAAK,kBAAkB,SAAS,oBAAoB;AACtD,YAAM,UAA0C,CAAC;AACjD,YAAM,QAAuC,CAAC;AAC9C,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,kBAAkB,OAAO,GAAG;AAC5E,gBAAQ,MAAM,IAAI,MAAM;AACxB,cAAM,MAAM,IAAI,MAAM;AAAA,MACxB;AACA,aAAO,EAAE,MAAM,oBAAoB,UAAU,KAAK,kBAAkB,UAAU,SAAS,MAAM;AAAA,IAC/F;AACA,WAAO,EAAE,MAAM,eAAe,UAAU,KAAK,kBAAkB,UAAU,SAAS,KAAK,kBAAkB,QAAQ;AAAA,EACnH;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,KAAK,kBAAmB;AAAA,IAClC,SAAS,kBAAkB,KAAK,kBAAmB,OAAO;AAAA,EAC5D;AACF;AAoBA,SAAS,0BACP,MACA,YAC8B;AAC9B,MAAI,eAAe,KAAM,QAAO;AAEhC,QAAM,cAAmC,oBAAI,IAAI,CAAC,cAAc,YAAY,KAAK,CAAC;AAGlF,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,QAAI,CAAC,YAAY,IAAI,KAAK,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR,kCAAkC,MAAM,2BAA2B,KAAK,IAAI;AAAA,MAG9E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,YAAY;AAElC,UAAM,SAAS,KAAK,iBAAiB,UAAU,KAAK,iBAAiB;AACrE,QAAI,WAAW,oBAAoB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MAKF;AAAA,IACF;AACA,UAAMA,aAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,QAAIA,eAAc,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,SAAS,oBAAoB;AAC1C,UAAM,WAAW,WAAW;AAC5B,QAAI,aAAa,UAAa,OAAQ,SAA6B,yBAAyB,cACrF,OAAQ,SAA6B,qBAAqB,YAAY;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,MAAM,uEAAkE;AAAA,IACpF;AACA,eAAW,UAAU,OAAO,KAAK,WAAW,OAAO,GAAG;AACpD,YAAM,OAAO,MAAM,MAAM;AACzB,UAAI,SAAS,QAAW;AACtB,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM;AAAA,QAClD;AAAA,MACF;AACA,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM,8BAA8B,OAAO,KAAK,CAAC,CAAC;AAAA,QAC9F;AAAA,MACF;AACA,UAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,WAAW,GAAG;AACzD,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM;AAAA,QAClD;AAAA,MACF;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM,4DAA4D,OAAO,KAAK,GAAG,CAAC;AAAA,QAC9H;AAAA,MACF;AAAA,IAIF;AACA,UAAMA,aAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,QAAIA,eAAc,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,QAAM,iBAAiB,KAAK,mBAAmB,QAAQ,KAAK,mBAAmB;AAC/E,MAAI,mBAAmB,eAAe;AACpC,UAAM,IAAI;AAAA,MACR,0HAC+C,OAAO,cAAc,CAAC;AAAA,IACvE;AAAA,EACF;AACA,MAAI,WAAW,aAAa,QAAW;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,YAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,MAAI,cAAc,GAAG;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAOA,eAAe,uBACb,UACA,YACyB;AACzB,MAAI,WAAW,SAAS,YAAY;AAClC,WAAO;AAAA,MACL,oBAAoB;AAAA,MACpB,MAAM;AAAA,MACN,aAAa;AAAA,QACX,MAAM;AAAA,QACN,SAAS,EAAE,GAAG,WAAW,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,WAAW;AAC5B,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI,MAAM,uDAAkD;AAAA,EACpE;AACA,QAAM,gBAAuD,CAAC;AAC9D,QAAM,UAAU,IAAI,YAAY;AAEhC,MAAI,WAAW,SAAS,oBAAoB;AAC1C,UAAM,kBAAkB;AACxB,UAAM,QAAQ,WAAW;AACzB,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,MAAM,uEAAkE;AAAA,IACpF;AACA,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,SAAS,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO,KAAK,KAAK,GAAG,IAAI;AACtF,oBAAc,MAAM,IAAI;AAAA,QACtB,KAAK,KAAK;AAAA;AAAA,QACV,QAAQ,cAAc,MAAM;AAAA,QAC5B,KAAK;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AAEL,UAAM,aAAa;AACnB,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,YAAM,SAAS,MAAM,WAAW,KAAK,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/D,oBAAc,MAAM,IAAI;AAAA,QACtB,KAAK,WAAW;AAAA,QAChB,QAAQ,cAAc,MAAM;AAAA,QAC5B,KAAK;AAAA,QACL,MAAM,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,oBAAoB;AAAA,IACpB,MAAM;AAAA,IACN,aAAa,EAAE,MAAM,UAAU,SAAS,cAAc;AAAA,EACxD;AACF;AAOA,SAAS,oBAAoB,YAA2E;AACtG,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,+EACG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE;AACA,QAAM,MAAM;AACZ,MAAI,IAAI,oBAAoB,MAAM,GAAG;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,IAAI,MAAM,MAAM,UAAU;AACnC,UAAM,IAAI,qBAAqB,kDAAkD;AAAA,EACnF;AACA,QAAM,OAAO,IAAI,aAAa;AAC9B,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,IAAI,qBAAqB,4CAA4C;AAAA,EAC7E;AACA,QAAM,UAAU;AAChB,QAAM,OAAO,QAAQ,MAAM;AAC3B,MAAI,SAAS,cAAc,SAAS,UAAU;AAC5C,UAAM,IAAI;AAAA,MACR,oCAAoC,OAAO,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,IAAI,MAAM;AAAA,IAChB;AAAA,EACF;AACF;AA4BO,SAAS,+BACd,UACA,MACwB;AACxB,SAAO,EAAE,oBAAoB,GAAG,MAAM,UAAU,eAAe,KAAK;AACtE;AAEO,SAAS,4BACd,YAC6C;AAC7C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,wFACG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,IAAI,qBAAqB,+CAA+C;AAAA,EAChF;AACA,QAAM,MAAM;AACZ,MAAI,IAAI,oBAAoB,MAAM,GAAG;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,IAAI,MAAM,MAAM,UAAU;AACnC,UAAM,IAAI,qBAAqB,2DAA2D;AAAA,EAC5F;AACA,QAAM,OAAO,IAAI,eAAe;AAChC,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,IAAI,qBAAqB,uDAAuD;AAAA,EACxF;AACA,QAAM,IAAI;AACV,MAAI,EAAE,GAAG,MAAM,KAAK,EAAE,KAAK,MAAM,4BAC1B,OAAO,EAAE,QAAQ,MAAM,YAAY,OAAO,EAAE,SAAS,MAAM,UAAU;AAC1E,UAAM,IAAI,qBAAqB,uDAAuD;AAAA,EACxF;AACA,SAAO,EAAE,MAAM,IAAI,MAAM,GAAG,KAAkC;AAChE;AAMA,SAAS,eAAe,OAAgD;AACtE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,MAAM,cAAc,OAAO,MAAM;AACzE,SAAO;AACT;AAwBA,eAAe,kBACb,MACA,MACmF;AACnF,MAAI,KAAK,SAAS,YAAY;AAC5B,UAAM,WAA2C,CAAC;AAClD,eAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,eAAS,MAAM,IAAI,eAAe,KAAK;AAAA,IACzC;AACA,WAAO,EAAE,MAAM,YAAY,SAAS,SAAS;AAAA,EAC/C;AAEA,MAAI,KAAK,qBAAqB,UAAa,KAAK,iBAAiB,WAAW,GAAG;AAI7E,UAAM,cAA8C,CAAC;AACrD,eAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,kBAAY,MAAM,IAAI,EAAE,MAAM,MAAM,QAAQ,cAAc,OAAO,MAAM,OAAO;AAAA,IAChF;AACA,WAAO,EAAE,MAAM,UAAU,SAAS,YAAY;AAAA,EAChD;AACA,QAAM,iBAAiB,oBAAI,IAAgC;AAC3D,aAAW,KAAK,KAAK,iBAAkB,gBAAe,IAAI,EAAE,IAAI,CAAC;AAEjE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,cAA8C,CAAC;AAErD,aAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,UAAM,WAA+B,MAAM,QAAQ;AACnD,UAAM,WAAW,eAAe,IAAI,MAAM,GAAG;AAC7C,QAAI,aAAa,QAAW;AAC1B,UAAI,KAAK,iCAAiC,MAAM;AAE9C,YAAI,SAAwB;AAC5B,mBAAW,aAAa,KAAK,kBAAkB;AAC7C,cAAI;AACF,kBAAMC,kBAAiB,MAAM,UAAU,OAAO,cAAc,MAAM,MAAM,CAAC;AACzE,qBAAS,QAAQ,OAAOA,eAAc;AACtC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AACA,YAAI,WAAW,MAAM;AACnB,cAAI,MAAM,SAAS,QAAW;AAG5B,wBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,MAAM,OAAO;AAC5D;AAAA,UACF;AACA,gBAAM,IAAI,wBAAwB,QAAQ,MAAM,GAAG;AAAA,QACrD;AACA,oBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,OAAO;AACtD;AAAA,MACF;AACA,UAAI,MAAM,SAAS,QAAW;AAI5B,oBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,MAAM,OAAO;AAC5D;AAAA,MACF;AACA,YAAM,IAAI,wBAAwB,QAAQ,MAAM,GAAG;AAAA,IACrD;AACA,UAAM,iBAAiB,MAAM,SAAS,OAAO,cAAc,MAAM,MAAM,CAAC;AACxE,gBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,QAAQ,OAAO,cAAc,EAAE;AAAA,EAChF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,YAAY;AAChD;AAEA,SAAS,cAAc,OAA2B;AAChD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAWA,IAAI,sBAAsC;AAC1C,SAAS,4BAAqC;AAC5C,MAAI,wBAAwB,KAAM,QAAO;AACzC,MAAI;AACF,QAAI,kBAAkB,IAAyB;AAC/C,0BAAsB;AAAA,EACxB,QAAQ;AACN,0BAAsB;AAAA,EACxB;AACA,SAAO;AACT;AAGO,SAAS,0BAAgC;AAC9C,wBAAsB;AACxB;AASA,SAAS,kBAAkB,QAGzB;AACA,QAAM,SAAS,UAAU;AACzB,MAAI,WAAW,OAAQ,QAAO,EAAE,QAAQ,kBAAkB,cAAc,KAAK;AAC7E,MAAI,WAAW,OAAQ,QAAO,EAAE,QAAQ,kBAAkB,cAAc,OAAO;AAC/E,MAAI,WAAW,UAAU;AACvB,QAAI,CAAC,0BAA0B,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,oBAAoB,cAAc,KAA0B;AAAA,EAC/E;AAEA,MAAI,0BAA0B,GAAG;AAC/B,WAAO,EAAE,QAAQ,oBAAoB,cAAc,KAA0B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,kBAAkB,cAAc,OAAO;AAC1D;AAcA,eAAe,kBACb,OACA,QACqB;AACrB,QAAM,WAAW,IAAI,KAAK,CAAC,KAAiB,CAAC,EAAE,OAAO,EAAE,YAAY,MAAM;AAC1E,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,OAAO;AACT,aAAO,KAAK,KAAmB;AAC/B,eAAS,MAAM;AAAA,IACjB;AAAA,EACF;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,QAAI,IAAI,OAAO,MAAM;AACrB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAWA,eAAeC,WAAU,OAAoC;AAS3D,QAAM,OAAO,IAAI,WAAW,MAAM,MAAM;AACxC,OAAK,IAAI,KAAK;AACd,SAAO,UAAe,IAAI;AAC5B;AAOA,SAAS,YAAY,OAA0C;AAC7D,MAAI,QAAQ;AACZ,aAAW,KAAK,MAAO,UAAS,EAAE;AAClC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAeA,eAAe,qBACb,OACA,UACA,MACiB;AACjB,MAAI,KAAK,qBAAqB,UAAa,KAAK,eAAe,QAAW;AACxE,WAAO;AAAA,EACT;AAEA,QAAM,aACJ,KAAK,cAAc;AAAA,IACjB;AAAA,MACE,IAAI,MAAM;AAAA,MACV,YAAY,KAAK;AAAA,MACjB,MAAM,MAAM;AAAA,IACd;AAAA,EACF;AAEF,QAAM,oBAAoB,MAAM,MAAM,6BAA6B,UAAU;AAE7E,QAAM,SAAS,KAAK,MAAM,QAAQ;AAClC,SAAO,WAAW;AAClB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAiBA,SAAS,kBACP,UACA,MACQ;AACR,QAAM,oBAAoB,KAAK,cAC3B,IAAI,IAAI,KAAK,WAAW,IACxB;AACJ,QAAM,UACJ,KAAK,UAAU,SAAY,IAAI,KAAK,KAAK,KAAK,EAAE,QAAQ,IAAI;AAC9D,MAAI,sBAAsB,QAAQ,YAAY,KAAM,QAAO;AAO3D,QAAM,SAAS,KAAK,MAAM,QAAQ;AAKlC,MAAI,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AAChE,UAAM,OAAgD,CAAC;AACvD,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AAChE,UAAI,qBAAqB,CAAC,kBAAkB,IAAI,IAAI,EAAG;AACvD,UAAI,YAAY,MAAM;AACpB,aAAK,IAAI,IAAI;AACb;AAAA,MACF;AACA,YAAM,OAAgC,CAAC;AACvC,iBAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,cAAM,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,IAAI;AACtD,YAAI,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS;AAC9C,eAAK,EAAE,IAAI;AAAA,QACb;AAAA,MACF;AACA,WAAK,IAAI,IAAI;AAAA,IACf;AACA,WAAO,cAAc;AAAA,EACvB;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AA4BA,eAAe,6BACb,OACA,UACiB;AACjB,QAAM,SAAS,KAAK,MAAM,QAAQ;AAIlC,MAAI,CAAC,OAAO,eAAe,OAAO,OAAO,gBAAgB,SAAU,QAAO;AAC1E,MAAI,OAAO,MAAM,qBAAqB,WAAY,QAAO;AAEzD,QAAM,EAAE,SAAS,MAAM,OAAO,IAAI,MAAM,iBAAiB;AACzD,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,2BAAyC;AAC1F,QAAM,UAAU,MAAM,wBAAwB,SAAS,MAAM,OAAO,KAAK,OAAO,WAAW,GAAG,MAAM;AACpG,MAAI,QAAQ,SAAS,EAAG,QAAO;AAE/B,QAAM,OAAgD,CAAC;AACvD,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACpE,UAAM,OAAO,QAAQ,IAAI,QAAQ;AACjC,QAAI,CAAC,MAAM;AAAE,WAAK,QAAQ,IAAI;AAAS;AAAA,IAAS;AAChD,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,UAAI,KAAK,IAAI,EAAE,EAAG,MAAK,EAAE,IAAI;AAAA,IAC/B;AACA,SAAK,QAAQ,IAAI;AAAA,EACnB;AACA,SAAO,cAAc;AACrB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAcA,eAAe,sBACb,OACA,UACA,MACiB;AACjB,MAAI,KAAK,UAAU,UAAa,KAAK,eAAe,QAAW;AAC7D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,KAAK,MAAM,QAAQ;AAIlC,MAAI,CAAC,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,QAAQ,KAAK;AAEnB,QAAM,OAA4C,CAAC;AACnD,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACpE,UAAM,OAA4B,CAAC;AACnC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAI/C,UAAI,gBAAgB,QAAW;AAC7B,cAAM,OAAO,IAAI,SAAS;AAC1B,YAAI,OAAO,YAAa;AAAA,MAC1B;AAIA,UAAI,UAAU,QAAW;AACvB,cAAM,SAAS,MAAM,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,QACF;AACA,cAAM,KAAK,MAAM,MAAM,QAAQ,EAAE,YAAY,UAAU,GAAG,CAAC;AAC3D,YAAI,CAAC,GAAI;AAAA,MACX;AACA,WAAK,EAAE,IAAI;AAAA,IACb;AACA,SAAK,QAAQ,IAAI;AAAA,EACnB;AACA,SAAO,cAAc;AACrB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAgCA,eAAsB,wBAAwB,MAMtB;AACtB,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAC3D,QAAM,EAAE,QAAQ,aAAa,IAAI,kBAAkB,KAAK,WAAW;AACnE,QAAM,OAAO,iBAAiB,OAC1B,YACA,MAAM,kBAAkB,WAAW,IAAI,kBAAkB,YAAY,CAAC;AAC1E,QAAM,aAAa,MAAMA,WAAU,IAAI;AAEvC,QAAM,SAAyB;AAAA,IAC7B,eAAe;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK;AAAA,IAChB;AAAA,IACA,GAAI,KAAK,cAAc,mBAAmB,SAAY,EAAE,gBAAgB,KAAK,aAAa,eAAe,IAAI,CAAC;AAAA,IAC9G,GAAI,KAAK,cAAc,eAAe,SAAY,EAAE,YAAY,KAAK,aAAa,WAAW,IAAI,CAAC;AAAA,IAClG,GAAI,KAAK,cAAc,eAAe,SAAY,EAAE,YAAY,KAAK,aAAa,WAAW,IAAI,CAAC;AAAA,IAClG,GAAI,KAAK,cAAc,iBAAiB,SAAY,EAAE,cAAc,KAAK,aAAa,aAAa,IAAI,CAAC;AAAA,EAC1G;AACA,QAAM,cAAc,mBAAmB,MAAM;AAE7C,QAAM,SAAS,IAAI,WAAW,yBAAyB;AACvD,SAAO,IAAI,oBAAoB,CAAC;AAChC,SAAO,CAAC,KAAK,iBAAiB,OAAO,IAAI,mBAAmB;AAC5D,SAAO,CAAC,IAAI;AACZ,gBAAc,QAAQ,GAAG,YAAY,MAAM;AAE3C,SAAO,YAAY,CAAC,QAAQ,aAAa,IAAI,CAAC;AAChD;AAEA,eAAsB,SACpB,OACA,OAAwB,CAAC,GACJ;AACrB,MAAI,KAAK,qBAAqB,UAAa,KAAK,eAAe,QAAW;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,uBAAuB,oBAAoB,IAAI;AACrD,QAAM,iBAAiB,0BAA0B,MAAM,oBAAoB;AAE3E,QAAM,SAAS,MAAM,MAAM,gBAAgB;AAC3C,QAAM,WAAW,MAAM,MAAM,KAAK;AAKlC,QAAM,oBAAoB,MAAM,6BAA6B,OAAO,QAAQ;AAK5E,QAAM,UAAU,MAAM,qBAAqB,OAAO,mBAAmB,IAAI;AAKzE,QAAM,gBAAgB,MAAM,sBAAsB,OAAO,SAAS,IAAI;AACtE,QAAM,WAAW,kBAAkB,eAAe,IAAI;AAKtD,QAAM,cAAc,yBAAyB,OACzC,WACA,KAAK,UAAU,MAAM,uBAAuB,UAAU,oBAAoB,CAAC;AAO/E,QAAM,QAAQ,MAAM,MAAM,SAAS;AAEnC,SAAO,wBAAwB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA;AAAA,MAEZ,GAAI,UAAU,SAAY,EAAE,gBAAgB,MAAM,IAAI,CAAC;AAAA,MACvD,GAAI,mBAAmB,OAAO,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA,IAClE;AAAA,EACF,CAAC;AACH;AAGO,IAAM,mBAAmB;AAYhC,SAAS,qBAAqB,OAK5B;AACA,MAAI,CAAC,oBAAoB,KAAK,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR,2EACS,CAAC,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,IACvF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,2BAA2B;AAC5C,UAAM,IAAI;AAAA,MACR,yCAAyC,MAAM,MAAM,kCACzB,yBAAyB;AAAA,IACvD;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,CAAC;AACrB,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,SAAS,oBAAoB,SAAS,oBAAoB,SAAS,oBAAoB;AACzF,UAAM,IAAI;AAAA,MACR,wDAAwD,IAAI;AAAA,IAE9D;AAAA,EACF;AACA,QAAM,eAAe,aAAa,OAAO,CAAC;AAC1C,QAAM,aAAa,4BAA4B;AAC/C,MAAI,aAAa,MAAM,QAAQ;AAC7B,UAAM,IAAI;AAAA,MACR,mDAAmD,YAAY,mCAC3B,MAAM,MAAM;AAAA,IAClD;AAAA,EACF;AACA,QAAM,cAAc,MAAM,MAAM,2BAA2B,UAAU;AACrE,QAAM,SAAS,mBAAmB,WAAW;AAC7C,SAAO,EAAE,QAAQ,YAAY,MAA+B,MAAM;AACpE;AAgBO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,KAAK,EAAE;AACrC;AAGO,IAAM,wBAAwB;AAe9B,SAAS,aACd,OACA,OAAqC,CAAC,GACnB;AACnB,QAAM,SAAS,qBAAqB,KAAK,EAAE;AAC3C,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,KAAK,WAAW,OAAW,QAAO;AACtC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,IAAI,SAAS,SAAY,EAAE,MAAM,WAAW,IAAI,MAAM,KAAK,QAAQ,IAAI,aAAa,EAAE,IAAI,CAAC;AAAA,IAC/F,GAAI,IAAI,gBAAgB,SAAY,EAAE,aAAa,WAAW,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,EAAE,IAAI,CAAC;AAAA,EACtH;AACF;AAGO,IAAM,gCAAgC;AAoB7C,eAAsB,QACpB,OACA,OAA+B,CAAC,GACA;AAChC,QAAM,EAAE,QAAQ,YAAY,KAAK,IAAI,qBAAqB,KAAK;AAC/D,QAAM,OAAO,MAAM,MAAM,UAAU;AAInC,MAAI,KAAK,WAAW,OAAO,WAAW;AACpC,UAAM,IAAI;AAAA,MACR,eAAe,KAAK,MAAM,oCACrB,OAAO,SAAS;AAAA,IAEvB;AAAA,EACF;AAEA,QAAM,YAAY,MAAMA,WAAU,IAAI;AACtC,MAAI,cAAc,OAAO,YAAY;AACnC,UAAM,IAAI;AAAA,MACR,eAAe,SAAS,qCACnB,OAAO,UAAU;AAAA,IAExB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,SAAS,kBAAkB;AAC7B,gBAAY;AAAA,EACd,OAAO;AACL,UAAM,eACJ,SAAS,qBAAsB,OAA6B;AAC9D,QAAI;AACF,kBAAY,MAAM,kBAAkB,MAAM,IAAI,oBAAoB,YAAY,CAAC;AAAA,IACjF,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,yBAA0B,IAAc,OAAO,oEAE1C,YAAY;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS;AAK7E,MAAI,OAAO,eAAe,QAAW;AACnC,WAAO,EAAE,QAAQ,UAAU,WAAW;AAAA,EACxC;AACA,QAAM,EAAE,MAAM,KAAK,IAAI,oBAAoB,UAAU;AACrD,QAAM,aAAa,MAAM,kBAAkB,MAAM,IAAI;AACrD,SAAO,EAAE,QAAQ,UAAU,MAAM,WAAW;AAC9C;AAGO,IAAM,kBAAkB;","names":["userCount","plaintextBytes","sha256Hex"]}