@noy-db/hub 0.6.0-pre.1 → 0.6.0-pre.11

package/dist/with-audit/periods/vault-facade.d.ts

@@ -3,7 +3,31 @@ import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
 import type { Collection } from '../../kernel/collection.js';
 import type { PeriodsStrategy } from './strategy.js';
-import { type PeriodRecord, type TargetPurgeCount, type ClosePeriodOptions, type OpenPeriodOptions } from './periods.js';
+import { type PeriodRecord, type TargetPurgeCount, type ClosePeriodOptions, type OpenPeriodOptions, type PeriodPartition, type PeriodReopenEvent } from './periods.js';
+/** Selects one period timeline. Omit — or pass an empty tuple — for the vault-wide one (#1005). */
+export interface PeriodScope {
+    readonly partition?: PeriodPartition;
+}
+/** A scoped operation that also records a free-text justification in the audit trail. */
+export interface PeriodScopeWithReason extends PeriodScope {
+    readonly reason?: string;
+}
+/** Options for `vault.reopenPeriod()` (#1022). */
+export interface ReopenPeriodOptions extends PeriodScopeWithReason {
+    /**
+     * ISO instant after which the period re-seals BY ITSELF, with nobody acting.
+     * Omit for a window that stays open until an explicit `reclosePeriod()`.
+     *
+     * Expiry is evaluated against the clock on every write check, so a lapsed
+     * window needs no sweep, no timer and no cache invalidation to take effect.
+     */
+    readonly until?: string;
+}
+/** The persisted side of a write, as the period write-guard sees it. */
+export interface PeriodGuardPrior {
+    readonly ts: string | null;
+    readonly record: Record<string, unknown> | null;
+}
 /** Everything the moving period methods touched on the vault's `this.*`. */
 export interface VaultPeriodsDeps {
     /** Resolved periods strategy (NO_PERIODS when not configured). */
@@ -56,7 +80,7 @@ export declare class VaultPeriods {
      * read only. Idempotent: a second call is a no-op that returns the
      * same merged record without re-purging or re-appending a ledger entry.
      */
-    freezePeriod(name: string): Promise<PeriodRecord>;
+    freezePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Archive a closed period (#613): physically relocates its in-window
      * records (those with `_ts < periodExclusiveUpperBound(endDate)`) from the
@@ -66,7 +90,7 @@ export declare class VaultPeriods {
      * through to cold) and idempotent: a second call is a no-op returning the
      * same merged record.
      */
-    archivePeriod(name: string): Promise<PeriodRecord>;
+    archivePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Target-purge a closed period (#615): sweeps delete markers off the vault's
      * PUSH-ONLY sync targets (`backup`/`archive`) via `purgeTargets`, recording a
@@ -76,22 +100,77 @@ export declare class VaultPeriods {
      * Idempotent once run; with no push-only targets it writes no companion and
      * is re-runnable.
      */
-    purgePeriodTargets(name: string): Promise<PeriodRecord>;
+    purgePeriodTargets(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /** Merge target-purge companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeTargetPurge;
     /** Merge archive companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeArchive;
     /** Merge freeze companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeFreeze;
-    /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
-    listPeriods(): Promise<readonly PeriodRecord[]>;
-    /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
-    getPeriod(name: string): Promise<PeriodRecord | null>;
-    /** Called by the gate bus before put/delete. */
+    /**
+     * Return every closed / opened period in `closedAt` order, merged with any
+     * freeze + archive companions.
+     *
+     * With no argument this spans EVERY timeline — the pre-#1005 behaviour, and
+     * the right default for an audit sweep. Pass `{ partition }` to scope to one
+     * timeline; `{ partition: [] }` (or omitting it) means the vault-wide one.
+     */
+    listPeriods(options?: PeriodScope): Promise<readonly PeriodRecord[]>;
+    /**
+     * Look up a single period by name within one timeline, merged with its
+     * freeze + archive + target-purge companions if any. Returns `null` if not
+     * found.
+     *
+     * Names are only unique per partition (#1005), so this resolves against the
+     * VAULT-WIDE timeline unless `{ partition }` says otherwise — matching how
+     * every pre-partition period is stored.
+     */
+    getPeriod(name: string, options?: PeriodScope): Promise<PeriodRecord | null>;
+    /**
+     * The full append-only reopen/reclose log for one period (#1022) — the record
+     * an audit actually asks for, in order. `[]` when never reopened.
+     */
+    listPeriodReopens(name: string, options?: PeriodScope): Promise<readonly PeriodReopenEvent[]>;
+    /**
+     * Return a closed period to a writable state (#1022).
+     *
+     * Close is a three-state lifecycle in practice — open / closed / reopened —
+     * because a month gets closed and then a missing invoice arrives, or a filing
+     * is rejected and must be amended. That is routine, and it is supposed to
+     * leave a trail.
+     *
+     * The `_periods/<key>` record is NOT touched: the reopen is appended to a
+     * companion log, so the inter-period hash chain that proves the close
+     * happened survives the reopen intact. The chain reads *closed at T1,
+     * reopened at T2 by U, reclosed at T3*.
+     *
+     * A reopen withdraws the PERIOD's veto and nothing else. Record-level rules —
+     * an `immutableGuard` on a sent receipt, a frozen field — are separate gate
+     * handlers registered ahead of the period gate, so a reopened month cannot
+     * resurrect a document that is independently locked. Period state can only
+     * ever widen what the record-level rule already permits.
+     *
+     * Reopening an already-open window is allowed and appends another event: that
+     * is how a window gets extended, and the log keeps both.
+     */
+    reopenPeriod(name: string, options?: ReopenPeriodOptions): Promise<PeriodRecord>;
+    /**
+     * Seal a reopened period again (#1022), ending the window explicitly rather
+     * than waiting for an `until` to lapse. Appends to the same log, so the
+     * close → reopen → reclose sequence is recoverable in order.
+     */
+    reclosePeriod(name: string, options?: PeriodScopeWithReason): Promise<PeriodRecord>;
+    /** Append one entry to a period's reopen log, ledger it, and invalidate the guard's view. */
+    private appendReopenEvent;
+    /** Merge each period's reopen log onto it. One adapter listing, not one per period. */
+    private mergeReopenState;
+    /** Resolve one period within the timeline named by `options` (vault-wide when absent). */
+    private findPeriod;
+    /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
     assertTsWritable(existing: {
         ts: string | null;
         record: Record<string, unknown> | null;
-    } | null, incoming: Record<string, unknown> | null): Promise<void>;
+    } | null, incoming: Record<string, unknown> | null, collection?: string): Promise<void>;
     private loadPeriodsCache;
     /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
     private writeReserved;

package/dist/with-audit/periods/window.d.ts

@@ -6,6 +6,16 @@ export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
 export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
 /** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
 export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+/**
+ * Sibling of {@link PERIODS_COLLECTION} holding reopen/reclose companions (#1022).
+ *
+ * Unlike the freeze / archive / target-purge companions — each a single,
+ * idempotent, once-only record — this one holds an APPEND-ONLY EVENT LIST,
+ * because reopening is a repeating cycle: a month can be closed, reopened,
+ * reclosed, and reopened again. The audit value is the sequence, not the
+ * latest state.
+ */
+export declare const PERIOD_REOPENS_COLLECTION = "_period_reopens";
 /**
  * Exclusive upper bound for a period's delete-marker purge window (#604).
  * Markers carry no business date (empty body), only write-time `_ts`, so freeze

package/dist/with-cargo/index.d.ts

@@ -8,7 +8,7 @@
  * distributed query, addressing, and change-observation. It consolidates the
  * runtime floor formerly published as `/kernel` plus the orchestration delta.
  *
- * See docs/superpowers/specs/2026-07-01-noydb-architecture-lexicon.md.
+ * See docs/foundations/architecture-lexicon.md.
  *
  * @packageDocumentation
  */
@@ -37,7 +37,7 @@ export type { ExtractPartitionResult } from './extract-partition.js';
 export { adoptPartition, unsealDeks, createOwnerOnAdoptedPartition } from './adopt-partition.js';
 export type { AdoptPartitionOptions, AdoptPartitionResult, CreateOwnerResult, CreateOwnerOptions, CreateOwnerStandardOptions, CreateOwnerManagedOptions, } from './adopt-partition.js';
 export { TransferSealError, AdoptionStateError, PartitionExtractionError } from '../kernel/errors.js';
-export type { WriteHook } from '../port/with/write-hooks.js';
+export type { WriteHook, WriteEvent } from '../port/with/write-hooks.js';
 export type { WriteQueue } from '../kernel/write-queue.js';
 export type { WriteConflict } from '../kernel/types.js';
 export type { AccessibleVault } from '../kernel/types.js';

package/dist/with-commit/history/ledger/entry.d.ts

@@ -128,7 +128,7 @@ export interface LedgerEntry {
      * the role of the actor, the (collection, id, vBefore, vAfter) tuple
      * for every record touched, and which guard invariants passed.
      *
-     * See docs/superpowers/specs/2026-05-18-guards-design.md.
+     * See design-history/2026-05-18-guards-design.md.
      */
     readonly amendment?: {
         readonly reason: string;

package/dist/with-commit/numbering/descriptor.d.ts

@@ -1,7 +1,7 @@
 /**
  * @category capability
  * Deferred-numbering config descriptor. See
- * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.
+ * design-history/2026-06-08-sealed-numbering-and-store-clock-design.md.
  */
 /** A registered deferred-numbering series. */
 export interface DeferredNumberingConfig {

package/dist/with-formula/derivations/with-derivation.d.ts

@@ -5,6 +5,6 @@ import type { DerivationSpec, DerivationStrategy } from './types.js';
  * plaintext after DEK unwrap. Outputs are encrypted with the same DEK
  * as the source and written via the standard `Collection.put` path.
  *
- * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
+ * See design-history/2026-05-01-dim14-derivation-v1-design.md.
  */
 export declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(spec: DerivationSpec<TSource, TOutputs>): DerivationStrategy;

package/dist/with-formula/materialized-views/types.d.ts

@@ -4,6 +4,7 @@ import type { ReduceSpec, Reduction } from '../../with-lookup/reduce/reduction.j
 import type { GroupedReduction } from '../../with-lookup/reduce/groupby.js';
 import type { JoinStrategy } from '../../kernel/query/join.js';
 import type { MoneyDescriptor } from '../../via/money/descriptor.js';
+import type { ExactMath } from '../../via/money/exact.js';
 import type { I18nTextDescriptor } from '../../via/i18n/core.js';
 /**
  * Minimal vault-shaped accessor passed to the MV `query()` callback.
@@ -269,6 +270,57 @@ export interface MaterializedViewSpec<TRow extends Record<string, unknown>> {
      * UNION-mode only. Ignored if {@link query} is set.
      */
     aggregate?: ReduceSpec;
+    /**
+     * Post-aggregate projection over ONE finished row (#1007).
+     *
+     * `aggregate` accepts reducers only, so a row can carry every input a
+     * derived value needs and still not express it — `max(0, netTotal - paid)`
+     * is not a reduction. `derive` closes that gap: it receives the row the
+     * grouping/aggregation pipeline just produced and returns a patch merged
+     * onto it, immediately before materialisation.
+     *
+     * ```ts
+     * aggregate: { paid: sum('paid'), netTotal: sum('netTotal') },
+     * derive: (row) => ({ toPay: Math.max(0, row.netTotal - row.paid) }),
+     * ```
+     *
+     * Deliberately narrow, and the narrowness is what keeps it safe under
+     * incremental recompute: **pure, single-row, no cross-row access, no second
+     * aggregation pass.** It only ever sees the row the reducer just produced,
+     * so a refresh triggered by one source write recomputes it correctly without
+     * the engine needing to know anything about the function.
+     *
+     * Returning `null` / `undefined` leaves the row unchanged. Returned keys
+     * that collide with a {@link groupBy} field throw
+     * `MaterializedViewConfigError` — a group key is the row's identity and
+     * feeds {@link rowKey}, so rewriting it would silently re-home the row.
+     *
+     * **Money:** money leaves a reducer as an exact decimal string, and
+     * `Number(a) - Number(b)` would put it straight back through binary floating
+     * point — `10.05 - 0.10` becomes `9.950000000000001`, which the money
+     * quantiser then refuses rather than storing drift. So `derive` receives
+     * {@link ExactMath} as its second argument; it works in scaled BigInt and
+     * cannot introduce a representation error:
+     *
+     * ```ts
+     * moneyFields: { netTotal: THB, paid: THB, toPay: THB },
+     * derive: (row, exact) => ({ toPay: exact.max(0, exact.sub(row.netTotal, row.paid)) }),
+     * ```
+     *
+     * Declare the derived field in {@link moneyFields} and the result is
+     * quantised through that descriptor before storage, exact at its scale.
+     *
+     * Note the one place `TRow` under-describes what arrives: a field declared
+     * in {@link moneyFields} reaches `derive` DECODED — the decimal string a
+     * reader would see, not the scaled integer the reducer left behind — even
+     * where `TRow` types it as `number` (which is what the arms' `map` emits).
+     * `ExactMath` accepts both, which is why its operations are the right tool
+     * here and why no cast is needed.
+     *
+     * Applies to every MV form (union, projection, and query), always as the
+     * last step before rows are materialised.
+     */
+    derive?: (row: TRow, exact: ExactMath) => Record<string, unknown> | null | undefined;
     /**
      * Money descriptors for the UNION-mode aggregate, keyed by the
      * OUTPUT/intermediate field name as it appears in the mapped row and

package/dist/with-formula/materialized-views/with-materialized-view.d.ts

@@ -21,8 +21,8 @@ import type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js'
  * The three modes are mutually exclusive — exactly one of `query` /
  * `unionSources` / `projection` must be set at registration time.
  *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2),
- * docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION),
- * and docs/superpowers/specs/2026-07-25-join-projection-mv-design.md (projection).
+ * See design-history/2026-05-20-dim14-mv-v2-design.md (single-source v2),
+ * design-history/2026-05-21-dim14-mv-multikey-and-union.md (UNION),
+ * and design-history/2026-07-25-join-projection-mv-design.md (projection).
  */
 export declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewSpec<TRow>): MaterializedViewStrategy;

package/dist/with-formula/overlay-views/with-overlayed-view.d.ts

@@ -4,6 +4,6 @@ import type { OverlayedViewSpec, OverlayedViewStrategy } from './types.js';
  * a user-writable overlay so consumers can express operator-editable
  * lifecycles as one declarative block.
  *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md.
+ * See design-history/2026-05-20-dim14-mv-v2-design.md.
  */
 export declare function withOverlayedView(spec: OverlayedViewSpec): OverlayedViewStrategy;

package/dist/with-party/custody/index.d.ts

@@ -20,7 +20,7 @@
  * vault instance (and thus no custody namespace) yet — it stays the exported
  * `team/deed.ts` function.
  *
- * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
+ * @see design-history/2026-06-17-fr6-deed-custodian-liberate-design.md
  * @module
  */
 import type { GrantOptions, RevokeOptions, FactorProofBundle } from '../../kernel/types.js';

package/dist/with-party/directory/user-envelope/index.d.ts

@@ -5,7 +5,7 @@
  * `UserEnvelopeOversizedError` live in the kernel spine
  * (`kernel/types.ts` / `kernel/constants.ts` / `kernel/errors.ts`).
  *
- * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ * @see design-history/2026-05-05-user-envelope-design.md
  *
  * @module
  */

package/dist/with-party/directory/user-envelope/storage.d.ts

@@ -12,7 +12,7 @@
  * (`vault.user.*`) sits on top of this; permission gates, own-only
  * write enforcement, and presence-channel propagation live there.
  *
- * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ * @see design-history/2026-05-05-user-envelope-design.md
  *
  * @module
  */

package/dist/with-party/team/echo-ceremony.d.ts

@@ -1,6 +1,6 @@
 /**
  * `beginEchoUnlock` — the interactive ceremony API (spec
- * docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940, Task 6).
+ * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).
  *
  * Split out of `echo-secret.ts` (which owns only the block builders +
  * verifiers) because this module orchestrates BOTH `echo-secret.ts`
@@ -33,7 +33,7 @@ export interface EchoCeremony {
      * TYPE it.
      *
      * Conforming-player contract (spec
-     * docs/superpowers/specs/2026-08-02-echo-secret-design.md, "Ceremony"):
+     * design-history/2026-08-02-echo-secret-design.md, "Ceremony"):
      * when the owner does NOT recognize the revealed echo, the player MUST show
      * a hard phishing warning — do not continue, open the official app, rotate
      * the secret immediately — MUST NOT offer any skip or
@@ -57,7 +57,7 @@ export interface EchoCeremony {
  * cannot be resolved — sealed reveal under a foreign device).
  *
  * Conforming-player contract (spec
- * docs/superpowers/specs/2026-08-02-echo-secret-design.md): an owner who does
+ * design-history/2026-08-02-echo-secret-design.md): an owner who does
  * not recognize `ceremony.reveal` is looking at a phish. The player MUST then
  * show a hard warning (stop, open the official app, rotate the secret now),
  * MUST NOT offer a skip / "verification unavailable" fallback or any

package/dist/with-party/team/echo-secret.d.ts

@@ -1,6 +1,6 @@
 /**
  * Echo-block builders + verifiers (spec
- * docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940).
+ * design-history/2026-08-02-echo-secret-design.md, #940).
  *
  * Builds and verifies the on-keyring {@link KeyringEchoBlock} declaration
  * for the 3-part echo ceremony (prompt → echo → key). This module owns:
@@ -24,7 +24,7 @@
  * offline brute-force oracles for anyone holding the keyring file (600K
  * PBKDF2 per guess), and the `sealed` reveal blob is unpadded so its length
  * discloses the echo's UTF-8 byte length — see the threat model in
- * `docs/superpowers/specs/2026-08-02-echo-secret-design.md`.
+ * `design-history/2026-08-02-echo-secret-design.md`.
  *
  * @module
  */

package/dist/with-party/team/keyring.d.ts

@@ -368,8 +368,17 @@ export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, v
     user: UserInfo;
     envelope: UserEnvelope<T> | null;
 }>>;
-/** Ensure a DEK exists for a collection. Generates one if new. */
 export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+/**
+ * The `Permissions` catch-all key (#1010). `Permissions` has always documented
+ * `'*'` as "the wildcard collection matching all collections in the vault", but
+ * nothing expanded it — a grantee handed the documented catch-all got no keys
+ * at all. It is honoured in three places, and they must agree: the DEK wrapping
+ * in `grant()`, and both permission checks below.
+ */
+export declare const PERMISSION_WILDCARD = "*";
+/** Does this permission map hand over the whole vault? */
+export declare function permissionsAreWildcard(permissions: Permissions | undefined): boolean;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */

package/dist/with-pod/bundle.d.ts

@@ -268,6 +268,21 @@ export interface WritePodOptions {
 }
 /** @deprecated Use `WritePodOptions`. */
 export type WriteNoydbBundleOptions = WritePodOptions;
+/**
+ * Every key `writePod` reads, in declaration order (#991).
+ *
+ * A pod is a wire artifact, so an option this list doesn't name is refused
+ * rather than ignored: a dropped write option produces a structurally valid
+ * bundle that is missing something, and the defect surfaces later — in
+ * whoever imports it — with nothing left to trace it back to.
+ *
+ * `bundle-option-keys.test.ts` parses `WritePodOptions` out of this file and
+ * fails if the two ever drift, so adding an option is enough; you do not have
+ * to remember to update this list, only to keep the interface shape parseable.
+ *
+ * @internal
+ */
+export declare const WRITE_POD_OPTION_KEYS: readonly ["compression", "collections", "since", "where", "tierAtMost", "exportSecret", "recipients", "autoCredentials", "sealedCredentials", "autoSecrets", "sealedSecrets", "sign", "engineRange", "unlockMethods", "hasApp", "species", "pointerMode", "redirect"];
 /**
  * Result returned by `readPod`. The caller is expected to
  * pass `dumpJson` into `vault.load(json, secret)` to

package/dist/with-shape/introspection/index.d.ts

@@ -3,7 +3,7 @@
  * {@link VaultSchemaSnapshot} describing the vault's shape and (optional)
  * stats. Consumed by `noydb describe` for human-readable audit output.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * @see design-history/2026-05-22-schema-dump-design.md
  *
  * @module
  */
@@ -14,6 +14,7 @@ export { jsonSchemaToFields } from './fields.js';
 export type { SchemaIntrospection } from './types.js';
 export type { FieldMeta, SemanticType } from './field-meta.js';
 export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
+export type { StandardSchemaV1Issue } from '../../kernel/schema.js';
 export { applyListProjection } from './projection.js';
 export type { ListProjectionOptions } from './projection.js';
 export type { BehaviorSummary, GuardBehaviorEntry, DerivationBehaviorEntry, DerivationOutputEntry, MaterializedViewBehaviorEntry, OverlayBehaviorEntry, SatelliteBehaviorEntry, } from './behaviors.js';

package/dist/with-shape/introspection/types.d.ts

@@ -3,7 +3,7 @@
  * by `vault.dumpSchema()`. Consumed by the upcoming `noydb describe`
  * CLI to emit human-readable YAML/JSON audit output.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * @see design-history/2026-05-22-schema-dump-design.md
  *
  * @module
  */

package/dist/with-shape/persisted-schemas/derive.d.ts

@@ -5,7 +5,7 @@
  * hub never statically imports zod. Other validator families write a stub
  * envelope flagging the kind.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * @see design-history/2026-05-22-schema-dump-design.md
  *
  * @module
  */

package/dist/with-shape/persisted-schemas/index.d.ts

@@ -10,7 +10,7 @@
  * Standard Schema validators (Valibot, ArkType, Effect Schema) write a
  * stub envelope flagging the kind without a JSON Schema body.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * @see design-history/2026-05-22-schema-dump-design.md
  *
  * @module
  */

package/dist/with-shape/persisted-schemas/types.d.ts

@@ -5,7 +5,7 @@
  * collection's records. Auditors who can unlock the collection's data can
  * also read its schema; nothing more.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * @see design-history/2026-05-22-schema-dump-design.md
  *
  * @module
  */

package/dist/{withdraw-accessible-JSDQHXHE.js → withdraw-accessible-7PG4DYQK.js}

@@ -4,18 +4,18 @@ import {
   freezeSnapshotOnly,
   randomId,
   withdrawAccessibleData
-} from "./chunk-JSRU5W2M.js";
-import "./chunk-4MQDV3HZ.js";
-import "./chunk-EK7DT5BT.js";
-import "./chunk-CYQOUTMY.js";
-import "./chunk-FY343IZR.js";
-import "./chunk-NQRJ5AJO.js";
+} from "./chunk-FZ6NYJ7L.js";
+import "./chunk-FFDNKRCY.js";
+import "./chunk-4VUPLMZ6.js";
+import "./chunk-2BMRJ6LQ.js";
+import "./chunk-3URQC7EH.js";
+import "./chunk-7H73RIE3.js";
 import "./chunk-HXGUIPQB.js";
 import "./chunk-AR2JDFAE.js";
 import "./chunk-747LRSOO.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-VCETL77O.js";
-import "./chunk-24ZLWWEO.js";
+import "./chunk-YPYHVOXP.js";
 import "./chunk-HNGSV2YC.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -25,4 +25,4 @@ export {
   randomId,
   withdrawAccessibleData
 };
-//# sourceMappingURL=withdraw-accessible-JSDQHXHE.js.map
+//# sourceMappingURL=withdraw-accessible-7PG4DYQK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.6.0-pre.1",
+  "version": "0.6.0-pre.11",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -20,6 +20,7 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./codemods/0.4.0-pre.json": "./codemods/0.4.0-pre.json",
     "./i18n": {
       "types": "./dist/via/i18n/index.d.ts",
       "default": "./dist/i18n/index.js"
@@ -202,20 +203,21 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "codemods"
   ],
   "engines": {
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.6.0-pre.1"
+    "@noy-db/attestation": "0.6.0-pre.11"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.6.0-pre.1"
+    "@noy-db/on-shamir": "0.6.0-pre.11"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/backup-GAYWQAFN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data)\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(keyringFile),\n    }\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. Legacy backups (no ledgerHead)\n  //    skip this with a one-line warning so existing consumers can\n  //    still read them while migrating.\n  if (!backup.ledgerHead) {\n    console.warn(\n      `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n      `verifiable-backup integrity check skipped. ` +\n      `Re-export with a ledger-aware build to get tamper detection.`,\n    )\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,KAAK;AAAA,IACjD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,WAAW;AAAA,IACnC;AACA,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAKrB,MAAI,CAAC,OAAO,YAAY;AACtB,YAAQ;AAAA,MACN;AAAA,IAGF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}