@noy-db/hub 0.6.0-pre.1 → 0.6.0-pre.3

package/dist/chunk-3HYWYLXL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/with-materialized-view.ts"],"sourcesContent":["import { MaterializedViewConfigError, ValidationError } from '../../kernel/errors.js'\nimport type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js'\n\n/**\n * Register a materialized view: a declared query whose result is\n * persisted as a queryable collection and kept fresh as sources\n * change. Writes go through the standard `Collection.put` pipeline;\n * refresh-driven deletes route through `Collection._internalDelete` so\n * user `onDelete` guards on the output collection aren't tripped by\n * housekeeping.\n *\n * Three registration modes:\n *   - **single-source** — declare `query: (db) => Query<TRow>`; the\n *     dependency analyzer derives source collections from the plan.\n *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`\n *     plus optional `groupBy` + `aggregate`; the executor reads each\n *     arm, maps to the unified row shape, concatenates, then groups\n *     and aggregates.\n *   - **projection** (#810) — declare `projection: { source, joins,\n *     map }`; one output row per primary record, enriched with\n *     forward FK legs and reverse \"collect\" legs before `map` runs.\n *\n * The three modes are mutually exclusive — exactly one of `query` /\n * `unionSources` / `projection` must be set at registration time.\n *\n * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2),\n * docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION),\n * and docs/superpowers/specs/2026-07-25-join-projection-mv-design.md (projection).\n */\nexport function withMaterializedView<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n): MaterializedViewStrategy {\n  if (!spec.name || spec.name.length === 0) {\n    throw new ValidationError('withMaterializedView: name is required')\n  }\n  // Mutual exclusion: exactly one of the three forms must be declared.\n  const declaredForms = [spec.query, spec.unionSources, spec.projection]\n    .filter((f) => f !== undefined).length\n  if (declaredForms > 1) {\n    throw new MaterializedViewConfigError(\n      'query, unionSources, and projection are mutually exclusive — pick one',\n    )\n  }\n  if (declaredForms === 0) {\n    throw new MaterializedViewConfigError(\n      'strategy must declare exactly one of query, unionSources, or projection',\n    )\n  }\n  if (spec.query !== undefined && typeof spec.query !== 'function') {\n    throw new ValidationError('withMaterializedView: query must be a function returning a Query<T>')\n  }\n  // UNION-form invariants.\n  if (spec.unionSources) {\n    // A single arm is a deliberate shape: map→group→aggregate over\n    // ONE collection with a COMPUTED bucket key (e.g. month sliced from a\n    // date field) — something the query form's stored-field groupBy cannot\n    // express. The executor and dependency analyzer are arm-count-agnostic.\n    if (spec.unionSources.length < 1) {\n      throw new MaterializedViewConfigError(\n        'unionSources requires at least 1 source collection',\n      )\n    }\n    const seen = new Set<string>()\n    for (const s of spec.unionSources) {\n      if (typeof s?.collection !== 'string' || s.collection.length === 0) {\n        throw new MaterializedViewConfigError(\n          'each unionSources entry must declare a non-empty `collection` string',\n        )\n      }\n      if (typeof s.map !== 'function') {\n        throw new MaterializedViewConfigError(\n          `unionSources entry for \"${s.collection}\" is missing a \\`map\\` function`,\n        )\n      }\n      if (seen.has(s.collection)) {\n        throw new MaterializedViewConfigError(\n          `unionSources must reference distinct collections (duplicate: \"${s.collection}\")`,\n        )\n      }\n      seen.add(s.collection)\n    }\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": UNION strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`,\n      )\n    }\n    // `moneyFields` only has meaning when there's an aggregate to\n    // money-rewrite — it keys reducer outputs, so declaring it without\n    // `aggregate` is a no-op config mistake.\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    // Per-arm joins resolve right-side collections that the union\n    // dependency set (built from arm `collection`s alone) does NOT\n    // include. The consumer must list those right-side collections in\n    // `sources` so writes to them trigger MV refresh.\n    if (spec.unionSources.some(s => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": a unionSources arm declares join(s) but `\n        + `no \\`sources\\` are listed — declare sources: [...] with the right-side `\n        + `(join-target) collection names so writes to them trigger MV refresh`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on UNION strategies — `\n        + `UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Use the query() form, or open an issue if per-arm predicates are needed`,\n      )\n    }\n  }\n  // Projection-form invariants (#810). Shape checks only — the\n  // semantic ref() check on collect legs (the `on` field must carry a\n  // ref() targeting the projection source) runs at first\n  // materialization, parity with join-time ref errors.\n  if (spec.projection) {\n    const projection = spec.projection\n    if (typeof projection.source !== 'string' || projection.source.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.source must be a non-empty collection name`,\n      )\n    }\n    if (typeof projection.map !== 'function') {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection is missing a \\`map\\` function`,\n      )\n    }\n    if (!Array.isArray(projection.joins) || projection.joins.length < 1) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.joins must declare at least 1 leg — `\n        + `a leg-less single-source MV is the query() form's job`,\n      )\n    }\n    const seenAs = new Set<string>()\n    for (const leg of projection.joins) {\n      const l = leg as { field?: unknown; collect?: unknown; on?: unknown; as?: unknown }\n      const isForward = l.field !== undefined\n      const isCollect = l.collect !== undefined\n      if (isForward && isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a projection leg cannot declare both \\`field\\` `\n          + `(forward) and \\`collect\\` (reverse) — split it into two legs`,\n        )\n      }\n      if (!isForward && !isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare either \\`field\\` `\n          + `(forward FK) or \\`collect\\` (reverse one-to-many)`,\n        )\n      }\n      if (isForward && (typeof l.field !== 'string' || l.field.length === 0)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a forward projection leg must declare a non-empty \\`field\\``,\n        )\n      }\n      if (isCollect) {\n        if (typeof l.collect !== 'string' || l.collect.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": a collect projection leg must declare a non-empty \\`collect\\` collection name`,\n          )\n        }\n        if (typeof l.on !== 'string' || l.on.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": collect leg for \"${l.collect}\" must declare a non-empty \\`on\\` FK field`,\n          )\n        }\n      }\n      if (typeof l.as !== 'string' || l.as.length === 0) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare a non-empty \\`as\\` alias`,\n        )\n      }\n      if (seenAs.has(l.as)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": projection legs must attach under distinct \\`as\\` aliases (duplicate: \"${l.as}\")`,\n        )\n      }\n      seenAs.add(l.as)\n    }\n    // Post-map grouping invariants — same rules as UNION (the mapped\n    // stream feeds the same shared groupAndReduce tail).\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a row-per-primary-record MV`,\n      )\n    }\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on projection strategies — `\n        + `projection mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Filter inside projection.map (return null to omit) instead`,\n      )\n    }\n  }\n  // i18nLocale + i18nFields drive compute-time i18n resolution of group-key\n  // i18nText fields before bucketing — UNION mode (resolved on the unified rows)\n  // AND query mode (resolved in GroupedReduction.run before groupAndReduce).\n  // i18nLocale without i18nFields cannot resolve anything, so reject it early.\n  if (spec.i18nLocale !== undefined && spec.i18nFields === undefined) {\n    throw new MaterializedViewConfigError(\n      `withMaterializedView \"${spec.name}\": i18nLocale requires i18nFields — `\n      + `declare the i18nText descriptors of the group-key fields so they can be `\n      + `resolved at the mv layer before bucketing.`,\n    )\n  }\n  if (typeof spec.rowKey !== 'function') {\n    throw new ValidationError('withMaterializedView: rowKey is required (no default; see spec § Type surface)')\n  }\n  if (spec.refresh !== 'eager' && spec.refresh !== 'lazy' && spec.refresh !== 'manual') {\n    throw new ValidationError(\n      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got \"${String(spec.refresh)}\"`,\n    )\n  }\n  return {\n    __noydb_strategy: 'materialized-view',\n    spec,\n  }\n}\n"],"mappings":";;;;;;AA6BO,SAAS,qBACd,MAC0B;AAC1B,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AAEA,QAAM,gBAAgB,CAAC,KAAK,OAAO,KAAK,cAAc,KAAK,UAAU,EAClE,OAAO,CAAC,MAAM,MAAM,MAAS,EAAE;AAClC,MAAI,gBAAgB,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,UAAU,UAAa,OAAO,KAAK,UAAU,YAAY;AAChE,UAAM,IAAI,gBAAgB,qEAAqE;AAAA,EACjG;AAEA,MAAI,KAAK,cAAc;AAKrB,QAAI,KAAK,aAAa,SAAS,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,OAAO,GAAG,eAAe,YAAY,EAAE,WAAW,WAAW,GAAG;AAClE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,EAAE,UAAU;AAAA,QACzC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,EAAE,UAAU,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,iEAAiE,EAAE,UAAU;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,IAAI,EAAE,UAAU;AAAA,IACvB;AACA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AAIA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAKA,QAAI,KAAK,aAAa,KAAK,OAAK,EAAE,QAAQ,EAAE,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI;AAC5G,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,YAAY;AACnB,UAAM,aAAa,KAAK;AACxB,QAAI,OAAO,WAAW,WAAW,YAAY,WAAW,OAAO,WAAW,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAQ,YAAY;AACxC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,KAAK,WAAW,MAAM,SAAS,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,WAAW,OAAO;AAClC,YAAM,IAAI;AACV,YAAM,YAAY,EAAE,UAAU;AAC9B,YAAM,YAAY,EAAE,YAAY;AAChC,UAAI,aAAa,WAAW;AAC1B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,cAAc,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IAAI;AACtE,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,WAAW;AACb,YAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,WAAW,GAAG;AAC3D,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UACpC;AAAA,QACF;AACA,YAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI,uBAAuB,EAAE,OAAO;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,OAAO,IAAI,EAAE,EAAE,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI,6EAA6E,EAAE,EAAE;AAAA,QACrH;AAAA,MACF;AACA,aAAO,IAAI,EAAE,EAAE;AAAA,IACjB;AAGA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,IAAI;AAAA,IAGpC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,WAAW,YAAY;AACrC,UAAM,IAAI,gBAAgB,mFAAgF;AAAA,EAC5G;AACA,MAAI,KAAK,YAAY,WAAW,KAAK,YAAY,UAAU,KAAK,YAAY,UAAU;AACpF,UAAM,IAAI;AAAA,MACR,2EAA2E,OAAO,KAAK,OAAO,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-46V67XP5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * docs/superpowers/specs/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DeviceSealProvider } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: DeviceSealProvider\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * docs/superpowers/specs/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * docs/superpowers/specs/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { DeviceSealProvider }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSealProvider implements DeviceSealProvider {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-CJ73OLMW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/with-derivation.ts","../src/with-formula/derivations/with-rollup.ts"],"sourcesContent":["import { ValidationError } from '../../kernel/errors.js'\nimport type { DerivationSpec, DerivationStrategy } from './types.js'\n\n/**\n * Register a deterministic derivation: one source collection → one or\n * more typed outputs, computed by the user's `derive` function on\n * plaintext after DEK unwrap. Outputs are encrypted with the same DEK\n * as the source and written via the standard `Collection.put` path.\n *\n * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.\n */\nexport function withDerivation<\n  TSource extends Record<string, unknown>,\n  TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>,\n>(spec: DerivationSpec<TSource, TOutputs>): DerivationStrategy {\n  if (!spec.source || spec.source.length === 0) {\n    throw new ValidationError('withDerivation: source collection name is required')\n  }\n  if (!spec.outputs || Object.keys(spec.outputs).length === 0) {\n    throw new ValidationError('withDerivation: outputs map must declare at least one output')\n  }\n  if (spec.deterministic !== true) {\n    throw new ValidationError('withDerivation: v1 only supports deterministic derivations')\n  }\n  if (typeof spec.derive !== 'function') {\n    throw new ValidationError('withDerivation: derive must be a function')\n  }\n\n  // Validate declared sibling sources. Each must be a non-empty\n  // string and must differ from the primary source — a self-reference\n  // would double-register the strategy under the same `_bySource` key.\n  if (spec.sources !== undefined) {\n    for (const extra of spec.sources) {\n      if (typeof extra !== 'string' || extra.length === 0) {\n        throw new ValidationError('withDerivation: each entry in sources[] must be a non-empty string')\n      }\n      if (extra === spec.source) {\n        throw new ValidationError(\n          `withDerivation: sources[] must not contain the primary source \"${spec.source}\"`,\n        )\n      }\n    }\n  }\n\n  // Validate FK triggers. Each `collection` must be a non-empty\n  // string differing from the primary source, and `on` a non-empty field.\n  if (spec.triggerBy !== undefined) {\n    for (const t of spec.triggerBy) {\n      if (typeof t?.collection !== 'string' || t.collection.length === 0) {\n        throw new ValidationError('withDerivation: each triggerBy entry needs a non-empty `collection`')\n      }\n      if (t.collection === spec.source) {\n        throw new ValidationError(\n          `withDerivation: triggerBy.collection must not equal the source \"${spec.source}\" (use sources[] for same-id triggers)`,\n        )\n      }\n      if (typeof t.on !== 'string' || t.on.length === 0) {\n        throw new ValidationError(\n          `withDerivation: triggerBy on \"${t.collection}\" needs a non-empty \\`on\\` (the FK field on the source)`,\n        )\n      }\n      if (t.maxFanout !== undefined && (!Number.isInteger(t.maxFanout) || t.maxFanout < 1)) {\n        throw new ValidationError(\n          `withDerivation: triggerBy maxFanout on \"${t.collection}\" must be a positive integer (got ${String(t.maxFanout)}).`,\n        )\n      }\n    }\n  }\n\n  // Validate array-shape outputs.\n  const lifecycleMode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n  for (const [outputKey, outputSpec] of Object.entries(spec.outputs)) {\n    // Self-write output (collection === source): reverse-denorm must declare\n    // `denorm` (the fields it owns) — field-level provenance.\n    if (outputSpec.shape === 'record' && outputSpec.collection === spec.source) {\n      if (!outputSpec.denorm || outputSpec.denorm.length === 0) {\n        throw new ValidationError(\n          `withDerivation: self-write output \"${outputKey}\" (collection === source \"${spec.source}\") `\n          + 'must declare `denorm: [...]` naming the fields it maintains.',\n        )\n      }\n    }\n    if (outputSpec.shape === 'array') {\n      if (lifecycleMode !== 'eager') {\n        throw new ValidationError(\n          `withDerivation: shape 'array' supports lifecycle 'eager' only in this release `\n          + `Output \"${outputKey}\" declared lifecycle '${lifecycleMode}'. `\n          + 'Switch to `lifecycle: \"eager\"` or use shape: \"record\".',\n        )\n      }\n      if (typeof outputSpec.key !== 'function') {\n        throw new ValidationError(\n          `withDerivation: shape 'array' output \"${outputKey}\" requires \\`key: (out) => string\\`.`,\n        )\n      }\n      if (outputSpec.maxFanout !== undefined) {\n        if (!Number.isInteger(outputSpec.maxFanout) || outputSpec.maxFanout < 1) {\n          throw new ValidationError(\n            `withDerivation: maxFanout for output \"${outputKey}\" must be a positive integer `\n            + `(got ${String(outputSpec.maxFanout)}).`,\n          )\n        }\n      }\n    }\n  }\n\n  return {\n    __noydb_strategy: 'derivation',\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: spec as DerivationSpec<any, any>,\n  }\n}\n","import { ValidationError } from '../../kernel/errors.js'\nimport type { DerivationSpec, DerivationStrategy } from './types.js'\n\n/** Options for {@link withRollup} (#844b — was an inline literal, so unnameable). */\nexport interface WithRollupOptions<\n  TChild extends Record<string, unknown> = Record<string, unknown>,\n  TParent extends Record<string, unknown> = Record<string, unknown>,\n> {\n  /** Child collection — the trigger. */\n  readonly from: string\n  /** FK field on the child pointing at the parent id. */\n  readonly key: keyof TChild & string\n  /** Parent collection carrying the maintained summary. */\n  readonly into: string\n  /** Field on the parent to maintain. */\n  readonly field: keyof TParent & string\n  /** Reduces the matching children to the value written at `field`. */\n  readonly compute: (children: TChild[]) => unknown\n}\n\n/**\n * `withRollup` — aggregate many child records onto a single field of their\n * parent. The reverse of a join: instead of reading children\n * on demand, the parent carries a maintained summary.\n *\n * ```ts\n * withRollup<Sale, Buyer>({\n *   from: 'sales',          // child collection (the trigger)\n *   key: 'buyerId',         // FK on the child → parent id\n *   into: 'buyers',         // parent collection\n *   field: 'revenueByYear', // field on the parent to maintain\n *   compute: (sales) => groupSumByYear(sales, 'total'),\n * })\n * ```\n *\n * On every write OR delete of a `from` record, the parent at id `child[key]`\n * is recomputed: `compute(allChildren where child[key] === parentId)` is\n * patched onto `parent[field]`. A parent write also recomputes its own\n * aggregate (so a parent created after its children still fills in). Only the\n * `field` is touched — the rest of the parent record is never clobbered — and\n * a value-equality guard suppresses no-op writes. The aggregate is gap-free\n * with respect to child inserts, updates, and deletes.\n *\n * Desugars to a `withDerivation` strategy carrying a `rollup` marker; dispatch\n * handles it without invoking the executor. Eager-only in this slice.\n */\nexport function withRollup<\n  TChild extends Record<string, unknown> = Record<string, unknown>,\n  TParent extends Record<string, unknown> = Record<string, unknown>,\n>(opts: WithRollupOptions<TChild, TParent>): DerivationStrategy {\n  const { from, key, into, field, compute } = opts\n  if (!from || from.length === 0) {\n    throw new ValidationError('withRollup: `from` (child collection) is required')\n  }\n  if (!into || into.length === 0) {\n    throw new ValidationError('withRollup: `into` (parent collection) is required')\n  }\n  if (from === into) {\n    throw new ValidationError('withRollup: `from` and `into` must be different collections')\n  }\n  if (!key || key.length === 0) {\n    throw new ValidationError('withRollup: `key` (FK field on the child) is required')\n  }\n  if (!field || field.length === 0) {\n    throw new ValidationError('withRollup: `field` (target field on the parent) is required')\n  }\n  if (typeof compute !== 'function') {\n    throw new ValidationError('withRollup: `compute` must be a function')\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const spec: DerivationSpec<any, any> = {\n    source: into, // the parent record is what carries the rolled-up field\n    deterministic: true,\n    rollup: { from, key, field, compute: compute as (children: unknown[]) => unknown },\n    // Synthetic self-write output for registry / cycle bookkeeping. Dispatch\n    // patches `field` directly (value-equality guarded); the executor is not run.\n    outputs: { value: { shape: 'record', collection: into, denorm: [field] } },\n    derive: () => ({ value: {} }), // never invoked for a rollup strategy\n    lifecycle: 'eager',\n  }\n\n  return { __noydb_strategy: 'derivation', spec }\n}\n"],"mappings":";;;;;AAWO,SAAS,eAGd,MAA6D;AAC7D,MAAI,CAAC,KAAK,UAAU,KAAK,OAAO,WAAW,GAAG;AAC5C,UAAM,IAAI,gBAAgB,oDAAoD;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,WAAW,OAAO,KAAK,KAAK,OAAO,EAAE,WAAW,GAAG;AAC3D,UAAM,IAAI,gBAAgB,8DAA8D;AAAA,EAC1F;AACA,MAAI,KAAK,kBAAkB,MAAM;AAC/B,UAAM,IAAI,gBAAgB,4DAA4D;AAAA,EACxF;AACA,MAAI,OAAO,KAAK,WAAW,YAAY;AACrC,UAAM,IAAI,gBAAgB,2CAA2C;AAAA,EACvE;AAKA,MAAI,KAAK,YAAY,QAAW;AAC9B,eAAW,SAAS,KAAK,SAAS;AAChC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,cAAM,IAAI,gBAAgB,oEAAoE;AAAA,MAChG;AACA,UAAI,UAAU,KAAK,QAAQ;AACzB,cAAM,IAAI;AAAA,UACR,kEAAkE,KAAK,MAAM;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAIA,MAAI,KAAK,cAAc,QAAW;AAChC,eAAW,KAAK,KAAK,WAAW;AAC9B,UAAI,OAAO,GAAG,eAAe,YAAY,EAAE,WAAW,WAAW,GAAG;AAClE,cAAM,IAAI,gBAAgB,qEAAqE;AAAA,MACjG;AACA,UAAI,EAAE,eAAe,KAAK,QAAQ;AAChC,cAAM,IAAI;AAAA,UACR,mEAAmE,KAAK,MAAM;AAAA,QAChF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,iCAAiC,EAAE,UAAU;AAAA,QAC/C;AAAA,MACF;AACA,UAAI,EAAE,cAAc,WAAc,CAAC,OAAO,UAAU,EAAE,SAAS,KAAK,EAAE,YAAY,IAAI;AACpF,cAAM,IAAI;AAAA,UACR,2CAA2C,EAAE,UAAU,qCAAqC,OAAO,EAAE,SAAS,CAAC;AAAA,QACjH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,gBAAgB,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAC3F,aAAW,CAAC,WAAW,UAAU,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAGlE,QAAI,WAAW,UAAU,YAAY,WAAW,eAAe,KAAK,QAAQ;AAC1E,UAAI,CAAC,WAAW,UAAU,WAAW,OAAO,WAAW,GAAG;AACxD,cAAM,IAAI;AAAA,UACR,sCAAsC,SAAS,6BAA6B,KAAK,MAAM;AAAA,QAEzF;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,UAAU,SAAS;AAChC,UAAI,kBAAkB,SAAS;AAC7B,cAAM,IAAI;AAAA,UACR,yFACa,SAAS,yBAAyB,aAAa;AAAA,QAE9D;AAAA,MACF;AACA,UAAI,OAAO,WAAW,QAAQ,YAAY;AACxC,cAAM,IAAI;AAAA,UACR,yCAAyC,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,WAAW,cAAc,QAAW;AACtC,YAAI,CAAC,OAAO,UAAU,WAAW,SAAS,KAAK,WAAW,YAAY,GAAG;AACvE,gBAAM,IAAI;AAAA,YACR,yCAAyC,SAAS,qCACxC,OAAO,WAAW,SAAS,CAAC;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,kBAAkB;AAAA;AAAA,IAElB;AAAA,EACF;AACF;;;ACjEO,SAAS,WAGd,MAA8D;AAC9D,QAAM,EAAE,MAAM,KAAK,MAAM,OAAO,QAAQ,IAAI;AAC5C,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,UAAM,IAAI,gBAAgB,mDAAmD;AAAA,EAC/E;AACA,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,UAAM,IAAI,gBAAgB,oDAAoD;AAAA,EAChF;AACA,MAAI,SAAS,MAAM;AACjB,UAAM,IAAI,gBAAgB,6DAA6D;AAAA,EACzF;AACA,MAAI,CAAC,OAAO,IAAI,WAAW,GAAG;AAC5B,UAAM,IAAI,gBAAgB,uDAAuD;AAAA,EACnF;AACA,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,UAAM,IAAI,gBAAgB,8DAA8D;AAAA,EAC1F;AACA,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI,gBAAgB,0CAA0C;AAAA,EACtE;AAGA,QAAM,OAAiC;AAAA,IACrC,QAAQ;AAAA;AAAA,IACR,eAAe;AAAA,IACf,QAAQ,EAAE,MAAM,KAAK,OAAO,QAAqD;AAAA;AAAA;AAAA,IAGjF,SAAS,EAAE,OAAO,EAAE,OAAO,UAAU,YAAY,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE;AAAA,IACzE,QAAQ,OAAO,EAAE,OAAO,CAAC,EAAE;AAAA;AAAA,IAC3B,WAAW;AAAA,EACb;AAEA,SAAO,EAAE,kBAAkB,cAAc,KAAK;AAChD;","names":[]}

package/dist/chunk-EK7DT5BT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/format.ts","../src/with-pod/signature.ts","../src/with-pod/bundle.ts"],"sourcesContent":["/**\n * `.noydb` container format — byte layout, header schema, validators.\n *\n *. Wraps a `vault.dump()` JSON string in a thin\n * binary container with a magic-byte prefix, a minimum-disclosure\n * unencrypted header, and a compressed body.\n *\n * **Byte layout** (read in order from offset 0):\n *\n * ```\n * +--------+--------+--------+--------+\n * |  N=78  |  D=68  |  B=66  |  1=49  |  Magic 'NDB1' (4 bytes)\n * +--------+--------+--------+--------+\n * | flags  | compr  |  header_length (uint32 BE)            |\n * +--------+--------+--------+--------+--------+--------+--------+\n * | header_length bytes of UTF-8 JSON header                       ...\n * +--------+--------+\n * | compressed body bytes                                            ...\n * ```\n *\n * Total fixed prefix before the header JSON is **10 bytes**:\n *   - 4 bytes magic\n *   - 1 byte flags\n *   - 1 byte compression algorithm\n *   - 4 bytes header length (uint32 big-endian)\n *\n * **Why a binary container** at all? `vault.dump()` already\n * produces a JSON string with encrypted records inside. Wrapping it\n * again seems redundant — but the wrap is what makes the file safe\n * to drop into cloud storage (Drive, Dropbox, iCloud) without\n * leaking the vault name and exporter identity through the\n * cloud's metadata API. The minimum-disclosure header is the only\n * thing visible without downloading and decompressing the body.\n * The dump JSON inside the body still contains the original\n * metadata, but that's only readable by someone who already has the\n * file bytes — the same person who could read the encrypted records\n * with the right secret.\n *\n * **Why minimum disclosure** in the header? Because consumers will\n * inevitably store these in services where the filename, file size,\n * and any unencrypted metadata are indexed for search. A field like\n * `vault: \"Acme Corp\"` would let an attacker (or a curious\n * cloud admin) enumerate which compartments exist and who exported\n * them, even with zero access to the encrypted body. The header\n * carries only what's needed to identify the file as a NOYDB\n * bundle and verify its integrity — nothing about the contents.\n */\n\nimport type { Cover } from '../with-party/directory/cover/types.js'\nimport type { Redirect } from './redirect.js'\n\n/** Magic bytes 'NDB1' (ASCII), identifying a NOYDB bundle. */\nexport const NOYDB_BUNDLE_MAGIC = new Uint8Array([0x4e, 0x44, 0x42, 0x31])\n\n/** Total fixed prefix before the header JSON: 4+1+1+4 bytes. */\nexport const NOYDB_BUNDLE_PREFIX_BYTES = 10\n\n/** Current bundle format version. Bumped on layout changes. Default for unsigned pods. */\nexport const NOYDB_BUNDLE_FORMAT_VERSION = 1\n\n/** Format version for pods carrying a header signature (`sig`/`keyId`/`sigAlg`). */\nexport const NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2\n\n/**\n * Bitfield interpretation of the flags byte.\n *\n * Bit 0 — body is compressed (0 = raw, 1 = compressed)\n * Bit 1 — header carries an integrity hash over the body bytes\n * Bits 2-7 — reserved, must be 0 in\n */\nexport const FLAG_COMPRESSED = 0b0000_0001\nexport const FLAG_HAS_INTEGRITY_HASH = 0b0000_0010\n\n/**\n * Compression algorithm encoding for the byte at offset 5.\n *\n * `none` is admitted for round-trip testing and for callers that\n * want to bundle without compression (e.g. when piping into a\n * separately compressed transport). `gzip` is the universally\n * available baseline (Node 18+, all modern browsers). `brotli` is\n * preferred when the runtime supports it — typically 30-50% smaller\n * for JSON payloads — but Node 22+ / Chrome 124+ / Firefox 122+\n * are required, so the writer feature-detects at runtime and falls\n * back to gzip. The reader must handle all three.\n */\nexport const COMPRESSION_NONE = 0\nexport const COMPRESSION_GZIP = 1\nexport const COMPRESSION_BROTLI = 2\n\nexport type CompressionAlgo = 0 | 1 | 2\n\n/**\n * The unencrypted header carried in every `.noydb` bundle.\n *\n * **Minimum-disclosure rules:** these are the ONLY allowed keys.\n * Any other key in a parsed header causes\n * `validateBundleHeader` to throw. The set is kept short to\n * minimize attack surface from cloud-storage metadata indexing —\n * see the file-level doc comment for the rationale.\n *\n * Forbidden in particular:\n *   - `vault` / `_compartment` — would leak the tenant name\n *   - `exporter` / `_exported_by` — would leak user identity\n *   - `timestamp` / `_exported_at` — would leak activity timing\n *   - `kdfParams` / salt fields — would leak crypto config that\n *     could narrow brute-force search space\n *   - any field starting with `_` (reserved by the dump format)\n */\nexport interface NoydbPodHeader {\n  /** Bundle format version — bumped on layout changes. */\n  readonly formatVersion: number\n  /**\n   * Opaque ULID identifier — generated once per vault and\n   * stable across re-exports of the same vault. Does not\n   * leak any information about contents (the timestamp prefix is\n   * just monotonicity for sortability, not exporter activity —\n   * see `bundle/ulid.ts` for the design notes).\n   */\n  readonly handle: string\n  /** Compressed body length in bytes. Lets readers verify completeness without decompressing. */\n  readonly bodyBytes: number\n  /** SHA-256 of the compressed body bytes (lowercase hex). Lets readers verify integrity without decompressing. */\n  readonly bodySha256: string\n  /**\n   * Owner-curated cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`).\n   * Optional — present only when the source vault has a\n   * `_meta/public-envelope` document AND the writer's hub is opted\n   * into the feature. Treat as **untrusted hint**; the body's\n   * encrypted contents remain the source of truth.\n   *\n   * The JSON key keeps its frozen wire name `publicEnvelope` (#799\n   * renamed only the developer surface — existing bundles stay\n   * readable byte-for-byte).\n   *\n   * The cover deliberately widens the minimum-disclosure rule\n   * for explicit, owner-curated label fields (name, icon, …). Every\n   * other unknown header key still rejects at parse time.\n   */\n  readonly publicEnvelope?: Cover\n  /**\n   * Auto-unlock material indicator. When present, the bundle\n   * body wraps the dump JSON in a structure carrying per-user\n   * secrets — either plaintext (`'unsealed'`, public-by-design)\n   * or sealed under a `SealingKeyProvider` (`'sealed'`, requires\n   * matching provider on the recipient side).\n   *\n   * Visible pre-decompression so cloud listing UIs can warn before\n   * download: \"this bundle opens itself for anyone holding the file\"\n   * (unsealed) or \"this bundle is sealed for a specific provider\"\n   * (sealed).\n   *\n   * Absent → the body is a raw `vault.dump()` JSON string (the\n   * the legacy shape; back-compatible).\n   */\n  readonly autoUnlock?: 'unsealed' | 'sealed'\n  /**\n   * Bundle's role in the source → destination lifecycle.\n   *   - omitted / 'snapshot' (default): backup/copy of an existing vault.\n   *   - 'extracted-partition': re-keyed projection awaiting adoption.\n   */\n  readonly bundleKind?: 'snapshot' | 'extracted-partition'\n  /**\n   * Transfer-seal INDICATOR — metadata only, no payload (the\n   * sealed DEKs live in the body). Present iff\n   * bundleKind === 'extracted-partition'.\n   */\n  readonly transferSeal?: {\n    readonly v: 1\n    readonly alg: 'aes-256-gcm-pre-shared'\n    readonly sealId: string\n  }\n  /**\n   * Non-secret 16-hex-char fingerprint identifying the signing key\n   * used for `sig`. A hash prefix, not the key itself — discloses no\n   * crypto config, safe under minimum-disclosure. Present iff `sig`\n   * and `sigAlg` are also present (all-or-nothing 3-tuple), and only\n   * on `formatVersion === 2` headers.\n   */\n  readonly keyId?: string\n  /**\n   * Signature authenticating the rest of the header (base64url,\n   * no padding). Verifies the header wasn't tampered with in\n   * transit/storage — see `with-pod/signature.ts`. Part of the\n   * sig/keyId/sigAlg 3-tuple.\n   */\n  readonly sig?: string\n  /**\n   * Signature algorithm for `sig`. Named `sigAlg` (not `alg`) to\n   * avoid confusion with `transferSeal.alg`. Part of the\n   * sig/keyId/sigAlg 3-tuple.\n   */\n  readonly sigAlg?: 'ed25519'\n  /**\n   * Engine version range that wrote (and can read) this pod, e.g.\n   * `'^0.5.0'`. Discloses only a semver range — no timestamps, no\n   * identities — so a version-skew triage step (open a decade-old\n   * pod → route to a version-matched read-only player instead of a\n   * hard failure) or a landing page can branch before any library\n   * code runs. Safe under minimum-disclosure: a range says nothing\n   * about who wrote the pod or when.\n   */\n  readonly engineRange?: string\n  /**\n   * Declared unlock method(s), e.g. `['password', 'webauthn']`. Lets\n   * a landing/player present the right unlock UI pre-library, and is\n   * ALL a shared connection pod may disclose about its bootstrap\n   * (auth method + endpoint class). Safe under minimum-disclosure: it\n   * names a method family, not a credential, key, or identity.\n   *\n   * The member set mirrors the `@noy-db/on-*` package family\n   * (`on-password`, `on-webauthn`, `on-oidc`, `on-totp`,\n   * `on-email-otp`, `on-magic-link`, `on-pin`, `on-recovery`,\n   * `on-shamir`) — the top-level \"which on-* package to load\" method\n   * name, not the finer-grained `FactorKind` used by policy gates\n   * (which splits WebAuthn into `webauthn-roaming` /\n   * `webauthn-platform` for factor-proof freshness). `on-threat` is\n   * excluded — it's a lockout/duress helper, not an unlock method a\n   * landing page would present.\n   */\n  readonly unlockMethods?: readonly UnlockMethod[]\n  /**\n   * App-manifest presence flag. Lets a landing fork between\n   * \"orphan pod → read-only browse\" and \"linked app → launch flow\"\n   * without reading the body. Safe under minimum-disclosure: a\n   * boolean, not the app's identity or contents.\n   */\n  readonly hasApp?: boolean\n  /**\n   * Artifact species hint for dispatcher branching, cloud tooling,\n   * and the share-flow guard that warns when a data-bearing pod is\n   * shared where a pointer was intended. An \"orphan\" pod is derived\n   * (`species: 'full'` + `hasApp: false`), not a separate species.\n   * Safe under minimum-disclosure: a coarse artifact-shape label, not\n   * contents or identity.\n   */\n  readonly species?: 'full' | 'connection' | 'snapshot' | 'redirect' | 'group'\n  /**\n   * Whether the app pointer (if any) is disclosed pre-auth. Default\n   * is `'private'` by product decision (recorded in #942) — absence\n   * means private by convention; this field is never auto-injected,\n   * only an author's explicit opt-in writes `'public'`. Safe under\n   * minimum-disclosure: a disclosure-policy flag, not the pointer\n   * itself.\n   */\n  readonly pointerMode?: 'public' | 'private'\n  /**\n   * Signed \"this moved, go there\" pointer (#944). Carried in the\n   * PLAINTEXT header (not the encrypted body) so a dispatcher can follow\n   * it pre-auth — no secret, no decompression. Structurally validated\n   * here (shape only); the record's OWN signature is a separate\n   * verification step (`verifyRedirect`) since a parser has no\n   * `trustedKeys`. `readPodRedirect` returns this field UNVERIFIED.\n   */\n  readonly redirect?: Redirect\n}\n\n/**\n * Declared unlock method names — mirrors the `@noy-db/on-*` package\n * family (see `unlockMethods` doc comment on `NoydbPodHeader`).\n */\nexport type UnlockMethod =\n  | 'password'\n  | 'webauthn'\n  | 'oidc'\n  | 'totp'\n  | 'email-otp'\n  | 'magic-link'\n  | 'pin'\n  | 'recovery'\n  | 'shamir'\n\n/** @deprecated Use `NoydbPodHeader`. */\nexport type NoydbBundleHeader = NoydbPodHeader\n\n/**\n * Allowlist of header keys. Any key not in this set is forbidden\n * and causes `validateBundleHeader` to throw. Kept as a Set for\n * O(1) lookup; the validator iterates over the parsed header and\n * checks each key against this set.\n */\nconst ALLOWED_HEADER_KEYS: ReadonlySet<string> = new Set([\n  'formatVersion',\n  'handle',\n  'bodyBytes',\n  'bodySha256',\n  'publicEnvelope',\n  'autoUnlock',\n  'bundleKind',\n  'transferSeal',\n  'sig',\n  'keyId',\n  'sigAlg',\n  'engineRange',\n  'unlockMethods',\n  'hasApp',\n  'species',\n  'pointerMode',\n  'redirect',\n])\n\n/** Valid `unlockMethods` member values — see `UnlockMethod`. */\nconst UNLOCK_METHODS: ReadonlySet<string> = new Set([\n  'password',\n  'webauthn',\n  'oidc',\n  'totp',\n  'email-otp',\n  'magic-link',\n  'pin',\n  'recovery',\n  'shamir',\n])\n\n/** Valid `species` values — see `NoydbPodHeader.species`. */\nconst POD_SPECIES: ReadonlySet<string> = new Set([\n  'full',\n  'connection',\n  'snapshot',\n  'redirect',\n  'group',\n])\n\n/** Valid `redirect.reason` values — see `Redirect['reason']`. */\nconst REDIRECT_REASONS: ReadonlySet<string> = new Set([\n  'moved',\n  'release',\n  'tombstone',\n  'repoint',\n])\n\n/**\n * Validate a parsed bundle header. Throws on any deviation from\n * the minimum-disclosure schema:\n *\n *   - Missing required field\n *   - Wrong type for any field\n *   - Any extra key not in `ALLOWED_HEADER_KEYS`\n *   - Unsupported `formatVersion`\n *   - Negative or non-integer `bodyBytes`\n *   - Malformed `handle` (must be 26-char Crockford base32)\n *   - Malformed `bodySha256` (must be 64-char lowercase hex)\n *\n * The error messages name the offending field so consumers can\n * fix the producer rather than the reader.\n */\nexport function validateBundleHeader(\n  parsed: unknown,\n): asserts parsed is NoydbPodHeader {\n  if (parsed === null || typeof parsed !== 'object') {\n    throw new Error(\n      `.noydb bundle header must be a JSON object, got ${parsed === null ? 'null' : typeof parsed}`,\n    )\n  }\n  // Disallow any unknown key — minimum disclosure means we reject\n  // forward-compat extension keys at the format layer; new fields\n  // require a format version bump and a new validator.\n  for (const key of Object.keys(parsed)) {\n    if (!ALLOWED_HEADER_KEYS.has(key)) {\n      throw new Error(\n        `.noydb bundle header contains forbidden key \"${key}\". ` +\n          `Only minimum-disclosure fields are allowed: ` +\n          `${[...ALLOWED_HEADER_KEYS].join(', ')}.`,\n      )\n    }\n  }\n  const h = parsed as Record<string, unknown>\n  if (\n    typeof h['formatVersion'] !== 'number' ||\n    (h['formatVersion'] !== NOYDB_BUNDLE_FORMAT_VERSION && h['formatVersion'] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED)\n  ) {\n    throw new Error(\n      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION} or ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, ` +\n        `got ${String(h['formatVersion'])}. The reader does not support ` +\n        `forward-compat versions; upgrade the reader to handle newer bundles.`,\n    )\n  }\n  if (typeof h['handle'] !== 'string' || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h['handle'])) {\n    throw new Error(\n      `.noydb bundle header.handle must be a 26-character Crockford base32 ULID, ` +\n        `got ${typeof h['handle'] === 'string' ? `\"${h['handle']}\"` : String(h['handle'])}.`,\n    )\n  }\n  if (typeof h['bodyBytes'] !== 'number' || !Number.isInteger(h['bodyBytes']) || h['bodyBytes'] < 0) {\n    throw new Error(\n      `.noydb bundle header.bodyBytes must be a non-negative integer, ` +\n        `got ${String(h['bodyBytes'])}.`,\n    )\n  }\n  if (typeof h['bodySha256'] !== 'string' || !/^[0-9a-f]{64}$/.test(h['bodySha256'])) {\n    throw new Error(\n      `.noydb bundle header.bodySha256 must be a 64-character lowercase hex string, ` +\n        `got ${typeof h['bodySha256'] === 'string' ? `\"${h['bodySha256']}\"` : String(h['bodySha256'])}.`,\n    )\n  }\n  if (h['publicEnvelope'] !== undefined) {\n    const env = h['publicEnvelope']\n    if (env === null || typeof env !== 'object' || Array.isArray(env)) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope must be a JSON object when present, got ${typeof env}.`,\n      )\n    }\n    const e = env as Record<string, unknown>\n    if (e['_noydb_public'] !== 1) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope._noydb_public must be 1, got ${String(e['_noydb_public'])}.`,\n      )\n    }\n    if (typeof e['version'] !== 'number' || !Number.isInteger(e['version']) || e['version'] < 1) {\n      throw new Error(\n        `.noydb bundle header.publicEnvelope.version must be a positive integer, got ${String(e['version'])}.`,\n      )\n    }\n  }\n  if (h['autoUnlock'] !== undefined) {\n    if (h['autoUnlock'] !== 'unsealed' && h['autoUnlock'] !== 'sealed') {\n      const got = typeof h['autoUnlock'] === 'string' ? `\"${h['autoUnlock']}\"` : typeof h['autoUnlock']\n      throw new Error(\n        `.noydb bundle header.autoUnlock must be 'unsealed' or 'sealed' when present, got ${got}.`,\n      )\n    }\n  }\n  if (h['bundleKind'] !== undefined) {\n    if (h['bundleKind'] !== 'snapshot' && h['bundleKind'] !== 'extracted-partition') {\n      const got = typeof h['bundleKind'] === 'string' ? `\"${h['bundleKind']}\"` : typeof h['bundleKind']\n      throw new Error(\n        `.noydb bundle header.bundleKind must be 'snapshot' or 'extracted-partition' when present, got ${got}.`,\n      )\n    }\n  }\n  if (h['transferSeal'] !== undefined) {\n    const ts = h['transferSeal']\n    if (ts === null || typeof ts !== 'object' || Array.isArray(ts)) {\n      throw new Error(`.noydb bundle header.transferSeal must be a JSON object when present, got ${typeof ts}.`)\n    }\n    const t = ts as Record<string, unknown>\n    if (t['v'] !== 1) {\n      throw new Error(`.noydb bundle header.transferSeal.v must be 1, got ${String(t['v'])}.`)\n    }\n    if (t['alg'] !== 'aes-256-gcm-pre-shared') {\n      throw new Error(`.noydb bundle header.transferSeal.alg must be 'aes-256-gcm-pre-shared', got ${String(t['alg'])}.`)\n    }\n    if (typeof t['sealId'] !== 'string' || t['sealId'].length === 0) {\n      throw new Error(`.noydb bundle header.transferSeal.sealId must be a non-empty string, got ${String(t['sealId'])}.`)\n    }\n  }\n  if (h['keyId'] !== undefined) {\n    if (typeof h['keyId'] !== 'string' || !/^[0-9a-f]{16}$/.test(h['keyId'])) {\n      throw new Error(\n        `.noydb bundle header.keyId must be a 16-character lowercase hex fingerprint, ` +\n          `got ${typeof h['keyId'] === 'string' ? `\"${h['keyId']}\"` : typeof h['keyId']}.`,\n      )\n    }\n  }\n  if (h['sig'] !== undefined) {\n    if (typeof h['sig'] !== 'string' || h['sig'].length === 0 || !/^[A-Za-z0-9_-]+$/.test(h['sig'])) {\n      throw new Error(\n        `.noydb bundle header.sig must be a non-empty base64url string, ` +\n          `got ${typeof h['sig'] === 'string' ? `\"${h['sig']}\"` : typeof h['sig']}.`,\n      )\n    }\n  }\n  if (h['sigAlg'] !== undefined) {\n    if (h['sigAlg'] !== 'ed25519') {\n      const got = typeof h['sigAlg'] === 'string' ? `\"${h['sigAlg']}\"` : typeof h['sigAlg']\n      throw new Error(`.noydb bundle header.sigAlg must be 'ed25519' when present, got ${got}.`)\n    }\n  }\n  if (h['engineRange'] !== undefined) {\n    if (typeof h['engineRange'] !== 'string' || h['engineRange'].length === 0) {\n      throw new Error(\n        `.noydb bundle header.engineRange must be a string when present, ` +\n          `got ${typeof h['engineRange']}.`,\n      )\n    }\n  }\n  if (h['unlockMethods'] !== undefined) {\n    const methods = h['unlockMethods']\n    if (!Array.isArray(methods)) {\n      throw new Error(\n        `.noydb bundle header.unlockMethods must be an array when present, got ${typeof methods}.`,\n      )\n    }\n    for (let i = 0; i < methods.length; i++) {\n      if (!UNLOCK_METHODS.has(methods[i])) {\n        throw new Error(\n          `.noydb bundle header.unlockMethods[${i}] must be one of: ` +\n            `${[...UNLOCK_METHODS].join(', ')}, got ${String(methods[i])}.`,\n        )\n      }\n    }\n  }\n  if (h['hasApp'] !== undefined) {\n    if (typeof h['hasApp'] !== 'boolean') {\n      throw new Error(\n        `.noydb bundle header.hasApp must be a boolean when present, got ${typeof h['hasApp']}.`,\n      )\n    }\n  }\n  if (h['species'] !== undefined) {\n    if (!POD_SPECIES.has(h['species'] as string)) {\n      const got = typeof h['species'] === 'string' ? `\"${h['species']}\"` : typeof h['species']\n      throw new Error(\n        `.noydb bundle header.species must be one of: ${[...POD_SPECIES].join(', ')}, got ${got}.`,\n      )\n    }\n  }\n  if (h['pointerMode'] !== undefined) {\n    if (h['pointerMode'] !== 'public' && h['pointerMode'] !== 'private') {\n      const got = typeof h['pointerMode'] === 'string' ? `\"${h['pointerMode']}\"` : typeof h['pointerMode']\n      throw new Error(`.noydb bundle header.pointerMode must be 'public' or 'private' when present, got ${got}.`)\n    }\n  }\n  if (h['redirect'] !== undefined) {\n    const r = h['redirect']\n    if (r === null || typeof r !== 'object' || Array.isArray(r)) {\n      throw new Error(`.noydb bundle header.redirect must be a JSON object when present, got ${typeof r}.`)\n    }\n    const rec = r as Record<string, unknown>\n    if (rec['v'] !== 1) {\n      throw new Error(`.noydb bundle header.redirect.v must be 1, got ${String(rec['v'])}.`)\n    }\n    if (typeof rec['target'] !== 'string' || rec['target'].length === 0) {\n      throw new Error(\n        `.noydb bundle header.redirect.target must be a non-empty string, got ${String(rec['target'])}.`,\n      )\n    }\n    if (!REDIRECT_REASONS.has(rec['reason'] as string)) {\n      throw new Error(\n        `.noydb bundle header.redirect.reason must be one of: ${[...REDIRECT_REASONS].join(', ')}, got ${String(rec['reason'])}.`,\n      )\n    }\n    if (typeof rec['issuedBy'] !== 'string' || !/^[0-9a-f]{16}$/.test(rec['issuedBy'])) {\n      throw new Error(\n        `.noydb bundle header.redirect.issuedBy must be a 16-character lowercase hex fingerprint, ` +\n          `got ${typeof rec['issuedBy'] === 'string' ? `\"${rec['issuedBy']}\"` : typeof rec['issuedBy']}.`,\n      )\n    }\n    if (typeof rec['sig'] !== 'string' || rec['sig'].length === 0 || !/^[A-Za-z0-9_-]+$/.test(rec['sig'])) {\n      throw new Error(\n        `.noydb bundle header.redirect.sig must be a non-empty base64url string, ` +\n          `got ${typeof rec['sig'] === 'string' ? `\"${rec['sig']}\"` : typeof rec['sig']}.`,\n      )\n    }\n  }\n  // Cross-field invariant: the seal indicator and the extracted-partition\n  // kind imply each other. An extracted partition is unlocked via its\n  // transfer seal; a seal without the kind is a malformed header.\n  const isExtracted = h['bundleKind'] === 'extracted-partition'\n  const hasSeal = h['transferSeal'] !== undefined\n  if (hasSeal && !isExtracted) {\n    throw new Error(\n      `.noydb bundle header.transferSeal requires bundleKind === 'extracted-partition'.`,\n    )\n  }\n  if (isExtracted && !hasSeal) {\n    throw new Error(\n      `.noydb bundle header with bundleKind === 'extracted-partition' must carry a transferSeal indicator.`,\n    )\n  }\n  // An extracted partition's unlock path IS the transfer seal. A parallel\n  // autoUnlock credential would create two unlock paths and weaken the\n  // one-time-seal guarantee. Reject the combination.\n  if (isExtracted && h['autoUnlock'] !== undefined) {\n    throw new Error(\n      `.noydb bundle header cannot carry both autoUnlock and bundleKind === 'extracted-partition' — `\n      + `an extracted partition is unlocked via its transfer seal, not an auto-credential.`,\n    )\n  }\n  // Cross-field invariant: sig/keyId/sigAlg authenticate the header as a\n  // unit — a partial tuple (e.g. sig without keyId) is a malformed or\n  // truncated signature, not a valid unsigned header. Signed headers also\n  // require formatVersion 2 so older readers refuse them instead of\n  // silently ignoring the signature.\n  const sigFieldsPresent = [h['sig'], h['keyId'], h['sigAlg']].filter((v) => v !== undefined).length\n  if (sigFieldsPresent > 0 && sigFieldsPresent < 3) {\n    throw new Error(\n      `.noydb bundle header.sig, .keyId, and .sigAlg must be present together or not at all ` +\n        `(got ${sigFieldsPresent} of 3).`,\n    )\n  }\n  if (sigFieldsPresent === 3 && h['formatVersion'] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {\n    throw new Error(\n      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, ` +\n        `got ${String(h['formatVersion'])}.`,\n    )\n  }\n}\n\n/**\n * Encode a header object to UTF-8 JSON bytes after validating\n * minimum disclosure. Used by the writer to serialize the header\n * region of the container.\n */\nexport function encodeBundleHeader(header: NoydbPodHeader): Uint8Array {\n  validateBundleHeader(header)\n  // Stable key ordering — JSON.stringify with no replacer uses\n  // insertion order, which is fine here because we control the\n  // object construction. Stable ordering means two bundles with\n  // identical contents produce byte-identical headers.\n  const json = JSON.stringify({\n    formatVersion: header.formatVersion,\n    handle: header.handle,\n    bodyBytes: header.bodyBytes,\n    bodySha256: header.bodySha256,\n    ...(header.publicEnvelope !== undefined ? { publicEnvelope: header.publicEnvelope } : {}),\n    ...(header.autoUnlock !== undefined ? { autoUnlock: header.autoUnlock } : {}),\n    ...(header.bundleKind !== undefined ? { bundleKind: header.bundleKind } : {}),\n    ...(header.transferSeal !== undefined ? { transferSeal: header.transferSeal } : {}),\n    // Encode order here is the WIRE-byte contract only — it does NOT\n    // affect the signature. The signer (Task 4/5) signs the header\n    // object via canonicalJson, which re-sorts keys independent of\n    // this insertion order.\n    ...(header.sig !== undefined ? { sig: header.sig } : {}),\n    ...(header.keyId !== undefined ? { keyId: header.keyId } : {}),\n    ...(header.sigAlg !== undefined ? { sigAlg: header.sigAlg } : {}),\n    ...(header.engineRange !== undefined ? { engineRange: header.engineRange } : {}),\n    ...(header.unlockMethods !== undefined ? { unlockMethods: header.unlockMethods } : {}),\n    ...(header.hasApp !== undefined ? { hasApp: header.hasApp } : {}),\n    ...(header.species !== undefined ? { species: header.species } : {}),\n    ...(header.pointerMode !== undefined ? { pointerMode: header.pointerMode } : {}),\n    ...(header.redirect !== undefined ? { redirect: header.redirect } : {}),\n  })\n  return new TextEncoder().encode(json)\n}\n\n/**\n * Parse a bundle header from its UTF-8 JSON bytes. Throws on\n * invalid JSON or any minimum-disclosure violation.\n */\nexport function decodeBundleHeader(bytes: Uint8Array): NoydbPodHeader {\n  const json = new TextDecoder('utf-8', { fatal: true }).decode(bytes)\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(json)\n  } catch (err) {\n    throw new Error(\n      `.noydb bundle header is not valid JSON: ${(err as Error).message}`,\n    )\n  }\n  validateBundleHeader(parsed)\n  return parsed\n}\n\n/**\n * Read a uint32 from `bytes` at `offset` in big-endian byte order.\n * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.\n * Used to decode the header length field; kept inline so the parser\n * doesn't depend on DataView allocation per call.\n */\nexport function readUint32BE(bytes: Uint8Array, offset: number): number {\n  return (\n    (bytes[offset]! << 24 >>> 0) +\n    (bytes[offset + 1]! << 16) +\n    (bytes[offset + 2]! << 8) +\n    bytes[offset + 3]!\n  )\n}\n\n/**\n * Write a uint32 to `bytes` at `offset` in big-endian byte order.\n * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.\n */\nexport function writeUint32BE(bytes: Uint8Array, offset: number, value: number): void {\n  bytes[offset] = (value >>> 24) & 0xff\n  bytes[offset + 1] = (value >>> 16) & 0xff\n  bytes[offset + 2] = (value >>> 8) & 0xff\n  bytes[offset + 3] = value & 0xff\n}\n\n/**\n * Verify the magic prefix of a bundle. Returns true if the first\n * 4 bytes match `NDB1`. Used by readers as a fast file-type check\n * before any further parsing.\n */\nexport function hasNoydbBundleMagic(bytes: Uint8Array): boolean {\n  if (bytes.length < NOYDB_BUNDLE_MAGIC.length) return false\n  for (let i = 0; i < NOYDB_BUNDLE_MAGIC.length; i++) {\n    if (bytes[i] !== NOYDB_BUNDLE_MAGIC[i]) return false\n  }\n  return true\n}\n","/**\n * The ONE signing convention for the noy-db family — pod header, the\n * Redirect record (#944), and manifest writes (#941) all sign through\n * this module rather than inventing their own scheme.\n *\n * Convention: `canonicalJson(payload minus sig)` → `utf8` → Ed25519, over\n * the published `@noy-db/attestation` primitives. The caller is\n * responsible for excluding the `sig` field from `payload` before\n * signing/verifying — this module never strips it for you, so a payload\n * that still carries a stray field (or `undefined`) fails loudly via\n * `canonicalJson` rather than silently signing the wrong bytes.\n *\n * No pod/vault imports here — this is a family-wide primitive.\n */\nimport { canonicalJson, ed25519Sign, ed25519Verify, utf8 } from '@noy-db/attestation'\n\nexport const POD_SIG_ALG = 'ed25519' as const\n\n/** The exact bytes a signature covers: utf8(canonicalJson(payload)). Exported for cross-checking. */\nexport function signedBytes(payload: Record<string, unknown>): Uint8Array {\n  return utf8(canonicalJson(payload))\n}\n\n/**\n * Sign an arbitrary canonical record. `payload` MUST already exclude any\n * `sig` field.\n */\nexport async function signRecord(privateKeyPkcs8B64: string, payload: Record<string, unknown>): Promise<string> {\n  return ed25519Sign(privateKeyPkcs8B64, signedBytes(payload))\n}\n\n/**\n * Verify. `payload` is the record WITHOUT `sig`. Fails closed (false) on\n * any malformed input.\n */\nexport async function verifyRecord(publicKeyB64: string, sig: string, payload: Record<string, unknown>): Promise<boolean> {\n  return ed25519Verify(publicKeyB64, sig, signedBytes(payload))\n}\n","/**\n * `.noydb` container primitives — write, read, header-only read.\n *\n *. Wraps a `vault.dump()` JSON string in the\n * binary container described in `format.ts`.\n *\n * **Three primitives:**\n *\n *   - `writePod(vault, opts?)` — produces the\n *     full container bytes ready to write to disk or upload\n *   - `readPodHeader(bytes)` — parses just the header\n *     without decompressing the body, fast file-type and\n *     metadata read for cloud listing UIs\n *   - `readPod(bytes)` — full read: validates magic,\n *     header, integrity hash, and decompresses the body to\n *     return the original `dump()` JSON string for use with\n *     `vault.load()`\n *\n * **Compression strategy:** brotli when available (Node 22+,\n * Chrome 124+, Firefox 122+), gzip fallback elsewhere. The\n * algorithm choice is encoded in the format byte at offset 5,\n * so readers handle either transparently. Brotli wins ~30-50%\n * on JSON payloads with repeated keys (which vault dumps\n * are).\n *\n * **Why split read/load?** `readPod` returns the\n * *unwrapped JSON string*, not a Vault object. The caller\n * is responsible for piping that JSON into\n * `vault.load(json, secret)`. Splitting the layers\n * keeps the bundle module free of any crypto/secret\n * concerns — it's purely a format layer. The same `readPod`\n * call can also feed verification tools, format inspectors, or\n * archive utilities that don't care about decryption.\n */\n\nimport {\n  COMPRESSION_BROTLI,\n  COMPRESSION_GZIP,\n  COMPRESSION_NONE,\n  FLAG_COMPRESSED,\n  FLAG_HAS_INTEGRITY_HASH,\n  NOYDB_BUNDLE_FORMAT_VERSION,\n  NOYDB_BUNDLE_FORMAT_VERSION_SIGNED,\n  NOYDB_BUNDLE_MAGIC,\n  NOYDB_BUNDLE_PREFIX_BYTES,\n  decodeBundleHeader,\n  encodeBundleHeader,\n  hasNoydbBundleMagic,\n  readUint32BE,\n  writeUint32BE,\n  type CompressionAlgo,\n  type NoydbPodHeader,\n  type UnlockMethod,\n} from './format.js'\nimport { signRecord, verifyRecord } from './signature.js'\nimport type { Redirect } from './redirect.js'\nimport type { DocSigner } from '../with-audit/attestation/signer.js'\nimport { sha256Hex as sha256HexBytes } from '../kernel/enclave/index.js'\nimport { BundleIntegrityError, BundleSealMismatchError, ValidationError } from '../kernel/errors.js'\nimport type { Vault } from '../kernel/vault.js'\nimport type { BundleRecipient } from '../with-party/team/keyring.js'\nimport { pickLocale } from '../with-party/directory/cover/storage.js'\nimport type { Cover } from '../with-party/directory/cover/types.js'\nimport type { SealingKeyProvider, RecipientSealer, RecipientHint } from '../with-party/team/managed-secret.js'\n\n// ─── Auto-credential types ────────────────────────────────────────────────────\n\n/**\n * The credential kinds that can be bundled for auto-unlock.\n * WebAuthn is intentionally excluded — it is hardware-bound and\n * cannot be embedded as a portable credential.\n */\nexport type AutoCredentialKind = 'secret' | 'password' | 'pin'\n\n/**\n * A typed credential for auto-unlock. Carries the credential `kind`\n * alongside the plaintext `value`, so consumers can dispatch the\n * correct login/prefill path rather than treating all credentials\n * as secrets.\n *\n * `bundle.ts` is a pure format layer — it carries the credential\n * without interpreting it. The consumer is responsible for\n * dispatching on `kind`.\n */\nexport interface AutoCredential {\n  readonly kind: AutoCredentialKind\n  readonly value: string\n}\n\n/**\n * Options accepted by `writePod`.\n *\n * - `compression: 'auto'` (default) — try brotli, fall back to gzip\n * - `compression: 'brotli'` — force brotli, throw if unsupported\n * - `compression: 'gzip'` — force gzip\n * - `compression: 'none'` — no compression (round-trip testing only)\n *\n * **Slice filtering:**\n * - `collections` — allowlist of collection names to include. Internal\n *   collections (keyrings, ledger) and excluded user collections are\n *   dropped from the bundle. Records inside included collections are\n *   carried through verbatim.\n * - `since` — only records whose envelope `_ts` is on/after the given\n *   instant survive. Operates on the unencrypted envelope timestamp,\n *   so plaintext access to records is not required.\n *\n * Both filters intersect (AND). When neither is provided the bundle is\n * a whole-vault snapshot, identical to today's behaviour.\n */\nexport interface WritePodOptions {\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n  /** Allowlist of user-collection names to include. */\n  readonly collections?: readonly string[]\n  /**\n   * Drop records whose envelope `_ts` is strictly older than this\n   * instant. Accepts a `Date` or any ISO-8601 string parseable by\n   * `new Date()`.\n   */\n  readonly since?: Date | string\n  /**\n   * Plaintext-pipeline record predicate. Decrypts each record\n   * with the vault's per-collection DEK, runs the predicate, and\n   * keeps the original ciphertext for survivors (no re-encrypt —\n   * preserves zero-knowledge cleanly). Records the predicate returns\n   * `false` for are dropped from the bundle.\n   *\n   * Async predicates are supported. Mutating the record from inside\n   * the predicate is undefined behaviour.\n   */\n  readonly where?: (\n    record: unknown,\n    ctx: { collection: string; id: string },\n  ) => boolean | Promise<boolean>\n  /**\n   * Hierarchical-tier ceiling. Records whose envelope `_tier`\n   * is strictly greater than this number are dropped. Operates on the\n   * envelope `_tier` (no decryption needed) — vault.exportStream is\n   * referenced in the issue body for symmetry, but the tier value\n   * lives on the unencrypted envelope. Vault without tiers is a no-op.\n   */\n  readonly tierAtMost?: number\n  /**\n   * Single-recipient re-keying shorthand. When set, the\n   * bundle's keyring is replaced with one freshly-derived entry sealed\n   * with this secret. The recipient inherits the source keyring's\n   * userId, role, and permissions. Mutually exclusive with `recipients`.\n   */\n  readonly exportSecret?: string\n  /**\n   * Multi-recipient re-keying. Replaces the bundle's keyring\n   * map with one slot per recipient, each sealed with its own\n   * secret. DEKs are unwrapped from the source keyring once and\n   * re-wrapped per recipient — record ciphertext is unchanged.\n   *\n   * Mutually exclusive with `exportSecret`. When neither is set,\n   * the bundle inherits the source keyring as-is (today's behaviour,\n   * suited to personal backup-and-restore).\n   */\n  readonly recipients?: readonly BundleRecipient[]\n  /**\n   * Auto-unlock — unsealed per-user credentials.\n   *\n   * Generalises `autoSecrets` to support any bundleable credential\n   * kind (`secret` | `password` | `pin`).\n   *\n   * Public-by-design: anyone holding the bundle bytes can read these\n   * plaintext credentials. Use for demo data, sample vaults,\n   * prospect onboarding.\n   *\n   * The `policy: 'public-by-design'` discriminant is mandatory. A\n   * bare `{ perUser }` without it is rejected at write time — the\n   * safety net against a careless call against a production vault.\n   *\n   * Mutually exclusive with `sealedCredentials`, `autoSecrets`,\n   * and `sealedSecrets`.\n   */\n  readonly autoCredentials?: {\n    readonly policy: 'public-by-design'\n    readonly perUser: Record<string, AutoCredential>\n  }\n  /**\n   * Auto-unlock — per-user credentials sealed under a\n   * {@link SealingKeyProvider}.\n   *\n   * Generalises `sealedSecrets` to support any bundleable\n   * credential kind (`secret` | `password` | `pin`).\n   *\n   * The hub seals each user's plaintext credential under `provider`\n   * and embeds the resulting sealed envelopes in the bundle. The\n   * recipient must hold a provider with a matching `pid` (i.e.,\n   * `provider.id`) to auto-unseal on import.\n   *\n   * `mode: 'self-target'` — sender and recipient share the same\n   * provider identity (same iCloud Keychain entry, same\n   * MDM-provisioned bundle id, same KMS account, etc.).\n   *\n   * `mode: 'recipient-target'` — asymmetric sealing via a\n   * {@link RecipientSealer}. Each user entry carries a\n   * `credential` and a `hint` (the recipient's public material).\n   * The bundle can only be unsealed by the holder of the matching\n   * private key.\n   *\n   * Mutually exclusive with `autoCredentials`, `autoSecrets`,\n   * and `sealedSecrets`.\n   */\n  readonly sealedCredentials?:\n    | {\n        readonly mode: 'self-target'\n        readonly provider: SealingKeyProvider\n        readonly perUser: Record<string, AutoCredential>\n      }\n    | {\n        readonly mode: 'recipient-target'\n        readonly provider: RecipientSealer\n        readonly perUser: Record<string, { readonly credential: AutoCredential; readonly hint: RecipientHint }>\n      }\n  /**\n   * @deprecated Use `autoCredentials` instead.\n   *\n   * Auto-unlock — unsealed per-user secrets.\n   *\n   * Public-by-design: anyone holding the bundle bytes can read these\n   * plaintext credentials. Use for demo data, sample vaults,\n   * prospect onboarding.\n   *\n   * The `policy: 'public-by-design'` discriminant is mandatory. A\n   * bare `{ perUser }` without it is rejected at write time — the\n   * safety net against a careless call against a production vault.\n   *\n   * Mutually exclusive with `autoCredentials`, `sealedCredentials`,\n   * and `sealedSecrets`.\n   */\n  readonly autoSecrets?: {\n    readonly policy: 'public-by-design'\n    readonly perUser: Record<string, string>\n  }\n  /**\n   * @deprecated Use `sealedCredentials` instead.\n   *\n   * Auto-unlock — per-user secrets sealed under a\n   * {@link SealingKeyProvider} (self-target only).\n   *\n   * The hub seals each user's plaintext secret under `provider`\n   * and embeds the resulting sealed envelopes in the bundle. The\n   * recipient must hold a provider with a matching `pid` (i.e.,\n   * `provider.id`) to auto-unseal on import.\n   *\n   * `mode: 'self-target'` is the only mode for `sealedSecrets` — sender\n   * and recipient share the same provider identity (same iCloud Keychain\n   * entry, same MDM-provisioned bundle id, same KMS account, etc.).\n   * For recipient-target sealing via the `RecipientSealer` interface,\n   * use `sealedCredentials` with `mode: 'recipient-target'` (§11.4).\n   *\n   * Mutually exclusive with `autoCredentials`, `sealedCredentials`,\n   * and `autoSecrets`.\n   */\n  readonly sealedSecrets?: {\n    readonly mode: 'self-target'\n    readonly provider: SealingKeyProvider\n    readonly perUser: Record<string, string>\n  }\n  /**\n   * Pod-header signing control (#943).\n   *\n   *   - omitted (default) — sign the header iff the source vault has a\n   *     persisted document signer (`vault._loadPodSigner()` returns\n   *     non-null). A vault that never minted a signer produces an\n   *     unsigned `formatVersion: 1` header, exactly as before.\n   *   - `false` — never sign, even if a signer is persisted.\n   *   - an explicit {@link DocSigner} — sign with the supplied keypair\n   *     without touching the vault's persisted signer (test / advanced\n   *     injection). Does not mint or persist anything.\n   *\n   * Signing NEVER mints a signer as a side effect of export: an absent\n   * signer means an unsigned pod, not an on-the-fly key generation.\n   */\n  readonly sign?: false | DocSigner\n  /**\n   * Header L2 fields (#942) — pre-auth dispatch metadata written verbatim\n   * into the pod header. See `NoydbPodHeader` for the disclosure rationale\n   * of each. All optional; absence produces a legacy-shaped header exactly\n   * as before.\n   */\n  readonly engineRange?: string\n  readonly unlockMethods?: readonly UnlockMethod[]\n  readonly hasApp?: boolean\n  readonly species?: 'full' | 'connection' | 'snapshot' | 'redirect' | 'group'\n  readonly pointerMode?: 'public' | 'private'\n  /**\n   * Signed \"this moved, go there\" pointer (#944), written verbatim into\n   * the plaintext header. Pass an already-signed {@link Redirect}\n   * (mint one via `signRedirect`) — `writePod` does not sign it for you.\n   */\n  readonly redirect?: Redirect\n}\n\n/** @deprecated Use `WritePodOptions`. */\nexport type WriteNoydbBundleOptions = WritePodOptions\n\n/**\n * Result returned by `readPod`. The caller is expected to\n * pass `dumpJson` into `vault.load(json, secret)` to\n * actually restore a vault. Splitting the layers keeps the\n * bundle module free of crypto concerns — see file-level docs.\n */\nexport interface NoydbBundleReadResult {\n  readonly header: NoydbPodHeader\n  readonly dumpJson: string\n  /**\n   * Auto-unlock material. Present only when\n   * the header's `autoUnlock` flag is set AND the body's wrapped\n   * structure survived parsing. Values are typed credentials — either\n   * delivered plain (`kind: 'unsealed'`) or unsealed at read time\n   * using one of the supplied `sealingProviders` (`kind: 'sealed'`).\n   *\n   * Consumers dispatch on `cred.kind` to choose the correct login /\n   * prefill path. Pre-0.2 bundles (bare string entries) are coerced\n   * to `{ kind: 'secret', value }` on read for back-compat.\n   *\n   * For `kind: 'sealed'` bundles read without `sealingProviders`, the\n   * `value` field is the raw base64 sealed bytes — opaque to the\n   * consumer until unsealed elsewhere.\n   */\n  readonly autoUnlock?: {\n    readonly kind: 'unsealed' | 'sealed'\n    readonly perUser: Record<string, AutoCredential>\n  }\n}\n\n/**\n * Sealed credential entry as it appears in the bundle body's\n * `_autoUnlock.perUser` map when the bundle was written with\n * `sealedCredentials` (or the deprecated `sealedSecrets`).\n * Provider's sealed output is base64-encoded; the `pid` is the\n * dispatch key matched against recipient-supplied\n * `SealingKeyProvider.id`. The `kind` carries the plaintext-tier\n * metadata so the consumer can dispatch on credential type without\n * unsealing first.\n *\n * Back-compat: `kind` is absent in older bundles — readers must\n * default to `'secret'` when not present.\n */\ninterface SealedAutoUnlockEntry {\n  readonly pid: string\n  readonly sealed: string\n  readonly alg: 'aes-256-gcm'\n  readonly kind?: AutoCredentialKind\n  /**\n   * Recipient-target only: the RecipientHint the sender used to seal.\n   * Carried for recipient verifiability (\"yes this was sealed against\n   * my published hint\"). Self-target entries omit it. Pre-0.2 readers\n   * ignore unknown fields, so this is back-compatible.\n   */\n  readonly hint?: RecipientHint\n}\n\n/**\n * Discriminated wrapper carried in the bundle body when the header's\n * `autoUnlock` flag is set. Without the flag, the body is the raw\n * `vault.dump()` JSON string.\n *\n * Back-compat: older bundles carry bare `string` values in the\n * unsealed `perUser` map. Readers must coerce those to\n * `{ kind: 'secret', value }`.\n */\ninterface AutoUnlockBody {\n  readonly _noydb_bundle_body: 1\n  readonly dump: string\n  readonly _autoUnlock:\n    | { readonly kind: 'unsealed'; readonly perUser: Record<string, AutoCredential | string> }\n    | { readonly kind: 'sealed'; readonly perUser: Record<string, SealedAutoUnlockEntry> }\n}\n\n/**\n * Options accepted by {@link readPod} for the\n * auto-unlock paths. Without these the reader behaves exactly as before\n * (header parsed; body returned as `dumpJson`).\n */\nexport interface ReadNoydbBundleOptions {\n  /**\n   * Recipient-side sealing providers used to unseal entries from\n   * `sealedSecrets`. The reader picks the one whose `.id`\n   * matches each entry's `pid`. Multiple providers may be supplied\n   * (different users may seal under different identities).\n   *\n   * When unset and the bundle carries sealed envelopes, the\n   * `autoUnlock.perUser` map remains the SEALED entries unmodified\n   * — callers can inspect them or unseal elsewhere.\n   */\n  readonly sealingProviders?: readonly SealingKeyProvider[]\n  /**\n   * Opt-in trial mode for unsealing — when an entry's `pid` doesn't\n   * match a registered provider, try each provider whose alg\n   * matches. Default `false` (strict-pid dispatch per foundation\n   * §11.9.2). Surfaces extra credential prompts; use deliberately.\n   */\n  readonly attemptUnsealAcrossProviders?: boolean\n}\n\n// ─── Auto-unlock helpers ──────────────────────────────────────────────────────\n\n/**\n * Internal normalized form of the auto-unlock options, computed once\n * from the four public-facing fields (autoCredentials, sealedCredentials,\n * autoSecrets, sealedSecrets). Callers work against this shape\n * so the build + validate paths share a single normalizer.\n */\ninterface NormalizedAutoUnlock {\n  readonly mode: 'unsealed' | 'sealed-self' | 'sealed-recipient'\n  readonly provider?: SealingKeyProvider | RecipientSealer\n  readonly perUser: Record<string, AutoCredential>\n  /** Present only for `sealed-recipient`. Same key set as `perUser`. */\n  readonly hints?: Record<string, RecipientHint>\n}\n\n/**\n * Coerce a `Record<string, string>` (legacy secret-only map) into\n * a `Record<string, AutoCredential>` by tagging each entry as\n * `kind: 'secret'`. Used by the normalizer to promote the deprecated\n * `autoSecrets`/`sealedSecrets` sugar.\n */\nfunction toAutoCredentials(m: Record<string, string>): Record<string, AutoCredential> {\n  return Object.fromEntries(\n    Object.entries(m).map(([u, value]) => [u, { kind: 'secret' as const, value }]),\n  )\n}\n\n/**\n * Normalize the four auto-unlock option fields into a single\n * `NormalizedAutoUnlock` (or `null` when none is set). Enforces mutual\n * exclusion — exactly one of the four may be present. Promotes the\n * deprecated sugar fields to `AutoCredential` shape.\n *\n * Does NOT validate field-level constraints (policy marker, perUser\n * length, mode, provider presence, kind allowlist) — those are checked\n * in `validateAutoUnlockOptions` after normalization.\n */\nfunction normalizeAutoUnlock(opts: WritePodOptions): NormalizedAutoUnlock | null {\n  const set = [\n    opts.autoCredentials,\n    opts.sealedCredentials,\n    opts.autoSecrets,\n    opts.sealedSecrets,\n  ].filter(v => v !== undefined).length\n  if (set === 0) return null\n  if (set > 1) {\n    throw new ValidationError(\n      'writePod: only one of autoCredentials / sealedCredentials / '\n      + 'autoSecrets / sealedSecrets may be set.',\n    )\n  }\n  if (opts.autoCredentials !== undefined) {\n    return { mode: 'unsealed', perUser: opts.autoCredentials.perUser }\n  }\n  if (opts.autoSecrets !== undefined) {\n    return { mode: 'unsealed', perUser: toAutoCredentials(opts.autoSecrets.perUser) }\n  }\n  if (opts.sealedCredentials !== undefined) {\n    if (opts.sealedCredentials.mode === 'recipient-target') {\n      const perUser: Record<string, AutoCredential> = {}\n      const hints: Record<string, RecipientHint> = {}\n      for (const [userId, entry] of Object.entries(opts.sealedCredentials.perUser)) {\n        perUser[userId] = entry.credential\n        hints[userId] = entry.hint\n      }\n      return { mode: 'sealed-recipient', provider: opts.sealedCredentials.provider, perUser, hints }\n    }\n    return { mode: 'sealed-self', provider: opts.sealedCredentials.provider, perUser: opts.sealedCredentials.perUser }\n  }\n  // sealedSecrets — only remaining option\n  return {\n    mode: 'sealed-self',\n    provider: opts.sealedSecrets!.provider,\n    perUser: toAutoCredentials(opts.sealedSecrets!.perUser),\n  }\n}\n\n/**\n * Validate the auto-unlock options and return the resulting header\n * `autoUnlock` value (or null when no auto-unlock requested).\n *\n * Takes the pre-computed `NormalizedAutoUnlock` so the caller (i.e.\n * `writePod`) can pass the same object to `buildAutoUnlockWrapper`\n * without a second `normalizeAutoUnlock` call.\n *\n * Validation per spec (§3):\n *   - (mutual exclusion already enforced by normalizeAutoUnlock)\n *   - unsealed path: `policy: 'public-by-design'` marker required\n *   - non-empty `perUser` maps\n *   - sealed path: provider present; both `mode: 'self-target'` and `mode: 'recipient-target'` accepted; recipient-target requires a `RecipientSealer` provider and per-user `hint` (§11.4)\n *   - every AutoCredential.kind ∈ {secret, password, pin}\n *     (WebAuthn is hardware-bound and cannot be bundled)\n *\n * Throws {@link ValidationError} on any violation.\n */\nfunction validateAutoUnlockOptions(\n  opts: WritePodOptions,\n  normalized: NormalizedAutoUnlock | null,\n): 'unsealed' | 'sealed' | null {\n  if (normalized === null) return null\n\n  const VALID_KINDS: ReadonlySet<string> = new Set(['secret', 'password', 'pin'])\n\n  // Validate every credential kind before any further checks.\n  for (const [userId, cred] of Object.entries(normalized.perUser)) {\n    if (!VALID_KINDS.has(cred.kind)) {\n      throw new ValidationError(\n        `writePod: credential for user '${userId}' has unsupported kind '${cred.kind}'. `\n        + 'auto-unlock supports secret/password/pin only; WebAuthn is hardware-bound '\n        + 'and cannot be bundled.',\n      )\n    }\n  }\n\n  if (normalized.mode === 'unsealed') {\n    // Read the policy marker from whichever active option carries it.\n    const policy = opts.autoCredentials?.policy ?? opts.autoSecrets?.policy\n    if (policy !== 'public-by-design') {\n      throw new ValidationError(\n        'writePod: `autoCredentials` (or `autoSecrets`) requires '\n        + '`policy: \"public-by-design\"`. '\n        + 'This is an explicit opt-in marker — bundling plaintext credentials is '\n        + 'safe only when those credentials are intended to be public (demo data, '\n        + 'sample vaults). For production credentials, use `sealedCredentials` instead.',\n      )\n    }\n    const userCount = Object.keys(normalized.perUser).length\n    if (userCount === 0) {\n      throw new ValidationError(\n        'writePod: `autoCredentials.perUser` (or `autoSecrets.perUser`) '\n        + 'must have at least one entry.',\n      )\n    }\n    return 'unsealed'\n  }\n\n  // Sealed path — branch on mode.\n  if (normalized.mode === 'sealed-recipient') {\n    const provider = normalized.provider\n    if (provider === undefined || typeof (provider as RecipientSealer).publishRecipientHint !== 'function'\n        || typeof (provider as RecipientSealer).sealForRecipient !== 'function') {\n      throw new ValidationError(\n        'writePod: `sealedCredentials.provider` for mode \\'recipient-target\\' must be a '\n        + 'RecipientSealer (publishRecipientHint + sealForRecipient). Self-only providers '\n        + '(MemorySealingKeyProvider, at-macos-keychain, etc.) do not satisfy this contract.',\n      )\n    }\n    const hints = normalized.hints\n    if (hints === undefined) {\n      throw new Error('unreachable — sealed-recipient normalization must populate hints')\n    }\n    for (const userId of Object.keys(normalized.perUser)) {\n      const hint = hints[userId]\n      if (hint === undefined) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}']\\` missing required \\`hint\\` for mode 'recipient-target'.`,\n        )\n      }\n      if (hint.v !== 1) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.v\\` must be 1 (got ${String(hint.v)}).`,\n        )\n      }\n      if (typeof hint.pid !== 'string' || hint.pid.length === 0) {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.pid\\` must be a non-empty string identifying the recipient.`,\n        )\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new ValidationError(\n          `writePod: \\`sealedCredentials.perUser['${userId}'].hint.alg\\` must be 'rsa-oaep-sha256' in slice 1 (got '${String(hint.alg)}').`,\n        )\n      }\n      // Note: hint.pid identifies the recipient, not the sender — no pid===sender.id check here.\n      // The sender holds a RecipientSealer that calls sealForRecipient(plaintext, hint);\n      // the hint's pid is the dispatch key on the reader side (matched against recipient providers).\n    }\n    const userCount = Object.keys(normalized.perUser).length\n    if (userCount === 0) {\n      throw new ValidationError(\n        'writePod: `sealedCredentials.perUser` must have at least one entry.',\n      )\n    }\n    return 'sealed'\n  }\n\n  // mode === 'sealed-self'\n  const selfTargetMode = opts.sealedCredentials?.mode ?? opts.sealedSecrets?.mode\n  if (selfTargetMode !== 'self-target') {\n    throw new ValidationError(\n      `writePod: \\`sealedCredentials.mode\\` (or \\`sealedSecrets.mode\\`) must be `\n      + `'self-target' or 'recipient-target' (got '${String(selfTargetMode)}').`,\n    )\n  }\n  if (normalized.provider === undefined) {\n    throw new ValidationError(\n      'writePod: `sealedCredentials.provider` (or `sealedSecrets.provider`) '\n      + 'is required (a `SealingKeyProvider`).',\n    )\n  }\n  const userCount = Object.keys(normalized.perUser).length\n  if (userCount === 0) {\n    throw new ValidationError(\n      'writePod: `sealedCredentials.perUser` (or `sealedSecrets.perUser`) '\n      + 'must have at least one entry.',\n    )\n  }\n  return 'sealed'\n}\n\n/**\n * Build the body wrapper carrying the dump + `_autoUnlock` blob.\n * Takes the pre-computed `NormalizedAutoUnlock` so both validate and\n * build work off the same normalized form (no double-normalize).\n */\nasync function buildAutoUnlockWrapper(\n  dumpJson: string,\n  normalized: NormalizedAutoUnlock,\n): Promise<AutoUnlockBody> {\n  if (normalized.mode === 'unsealed') {\n    return {\n      _noydb_bundle_body: 1,\n      dump: dumpJson,\n      _autoUnlock: {\n        kind: 'unsealed',\n        perUser: { ...normalized.perUser },\n      },\n    }\n  }\n  // Sealed path — branch on mode.\n  const provider = normalized.provider\n  if (provider === undefined) {\n    throw new Error('unreachable — validation should have caught this')\n  }\n  const sealedPerUser: Record<string, SealedAutoUnlockEntry> = {}\n  const encoder = new TextEncoder()\n\n  if (normalized.mode === 'sealed-recipient') {\n    const recipientSealer = provider as RecipientSealer\n    const hints = normalized.hints\n    if (hints === undefined) {\n      throw new Error('unreachable — sealed-recipient normalization must populate hints')\n    }\n    for (const [userId, cred] of Object.entries(normalized.perUser)) {\n      const hint = hints[userId]!\n      const sealed = await recipientSealer.sealForRecipient(encoder.encode(cred.value), hint)\n      sealedPerUser[userId] = {\n        pid: hint.pid,                  // use the recipient's pid, not the sender's\n        sealed: bytesToBase64(sealed),\n        alg: 'aes-256-gcm',\n        kind: cred.kind,\n        hint,\n      }\n    }\n  } else {\n    // mode === 'sealed-self'\n    const selfSealer = provider as SealingKeyProvider\n    for (const [userId, cred] of Object.entries(normalized.perUser)) {\n      const sealed = await selfSealer.seal(encoder.encode(cred.value))\n      sealedPerUser[userId] = {\n        pid: selfSealer.id,\n        sealed: bytesToBase64(sealed),\n        alg: 'aes-256-gcm',\n        kind: cred.kind,\n      }\n    }\n  }\n\n  return {\n    _noydb_bundle_body: 1,\n    dump: dumpJson,\n    _autoUnlock: { kind: 'sealed', perUser: sealedPerUser },\n  }\n}\n\n/**\n * Parse the body bytes when the header signaled an auto-unlock.\n * Returns the inner `dump` JSON string + the `_autoUnlock` blob;\n * throws if the wrapper structure is malformed.\n */\nfunction parseAutoUnlockBody(bodyString: string): { dump: string; blob: AutoUnlockBody['_autoUnlock'] } {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(bodyString)\n  } catch (err) {\n    throw new BundleIntegrityError(\n      'header declared autoUnlock but body could not be parsed as JSON wrapper: '\n      + (err instanceof Error ? err.message : String(err)),\n    )\n  }\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw new BundleIntegrityError('autoUnlock body is not a JSON object')\n  }\n  const obj = parsed as Record<string, unknown>\n  if (obj['_noydb_bundle_body'] !== 1) {\n    throw new BundleIntegrityError(\n      'autoUnlock body missing `_noydb_bundle_body: 1` discriminator',\n    )\n  }\n  if (typeof obj['dump'] !== 'string') {\n    throw new BundleIntegrityError('autoUnlock body must carry a string `dump` field')\n  }\n  const blob = obj['_autoUnlock']\n  if (typeof blob !== 'object' || blob === null) {\n    throw new BundleIntegrityError('autoUnlock body missing `_autoUnlock` blob')\n  }\n  const blobObj = blob as Record<string, unknown>\n  const kind = blobObj['kind']\n  if (kind !== 'unsealed' && kind !== 'sealed') {\n    throw new BundleIntegrityError(\n      `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`,\n    )\n  }\n  return {\n    dump: obj['dump'],\n    blob: blob as AutoUnlockBody['_autoUnlock'],\n  }\n}\n\n/**\n * Transfer-seal payload. The destination DEKs, exported to raw\n * bytes and AES-256-GCM-sealed *as a set* under the one-time transfer\n * key. `adoptPartition` unseals this; `createOwnerOnAdoptedPartition`\n * re-wraps the raw DEKs under the recipient's KEK.\n */\nexport interface TransferSealPayload {\n  readonly v: 1\n  readonly alg: 'aes-256-gcm-pre-shared'\n  readonly sealId: string\n  /** base64(AES-256-GCM(transferKey, JSON of { collection: base64(rawDEK) })) — iv ‖ ct ‖ tag. */\n  readonly payload: string\n}\n\n/**\n * Body wrapper for an extracted, transfer-sealed partition.\n * Sibling to {@link AutoUnlockBody}; selected by `header.bundleKind ===\n * 'extracted-partition'`. The inner `dump` is a re-keyed projection with\n * an empty `keyrings` map.\n */\nexport interface ExtractedPartitionBody {\n  readonly _noydb_bundle_body: 1\n  readonly dump: string\n  readonly _transferSeal: TransferSealPayload\n}\n\nexport function buildExtractedPartitionWrapper(\n  dumpJson: string,\n  seal: TransferSealPayload,\n): ExtractedPartitionBody {\n  return { _noydb_bundle_body: 1, dump: dumpJson, _transferSeal: seal }\n}\n\nexport function parseExtractedPartitionBody(\n  bodyString: string,\n): { dump: string; seal: TransferSealPayload } {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(bodyString)\n  } catch (err) {\n    throw new BundleIntegrityError(\n      'header declared extracted-partition but body could not be parsed as JSON wrapper: '\n      + (err instanceof Error ? err.message : String(err)),\n    )\n  }\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw new BundleIntegrityError('extracted-partition body is not a JSON object')\n  }\n  const obj = parsed as Record<string, unknown>\n  if (obj['_noydb_bundle_body'] !== 1) {\n    throw new BundleIntegrityError(\n      'extracted-partition body missing `_noydb_bundle_body: 1` discriminator',\n    )\n  }\n  if (typeof obj['dump'] !== 'string') {\n    throw new BundleIntegrityError('extracted-partition body must carry a string `dump` field')\n  }\n  const seal = obj['_transferSeal']\n  if (typeof seal !== 'object' || seal === null) {\n    throw new BundleIntegrityError('extracted-partition body missing `_transferSeal` blob')\n  }\n  const s = seal as Record<string, unknown>\n  if (s['v'] !== 1 || s['alg'] !== 'aes-256-gcm-pre-shared'\n      || typeof s['sealId'] !== 'string' || typeof s['payload'] !== 'string') {\n    throw new BundleIntegrityError('extracted-partition `_transferSeal` blob is malformed')\n  }\n  return { dump: obj['dump'], seal: seal as TransferSealPayload }\n}\n\n/**\n * Coerce an unsealed perUser entry to `AutoCredential`. Older bundles\n * store bare strings; newer bundles store `{ kind, value }` objects.\n */\nfunction coerceUnsealed(entry: AutoCredential | string): AutoCredential {\n  if (typeof entry === 'string') return { kind: 'secret', value: entry }\n  return entry\n}\n\n/**\n * Resolve the `_autoUnlock` blob into a typed per-user credential map.\n *\n * - For `kind: 'unsealed'`: pass through, coercing pre-0.2 bare strings\n *   to `{ kind: 'secret', value }`.\n * - For `kind: 'sealed'`: pick a `SealingKeyProvider` from\n *   `opts.sealingProviders` whose `.id` matches each entry's `pid`;\n *   unseal to `AutoCredential`. When no provider matches AND strict mode\n *   (default), throw `BundleSealMismatchError`. With\n *   `attemptUnsealAcrossProviders: true`, try each provider whose\n *   `alg` matches the envelope.\n *   Exception: if an unmatched entry carries a `hint` field (recipient-target\n *   entries), it passes through as `{ kind, value: base64sealed }` rather than\n *   throwing — multi-recipient bundles have N-1 unmatched entries from each\n *   recipient's perspective, and the consumer is expected to ignore entries\n *   not addressed to them.\n * - When `sealingProviders` is unset entirely on a `'sealed'` bundle,\n *   pass through the SEALED entries as `{ kind, value: base64sealed }` —\n *   the caller can inspect or unseal elsewhere.\n *\n * Pre-0.2 sealed entries missing `kind` default to `'secret'`.\n */\nasync function resolveAutoUnlock(\n  blob: AutoUnlockBody['_autoUnlock'],\n  opts: ReadNoydbBundleOptions,\n): Promise<{ kind: 'unsealed' | 'sealed'; perUser: Record<string, AutoCredential> }> {\n  if (blob.kind === 'unsealed') {\n    const resolved: Record<string, AutoCredential> = {}\n    for (const [userId, entry] of Object.entries(blob.perUser)) {\n      resolved[userId] = coerceUnsealed(entry)\n    }\n    return { kind: 'unsealed', perUser: resolved }\n  }\n  // Sealed path.\n  if (opts.sealingProviders === undefined || opts.sealingProviders.length === 0) {\n    // Inspection mode — pass the sealed payload through as a typed\n    // credential whose `value` is the opaque base64 sealed bytes.\n    // The caller is signalled by `kind: 'sealed'` on the outer result.\n    const passthrough: Record<string, AutoCredential> = {}\n    for (const [userId, entry] of Object.entries(blob.perUser)) {\n      passthrough[userId] = { kind: entry.kind ?? 'secret', value: entry.sealed }\n    }\n    return { kind: 'sealed', perUser: passthrough }\n  }\n  const providersByPid = new Map<string, SealingKeyProvider>()\n  for (const p of opts.sealingProviders) providersByPid.set(p.id, p)\n\n  const decoder = new TextDecoder()\n  const unsealedMap: Record<string, AutoCredential> = {}\n\n  for (const [userId, entry] of Object.entries(blob.perUser)) {\n    const credKind: AutoCredentialKind = entry.kind ?? 'secret'\n    const provider = providersByPid.get(entry.pid)\n    if (provider === undefined) {\n      if (opts.attemptUnsealAcrossProviders === true) {\n        // Try each provider; first that succeeds wins.\n        let opened: string | null = null\n        for (const candidate of opts.sealingProviders) {\n          try {\n            const plaintextBytes = await candidate.unseal(base64ToBytes(entry.sealed))\n            opened = decoder.decode(plaintextBytes)\n            break\n          } catch {\n            // try next\n          }\n        }\n        if (opened === null) {\n          if (entry.hint !== undefined) {\n            // Recipient-target entry not addressed to any held key — pass through sealed.\n            // Other recipients' entries in a multi-recipient bundle are opaque to us.\n            unsealedMap[userId] = { kind: credKind, value: entry.sealed }\n            continue\n          }\n          throw new BundleSealMismatchError(userId, entry.pid)\n        }\n        unsealedMap[userId] = { kind: credKind, value: opened }\n        continue\n      }\n      if (entry.hint !== undefined) {\n        // Recipient-target entry not addressed to any held key — pass through sealed.\n        // Multi-recipient bundles deliberately seal each user's entry under their own\n        // public key; a reader holding only alice's key will not match bob's pid.\n        unsealedMap[userId] = { kind: credKind, value: entry.sealed }\n        continue\n      }\n      throw new BundleSealMismatchError(userId, entry.pid)\n    }\n    const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed))\n    unsealedMap[userId] = { kind: credKind, value: decoder.decode(plaintextBytes) }\n  }\n  return { kind: 'sealed', perUser: unsealedMap }\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n  return btoa(binary)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n  const binary = atob(b64)\n  const out = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i)\n  return out\n}\n\n/**\n * Detect whether the runtime's `CompressionStream` supports brotli.\n *\n * Brotli requires Node 22+ / Chrome 124+ / Firefox 122+. The\n * detection runs the `CompressionStream` constructor in a\n * try/catch — unsupported formats throw `TypeError` synchronously,\n * making this a safe one-shot check that we cache for the\n * lifetime of the process.\n */\nlet cachedBrotliSupport: boolean | null = null\nfunction supportsBrotliCompression(): boolean {\n  if (cachedBrotliSupport !== null) return cachedBrotliSupport\n  try {\n    new CompressionStream('br' as CompressionFormat)\n    cachedBrotliSupport = true\n  } catch {\n    cachedBrotliSupport = false\n  }\n  return cachedBrotliSupport\n}\n\n/** Test-only: reset the brotli detection cache between tests. */\nexport function resetBrotliSupportCache(): void {\n  cachedBrotliSupport = null\n}\n\n/**\n * Pick the compression algorithm and the corresponding format byte\n * from a user option. Throws if the user explicitly requests brotli\n * on a runtime that doesn't support it — a silent fallback would\n * make the produced bundle smaller-than-expected and confuse\n * size-bound tests.\n */\nfunction selectCompression(option: WritePodOptions['compression']): {\n  format: CompressionAlgo\n  streamFormat: CompressionFormat | null\n} {\n  const choice = option ?? 'auto'\n  if (choice === 'none') return { format: COMPRESSION_NONE, streamFormat: null }\n  if (choice === 'gzip') return { format: COMPRESSION_GZIP, streamFormat: 'gzip' }\n  if (choice === 'brotli') {\n    if (!supportsBrotliCompression()) {\n      throw new Error(\n        `writePod({ compression: 'brotli' }) is not supported on this ` +\n          `runtime. Brotli requires Node 22+, Chrome 124+, or Firefox 122+. ` +\n          `Use { compression: 'auto' } to fall back to gzip silently, or ` +\n          `{ compression: 'gzip' } to be explicit.`,\n      )\n    }\n    return { format: COMPRESSION_BROTLI, streamFormat: 'br' as CompressionFormat }\n  }\n  // 'auto' — prefer brotli, fall back to gzip\n  if (supportsBrotliCompression()) {\n    return { format: COMPRESSION_BROTLI, streamFormat: 'br' as CompressionFormat }\n  }\n  return { format: COMPRESSION_GZIP, streamFormat: 'gzip' }\n}\n\n/**\n * Pump a Uint8Array through a CompressionStream / DecompressionStream\n * and collect the output. Both APIs are universally available in\n * Node 18+ and modern browsers; the only variance is which\n * formats they support, handled by `selectCompression` above.\n *\n * Implementation: build a single-chunk ReadableStream from the\n * input, pipe through the transform, then drain the resulting\n * ReadableStream into a single concatenated Uint8Array. This is\n * O(N) memory in the input + output sizes, which is fine for the\n * dump-sized payloads (typically <50MB) targets.\n */\nasync function pumpThroughStream(\n  input: Uint8Array,\n  stream: CompressionStream | DecompressionStream,\n): Promise<Uint8Array> {\n  const readable = new Blob([input as BlobPart]).stream().pipeThrough(stream)\n  const reader = readable.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n  for (;;) {\n    const { value, done } = await reader.read()\n    if (done) break\n    if (value) {\n      chunks.push(value as Uint8Array)\n      total += value.length\n    }\n  }\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    out.set(chunk, offset)\n    offset += chunk.length\n  }\n  return out\n}\n\n/**\n * SHA-256 hex digest of `bytes`. Used for the bundle integrity\n * hash carried in the header. Web Crypto API only — no Node\n * crypto module, no third-party hash library.\n *\n * The output format is lowercase hex (64 chars for SHA-256). The\n * format validator pins this — uppercase or mixed-case digests\n * are rejected, so the writer and reader agree on canonicalization.\n */\nasync function sha256Hex(bytes: Uint8Array): Promise<string> {\n  // Copy into a fresh ArrayBuffer-backed Uint8Array. The\n  // underlying buffer of `bytes` may be SharedArrayBuffer (e.g.\n  // from a worker), which `subtle.digest` rejects via TypeScript's\n  // BufferSource type. Allocating a fresh ArrayBuffer-backed view\n  // sidesteps the type narrowing and is portable across all\n  // runtimes — the copy cost is O(N) but bundle bodies are\n  // typically <50MB, well below the threshold where the copy\n  // matters.\n  const copy = new Uint8Array(bytes.length)\n  copy.set(bytes)\n  return sha256HexBytes(copy)\n}\n\n/**\n * Concatenate any number of Uint8Arrays into a single new buffer.\n * Used to assemble the final bundle from its prefix + header +\n * body parts.\n */\nfunction concatBytes(parts: readonly Uint8Array[]): Uint8Array {\n  let total = 0\n  for (const p of parts) total += p.length\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const p of parts) {\n    out.set(p, offset)\n    offset += p.length\n  }\n  return out\n}\n\n/**\n * Replace the bundle's keyrings with freshly built recipient slots,\n * one per supplied recipient. No-op when neither `exportSecret`\n * nor `recipients` is set — the source keyring is inherited as-is.\n *\n * The single-secret shorthand creates a one-recipient list whose\n * id, role, and permissions inherit from the source vault — useful\n * for \"back up to a different secret\" without changing role\n * semantics. The multi-recipient form wraps each slot independently\n * with its declared role + permissions.\n *\n * @internal\n */\nasync function applyRecipientRewrap(\n  vault: Vault,\n  dumpJson: string,\n  opts: WritePodOptions,\n): Promise<string> {\n  if (opts.exportSecret === undefined && opts.recipients === undefined) {\n    return dumpJson\n  }\n\n  const recipients: readonly BundleRecipient[] =\n    opts.recipients ?? [\n      {\n        id: vault.userId,\n        secret: opts.exportSecret as string,\n        role: vault.role,\n      },\n    ]\n\n  const recipientKeyrings = await vault.buildBundleRecipientKeyrings(recipients)\n\n  const backup = JSON.parse(dumpJson) as { keyrings: unknown; [k: string]: unknown }\n  backup.keyrings = recipientKeyrings\n  return JSON.stringify(backup)\n}\n\n/**\n * Apply opt-in slice filters to a vault dump JSON string. Filters that\n * narrow the bundle without crossing the encryption boundary — both\n * operate on metadata (collection name, envelope `_ts`) and never need\n * to decrypt records. When neither filter is set, the dump is returned\n * unchanged so the no-arg path stays a pure passthrough.\n *\n * Internal-collection filtering: when a `collections` allowlist is\n * provided, the bundle still carries `_internal` (ledger entries) and\n * the keyrings — they're necessary for the receiver to verify and\n * unlock the bundle. The allowlist applies to the user-collection\n * map only.\n *\n * @internal\n */\nfunction applySliceFilters(\n  dumpJson: string,\n  opts: WritePodOptions,\n): string {\n  const collectionsFilter = opts.collections\n    ? new Set(opts.collections)\n    : null\n  const sinceMs =\n    opts.since !== undefined ? new Date(opts.since).getTime() : null\n  if (collectionsFilter === null && sinceMs === null) return dumpJson\n\n  // Parse, prune, re-serialize. The dump shape is stable\n  // (VaultBackup) so this is a one-off allocation; for vaults beyond\n  // the documented 1K–50K target a streaming variant would be a\n  // follow-up, but the simple parse path keeps the slice path\n  // type-safe and trivially auditable.\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, { _ts?: string }>>\n    [k: string]: unknown\n  }\n\n  if (backup.collections && typeof backup.collections === 'object') {\n    const next: Record<string, Record<string, unknown>> = {}\n    for (const [name, records] of Object.entries(backup.collections)) {\n      if (collectionsFilter && !collectionsFilter.has(name)) continue\n      if (sinceMs === null) {\n        next[name] = records\n        continue\n      }\n      const kept: Record<string, unknown> = {}\n      for (const [id, env] of Object.entries(records)) {\n        const envTs = env._ts ? new Date(env._ts).getTime() : NaN\n        if (Number.isFinite(envTs) && envTs >= sinceMs) {\n          kept[id] = env\n        }\n      }\n      next[name] = kept\n    }\n    backup.collections = next as typeof backup.collections\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Unconditionally drop satellite-collection records whose base row is dead\n * (absent or tombstoned — existence.ts rule 1) from a vault dump. Unlike\n * `applySliceFilters` / `applyPlaintextFilters`, this isn't opt-in: a\n * satellite envelope that outlived its base is dead ciphertext (plus its\n * wrapped keys) that should never leave the vault in a `.noydb` backup\n * (#591 Task 10 — closes the last enumerated existence-authority surface).\n *\n * Pairing info comes from the persisted `_schemas/<name>` marker rather\n * than the in-memory `SatelliteRegistry` — that registry is private to\n * `Vault` and the bundle-export path only has `Vault._introspectState()`\n * (adapter + vault name + per-collection DEK accessor), so it reads the\n * marker instead of widening the kernel's surface. See\n * `with-shape/satellites/dead-filter.ts`.\n *\n * No-ops (returns `dumpJson` unchanged) when the vault has no detectable\n * satellite collections at all, so vaults that never use satellites pay\n * no extra parse/reserialize cost. Also no-ops when `vault` doesn't\n * implement `_introspectState()` at all — some call sites pass a minimal\n * duck-typed vault-like object for unit tests (e.g.\n * `snapshots.test.ts`'s `makeMockVault`, which implements only\n * `getBundleHandle`/`dump`/`load`/`getCover`); a real `Vault`\n * always implements it.\n *\n * @internal\n */\nasync function applySatelliteLivenessFilter(\n  vault: Vault,\n  dumpJson: string,\n): Promise<string> {\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, unknown>>\n    [k: string]: unknown\n  }\n  if (!backup.collections || typeof backup.collections !== 'object') return dumpJson\n  if (typeof vault._introspectState !== 'function') return dumpJson\n\n  const { adapter, name, getDEK } = vault._introspectState()\n  const { liveBaseIdSetsForBundle } = await import('../with-shape/satellites/dead-filter.js')\n  const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK)\n  if (satLive.size === 0) return dumpJson\n\n  const next: Record<string, Record<string, unknown>> = {}\n  for (const [collName, records] of Object.entries(backup.collections)) {\n    const live = satLive.get(collName)\n    if (!live) { next[collName] = records; continue }\n    const kept: Record<string, unknown> = {}\n    for (const [id, env] of Object.entries(records)) {\n      if (live.has(id)) kept[id] = env\n    }\n    next[collName] = kept\n  }\n  backup.collections = next\n  return JSON.stringify(backup)\n}\n\n/**\n * Apply opt-in plaintext-tier filters\n * to a vault dump. Operates BEFORE `applySliceFilters` so the metadata\n * pass sees the trimmed record set.\n *\n * The filter never re-encrypts: surviving records carry their original\n * envelope unchanged. Failing records are dropped from the\n * `collections` map. Internal collections (ledger, deltas) and the\n * keyrings map are untouched.\n *\n * @internal\n */\nasync function applyPlaintextFilters(\n  vault: Vault,\n  dumpJson: string,\n  opts: WritePodOptions,\n): Promise<string> {\n  if (opts.where === undefined && opts.tierAtMost === undefined) {\n    return dumpJson\n  }\n\n  type Env = { _ts?: string; _tier?: number; _iv: string; _data: string }\n  const backup = JSON.parse(dumpJson) as {\n    collections?: Record<string, Record<string, Env>>\n    [k: string]: unknown\n  }\n  if (!backup.collections || typeof backup.collections !== 'object') {\n    return dumpJson\n  }\n\n  const tierCeiling = opts.tierAtMost\n  const where = opts.where\n\n  const next: Record<string, Record<string, Env>> = {}\n  for (const [collName, records] of Object.entries(backup.collections)) {\n    const kept: Record<string, Env> = {}\n    for (const [id, env] of Object.entries(records)) {\n      // Tier ceiling — runs FIRST so we don't waste a decrypt on\n      // records about to be dropped anyway. Envelope tier defaults to\n      // 0 when absent (matches Vault's tier-0 conventions).\n      if (tierCeiling !== undefined) {\n        const tier = env._tier ?? 0\n        if (tier > tierCeiling) continue\n      }\n      // Plaintext predicate — decrypt, run, keep on truthy. Errors\n      // from inside the predicate propagate (callers want to see why\n      // their filter blew up rather than getting a silent passthrough).\n      if (where !== undefined) {\n        const record = await vault._decryptEnvelopeForBundleFilter(\n          env as never,\n          collName,\n        )\n        const ok = await where(record, { collection: collName, id })\n        if (!ok) continue\n      }\n      kept[id] = env\n    }\n    next[collName] = kept\n  }\n  backup.collections = next\n  return JSON.stringify(backup)\n}\n\n/**\n * Write a `.noydb` bundle for the given vault.\n *\n * Pipeline:\n *   1. Resolve or create the compartment's stable bundle handle\n *      via `vault.getBundleHandle()` — same handle on\n *      every export from the same vault instance, so cloud\n *      adapters can use it as a primary key.\n *   2. `vault.dump()` → JSON string with encrypted records\n *      inside.\n *   3. UTF-8 encode the dump string.\n *   4. Compress (brotli if available, gzip fallback by default).\n *   5. Compute SHA-256 of the compressed body for integrity.\n *   6. Build the minimum-disclosure header from format version,\n *      handle, body length, body sha.\n *   7. Serialize: magic (4) + flags (1) + algo (1) + headerLen (4)\n *      + header JSON (N) + compressed body (M).\n *\n * The output is a single `Uint8Array`. Consumers writing to disk\n * pass it to `fs.writeFile`; consumers uploading to cloud storage\n * pass it as the request body. The `@noy-db/file` adapter wraps\n * this with a `saveBundle(path, vault)` helper.\n */\n/**\n * Assemble the final `.noydb` container bytes from a body JSON string +\n * header extras. Shared by `writePod` and `extractPartition`\n * so both producers go through one compress/hash/prefix path.\n *\n * @internal\n */\nexport async function assembleBundleContainer(opts: {\n  handle: string\n  bodyJsonStr: string\n  compression: WritePodOptions['compression']\n  /** Header fields beyond the always-present four. */\n  headerExtras?: Partial<Pick<NoydbPodHeader,\n    | 'publicEnvelope' | 'autoUnlock' | 'bundleKind' | 'transferSeal'\n    | 'engineRange' | 'unlockMethods' | 'hasApp' | 'species' | 'pointerMode' | 'redirect'\n  >>\n  /**\n   * When present, the assembled header is signed (#943): the header is\n   * bumped to `formatVersion: 2` and carries the sig/keyId/sigAlg tuple.\n   * Absent → an unsigned `formatVersion: 1` header (partitions, and pods\n   * from vaults without a signer, stay unsigned).\n   */\n  signer?: DocSigner\n}): Promise<Uint8Array> {\n  const dumpBytes = new TextEncoder().encode(opts.bodyJsonStr)\n  const { format, streamFormat } = selectCompression(opts.compression)\n  const body = streamFormat === null\n    ? dumpBytes\n    : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat))\n  const bodySha256 = await sha256Hex(body)\n\n  const header: NoydbPodHeader = {\n    formatVersion: NOYDB_BUNDLE_FORMAT_VERSION,\n    handle: opts.handle,\n    bodyBytes: body.length,\n    bodySha256,\n    ...(opts.headerExtras?.publicEnvelope !== undefined ? { publicEnvelope: opts.headerExtras.publicEnvelope } : {}),\n    ...(opts.headerExtras?.autoUnlock !== undefined ? { autoUnlock: opts.headerExtras.autoUnlock } : {}),\n    ...(opts.headerExtras?.bundleKind !== undefined ? { bundleKind: opts.headerExtras.bundleKind } : {}),\n    ...(opts.headerExtras?.transferSeal !== undefined ? { transferSeal: opts.headerExtras.transferSeal } : {}),\n    ...(opts.headerExtras?.engineRange !== undefined ? { engineRange: opts.headerExtras.engineRange } : {}),\n    ...(opts.headerExtras?.unlockMethods !== undefined ? { unlockMethods: opts.headerExtras.unlockMethods } : {}),\n    ...(opts.headerExtras?.hasApp !== undefined ? { hasApp: opts.headerExtras.hasApp } : {}),\n    ...(opts.headerExtras?.species !== undefined ? { species: opts.headerExtras.species } : {}),\n    ...(opts.headerExtras?.pointerMode !== undefined ? { pointerMode: opts.headerExtras.pointerMode } : {}),\n    ...(opts.headerExtras?.redirect !== undefined ? { redirect: opts.headerExtras.redirect } : {}),\n  }\n  // Header signing (#943): sign the header object as it will stand at\n  // formatVersion 2 WITH keyId + sigAlg but WITHOUT `sig`, then attach the\n  // resulting 3-tuple + bump the version. `signRecord`/`canonicalJson`\n  // throw on any `undefined`, so the signed payload is built with only the\n  // fields actually present (spread of the header carries no undefined\n  // keys). Only produce formatVersion 2 WHEN signing — an unsigned pod\n  // stays formatVersion 1 with no sig fields.\n  const signed: NoydbPodHeader = opts.signer === undefined\n    ? header\n    : await (async (s: DocSigner): Promise<NoydbPodHeader> => {\n        const toSign = { ...header, formatVersion: NOYDB_BUNDLE_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: 'ed25519' as const }\n        const sig = await signRecord(s.privateKeyPkcs8B64, toSign)\n        return { ...toSign, sig }\n      })(opts.signer)\n  const headerBytes = encodeBundleHeader(signed)\n\n  const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES)\n  prefix.set(NOYDB_BUNDLE_MAGIC, 0)\n  prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH\n  prefix[5] = format\n  writeUint32BE(prefix, 6, headerBytes.length)\n\n  return concatBytes([prefix, headerBytes, body])\n}\n\nexport async function writePod(\n  vault: Vault,\n  opts: WritePodOptions = {},\n): Promise<Uint8Array> {\n  if (opts.exportSecret !== undefined && opts.recipients !== undefined) {\n    throw new Error(\n      'writePod: pass either exportSecret or recipients, not both',\n    )\n  }\n\n  // Auto-unlock: normalize once, validate + build from the\n  // same NormalizedAutoUnlock object so there's no double-normalize call.\n  const normalizedAutoUnlock = normalizeAutoUnlock(opts)\n  const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock)\n\n  const handle = await vault.getBundleHandle()\n  const dumpJson = await vault.dump()\n\n  // Satellite existence-authority filter (#591 Task 10) — unconditional,\n  // runs before every other filter so dead-ciphertext satellite records\n  // never reach recipient rewrap or the opt-in filters below.\n  const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson)\n\n  // Re-keying: when caller supplied recipients (or the single-recipient\n  // shorthand), substitute the bundle's `keyrings` map with freshly\n  // built recipient slots before slice filters run.\n  const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts)\n  // Plaintext-tier filters run BEFORE\n  // the metadata-only slice — that way the metadata pass sees the\n  // already-trimmed record set and the two filter chains compose\n  // cleanly.\n  const plainFiltered = await applyPlaintextFilters(vault, rekeyed, opts)\n  const filtered = applySliceFilters(plainFiltered, opts)\n\n  // If no auto-unlock requested, body remains the raw dump JSON.\n  // Otherwise build the wrapped body containing the\n  // dump + `_autoUnlock` blob and serialize.\n  const bodyJsonStr = normalizedAutoUnlock === null\n    ? filtered\n    : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock))\n  // Snapshot the source vault's cover into the header when one is\n  // persisted. `Vault.getCover` tolerates a missing document and\n  // returns undefined, which we propagate as \"no cover in the\n  // header.\" Vaults without a `_meta/public-envelope` document\n  // (the frozen wire name) produce minimum-disclosure headers\n  // exactly like before, preserving back-compat.\n  const cover = await vault.getCover()\n\n  // Resolve the header signer (#943): explicit `false` disables signing;\n  // an explicit DocSigner is used verbatim (no vault touch); otherwise fall\n  // back to the vault's persisted signer, which is `null` (unsigned) when\n  // none was ever minted — export never mints one.\n  const signer = opts.sign === false\n    ? undefined\n    : opts.sign !== undefined\n      ? opts.sign\n      : (await vault._loadPodSigner()) ?? undefined\n\n  return assembleBundleContainer({\n    handle,\n    bodyJsonStr,\n    compression: opts.compression,\n    headerExtras: {\n      // `publicEnvelope` is the frozen wire key for the cover (#799).\n      ...(cover !== undefined ? { publicEnvelope: cover } : {}),\n      ...(autoUnlockMode !== null ? { autoUnlock: autoUnlockMode } : {}),\n      // Header L2 fields (#942) — passed through verbatim from opts.\n      ...(opts.engineRange !== undefined ? { engineRange: opts.engineRange } : {}),\n      ...(opts.unlockMethods !== undefined ? { unlockMethods: opts.unlockMethods } : {}),\n      ...(opts.hasApp !== undefined ? { hasApp: opts.hasApp } : {}),\n      ...(opts.species !== undefined ? { species: opts.species } : {}),\n      ...(opts.pointerMode !== undefined ? { pointerMode: opts.pointerMode } : {}),\n      ...(opts.redirect !== undefined ? { redirect: opts.redirect } : {}),\n    },\n    ...(signer !== undefined ? { signer } : {}),\n  })\n}\n\n/** @deprecated Use `writePod`. */\nexport const writeNoydbBundle = writePod\n\n/**\n * Internal helper shared by both readers — parses just the prefix\n * + header region of a bundle without touching the body. Returns\n * the parsed header plus the offset where the body starts and the\n * compression algorithm needed to decompress it.\n *\n * Throws on any format violation: missing/invalid magic, truncated\n * prefix, header length larger than the file, or unknown\n * compression algorithm.\n */\nfunction parsePrefixAndHeader(bytes: Uint8Array): {\n  header: NoydbPodHeader\n  bodyOffset: number\n  algo: CompressionAlgo\n  flags: number\n} {\n  if (!hasNoydbBundleMagic(bytes)) {\n    throw new Error(\n      `Not a .noydb bundle: missing 'NDB1' magic prefix. The first 4 bytes ` +\n        `are ${[...bytes.slice(0, 4)].map((b) => b.toString(16).padStart(2, '0')).join(' ')}.`,\n    )\n  }\n  if (bytes.length < NOYDB_BUNDLE_PREFIX_BYTES) {\n    throw new Error(\n      `Truncated .noydb bundle: file is only ${bytes.length} bytes, ` +\n        `which is less than the ${NOYDB_BUNDLE_PREFIX_BYTES}-byte fixed prefix.`,\n    )\n  }\n  const flags = bytes[4]!\n  const algo = bytes[5]!\n  if (algo !== COMPRESSION_NONE && algo !== COMPRESSION_GZIP && algo !== COMPRESSION_BROTLI) {\n    throw new Error(\n      `.noydb bundle declares unknown compression algorithm ${algo}. ` +\n        `Known values: 0 (none), 1 (gzip), 2 (brotli).`,\n    )\n  }\n  const headerLength = readUint32BE(bytes, 6)\n  const bodyOffset = NOYDB_BUNDLE_PREFIX_BYTES + headerLength\n  if (bodyOffset > bytes.length) {\n    throw new Error(\n      `Truncated .noydb bundle: declared header length ${headerLength} ` +\n        `would extend past end of file (${bytes.length} bytes).`,\n    )\n  }\n  const headerBytes = bytes.slice(NOYDB_BUNDLE_PREFIX_BYTES, bodyOffset)\n  const header = decodeBundleHeader(headerBytes)\n  return { header, bodyOffset, algo: algo as CompressionAlgo, flags }\n}\n\n/**\n * Read just the bundle header — no body decompression, no\n * integrity verification. Intended for cloud-listing UIs that want\n * to show the handle and size before downloading the full body.\n *\n * Returns the same `NoydbPodHeader` shape as the writer, with\n * minimum-disclosure validation already applied.\n *\n * **Cost** — O(prefix + header bytes). The header is normally well\n * under 1 KB, but may grow to roughly 256 KB when a `publicEnvelope`\n * with an inline icon is present. Cloud-listing UIs that previously\n * assumed sub-KB header reads should account for this when sizing\n * range requests against bundles that may carry icons.\n */\nexport function readPodHeader(bytes: Uint8Array): NoydbPodHeader {\n  return parsePrefixAndHeader(bytes).header\n}\n\n/** @deprecated Use `readPodHeader`. */\nexport const readNoydbBundleHeader = readPodHeader\n\n/**\n * Outcome of {@link verifyPodHeader}.\n *\n *   - `verified`  — the header carried a sig-tuple, its `keyId` is in\n *     `trustedKeys`, and the signature checks out over the canonical\n *     header bytes.\n *   - `unsigned`  — the header carried no signature (a legacy v1 pod, or a\n *     v2 pod written with `{ sign: false }`). Not an error; just unauthenticated.\n *   - `untrusted` — the header is signed but its `keyId` is not one the\n *     caller trusts. The signature was NOT checked.\n *   - `tampered`  — the header is signed by a trusted key but the signature\n *     does not verify: the signed bytes were altered, or the mapped public\n *     key is not the one that actually signed.\n */\nexport interface PodVerifyResult {\n  readonly status: 'verified' | 'unsigned' | 'untrusted' | 'tampered'\n  /** The header's `keyId`, present whenever the header carried a sig-tuple. */\n  readonly keyId?: string\n}\n\n/**\n * Authenticate a pod header (#943) — a pure, dependency-free, WebCrypto-only\n * verifier. Given only the raw pod bytes and a `trustedKeys` map\n * (`keyId → publicKeyB64` the caller already trusts), it reports whether the\n * header was signed by a trusted document signer.\n *\n * Pairs with the signing half in `assembleBundleContainer`/`writePod`: the\n * signed payload is the final wire header with `sig` removed, so verification\n * reconstructs it by stripping EXACTLY the `sig` field — `keyId`, `sigAlg`,\n * and every other header field stay in the verified payload.\n *\n * No store, enclave, or vault dependency — reachable from a static page with\n * only the pod bytes, the trusted-key map, and `globalThis.crypto`.\n *\n * SECURITY — authenticity is not integrity. A `verified` result proves the\n * header (which includes the *claimed* `bodySha256`) is signed by a trusted\n * key; it does NOT prove the body matches that hash. To trust the pod's\n * BODY you MUST also confirm the body hashes to `header.bodySha256` — call\n * `readPod`, which throws `BundleIntegrityError` on mismatch. A `verified`\n * header paired with a swapped body is caught only by that integrity check.\n * This function stays body-free by design so a static page can authenticate a\n * header without decompressing the body; composing the two checks is the\n * caller's responsibility. See `docs/subsystems/pod-signature.md`.\n */\nexport async function verifyPodHeader(\n  bytes: Uint8Array,\n  trustedKeys: Readonly<Record<string, string>>,\n): Promise<PodVerifyResult> {\n  const { header } = parsePrefixAndHeader(bytes)\n\n  // No signature tuple → unsigned, regardless of formatVersion. The format\n  // layer guarantees sig/keyId/sigAlg are all-or-nothing, so any one being\n  // absent means the header is unsigned.\n  if (header.sig === undefined || header.keyId === undefined || header.sigAlg === undefined) {\n    return { status: 'unsigned' }\n  }\n\n  const publicKeyB64 = trustedKeys[header.keyId]\n  if (publicKeyB64 === undefined) {\n    return { status: 'untrusted', keyId: header.keyId }\n  }\n\n  // Reconstruct the signed payload: the FINAL wire header minus EXACTLY `sig`.\n  const payload: Record<string, unknown> = { ...header }\n  delete payload['sig']\n\n  const ok = await verifyRecord(publicKeyB64, header.sig, payload)\n  return { status: ok ? 'verified' : 'tampered', keyId: header.keyId }\n}\n\n/**\n * Read just the bundle's cover (`https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`)\n * — without verifying the body or even parsing the dump JSON. Pass\n * the raw bundle bytes; receive the owner-curated metadata or\n * `undefined` if the bundle was written without one.\n *\n * Locale-resolves any `name` / `description` map fields when `locale`\n * is supplied. Omitting `locale` returns the raw cover.\n *\n * Same security caveat as the on-vault read path — the cover is an\n * **untrusted hint** in v1; the encrypted body remains\n * the source of truth for vault contents.\n */\nexport function readPodCover(\n  bytes: Uint8Array,\n  opts: { readonly locale?: string } = {},\n): Cover | undefined {\n  const header = parsePrefixAndHeader(bytes).header\n  const env = header.publicEnvelope\n  if (!env) return undefined\n  if (opts.locale === undefined) return env\n  return {\n    ...env,\n    ...(env.name !== undefined ? { name: pickLocale(env.name, opts.locale, env.defaultLocale) } : {}),\n    ...(env.description !== undefined ? { description: pickLocale(env.description, opts.locale, env.defaultLocale) } : {}),\n  }\n}\n\n/**\n * Read just the bundle's Redirect record (#944) — without verifying the\n * body or even parsing the dump JSON. Pass the raw bundle bytes; receive\n * the header's `redirect` field or `undefined` if the bundle was written\n * without one.\n *\n * The record is returned UNVERIFIED: `validateBundleHeader` only checks\n * its shape at parse time (a parser has no `trustedKeys`). Callers that\n * intend to follow the redirect MUST separately call `verifyRedirect`\n * (`redirect.js`) before trusting `target`.\n */\nexport function readPodRedirect(bytes: Uint8Array): Redirect | undefined {\n  return parsePrefixAndHeader(bytes).header.redirect\n}\n\n/**\n * Read a full `.noydb` bundle: validate magic + header, verify\n * integrity hash over the body bytes, decompress, and return the\n * original `vault.dump()` JSON string ready to pass to\n * `vault.load()`.\n *\n * Throws `BundleIntegrityError` if the body's actual SHA-256 does\n * not match the value declared in the header. Distinct from a\n * format error so consumers can pattern-match in catch blocks\n * (corrupted-in-transit vs malformed-by-producer).\n *\n * Note: this function does NOT take a secret. The dump JSON\n * inside the body still contains encrypted records — restoring\n * the vault requires `vault.load(dumpJson, secret)`\n * after this call. Splitting the layers keeps the bundle module\n * free of crypto concerns and lets the same code feed format\n * inspectors that never decrypt anything.\n */\nexport async function readPod(\n  bytes: Uint8Array,\n  opts: ReadNoydbBundleOptions = {},\n): Promise<NoydbBundleReadResult> {\n  const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes)\n  const body = bytes.slice(bodyOffset)\n\n  // Length check before hash check — a length mismatch is the\n  // cheapest tamper signal and produces a more actionable error.\n  if (body.length !== header.bodyBytes) {\n    throw new BundleIntegrityError(\n      `body length ${body.length} does not match header.bodyBytes ` +\n        `${header.bodyBytes}. The bundle was truncated or padded ` +\n        `between write and read.`,\n    )\n  }\n\n  const actualSha = await sha256Hex(body)\n  if (actualSha !== header.bodySha256) {\n    throw new BundleIntegrityError(\n      `body sha256 ${actualSha} does not match header.bodySha256 ` +\n        `${header.bodySha256}. The bundle bytes were modified between ` +\n        `write and read — refuse to decompress.`,\n    )\n  }\n\n  let dumpBytes: Uint8Array\n  if (algo === COMPRESSION_NONE) {\n    dumpBytes = body\n  } else {\n    const streamFormat: CompressionFormat =\n      algo === COMPRESSION_BROTLI ? ('br' as CompressionFormat) : 'gzip'\n    try {\n      dumpBytes = await pumpThroughStream(body, new DecompressionStream(streamFormat))\n    } catch (err) {\n      throw new BundleIntegrityError(\n        `decompression failed: ${(err as Error).message}. The bundle ` +\n          `passed the integrity hash but the body is not valid ` +\n          `${streamFormat} data — likely a producer bug.`,\n      )\n    }\n  }\n\n  const bodyString = new TextDecoder('utf-8', { fatal: true }).decode(dumpBytes)\n\n  // When the header signals auto-unlock, the body is a\n  // JSON wrapper carrying the dump string + the auto-unlock blob.\n  // When absent, the body IS the raw dump JSON.\n  if (header.autoUnlock === undefined) {\n    return { header, dumpJson: bodyString }\n  }\n  const { dump, blob } = parseAutoUnlockBody(bodyString)\n  const autoUnlock = await resolveAutoUnlock(blob, opts)\n  return { header, dumpJson: dump, autoUnlock }\n}\n\n/** @deprecated Use `readPod`. */\nexport const readNoydbBundle = readPod\n"],"mappings":";;;;;;;;;;;;;AAoDO,IAAM,qBAAqB,IAAI,WAAW,CAAC,IAAM,IAAM,IAAM,EAAI,CAAC;AAGlE,IAAM,4BAA4B;AAGlC,IAAM,8BAA8B;AAGpC,IAAM,qCAAqC;AAS3C,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAchC,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAiMlC,IAAM,sBAA2C,oBAAI,IAAI;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iBAAsC,oBAAI,IAAI;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,cAAmC,oBAAI,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,mBAAwC,oBAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAiBM,SAAS,qBACd,QACkC;AAClC,MAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,UAAM,IAAI;AAAA,MACR,mDAAmD,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,IAC7F;AAAA,EACF;AAIA,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,CAAC,oBAAoB,IAAI,GAAG,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,gDAAgD,GAAG,kDAE9C,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI;AACV,MACE,OAAO,EAAE,eAAe,MAAM,YAC7B,EAAE,eAAe,MAAM,+BAA+B,EAAE,eAAe,MAAM,oCAC9E;AACA,UAAM,IAAI;AAAA,MACR,8CAA8C,2BAA2B,OAAO,kCAAkC,SACzG,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,IAErC;AAAA,EACF;AACA,MAAI,OAAO,EAAE,QAAQ,MAAM,YAAY,CAAC,2BAA2B,KAAK,EAAE,QAAQ,CAAC,GAAG;AACpF,UAAM,IAAI;AAAA,MACR,iFACS,OAAO,EAAE,QAAQ,MAAM,WAAW,IAAI,EAAE,QAAQ,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI,OAAO,EAAE,WAAW,MAAM,YAAY,CAAC,OAAO,UAAU,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,IAAI,GAAG;AACjG,UAAM,IAAI;AAAA,MACR,sEACS,OAAO,EAAE,WAAW,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,MAAI,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,iBAAiB,KAAK,EAAE,YAAY,CAAC,GAAG;AAClF,UAAM,IAAI;AAAA,MACR,oFACS,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY,CAAC,CAAC;AAAA,IACjG;AAAA,EACF;AACA,MAAI,EAAE,gBAAgB,MAAM,QAAW;AACrC,UAAM,MAAM,EAAE,gBAAgB;AAC9B,QAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjE,YAAM,IAAI;AAAA,QACR,+EAA+E,OAAO,GAAG;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,IAAI;AACV,QAAI,EAAE,eAAe,MAAM,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,oEAAoE,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,OAAO,EAAE,SAAS,MAAM,YAAY,CAAC,OAAO,UAAU,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG;AAC3F,YAAM,IAAI;AAAA,QACR,+EAA+E,OAAO,EAAE,SAAS,CAAC,CAAC;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,YAAY,MAAM,QAAW;AACjC,QAAI,EAAE,YAAY,MAAM,cAAc,EAAE,YAAY,MAAM,UAAU;AAClE,YAAM,MAAM,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY;AAChG,YAAM,IAAI;AAAA,QACR,oFAAoF,GAAG;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,YAAY,MAAM,QAAW;AACjC,QAAI,EAAE,YAAY,MAAM,cAAc,EAAE,YAAY,MAAM,uBAAuB;AAC/E,YAAM,MAAM,OAAO,EAAE,YAAY,MAAM,WAAW,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,EAAE,YAAY;AAChG,YAAM,IAAI;AAAA,QACR,iGAAiG,GAAG;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,cAAc,MAAM,QAAW;AACnC,UAAM,KAAK,EAAE,cAAc;AAC3B,QAAI,OAAO,QAAQ,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,GAAG;AAC9D,YAAM,IAAI,MAAM,6EAA6E,OAAO,EAAE,GAAG;AAAA,IAC3G;AACA,UAAM,IAAI;AACV,QAAI,EAAE,GAAG,MAAM,GAAG;AAChB,YAAM,IAAI,MAAM,sDAAsD,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG;AAAA,IACzF;AACA,QAAI,EAAE,KAAK,MAAM,0BAA0B;AACzC,YAAM,IAAI,MAAM,+EAA+E,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG;AAAA,IACpH;AACA,QAAI,OAAO,EAAE,QAAQ,MAAM,YAAY,EAAE,QAAQ,EAAE,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,4EAA4E,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG;AAAA,IACpH;AAAA,EACF;AACA,MAAI,EAAE,OAAO,MAAM,QAAW;AAC5B,QAAI,OAAO,EAAE,OAAO,MAAM,YAAY,CAAC,iBAAiB,KAAK,EAAE,OAAO,CAAC,GAAG;AACxE,YAAM,IAAI;AAAA,QACR,oFACS,OAAO,EAAE,OAAO,MAAM,WAAW,IAAI,EAAE,OAAO,CAAC,MAAM,OAAO,EAAE,OAAO,CAAC;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,KAAK,MAAM,QAAW;AAC1B,QAAI,OAAO,EAAE,KAAK,MAAM,YAAY,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,mBAAmB,KAAK,EAAE,KAAK,CAAC,GAAG;AAC/F,YAAM,IAAI;AAAA,QACR,sEACS,OAAO,EAAE,KAAK,MAAM,WAAW,IAAI,EAAE,KAAK,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,QAAQ,MAAM,QAAW;AAC7B,QAAI,EAAE,QAAQ,MAAM,WAAW;AAC7B,YAAM,MAAM,OAAO,EAAE,QAAQ,MAAM,WAAW,IAAI,EAAE,QAAQ,CAAC,MAAM,OAAO,EAAE,QAAQ;AACpF,YAAM,IAAI,MAAM,mEAAmE,GAAG,GAAG;AAAA,IAC3F;AAAA,EACF;AACA,MAAI,EAAE,aAAa,MAAM,QAAW;AAClC,QAAI,OAAO,EAAE,aAAa,MAAM,YAAY,EAAE,aAAa,EAAE,WAAW,GAAG;AACzE,YAAM,IAAI;AAAA,QACR,uEACS,OAAO,EAAE,aAAa,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,eAAe,MAAM,QAAW;AACpC,UAAM,UAAU,EAAE,eAAe;AACjC,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,yEAAyE,OAAO,OAAO;AAAA,MACzF;AAAA,IACF;AACA,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,GAAG;AACnC,cAAM,IAAI;AAAA,UACR,sCAAsC,CAAC,qBAClC,CAAC,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC,SAAS,OAAO,QAAQ,CAAC,CAAC,CAAC;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,QAAQ,MAAM,QAAW;AAC7B,QAAI,OAAO,EAAE,QAAQ,MAAM,WAAW;AACpC,YAAM,IAAI;AAAA,QACR,mEAAmE,OAAO,EAAE,QAAQ,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,SAAS,MAAM,QAAW;AAC9B,QAAI,CAAC,YAAY,IAAI,EAAE,SAAS,CAAW,GAAG;AAC5C,YAAM,MAAM,OAAO,EAAE,SAAS,MAAM,WAAW,IAAI,EAAE,SAAS,CAAC,MAAM,OAAO,EAAE,SAAS;AACvF,YAAM,IAAI;AAAA,QACR,gDAAgD,CAAC,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,SAAS,GAAG;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,aAAa,MAAM,QAAW;AAClC,QAAI,EAAE,aAAa,MAAM,YAAY,EAAE,aAAa,MAAM,WAAW;AACnE,YAAM,MAAM,OAAO,EAAE,aAAa,MAAM,WAAW,IAAI,EAAE,aAAa,CAAC,MAAM,OAAO,EAAE,aAAa;AACnG,YAAM,IAAI,MAAM,oFAAoF,GAAG,GAAG;AAAA,IAC5G;AAAA,EACF;AACA,MAAI,EAAE,UAAU,MAAM,QAAW;AAC/B,UAAM,IAAI,EAAE,UAAU;AACtB,QAAI,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,GAAG;AAC3D,YAAM,IAAI,MAAM,yEAAyE,OAAO,CAAC,GAAG;AAAA,IACtG;AACA,UAAM,MAAM;AACZ,QAAI,IAAI,GAAG,MAAM,GAAG;AAClB,YAAM,IAAI,MAAM,kDAAkD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG;AAAA,IACvF;AACA,QAAI,OAAO,IAAI,QAAQ,MAAM,YAAY,IAAI,QAAQ,EAAE,WAAW,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,wEAAwE,OAAO,IAAI,QAAQ,CAAC,CAAC;AAAA,MAC/F;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,IAAI,IAAI,QAAQ,CAAW,GAAG;AAClD,YAAM,IAAI;AAAA,QACR,wDAAwD,CAAC,GAAG,gBAAgB,EAAE,KAAK,IAAI,CAAC,SAAS,OAAO,IAAI,QAAQ,CAAC,CAAC;AAAA,MACxH;AAAA,IACF;AACA,QAAI,OAAO,IAAI,UAAU,MAAM,YAAY,CAAC,iBAAiB,KAAK,IAAI,UAAU,CAAC,GAAG;AAClF,YAAM,IAAI;AAAA,QACR,gGACS,OAAO,IAAI,UAAU,MAAM,WAAW,IAAI,IAAI,UAAU,CAAC,MAAM,OAAO,IAAI,UAAU,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,OAAO,IAAI,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,WAAW,KAAK,CAAC,mBAAmB,KAAK,IAAI,KAAK,CAAC,GAAG;AACrG,YAAM,IAAI;AAAA,QACR,+EACS,OAAO,IAAI,KAAK,MAAM,WAAW,IAAI,IAAI,KAAK,CAAC,MAAM,OAAO,IAAI,KAAK,CAAC;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AAIA,QAAM,cAAc,EAAE,YAAY,MAAM;AACxC,QAAM,UAAU,EAAE,cAAc,MAAM;AACtC,MAAI,WAAW,CAAC,aAAa;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,CAAC,SAAS;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,eAAe,EAAE,YAAY,MAAM,QAAW;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAMA,QAAM,mBAAmB,CAAC,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,MAAS,EAAE;AAC5F,MAAI,mBAAmB,KAAK,mBAAmB,GAAG;AAChD,UAAM,IAAI;AAAA,MACR,6FACU,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,qBAAqB,KAAK,EAAE,eAAe,MAAM,oCAAoC;AACvF,UAAM,IAAI;AAAA,MACR,0EAA0E,kCAAkC,SACnG,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,IACrC;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,QAAoC;AACrE,uBAAqB,MAAM;AAK3B,QAAM,OAAO,KAAK,UAAU;AAAA,IAC1B,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,YAAY,OAAO;AAAA,IACnB,GAAI,OAAO,mBAAmB,SAAY,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,OAAO,eAAe,SAAY,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,IAC3E,GAAI,OAAO,eAAe,SAAY,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,IAC3E,GAAI,OAAO,iBAAiB,SAAY,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKjF,GAAI,OAAO,QAAQ,SAAY,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,IACtD,GAAI,OAAO,UAAU,SAAY,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC5D,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC/D,GAAI,OAAO,gBAAgB,SAAY,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,IAC9E,GAAI,OAAO,kBAAkB,SAAY,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,IACpF,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC/D,GAAI,OAAO,YAAY,SAAY,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IAClE,GAAI,OAAO,gBAAgB,SAAY,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,IAC9E,GAAI,OAAO,aAAa,SAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,EACvE,CAAC;AACD,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AACtC;AAMO,SAAS,mBAAmB,OAAmC;AACpE,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AACnE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,2CAA4C,IAAc,OAAO;AAAA,IACnE;AAAA,EACF;AACA,uBAAqB,MAAM;AAC3B,SAAO;AACT;AAQO,SAAS,aAAa,OAAmB,QAAwB;AACtE,UACG,MAAM,MAAM,KAAM,OAAO,MACzB,MAAM,SAAS,CAAC,KAAM,OACtB,MAAM,SAAS,CAAC,KAAM,KACvB,MAAM,SAAS,CAAC;AAEpB;AAMO,SAAS,cAAc,OAAmB,QAAgB,OAAqB;AACpF,QAAM,MAAM,IAAK,UAAU,KAAM;AACjC,QAAM,SAAS,CAAC,IAAK,UAAU,KAAM;AACrC,QAAM,SAAS,CAAC,IAAK,UAAU,IAAK;AACpC,QAAM,SAAS,CAAC,IAAI,QAAQ;AAC9B;AAOO,SAAS,oBAAoB,OAA4B;AAC9D,MAAI,MAAM,SAAS,mBAAmB,OAAQ,QAAO;AACrD,WAAS,IAAI,GAAG,IAAI,mBAAmB,QAAQ,KAAK;AAClD,QAAI,MAAM,CAAC,MAAM,mBAAmB,CAAC,EAAG,QAAO;AAAA,EACjD;AACA,SAAO;AACT;;;AC1pBA,SAAS,eAAe,aAAa,eAAe,YAAY;AAEzD,IAAM,cAAc;AAGpB,SAAS,YAAY,SAA8C;AACxE,SAAO,KAAK,cAAc,OAAO,CAAC;AACpC;AAMA,eAAsB,WAAW,oBAA4B,SAAmD;AAC9G,SAAO,YAAY,oBAAoB,YAAY,OAAO,CAAC;AAC7D;AAMA,eAAsB,aAAa,cAAsB,KAAa,SAAoD;AACxH,SAAO,cAAc,cAAc,KAAK,YAAY,OAAO,CAAC;AAC9D;;;ACgYA,SAAS,kBAAkB,GAA2D;AACpF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,UAAmB,MAAM,CAAC,CAAC;AAAA,EAC/E;AACF;AAYA,SAAS,oBAAoB,MAAoD;AAC/E,QAAM,MAAM;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP,EAAE,OAAO,OAAK,MAAM,MAAS,EAAE;AAC/B,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,MAAM,GAAG;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,MAAI,KAAK,oBAAoB,QAAW;AACtC,WAAO,EAAE,MAAM,YAAY,SAAS,KAAK,gBAAgB,QAAQ;AAAA,EACnE;AACA,MAAI,KAAK,gBAAgB,QAAW;AAClC,WAAO,EAAE,MAAM,YAAY,SAAS,kBAAkB,KAAK,YAAY,OAAO,EAAE;AAAA,EAClF;AACA,MAAI,KAAK,sBAAsB,QAAW;AACxC,QAAI,KAAK,kBAAkB,SAAS,oBAAoB;AACtD,YAAM,UAA0C,CAAC;AACjD,YAAM,QAAuC,CAAC;AAC9C,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,kBAAkB,OAAO,GAAG;AAC5E,gBAAQ,MAAM,IAAI,MAAM;AACxB,cAAM,MAAM,IAAI,MAAM;AAAA,MACxB;AACA,aAAO,EAAE,MAAM,oBAAoB,UAAU,KAAK,kBAAkB,UAAU,SAAS,MAAM;AAAA,IAC/F;AACA,WAAO,EAAE,MAAM,eAAe,UAAU,KAAK,kBAAkB,UAAU,SAAS,KAAK,kBAAkB,QAAQ;AAAA,EACnH;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,KAAK,cAAe;AAAA,IAC9B,SAAS,kBAAkB,KAAK,cAAe,OAAO;AAAA,EACxD;AACF;AAoBA,SAAS,0BACP,MACA,YAC8B;AAC9B,MAAI,eAAe,KAAM,QAAO;AAEhC,QAAM,cAAmC,oBAAI,IAAI,CAAC,UAAU,YAAY,KAAK,CAAC;AAG9E,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,QAAI,CAAC,YAAY,IAAI,KAAK,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR,kCAAkC,MAAM,2BAA2B,KAAK,IAAI;AAAA,MAG9E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,YAAY;AAElC,UAAM,SAAS,KAAK,iBAAiB,UAAU,KAAK,aAAa;AACjE,QAAI,WAAW,oBAAoB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MAKF;AAAA,IACF;AACA,UAAMA,aAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,QAAIA,eAAc,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,SAAS,oBAAoB;AAC1C,UAAM,WAAW,WAAW;AAC5B,QAAI,aAAa,UAAa,OAAQ,SAA6B,yBAAyB,cACrF,OAAQ,SAA6B,qBAAqB,YAAY;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AACzB,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,MAAM,uEAAkE;AAAA,IACpF;AACA,eAAW,UAAU,OAAO,KAAK,WAAW,OAAO,GAAG;AACpD,YAAM,OAAO,MAAM,MAAM;AACzB,UAAI,SAAS,QAAW;AACtB,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM;AAAA,QAClD;AAAA,MACF;AACA,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM,8BAA8B,OAAO,KAAK,CAAC,CAAC;AAAA,QAC9F;AAAA,MACF;AACA,UAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,WAAW,GAAG;AACzD,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM;AAAA,QAClD;AAAA,MACF;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI;AAAA,UACR,0CAA0C,MAAM,4DAA4D,OAAO,KAAK,GAAG,CAAC;AAAA,QAC9H;AAAA,MACF;AAAA,IAIF;AACA,UAAMA,aAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,QAAIA,eAAc,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,QAAM,iBAAiB,KAAK,mBAAmB,QAAQ,KAAK,eAAe;AAC3E,MAAI,mBAAmB,eAAe;AACpC,UAAM,IAAI;AAAA,MACR,sHAC+C,OAAO,cAAc,CAAC;AAAA,IACvE;AAAA,EACF;AACA,MAAI,WAAW,aAAa,QAAW;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,YAAY,OAAO,KAAK,WAAW,OAAO,EAAE;AAClD,MAAI,cAAc,GAAG;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAOA,eAAe,uBACb,UACA,YACyB;AACzB,MAAI,WAAW,SAAS,YAAY;AAClC,WAAO;AAAA,MACL,oBAAoB;AAAA,MACpB,MAAM;AAAA,MACN,aAAa;AAAA,QACX,MAAM;AAAA,QACN,SAAS,EAAE,GAAG,WAAW,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,WAAW;AAC5B,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI,MAAM,uDAAkD;AAAA,EACpE;AACA,QAAM,gBAAuD,CAAC;AAC9D,QAAM,UAAU,IAAI,YAAY;AAEhC,MAAI,WAAW,SAAS,oBAAoB;AAC1C,UAAM,kBAAkB;AACxB,UAAM,QAAQ,WAAW;AACzB,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,MAAM,uEAAkE;AAAA,IACpF;AACA,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,SAAS,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO,KAAK,KAAK,GAAG,IAAI;AACtF,oBAAc,MAAM,IAAI;AAAA,QACtB,KAAK,KAAK;AAAA;AAAA,QACV,QAAQ,cAAc,MAAM;AAAA,QAC5B,KAAK;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AAEL,UAAM,aAAa;AACnB,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,OAAO,GAAG;AAC/D,YAAM,SAAS,MAAM,WAAW,KAAK,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/D,oBAAc,MAAM,IAAI;AAAA,QACtB,KAAK,WAAW;AAAA,QAChB,QAAQ,cAAc,MAAM;AAAA,QAC5B,KAAK;AAAA,QACL,MAAM,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,oBAAoB;AAAA,IACpB,MAAM;AAAA,IACN,aAAa,EAAE,MAAM,UAAU,SAAS,cAAc;AAAA,EACxD;AACF;AAOA,SAAS,oBAAoB,YAA2E;AACtG,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,+EACG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE;AACA,QAAM,MAAM;AACZ,MAAI,IAAI,oBAAoB,MAAM,GAAG;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,IAAI,MAAM,MAAM,UAAU;AACnC,UAAM,IAAI,qBAAqB,kDAAkD;AAAA,EACnF;AACA,QAAM,OAAO,IAAI,aAAa;AAC9B,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,IAAI,qBAAqB,4CAA4C;AAAA,EAC7E;AACA,QAAM,UAAU;AAChB,QAAM,OAAO,QAAQ,MAAM;AAC3B,MAAI,SAAS,cAAc,SAAS,UAAU;AAC5C,UAAM,IAAI;AAAA,MACR,oCAAoC,OAAO,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,IAAI,MAAM;AAAA,IAChB;AAAA,EACF;AACF;AA4BO,SAAS,+BACd,UACA,MACwB;AACxB,SAAO,EAAE,oBAAoB,GAAG,MAAM,UAAU,eAAe,KAAK;AACtE;AAEO,SAAS,4BACd,YAC6C;AAC7C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,wFACG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,IAAI,qBAAqB,+CAA+C;AAAA,EAChF;AACA,QAAM,MAAM;AACZ,MAAI,IAAI,oBAAoB,MAAM,GAAG;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,IAAI,MAAM,MAAM,UAAU;AACnC,UAAM,IAAI,qBAAqB,2DAA2D;AAAA,EAC5F;AACA,QAAM,OAAO,IAAI,eAAe;AAChC,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,IAAI,qBAAqB,uDAAuD;AAAA,EACxF;AACA,QAAM,IAAI;AACV,MAAI,EAAE,GAAG,MAAM,KAAK,EAAE,KAAK,MAAM,4BAC1B,OAAO,EAAE,QAAQ,MAAM,YAAY,OAAO,EAAE,SAAS,MAAM,UAAU;AAC1E,UAAM,IAAI,qBAAqB,uDAAuD;AAAA,EACxF;AACA,SAAO,EAAE,MAAM,IAAI,MAAM,GAAG,KAAkC;AAChE;AAMA,SAAS,eAAe,OAAgD;AACtE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,MAAM,UAAU,OAAO,MAAM;AACrE,SAAO;AACT;AAwBA,eAAe,kBACb,MACA,MACmF;AACnF,MAAI,KAAK,SAAS,YAAY;AAC5B,UAAM,WAA2C,CAAC;AAClD,eAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,eAAS,MAAM,IAAI,eAAe,KAAK;AAAA,IACzC;AACA,WAAO,EAAE,MAAM,YAAY,SAAS,SAAS;AAAA,EAC/C;AAEA,MAAI,KAAK,qBAAqB,UAAa,KAAK,iBAAiB,WAAW,GAAG;AAI7E,UAAM,cAA8C,CAAC;AACrD,eAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,kBAAY,MAAM,IAAI,EAAE,MAAM,MAAM,QAAQ,UAAU,OAAO,MAAM,OAAO;AAAA,IAC5E;AACA,WAAO,EAAE,MAAM,UAAU,SAAS,YAAY;AAAA,EAChD;AACA,QAAM,iBAAiB,oBAAI,IAAgC;AAC3D,aAAW,KAAK,KAAK,iBAAkB,gBAAe,IAAI,EAAE,IAAI,CAAC;AAEjE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,cAA8C,CAAC;AAErD,aAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC1D,UAAM,WAA+B,MAAM,QAAQ;AACnD,UAAM,WAAW,eAAe,IAAI,MAAM,GAAG;AAC7C,QAAI,aAAa,QAAW;AAC1B,UAAI,KAAK,iCAAiC,MAAM;AAE9C,YAAI,SAAwB;AAC5B,mBAAW,aAAa,KAAK,kBAAkB;AAC7C,cAAI;AACF,kBAAMC,kBAAiB,MAAM,UAAU,OAAO,cAAc,MAAM,MAAM,CAAC;AACzE,qBAAS,QAAQ,OAAOA,eAAc;AACtC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AACA,YAAI,WAAW,MAAM;AACnB,cAAI,MAAM,SAAS,QAAW;AAG5B,wBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,MAAM,OAAO;AAC5D;AAAA,UACF;AACA,gBAAM,IAAI,wBAAwB,QAAQ,MAAM,GAAG;AAAA,QACrD;AACA,oBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,OAAO;AACtD;AAAA,MACF;AACA,UAAI,MAAM,SAAS,QAAW;AAI5B,oBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,MAAM,OAAO;AAC5D;AAAA,MACF;AACA,YAAM,IAAI,wBAAwB,QAAQ,MAAM,GAAG;AAAA,IACrD;AACA,UAAM,iBAAiB,MAAM,SAAS,OAAO,cAAc,MAAM,MAAM,CAAC;AACxE,gBAAY,MAAM,IAAI,EAAE,MAAM,UAAU,OAAO,QAAQ,OAAO,cAAc,EAAE;AAAA,EAChF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,YAAY;AAChD;AAEA,SAAS,cAAc,OAA2B;AAChD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAWA,IAAI,sBAAsC;AAC1C,SAAS,4BAAqC;AAC5C,MAAI,wBAAwB,KAAM,QAAO;AACzC,MAAI;AACF,QAAI,kBAAkB,IAAyB;AAC/C,0BAAsB;AAAA,EACxB,QAAQ;AACN,0BAAsB;AAAA,EACxB;AACA,SAAO;AACT;AAGO,SAAS,0BAAgC;AAC9C,wBAAsB;AACxB;AASA,SAAS,kBAAkB,QAGzB;AACA,QAAM,SAAS,UAAU;AACzB,MAAI,WAAW,OAAQ,QAAO,EAAE,QAAQ,kBAAkB,cAAc,KAAK;AAC7E,MAAI,WAAW,OAAQ,QAAO,EAAE,QAAQ,kBAAkB,cAAc,OAAO;AAC/E,MAAI,WAAW,UAAU;AACvB,QAAI,CAAC,0BAA0B,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,oBAAoB,cAAc,KAA0B;AAAA,EAC/E;AAEA,MAAI,0BAA0B,GAAG;AAC/B,WAAO,EAAE,QAAQ,oBAAoB,cAAc,KAA0B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,kBAAkB,cAAc,OAAO;AAC1D;AAcA,eAAe,kBACb,OACA,QACqB;AACrB,QAAM,WAAW,IAAI,KAAK,CAAC,KAAiB,CAAC,EAAE,OAAO,EAAE,YAAY,MAAM;AAC1E,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,OAAO;AACT,aAAO,KAAK,KAAmB;AAC/B,eAAS,MAAM;AAAA,IACjB;AAAA,EACF;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,QAAI,IAAI,OAAO,MAAM;AACrB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAWA,eAAeC,WAAU,OAAoC;AAS3D,QAAM,OAAO,IAAI,WAAW,MAAM,MAAM;AACxC,OAAK,IAAI,KAAK;AACd,SAAO,UAAe,IAAI;AAC5B;AAOA,SAAS,YAAY,OAA0C;AAC7D,MAAI,QAAQ;AACZ,aAAW,KAAK,MAAO,UAAS,EAAE;AAClC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAeA,eAAe,qBACb,OACA,UACA,MACiB;AACjB,MAAI,KAAK,iBAAiB,UAAa,KAAK,eAAe,QAAW;AACpE,WAAO;AAAA,EACT;AAEA,QAAM,aACJ,KAAK,cAAc;AAAA,IACjB;AAAA,MACE,IAAI,MAAM;AAAA,MACV,QAAQ,KAAK;AAAA,MACb,MAAM,MAAM;AAAA,IACd;AAAA,EACF;AAEF,QAAM,oBAAoB,MAAM,MAAM,6BAA6B,UAAU;AAE7E,QAAM,SAAS,KAAK,MAAM,QAAQ;AAClC,SAAO,WAAW;AAClB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAiBA,SAAS,kBACP,UACA,MACQ;AACR,QAAM,oBAAoB,KAAK,cAC3B,IAAI,IAAI,KAAK,WAAW,IACxB;AACJ,QAAM,UACJ,KAAK,UAAU,SAAY,IAAI,KAAK,KAAK,KAAK,EAAE,QAAQ,IAAI;AAC9D,MAAI,sBAAsB,QAAQ,YAAY,KAAM,QAAO;AAO3D,QAAM,SAAS,KAAK,MAAM,QAAQ;AAKlC,MAAI,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AAChE,UAAM,OAAgD,CAAC;AACvD,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AAChE,UAAI,qBAAqB,CAAC,kBAAkB,IAAI,IAAI,EAAG;AACvD,UAAI,YAAY,MAAM;AACpB,aAAK,IAAI,IAAI;AACb;AAAA,MACF;AACA,YAAM,OAAgC,CAAC;AACvC,iBAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,cAAM,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,IAAI;AACtD,YAAI,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS;AAC9C,eAAK,EAAE,IAAI;AAAA,QACb;AAAA,MACF;AACA,WAAK,IAAI,IAAI;AAAA,IACf;AACA,WAAO,cAAc;AAAA,EACvB;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AA4BA,eAAe,6BACb,OACA,UACiB;AACjB,QAAM,SAAS,KAAK,MAAM,QAAQ;AAIlC,MAAI,CAAC,OAAO,eAAe,OAAO,OAAO,gBAAgB,SAAU,QAAO;AAC1E,MAAI,OAAO,MAAM,qBAAqB,WAAY,QAAO;AAEzD,QAAM,EAAE,SAAS,MAAM,OAAO,IAAI,MAAM,iBAAiB;AACzD,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,2BAAyC;AAC1F,QAAM,UAAU,MAAM,wBAAwB,SAAS,MAAM,OAAO,KAAK,OAAO,WAAW,GAAG,MAAM;AACpG,MAAI,QAAQ,SAAS,EAAG,QAAO;AAE/B,QAAM,OAAgD,CAAC;AACvD,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACpE,UAAM,OAAO,QAAQ,IAAI,QAAQ;AACjC,QAAI,CAAC,MAAM;AAAE,WAAK,QAAQ,IAAI;AAAS;AAAA,IAAS;AAChD,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,UAAI,KAAK,IAAI,EAAE,EAAG,MAAK,EAAE,IAAI;AAAA,IAC/B;AACA,SAAK,QAAQ,IAAI;AAAA,EACnB;AACA,SAAO,cAAc;AACrB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAcA,eAAe,sBACb,OACA,UACA,MACiB;AACjB,MAAI,KAAK,UAAU,UAAa,KAAK,eAAe,QAAW;AAC7D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,KAAK,MAAM,QAAQ;AAIlC,MAAI,CAAC,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK;AACzB,QAAM,QAAQ,KAAK;AAEnB,QAAM,OAA4C,CAAC;AACnD,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACpE,UAAM,OAA4B,CAAC;AACnC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAI/C,UAAI,gBAAgB,QAAW;AAC7B,cAAM,OAAO,IAAI,SAAS;AAC1B,YAAI,OAAO,YAAa;AAAA,MAC1B;AAIA,UAAI,UAAU,QAAW;AACvB,cAAM,SAAS,MAAM,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,QACF;AACA,cAAM,KAAK,MAAM,MAAM,QAAQ,EAAE,YAAY,UAAU,GAAG,CAAC;AAC3D,YAAI,CAAC,GAAI;AAAA,MACX;AACA,WAAK,EAAE,IAAI;AAAA,IACb;AACA,SAAK,QAAQ,IAAI;AAAA,EACnB;AACA,SAAO,cAAc;AACrB,SAAO,KAAK,UAAU,MAAM;AAC9B;AAgCA,eAAsB,wBAAwB,MAgBtB;AACtB,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAC3D,QAAM,EAAE,QAAQ,aAAa,IAAI,kBAAkB,KAAK,WAAW;AACnE,QAAM,OAAO,iBAAiB,OAC1B,YACA,MAAM,kBAAkB,WAAW,IAAI,kBAAkB,YAAY,CAAC;AAC1E,QAAM,aAAa,MAAMA,WAAU,IAAI;AAEvC,QAAM,SAAyB;AAAA,IAC7B,eAAe;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK;AAAA,IAChB;AAAA,IACA,GAAI,KAAK,cAAc,mBAAmB,SAAY,EAAE,gBAAgB,KAAK,aAAa,eAAe,IAAI,CAAC;AAAA,IAC9G,GAAI,KAAK,cAAc,eAAe,SAAY,EAAE,YAAY,KAAK,aAAa,WAAW,IAAI,CAAC;AAAA,IAClG,GAAI,KAAK,cAAc,eAAe,SAAY,EAAE,YAAY,KAAK,aAAa,WAAW,IAAI,CAAC;AAAA,IAClG,GAAI,KAAK,cAAc,iBAAiB,SAAY,EAAE,cAAc,KAAK,aAAa,aAAa,IAAI,CAAC;AAAA,IACxG,GAAI,KAAK,cAAc,gBAAgB,SAAY,EAAE,aAAa,KAAK,aAAa,YAAY,IAAI,CAAC;AAAA,IACrG,GAAI,KAAK,cAAc,kBAAkB,SAAY,EAAE,eAAe,KAAK,aAAa,cAAc,IAAI,CAAC;AAAA,IAC3G,GAAI,KAAK,cAAc,WAAW,SAAY,EAAE,QAAQ,KAAK,aAAa,OAAO,IAAI,CAAC;AAAA,IACtF,GAAI,KAAK,cAAc,YAAY,SAAY,EAAE,SAAS,KAAK,aAAa,QAAQ,IAAI,CAAC;AAAA,IACzF,GAAI,KAAK,cAAc,gBAAgB,SAAY,EAAE,aAAa,KAAK,aAAa,YAAY,IAAI,CAAC;AAAA,IACrG,GAAI,KAAK,cAAc,aAAa,SAAY,EAAE,UAAU,KAAK,aAAa,SAAS,IAAI,CAAC;AAAA,EAC9F;AAQA,QAAM,SAAyB,KAAK,WAAW,SAC3C,SACA,OAAO,OAAO,MAA0C;AACtD,UAAM,SAAS,EAAE,GAAG,QAAQ,eAAe,oCAAoC,OAAO,EAAE,OAAO,QAAQ,UAAmB;AAC1H,UAAM,MAAM,MAAM,WAAW,EAAE,oBAAoB,MAAM;AACzD,WAAO,EAAE,GAAG,QAAQ,IAAI;AAAA,EAC1B,GAAG,KAAK,MAAM;AAClB,QAAM,cAAc,mBAAmB,MAAM;AAE7C,QAAM,SAAS,IAAI,WAAW,yBAAyB;AACvD,SAAO,IAAI,oBAAoB,CAAC;AAChC,SAAO,CAAC,KAAK,iBAAiB,OAAO,IAAI,mBAAmB;AAC5D,SAAO,CAAC,IAAI;AACZ,gBAAc,QAAQ,GAAG,YAAY,MAAM;AAE3C,SAAO,YAAY,CAAC,QAAQ,aAAa,IAAI,CAAC;AAChD;AAEA,eAAsB,SACpB,OACA,OAAwB,CAAC,GACJ;AACrB,MAAI,KAAK,iBAAiB,UAAa,KAAK,eAAe,QAAW;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,QAAM,uBAAuB,oBAAoB,IAAI;AACrD,QAAM,iBAAiB,0BAA0B,MAAM,oBAAoB;AAE3E,QAAM,SAAS,MAAM,MAAM,gBAAgB;AAC3C,QAAM,WAAW,MAAM,MAAM,KAAK;AAKlC,QAAM,oBAAoB,MAAM,6BAA6B,OAAO,QAAQ;AAK5E,QAAM,UAAU,MAAM,qBAAqB,OAAO,mBAAmB,IAAI;AAKzE,QAAM,gBAAgB,MAAM,sBAAsB,OAAO,SAAS,IAAI;AACtE,QAAM,WAAW,kBAAkB,eAAe,IAAI;AAKtD,QAAM,cAAc,yBAAyB,OACzC,WACA,KAAK,UAAU,MAAM,uBAAuB,UAAU,oBAAoB,CAAC;AAO/E,QAAM,QAAQ,MAAM,MAAM,SAAS;AAMnC,QAAM,SAAS,KAAK,SAAS,QACzB,SACA,KAAK,SAAS,SACZ,KAAK,OACJ,MAAM,MAAM,eAAe,KAAM;AAExC,SAAO,wBAAwB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA;AAAA,MAEZ,GAAI,UAAU,SAAY,EAAE,gBAAgB,MAAM,IAAI,CAAC;AAAA,MACvD,GAAI,mBAAmB,OAAO,EAAE,YAAY,eAAe,IAAI,CAAC;AAAA;AAAA,MAEhE,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,MAChF,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,MAC3D,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,IACnE;AAAA,IACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C,CAAC;AACH;AAGO,IAAM,mBAAmB;AAYhC,SAAS,qBAAqB,OAK5B;AACA,MAAI,CAAC,oBAAoB,KAAK,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR,2EACS,CAAC,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,IACvF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,2BAA2B;AAC5C,UAAM,IAAI;AAAA,MACR,yCAAyC,MAAM,MAAM,kCACzB,yBAAyB;AAAA,IACvD;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,CAAC;AACrB,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,SAAS,oBAAoB,SAAS,oBAAoB,SAAS,oBAAoB;AACzF,UAAM,IAAI;AAAA,MACR,wDAAwD,IAAI;AAAA,IAE9D;AAAA,EACF;AACA,QAAM,eAAe,aAAa,OAAO,CAAC;AAC1C,QAAM,aAAa,4BAA4B;AAC/C,MAAI,aAAa,MAAM,QAAQ;AAC7B,UAAM,IAAI;AAAA,MACR,mDAAmD,YAAY,mCAC3B,MAAM,MAAM;AAAA,IAClD;AAAA,EACF;AACA,QAAM,cAAc,MAAM,MAAM,2BAA2B,UAAU;AACrE,QAAM,SAAS,mBAAmB,WAAW;AAC7C,SAAO,EAAE,QAAQ,YAAY,MAA+B,MAAM;AACpE;AAgBO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,KAAK,EAAE;AACrC;AAGO,IAAM,wBAAwB;AA8CrC,eAAsB,gBACpB,OACA,aAC0B;AAC1B,QAAM,EAAE,OAAO,IAAI,qBAAqB,KAAK;AAK7C,MAAI,OAAO,QAAQ,UAAa,OAAO,UAAU,UAAa,OAAO,WAAW,QAAW;AACzF,WAAO,EAAE,QAAQ,WAAW;AAAA,EAC9B;AAEA,QAAM,eAAe,YAAY,OAAO,KAAK;AAC7C,MAAI,iBAAiB,QAAW;AAC9B,WAAO,EAAE,QAAQ,aAAa,OAAO,OAAO,MAAM;AAAA,EACpD;AAGA,QAAM,UAAmC,EAAE,GAAG,OAAO;AACrD,SAAO,QAAQ,KAAK;AAEpB,QAAM,KAAK,MAAM,aAAa,cAAc,OAAO,KAAK,OAAO;AAC/D,SAAO,EAAE,QAAQ,KAAK,aAAa,YAAY,OAAO,OAAO,MAAM;AACrE;AAeO,SAAS,aACd,OACA,OAAqC,CAAC,GACnB;AACnB,QAAM,SAAS,qBAAqB,KAAK,EAAE;AAC3C,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,KAAK,WAAW,OAAW,QAAO;AACtC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,IAAI,SAAS,SAAY,EAAE,MAAM,WAAW,IAAI,MAAM,KAAK,QAAQ,IAAI,aAAa,EAAE,IAAI,CAAC;AAAA,IAC/F,GAAI,IAAI,gBAAgB,SAAY,EAAE,aAAa,WAAW,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,EAAE,IAAI,CAAC;AAAA,EACtH;AACF;AAaO,SAAS,gBAAgB,OAAyC;AACvE,SAAO,qBAAqB,KAAK,EAAE,OAAO;AAC5C;AAoBA,eAAsB,QACpB,OACA,OAA+B,CAAC,GACA;AAChC,QAAM,EAAE,QAAQ,YAAY,KAAK,IAAI,qBAAqB,KAAK;AAC/D,QAAM,OAAO,MAAM,MAAM,UAAU;AAInC,MAAI,KAAK,WAAW,OAAO,WAAW;AACpC,UAAM,IAAI;AAAA,MACR,eAAe,KAAK,MAAM,oCACrB,OAAO,SAAS;AAAA,IAEvB;AAAA,EACF;AAEA,QAAM,YAAY,MAAMA,WAAU,IAAI;AACtC,MAAI,cAAc,OAAO,YAAY;AACnC,UAAM,IAAI;AAAA,MACR,eAAe,SAAS,qCACnB,OAAO,UAAU;AAAA,IAExB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,SAAS,kBAAkB;AAC7B,gBAAY;AAAA,EACd,OAAO;AACL,UAAM,eACJ,SAAS,qBAAsB,OAA6B;AAC9D,QAAI;AACF,kBAAY,MAAM,kBAAkB,MAAM,IAAI,oBAAoB,YAAY,CAAC;AAAA,IACjF,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,yBAA0B,IAAc,OAAO,oEAE1C,YAAY;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS;AAK7E,MAAI,OAAO,eAAe,QAAW;AACnC,WAAO,EAAE,QAAQ,UAAU,WAAW;AAAA,EACxC;AACA,QAAM,EAAE,MAAM,KAAK,IAAI,oBAAoB,UAAU;AACrD,QAAM,aAAa,MAAM,kBAAkB,MAAM,IAAI;AACrD,SAAO,EAAE,QAAQ,UAAU,MAAM,WAAW;AAC9C;AAGO,IAAM,kBAAkB;","names":["userCount","plaintextBytes","sha256Hex"]}

package/dist/chunk-GS5RT2KK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/via/classified/descriptor.ts","../src/via/classified/errors.ts","../src/via/classified/resolve.ts","../src/via/classified/write.ts","../src/via/classified/guards.ts","../src/via/classified/binding.ts","../src/port/with/classified-strategy.ts"],"sourcesContent":["/**\n * Classified fields — behavioral sensitive-field descriptors (stage 1).\n * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md\n * Law: open on write, declarative on read — read-side behavior is this\n * closed vocabulary; there are no read-side callbacks.\n * @module\n */\n\nexport type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only'\n\nexport type ClassifiedList =\n  | { readonly kind: 'omit' }\n  | { readonly kind: 'mask'; readonly pattern: string }\n  | { readonly kind: 'rider'; readonly rider: string }\n\nexport type ClassifiedRider = (value: unknown) => unknown\n\nexport interface ClassifiedFieldSpec {\n  readonly _noydbClassified: true\n  /**\n   * Via port brand marker — lets a `ClassifiedFieldSpec` satisfy the\n   * kernel's opaque `ViaDescriptor` (#629 Task 5). Optional (unlike\n   * `MoneyDescriptor._viaBrand`/`I18nTextDescriptor._viaBrand`, which are\n   * required): every `classified.*()` preset factory stamps it, but the\n   * pre-existing test suite's hand-rolled `ClassifiedFieldSpec` fixtures\n   * (built without going through a preset) predate this field and would\n   * fail to compile if it were mandatory.\n   */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  readonly storage: ClassifiedStorage\n  readonly list: ClassifiedList\n  readonly sensitivity: 'pii' | 'secret'\n  /** Write-time safe projections; companion field name is `<field>_<rider>`. */\n  readonly riders?: Record<string, ClassifiedRider>\n  /** Write-time validator: error message, or null when valid. */\n  readonly validate?: (value: unknown) => string | null\n  /** Digest-only verify policy (stage 2). Mode both sides normalize under. */\n  readonly verifyNormalize?: 'password' | 'secret-answer'\n  /** Decorate ok:true verdicts with mustRotate after this many days (I1). */\n  readonly rotateDays?: number\n  /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */\n  readonly notLastN?: number\n  /** Member of the collection's matchGroup (secretAnswer preset). */\n  readonly verifyGroupMember?: true\n  /**\n   * Opt into a store-visible blind-index (`_bidx`) tag so equal values become\n   * queryable/joinable while staying digest-only. Digest-only knob (R7); gated\n   * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values\n   * produce equal tags — a partition leak a DEK holder can offline-dictionary\n   * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.\n   */\n  readonly equatable?: true\n}\n\nexport interface ClassifiedGroup {\n  readonly _noydbClassifiedGroup: true\n  /** Via port brand marker — see {@link ClassifiedFieldSpec._viaBrand}. */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  /** member record-field name -> spec (differential per-member policy). */\n  readonly members: Record<string, ClassifiedFieldSpec>\n}\n\nexport type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup\n\nexport function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassified?: unknown })._noydbClassified === true\n}\n\nexport function isClassifiedGroup(x: unknown): x is ClassifiedGroup {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassifiedGroup?: unknown })._noydbClassifiedGroup === true\n}\n","/**\n * Configuration/write errors for classified fields. @module\n *\n * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`\n * (stage 2) so `kernel/enclave/classify/*` can throw them without importing\n * with-*. Re-exported here under the same names so existing import paths\n * keep working.\n */\nexport { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js'\n\nexport class ClassifiedNeverStoredError extends Error {\n  constructor(public readonly collection: string, public readonly field: string) {\n    super(`Field \"${field}\" in collection \"${collection}\" is classified storage:'never' `\n      + `(e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`)\n    this.name = 'ClassifiedNeverStoredError'\n  }\n}\n\nexport class ClassifiedValidationError extends Error {\n  constructor(public readonly collection: string, public readonly field: string, detail: string) {\n    super(`Classified field \"${field}\" in collection \"${collection}\" failed validation: ${detail}`)\n    this.name = 'ClassifiedValidationError'\n  }\n}\n","/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */\n\nimport { isClassifiedGroup, type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from './errors.js'\n\nexport type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js'\nexport { ClassifiedConfigError } from './errors.js'\n\nexport interface ResolvedClassified {\n  readonly byField: Record<string, ClassifiedFieldSpec>\n  readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>\n}\n\nexport function resolveClassifiedFields(\n  collection: string,\n  config: Record<string, ClassifiedEntry>,\n): ResolvedClassified {\n  const byField: Record<string, ClassifiedFieldSpec> = {}\n  const claim = (field: string, spec: ClassifiedFieldSpec): void => {\n    if (byField[field] !== undefined) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is claimed twice — storage forms are mutually exclusive per field (R5): ` +\n        `a field is digest-only OR recoverable OR never, exactly one`)\n    }\n    byField[field] = spec\n  }\n  for (const [key, entry] of Object.entries(config)) {\n    if (isClassifiedGroup(entry)) {\n      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec)\n    } else {\n      claim(key, entry)\n    }\n  }\n  const riderComputed: Record<string, (record: Record<string, unknown>) => unknown> = {}\n  for (const [field, spec] of Object.entries(byField)) {\n    for (const [name, rider] of Object.entries(spec.riders ?? {})) {\n      const companion = `${field}_${name}`\n      if (byField[companion] !== undefined || riderComputed[companion] !== undefined) {\n        throw new ClassifiedConfigError(collection, `rider companion \"${companion}\" collides with a declared field`)\n      }\n      riderComputed[companion] = (record) =>\n        record[field] === undefined ? undefined : rider(record[field])\n    }\n  }\n  return { byField, riderComputed }\n}\n","/** Write-path enforcement: storage:'never' rejection + preset validators.\n *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */\n\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNeverStoredError, ClassifiedValidationError } from './errors.js'\n\nexport function enforceClassifiedWrite(\n  record: Record<string, unknown>,\n  byField: Record<string, ClassifiedFieldSpec>,\n  collection: string,\n): void {\n  for (const [field, spec] of Object.entries(byField)) {\n    const value = record[field]\n    if (value === undefined) continue\n    if (value === null && spec.storage === 'digest-only') continue // explicit clear (C6 branch 3)\n    if (spec.storage === 'never') throw new ClassifiedNeverStoredError(collection, field)\n    const problem = spec.validate?.(value) ?? null\n    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem)\n  }\n}\n","/**\n * Refusal matrix R1-R5 (spec) — ONE guard, run at BOTH doors:\n * `collection()` config resolution AND `_applyClassifiedFields` (the reconcile\n * seam), because crdt/conflictPolicy/perRecordKeys are construction-only\n * while classifiedFields can attach later (C5's lesson). @module\n */\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from '../../kernel/errors.js'\n\nexport interface ClassifiedGuardCtx {\n  readonly perRecordKeys: boolean\n  readonly crdt: boolean\n  readonly hasConflictPolicy: boolean\n  /** False on plaintext (`encrypt: false`) collections — no vdig/seal path exists. */\n  readonly storeCiphertext: boolean\n  readonly deterministicFields: ReadonlySet<string> | null\n  readonly indexedFields: ReadonlySet<string>\n  readonly textIndexFields: ReadonlySet<string>\n  readonly vectorSourceFields: ReadonlySet<string>\n  readonly subjectKeyField: string | undefined\n  readonly bareSensitiveFields: ReadonlySet<string>\n  /** Collection-level gate for the `equatable` knob (R8 double door). */\n  readonly acknowledgeEquatableRisk: boolean\n}\n\nexport function guardClassifiedCompat(\n  collection: string,\n  byField: Record<string, ClassifiedFieldSpec>,\n  ctx: ClassifiedGuardCtx,\n): void {\n  const digestOnly = Object.entries(byField)\n    .filter(([, s]) => s.storage === 'digest-only')\n  const protectedForms = Object.values(byField)\n    .filter((s) => s.storage === 'digest-only' || s.storage === 'recoverable')\n\n  // R2 — merge resolvers bypass the write pipeline entirely (C5): a merge\n  // could carry stale/foreign _vdig or resurrect plaintext (the CRDT put\n  // branch persists via encryptJsonString with no vdig backstop). Fail-loud.\n  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {\n    throw new ClassifiedConfigError(collection,\n      'digest-only/recoverable classified fields cannot combine with a crdt mode or a ' +\n      'conflictPolicy resolver — merge paths bypass write enforcement (R2)')\n  }\n  // R7 — `equatable` is a digest-only knob: it drives the `_bidx` blind-index\n  // slot, which only exists on the digest-only write path. A recoverable/never\n  // field carrying it would silently no-op (recoverable equality is `_det`'s\n  // job). Refuse rather than accept-and-ignore. Checked over ALL specs, before\n  // the digest-only early-return below, precisely to catch the non-digest case.\n  for (const [f, spec] of Object.entries(byField)) {\n    if (spec.equatable === true && spec.storage !== 'digest-only') {\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" declares equatable but storage is '${spec.storage}' — equatable is a ` +\n        `digest-only knob; recoverable equality is _det's job (R7)`)\n    }\n  }\n\n  // R8 — the equatable double door (mirrors deterministicFields ×\n  // acknowledgeDeterministicRisk): any field opting into `equatable` requires\n  // the collection to acknowledge the partition-leak risk. One-directional —\n  // `acknowledgeEquatableRisk: true` with ZERO equatable members is a silent\n  // no-op (never throws here), so the ack can sit on a collection config\n  // ahead of the field landing.\n  const hasEquatable = Object.values(byField).some((s) => s.equatable === true)\n  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {\n    throw new ClassifiedConfigError(collection,\n      `classified equatable fields require \\`acknowledgeEquatableRisk: true\\` — equal values ` +\n      `produce equal store-visible index tags (a partition leak a DEK holder can offline-` +\n      `dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`)\n  }\n\n  if (digestOnly.length === 0) return\n\n  // Digest-only on a plaintext collection: the codec's vdig block is gated on\n  // storeCiphertext, so the secret would persist as raw plaintext. Refuse.\n  if (!ctx.storeCiphertext) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires an encrypted collection — with encrypt: false the ` +\n      `write path skips the digest slot entirely and the secret would persist as raw plaintext`)\n  }\n  // R1 — vdig slot keys are CEK-only (I3); without perRecordKeys a digest\n  // would survive forget() in backups as offline-crackable material.\n  if (!ctx.perRecordKeys) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires perRecordKeys: true — vdig keys derive from the ` +\n      `per-record CEK so forget() shreds them (R1)`)\n  }\n  for (const [f, spec] of digestOnly) {\n    // notLastN cap: presets clamp this at construction, but a raw spec object\n    // bypasses the preset — enforce the same 0..8 cap in the policy projection.\n    const n = spec.notLastN ?? 0\n    if (!Number.isInteger(n) || n < 0 || n > 8) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" declares notLastN ${n} — must be an integer 0..8 ` +\n        `(write cost is n × 600K PBKDF2; ring blast radius is documented)`)\n    }\n    if (ctx.bareSensitiveFields.has(f)) {\n      // R5 — the sealed block runs before the vdig block in the codec, so the\n      // overlap would seal the value recoverably (silent downgrade + I4\n      // double-slot). Storage forms are mutually exclusive per field.\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" is digest-only AND listed in sensitive[] — storage forms are mutually exclusive per field (R5)`)\n    }\n    if (ctx.deterministicFields?.has(f)) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be deterministic — equality-correlatable ciphertext defeats per-write salts (R3)`)\n    }\n    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f)\n      || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`)\n    }\n  }\n}\n","/**\n * The classified `ViaBinding` (#629 Task 5, LIVE since Task 6) — wires\n * classified-fields declaration/write-enforcement/at-rest sealing/erasure\n * into the kernel's generic Via port. Mirrors `via/money/binding.ts`'s\n * inline declaration-time validation and `via/i18n/binding.ts`'s\n * `linkXVia` static-link pattern — except the link itself is EAGER\n * (`port/with/classified-strategy.ts` calls `linkClassifiedVia()` at module\n * load, not lazily from a `classified.*()` preset call): several fixtures\n * build a raw `ClassifiedFieldSpec` literal without ever calling a preset,\n * and the binder must be installed before `compileViaBindings` needs it\n * regardless.\n *\n * `compileViaBindings` (`kernel/collection-config.ts`) compiles this binding\n * in whenever a collection declares `classifiedFields` — money then i18n\n * then classified, order pinned. `kernel/collection.ts`'s `_putInternal`\n * runs `enforceClassifiedWrite`'s effect via the pipeline's `enforceWrite`\n * phase; the codec's `encodeAtRest`/`decodeAtRest` hooks (Task 3's boundary)\n * replace the inline `sensitiveFields` seal path for any collection this\n * binding is compiled into.\n *\n * `declare` — `classifiedBinding(cfg)` runs `resolveClassifiedFields` +\n * `guardClassifiedCompat` at CONSTRUCTION time (the same #553 pattern\n * `moneyBinding`'s `validateMoneyFieldPaths(moneyFields)` call uses) —\n * mirrors today's \"door 1\" (`collection-config.ts`'s\n * `resolveCollectionConfig`). Both may throw `ClassifiedConfigError`.\n */\nimport type { ViaBinding, ViaWriteCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport { SealedHandle } from '../../kernel/types.js'\nimport { resolveClassifiedFields, type ClassifiedEntry } from './resolve.js'\nimport { guardClassifiedCompat, type ClassifiedGuardCtx } from './guards.js'\nimport { enforceClassifiedWrite } from './write.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\n/**\n * One classified per-slot shred/residue verdict — mirrors\n * `RecordCodec.SealedShredSlot` (`kernel/enclave/record-keys/record-codec.ts`)\n * byte-for-byte. Duplicated here (not imported) so this binding never\n * reaches into `kernel/enclave/` (`via-enclave-isolation`, #629) — the\n * closure that PRODUCES real values of this shape is codec-owned and\n * injected via {@link ClassifiedViaConfig.classifySealedShred}.\n */\nexport interface ClassifiedShredSlot {\n  readonly field: string\n  readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups'\n}\n\n/**\n * Config a classified collection's declarations resolve to — the binding's\n * construction input. `entries`/`guardCtx` are the raw \"door 1\" inputs\n * (`resolveClassifiedFields`/`guardClassifiedCompat`'s own parameters);\n * `classifySealedShred`/`purgeSealedCekEnvelopes` are OPTIONAL codec/vault-\n * provided closures for the `erase` hook — undefined in this dormant task\n * (no caller wires them yet), wired for real in #629 Task 10 (\"posture\n * enforcement — forget + erase hooks live\").\n */\nexport interface ClassifiedViaConfig {\n  readonly entries: Record<string, ClassifiedEntry>\n  readonly collectionName: string\n  readonly guardCtx: ClassifiedGuardCtx\n  /**\n   * Codec-provided closure mirroring `RecordCodec.classifySealedShred` —\n   * classifies a live envelope's `_sealed` slots for crypto-shred\n   * completeness (see that method's doc comment for the shreddable/\n   * dekResidue/both-class semantics). `live` is `ViaEraseCtx.live`'s opaque\n   * envelope, passed straight through. NOT `readonly` (#629 Task 10):\n   * `compileViaBindings` builds this cfg before the owning `Collection`'s\n   * `RecordCodec` exists, so `Collection`'s constructor mutates this field\n   * in place once `this.codec` is available — the closure `eraseClassified`\n   * reads is looked up at CALL time, not at binding-construction time, so\n   * the late assignment is picked up correctly.\n   */\n  classifySealedShred?: (live: unknown) => Promise<{ readonly slots: readonly ClassifiedShredSlot[] }>\n  /**\n   * Vault-provided closure that purges every `_sealed_cek/<collection>/<id>/*`\n   * host-delivery envelope for one record (mirrors `rotateRecordCek`'s own\n   * prefix-delete) and returns the count purged. Deliberately left UNWIRED\n   * by `compileViaBindings` (#629 Task 10) — `forget-sealed-erasure.test.ts`\n   * proves this purge is UNCONDITIONAL on `sealRecordToHost` usage alone,\n   * independent of whether `classifiedFields` is declared (a bare\n   * `sensitive: [...]` collection exercises it with no classified binding\n   * at all) — vault.ts keeps owning it directly so that case stays correct.\n   */\n  readonly purgeSealedCekEnvelopes?: (id: string) => Promise<number>\n}\n\n/** Fields declared `storage: 'recoverable'` (digest-only stays codec-inline; `'never'` is rejected by `enforceWrite` before either hook runs). */\nfunction recoverableFields(byField: Record<string, ClassifiedFieldSpec>): string[] {\n  return Object.entries(byField).filter(([, spec]) => spec.storage === 'recoverable').map(([field]) => field)\n}\n\n/**\n * The full set this binding's `encodeAtRest`/`decodeAtRest` seal: declared\n * recoverable classified fields UNION bare `sensitive[]` fields — mirrors\n * `collection-config.ts`'s pre-cutover \"recoverable classified fields are\n * unioned into sensitiveFields... zero new crypto code\" semantics. Once this\n * binding is compiled into a collection's pipeline, `hasAtRestHooks` is true\n * and the codec's inline `sensitiveFields` seal path (record-codec.ts) is\n * DEAD for that collection — mutually exclusive with the hook path (#629\n * Task 3) — so bare `sensitive[]` fields MUST seal through here too, or\n * they'd silently stop being sealed at all (#629 Task 6 reconciliation).\n * `guardCtx.bareSensitiveFields` is the exact same `Set` the collection's\n * refusal-matrix guard already carries (`ClassifiedGuardCtx`).\n */\nfunction sealFieldNames(byField: Record<string, ClassifiedFieldSpec>, guardCtx: ClassifiedGuardCtx): string[] {\n  return [...recoverableFields(byField), ...guardCtx.bareSensitiveFields]\n}\n\n/**\n * Seal every named field present with a defined value into its own sealed\n * slot via `crypto.sealedSlots`, peeling it out of the record.\n */\nasync function encodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  crypto: ViaCryptoCtx,\n  fields: readonly string[],\n): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }> {\n  let open = record\n  let sealed: Record<string, SealedSlotRef> | undefined\n  for (const field of fields) {\n    if (!(field in record)) continue\n    const value = record[field]\n    if (value === undefined) continue\n    const ref = await crypto.sealedSlots.seal(field, value)\n    if (open === record) open = { ...record }\n    delete open[field]\n    sealed ??= {}\n    sealed[field] = ref\n  }\n  return sealed ? { record: open, sealed } : { record }\n}\n\n/**\n * Restore every named field's sealed slot back onto the record: an opaque\n * `SealedHandle` under `asHandles` (never materialises plaintext into the\n * cache — `SealedHandle.toJSON()` returns `'[sealed]'`, the export-redaction\n * guarantee `reveal()` alone can lift), the plaintext value otherwise.\n */\nasync function decodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  sealed: Record<string, SealedSlotRef>,\n  crypto: ViaCryptoCtx,\n  opts: { asHandles: boolean },\n  fields: readonly string[],\n): Promise<Record<string, unknown>> {\n  let out = record\n  for (const field of fields) {\n    const ref = sealed[field]\n    if (ref === undefined) continue\n    if (out === record) out = { ...record }\n    out[field] = opts.asHandles\n      ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref))\n      : await crypto.sealedSlots.unseal(field, ref)\n  }\n  return out\n}\n\n/**\n * `forget()`'s per-ref erasure participation: classify the live envelope's\n * sealed slots (via the codec-provided closure) and mark each shreddable\n * one deleted on this call's sealed-slots capability, then purge the\n * record's sealed-CEK host-delivery envelopes (via the vault-provided\n * closure). Both closures are optional — undefined (this dormant task's\n * only caller, its own unit tests) reports a zero-shredded, zero-residue\n * no-op rather than throwing.\n */\nasync function eraseClassified(\n  ctx: ViaEraseCtx,\n  cfg: ClassifiedViaConfig,\n): Promise<ViaEraseReport> {\n  let shredded = 0\n  const residue: unknown[] = []\n\n  if (cfg.classifySealedShred) {\n    const { slots } = await cfg.classifySealedShred(ctx.live)\n    for (const slot of slots) {\n      if (slot.class === 'shreddable' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        shredded += 1\n        await ctx.crypto.sealedSlots.delete(slot.field)\n      }\n      if (slot.class === 'dekResidue' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        residue.push({ kind: 'classified-sealed-dek-residue', field: slot.field })\n      }\n    }\n  }\n\n  if (cfg.purgeSealedCekEnvelopes) {\n    shredded += await cfg.purgeSealedCekEnvelopes(ctx.id)\n  }\n\n  return { shredded, residue }\n}\n\nfunction buildClassifiedDescribeFragment(byField: Record<string, ClassifiedFieldSpec>): Record<string, unknown> {\n  return {\n    classifiedFields: Object.fromEntries(\n      Object.entries(byField).map(([field, spec]) => [field, { storage: spec.storage, sensitivity: spec.sensitivity }]),\n    ),\n  }\n}\n\nexport function classifiedBinding(cfg: ClassifiedViaConfig): ViaBinding {\n  // declare — door 1: resolve + guard, exactly like collection-config.ts's\n  // resolveCollectionConfig does today. Throws ClassifiedConfigError on any\n  // R1-R8 refusal-matrix violation or field-collision.\n  const resolved = resolveClassifiedFields(cfg.collectionName, cfg.entries)\n  guardClassifiedCompat(cfg.collectionName, resolved.byField, cfg.guardCtx)\n  const byField = resolved.byField\n  const sealFields = sealFieldNames(byField, cfg.guardCtx)\n\n  return {\n    brand: 'classified',\n    posture: { encryptedAtRest: 'sealed', queryable: 'det-exact', exportable: false, forgettable: true },\n    covers: (field) => field in byField,\n    // async (rather than a bare passthrough) so a refusal is always a\n    // rejected Promise for direct callers, matching every other async-stack\n    // hook's calling convention — `enforceClassifiedWrite` itself stays sync.\n    enforceWrite: async (record: Record<string, unknown>, _ctx: ViaWriteCtx) =>\n      enforceClassifiedWrite(record, byField, cfg.collectionName),\n    encodeAtRest: (record, crypto) => encodeClassifiedAtRest(record, crypto, sealFields),\n    decodeAtRest: (record, sealed, crypto, opts) => decodeClassifiedAtRest(record, sealed, crypto, opts, sealFields),\n    erase: (ctx) => eraseClassified(ctx, cfg),\n    describeFragment: () => buildClassifiedDescribeFragment(byField),\n  }\n}\n\nexport function linkClassifiedVia(): void {\n  installViaBinder('classified', (c) => classifiedBinding(c as ClassifiedViaConfig))\n}\n","/**\n * Classified strategy seam (#629 Task 5 — moved out of\n * `via/classified/strategy.ts`, precedent: `port/with/i18n-strategy.ts`).\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`Vault` can hold the `NO_CLASSIFIED` default\n * without a spine→service static import.\n *\n * This file (unlike `via/classified/**`) is NOT subject to the\n * `via-enclave-isolation` architecture guard — it may import `EnclaveKey`\n * from the enclave barrel freely, the same way `port/with/i18n-strategy.ts`\n * did before #629 Task 4's DictionaryHandle cutover.\n *\n * The ② capability seam for classified read-egress ops (stage 1: reveal;\n * stage 2: verify).\n *\n * @internal\n */\nimport type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js'\nimport { ClassifiedNotEnabledError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { linkClassifiedVia } from '../../via/classified/binding.js'\n\n// #629 Task 10 — re-export the classified binding's erase-cfg TYPE (not\n// `via/classified/binding.js` directly) so the kernel spine can name\n// it for the post-construction `classifySealedShred` wiring, same rationale\n// as `resolveClassifiedFields`/`guardClassifiedCompat` above.\nexport type { ClassifiedViaConfig } from '../../via/classified/binding.js'\n\nexport type { ClassifiedVerdict } from '../../kernel/types.js'\nimport type { ClassifiedVerdict } from '../../kernel/types.js'\n\n// #629 Task 6 — the classified binding's construction-time resolve/guard,\n// re-exported here (not `via/classified/{resolve,guards}.js` directly)\n// so the kernel spine keeps importing only this one `/with` port seam, same\n// rationale as `NO_CLASSIFIED` below.\nexport { resolveClassifiedFields, type ClassifiedEntry, type ResolvedClassified } from '../../via/classified/resolve.js'\nexport { guardClassifiedCompat, type ClassifiedGuardCtx } from '../../via/classified/guards.js'\nexport type { ClassifiedFieldSpec }\n\n// Install the classified Via binder EAGERLY — unlike money()/i18nText(),\n// several classified fixtures (both hub tests and consumer code) build a raw\n// `ClassifiedFieldSpec` object literal without ever calling a\n// `classified.*()` preset (bypassing `via/classified/presets.ts`\n// entirely — an intentionally supported pattern, see that module's Task 5\n// doc comment). Linking lazily at preset-call time (the money/i18n pattern)\n// would leave `viaBinder('classified')` unlinked for those declarations.\n// This port module is already unconditionally imported by the kernel spine\n// (for the `NO_CLASSIFIED` strategy default below), so linking here\n// guarantees the binder is always installed before `compileViaBindings`\n// ever needs it, regardless of how a collection's classifiedFields were\n// constructed.\nlinkClassifiedVia()\n\nexport interface ClassifiedRevealCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  /** True on an encrypted collection — false selects the plaintext-body read. */\n  readonly encrypted: boolean\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedVerifyCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>       // raw envelope, NOT a decrypted view\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly now: () => number                                        // injected (Q7)\n  /** Group members resolved by the collection (matchGroup only). */\n  readonly groupMembers?: ReadonlyArray<{ readonly field: string; readonly spec: ClassifiedFieldSpec }>\n  readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedStrategy {\n  reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>\n  verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>,\n             opts: { readonly min: number }): Promise<{ readonly passed: boolean }>\n  computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>\n}\n\nexport const NO_CLASSIFIED: ClassifiedStrategy = {\n  async reveal() { throw new ClassifiedNotEnabledError() },\n  async verify() { throw new ClassifiedNotEnabledError() },\n  async verifyText() { throw new ClassifiedNotEnabledError() },\n  async matchGroup() { throw new ClassifiedNotEnabledError() },\n  async computeTarget() { throw new ClassifiedNotEnabledError() },\n}\n"],"mappings":";;;;;;;;;;;;AAkEO,SAAS,sBAAsB,GAAsC;AAC1E,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAAqC,qBAAqB;AAClE;AAEO,SAAS,kBAAkB,GAAkC;AAClE,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAA0C,0BAA0B;AAC5E;;;AChEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,OAAe;AAC7E,UAAM,UAAU,KAAK,oBAAoB,UAAU,0HAC2C;AAFpE;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAA4B,YAAoC,OAAe,QAAgB;AAC7F,UAAM,qBAAqB,KAAK,oBAAoB,UAAU,wBAAwB,MAAM,EAAE;AADpE;AAAoC;AAE9D,SAAK,OAAO;AAAA,EACd;AAAA,EAH4B;AAAA,EAAoC;AAIlE;;;ACVO,SAAS,wBACd,YACA,QACoB;AACpB,QAAM,UAA+C,CAAC;AACtD,QAAM,QAAQ,CAAC,OAAe,SAAoC;AAChE,QAAI,QAAQ,KAAK,MAAM,QAAW;AAChC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAC8C;AAAA,IACjE;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,kBAAkB,KAAK,GAAG;AAC5B,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9E,OAAO;AACL,YAAM,KAAK,KAAK;AAAA,IAClB;AAAA,EACF;AACA,QAAM,gBAA8E,CAAC;AACrF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;AAC7D,YAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,UAAI,QAAQ,SAAS,MAAM,UAAa,cAAc,SAAS,MAAM,QAAW;AAC9E,cAAM,IAAI,sBAAsB,YAAY,oBAAoB,SAAS,kCAAkC;AAAA,MAC7G;AACA,oBAAc,SAAS,IAAI,CAAC,WAC1B,OAAO,KAAK,MAAM,SAAY,SAAY,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACA,SAAO,EAAE,SAAS,cAAc;AAClC;;;ACvCO,SAAS,uBACd,QACA,SACA,YACM;AACN,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,UAAU,QAAQ,KAAK,YAAY,cAAe;AACtD,QAAI,KAAK,YAAY,QAAS,OAAM,IAAI,2BAA2B,YAAY,KAAK;AACpF,UAAM,UAAU,KAAK,WAAW,KAAK,KAAK;AAC1C,QAAI,YAAY,KAAM,OAAM,IAAI,0BAA0B,YAAY,OAAO,OAAO;AAAA,EACtF;AACF;;;ACMO,SAAS,sBACd,YACA,SACA,KACM;AACN,QAAM,aAAa,OAAO,QAAQ,OAAO,EACtC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,aAAa;AAChD,QAAM,iBAAiB,OAAO,OAAO,OAAO,EACzC,OAAO,CAAC,MAAM,EAAE,YAAY,iBAAiB,EAAE,YAAY,aAAa;AAK3E,MAAI,eAAe,SAAS,MAAM,IAAI,QAAQ,IAAI,oBAAoB;AACpE,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACqE;AAAA,EACzE;AAMA,aAAW,CAAC,GAAG,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,QAAI,KAAK,cAAc,QAAQ,KAAK,YAAY,eAAe;AAC7D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC,wCAAwC,KAAK,OAAO;AAAA,MACJ;AAAA,IAC/D;AAAA,EACF;AAQA,QAAM,eAAe,OAAO,OAAO,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,IAAI;AAC5E,MAAI,gBAAgB,IAAI,6BAA6B,MAAM;AACzD,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAE2F;AAAA,EAC/F;AAEA,MAAI,WAAW,WAAW,EAAG;AAI7B,MAAI,CAAC,IAAI,iBAAiB;AACxB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACyF;AAAA,EAC7F;AAGA,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAC6C;AAAA,EACjD;AACA,aAAW,CAAC,GAAG,IAAI,KAAK,YAAY;AAGlC,UAAM,IAAI,KAAK,YAAY;AAC3B,QAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG;AAC1C,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC,uBAAuB,CAAC;AAAA,MACmB;AAAA,IACtE;AACA,QAAI,IAAI,oBAAoB,IAAI,CAAC,GAAG;AAIlC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC;AAAA,MAAkG;AAAA,IACjH;AACA,QAAI,IAAI,qBAAqB,IAAI,CAAC,GAAG;AACnC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2F;AAAA,IACtH;AACA,QAAI,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,gBAAgB,IAAI,CAAC,KACpD,IAAI,mBAAmB,IAAI,CAAC,KAAK,IAAI,oBAAoB,GAAG;AAC/D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2E;AAAA,IACtG;AAAA,EACF;AACF;;;ACzBA,SAAS,kBAAkB,SAAwD;AACjF,SAAO,OAAO,QAAQ,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAC5G;AAeA,SAAS,eAAe,SAA8C,UAAwC;AAC5G,SAAO,CAAC,GAAG,kBAAkB,OAAO,GAAG,GAAG,SAAS,mBAAmB;AACxE;AAMA,eAAe,uBACb,QACA,QACA,QACsF;AACtF,MAAI,OAAO;AACX,MAAI;AACJ,aAAW,SAAS,QAAQ;AAC1B,QAAI,EAAE,SAAS,QAAS;AACxB,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,UAAM,MAAM,MAAM,OAAO,YAAY,KAAK,OAAO,KAAK;AACtD,QAAI,SAAS,OAAQ,QAAO,EAAE,GAAG,OAAO;AACxC,WAAO,KAAK,KAAK;AACjB,eAAW,CAAC;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,SAAO,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,EAAE,OAAO;AACtD;AAQA,eAAe,uBACb,QACA,QACA,QACA,MACA,QACkC;AAClC,MAAI,MAAM;AACV,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,QAAQ,OAAW;AACvB,QAAI,QAAQ,OAAQ,OAAM,EAAE,GAAG,OAAO;AACtC,QAAI,KAAK,IAAI,KAAK,YACd,IAAI,aAAa,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG,CAAC,IAC5D,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG;AAAA,EAChD;AACA,SAAO;AACT;AAWA,eAAe,gBACb,KACA,KACyB;AACzB,MAAI,WAAW;AACf,QAAM,UAAqB,CAAC;AAE5B,MAAI,IAAI,qBAAqB;AAC3B,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI,oBAAoB,IAAI,IAAI;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,oBAAY;AACZ,cAAM,IAAI,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA,MAChD;AACA,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,gBAAQ,KAAK,EAAE,MAAM,iCAAiC,OAAO,KAAK,MAAM,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,yBAAyB;AAC/B,gBAAY,MAAM,IAAI,wBAAwB,IAAI,EAAE;AAAA,EACtD;AAEA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,gCAAgC,SAAuE;AAC9G,SAAO;AAAA,IACL,kBAAkB,OAAO;AAAA,MACvB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,YAAY,CAAC,CAAC;AAAA,IAClH;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,KAAsC;AAItE,QAAM,WAAW,wBAAwB,IAAI,gBAAgB,IAAI,OAAO;AACxE,wBAAsB,IAAI,gBAAgB,SAAS,SAAS,IAAI,QAAQ;AACxE,QAAM,UAAU,SAAS;AACzB,QAAM,aAAa,eAAe,SAAS,IAAI,QAAQ;AAEvD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,UAAU,WAAW,aAAa,YAAY,OAAO,aAAa,KAAK;AAAA,IACnG,QAAQ,CAAC,UAAU,SAAS;AAAA;AAAA;AAAA;AAAA,IAI5B,cAAc,OAAO,QAAiC,SACpD,uBAAuB,QAAQ,SAAS,IAAI,cAAc;AAAA,IAC5D,cAAc,CAAC,QAAQ,WAAW,uBAAuB,QAAQ,QAAQ,UAAU;AAAA,IACnF,cAAc,CAAC,QAAQ,QAAQ,QAAQ,SAAS,uBAAuB,QAAQ,QAAQ,QAAQ,MAAM,UAAU;AAAA,IAC/G,OAAO,CAAC,QAAQ,gBAAgB,KAAK,GAAG;AAAA,IACxC,kBAAkB,MAAM,gCAAgC,OAAO;AAAA,EACjE;AACF;AAEO,SAAS,oBAA0B;AACxC,mBAAiB,cAAc,CAAC,MAAM,kBAAkB,CAAwB,CAAC;AACnF;;;AChLA,kBAAkB;AAkCX,IAAM,gBAAoC;AAAA,EAC/C,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,gBAAgB;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAChE;","names":[]}

package/dist/chunk-KZ3KMDN3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/guards/with-guard.ts","../src/with-audit/guards/immutable-guard.ts","../src/with-audit/guards/transition-guard.ts"],"sourcesContent":["import { ValidationError } from '../../kernel/errors.js'\nimport type { GuardSpec, GuardStrategy } from './types.js'\n\n/**\n * Register a guard for a collection. Guards run on every `put()` /\n * `delete()` for the named collection (after permissions, before\n * encryption) and may:\n *\n *   - `check` — block writes by throwing (typically `RecordLockedError`)\n *   - `frozenFields` — freeze specific fields once a condition is true\n *   - `amendment` — declare an authorized-override path with invariant\n *\n * Pass the returned handle to `createNoydb({ strategies: [...] })`.\n *\n * @see docs/superpowers/specs/2026-05-18-guards-design.md\n */\nexport function withGuard<T extends Record<string, unknown>>(\n  strategy: GuardSpec<T>,\n): GuardStrategy<T> {\n  if (!strategy.collection || strategy.collection.length === 0) {\n    throw new ValidationError('withGuard: collection name is required')\n  }\n  return {\n    __noydb_strategy: 'guard',\n    spec: strategy,\n  }\n}\n","/**\n * `immutableGuard` — declarative WORM / append-only sugar over the guard\n * service.\n *\n * Issued fiscal documents (invoices, DDTs) must be immutable after issue.\n * That is expressible today with a hand-rolled `withGuard` (block on\n * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is\n * repetitive and easy to get subtly wrong. `immutableGuard` generates\n * exactly that guard from a declarative config, reusing the guard\n * machinery wholesale — `check`/`onDelete` rejection, the ledgered\n * `amendment` override, and composition with `periods`/`history`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   immutableGuard({\n *     collection: 'invoices',\n *     after: (r) => r.status === 'issued',   // immutable once issued\n *   }),\n * ] })\n * ```\n *\n * A record is mutable until `after(record)` holds; from then on, updates\n * and deletes throw `RecordLockedError` unless performed inside an\n * `amendment` transaction by an authorized role (the override is\n * ledgered by the guard amendment mechanism). `appendOnly: true` is\n * shorthand for `after: () => true` — immutable from creation.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { RecordLockedError, ValidationError } from '../../kernel/errors.js'\n\nexport interface ImmutableGuardConfig<T extends Record<string, unknown>> {\n  /** The collection to make WORM. */\n  collection: string\n  /**\n   * A record becomes immutable once this predicate holds. Evaluated on\n   * the *existing* (already-persisted) record, so the write that first\n   * makes it true is still allowed; subsequent writes are blocked.\n   * Mutually exclusive with `appendOnly`.\n   */\n  after?: (record: T) => boolean\n  /** Shorthand for `after: () => true` — immutable from creation. */\n  appendOnly?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly: it receives every {before, after} pair touching this\n   * collection in the amendment plus the guard context; throwing reverts\n   * the whole amendment and surfaces as `InvariantError`.\n   *\n   * Use this to keep a constraint inviolable EVEN under amendment — e.g.\n   * forbid deleting an issued document by re-throwing on any\n   * `before !== null && after === null` change, or assert a cross-record\n   * sum is preserved. When omitted the amendment is unconditionally\n   * allowed (the amendment itself is the sanctioned, ledgered override) —\n   * this is the backward-compatible default.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\n/**\n * Build an immutability guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function immutableGuard<T extends Record<string, unknown>>(\n  config: ImmutableGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config\n  if (appendOnly && after !== undefined) {\n    throw new ValidationError('immutableGuard: `after` and `appendOnly` are mutually exclusive')\n  }\n  if (!appendOnly && after === undefined) {\n    throw new ValidationError('immutableGuard: provide `after` or `appendOnly: true`')\n  }\n\n  const isImmutable: (record: T) => boolean = appendOnly ? () => true : after!\n  const reason = appendOnly ? 'append-only collection' : 'record is immutable after issue'\n\n  const spec: GuardSpec<T> = {\n    collection,\n    // Block updates to an already-immutable record. Inserts (existing\n    // null) and the transition write that first makes the record\n    // immutable are allowed — `after` reads the prior state.\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      if (ctx.existing !== null && isImmutable(ctx.existing)) {\n        throw new RecordLockedError(collection, recordId(incoming as Record<string, unknown>), reason)\n      }\n    },\n    // Block deletes of an immutable record.\n    onDelete: (existing: T) => {\n      if (isImmutable(existing)) {\n        throw new RecordLockedError(collection, recordId(existing as Record<string, unknown>), reason)\n      }\n    },\n    // The authorized override: inside an amendment transaction the\n    // check/onDelete are skipped and the change is ledgered. By default\n    // there is no extra invariant — the amendment itself is the\n    // sanctioned exception. Callers may supply `amendmentInvariant` to\n    // keep a constraint inviolable even under amendment (e.g. forbid\n    // deletes, or preserve a cross-record sum); a throw reverts the\n    // amendment and surfaces as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n","/**\n * `transitionGuard` — declarative state-machine sugar over the guard\n * service.\n *\n * Any record with a lifecycle field (invoice `status`, order state,\n * ticket workflow, subscription phase) needs transition validation: a\n * write may only move the field along a declared arc. That is expressible\n * with a hand-rolled `withGuard({ check })`, but every consumer\n * re-implements the same graph lookup + error. `transitionGuard`\n * generates exactly that guard from a state graph, reusing the guard\n * machinery wholesale — `check` rejection, the ledgered `amendment`\n * override, and composition with `periods`/`history`.\n *\n * It generalizes {@link immutableGuard}: WORM is the special case \"every\n * state has no outgoing arcs\", i.e. `transitions` mapping each state to `[]`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   transitionGuard<Sale>({\n *     collection: 'sales', field: 'status',\n *     transitions: {                          // absence of an arc = forbidden\n *       draft: ['to_verify', 'cancelled'],\n *       to_verify: ['proforma', 'draft', 'cancelled'],\n *       proforma: ['invoiced', 'cancelled'],\n *       invoiced: ['paid'], paid: [], cancelled: [],\n *     },\n *     initial: ['draft', 'to_verify'],        // allowed status on insert\n *   }),\n * ] })\n * ```\n *\n * Semantics:\n * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in\n *   `initial`. When `initial` is omitted, any value is allowed on insert.\n * - **Update**: the arc `(existing[field] → incoming[field])` must be\n *   listed in `transitions[from]`, else `IllegalTransitionError`. A\n *   same-value write (`from === to`) is allowed when `allowIdempotent`\n *   (default `true`) — so writes that touch other fields without moving\n *   state pass.\n * - **Override**: inside an `amendment` transaction by an authorized role\n *   the check is skipped and the change is ledgered (mirrors every guard).\n *\n * The status graph is caller-supplied data — no UI, no domain logic.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { IllegalTransitionError, ValidationError } from '../../kernel/errors.js'\n\nexport interface TransitionGuardConfig<T extends Record<string, unknown>> {\n  /** The collection whose state field is governed. */\n  collection: string\n  /** The state field on the record (e.g. `'status'`). */\n  field: keyof T & string\n  /**\n   * The transition graph: each state maps to the states it may move to.\n   * A state absent from the map (or mapped to `[]`) is terminal — no\n   * outgoing arc, so any non-idempotent write from it is rejected.\n   */\n  transitions: Readonly<Record<string, readonly string[]>>\n  /**\n   * States allowed as the initial value on insert (`existing === null`).\n   * Omit to allow any value on insert.\n   */\n  initial?: readonly string[]\n  /**\n   * Allow a same-value write (`from === to`) on update. Default `true` —\n   * lets a put that changes other fields, but not the state, through.\n   */\n  allowIdempotent?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly. When omitted the amendment is unconditionally allowed (the\n   * amendment itself is the sanctioned, ledgered override) — the\n   * backward-compatible default. Mirrors {@link immutableGuard}.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\nfunction stateOf(record: Record<string, unknown>, field: string): string {\n  const v = record[field]\n  return typeof v === 'string' ? v : String(v)\n}\n\n/**\n * Build a state-machine transition guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function transitionGuard<T extends Record<string, unknown>>(\n  config: TransitionGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config\n  const allowIdempotent = config.allowIdempotent ?? true\n\n  if (!field) {\n    throw new ValidationError('transitionGuard: `field` is required')\n  }\n  if (transitions === undefined || typeof transitions !== 'object') {\n    throw new ValidationError('transitionGuard: `transitions` must be a state→states map')\n  }\n\n  const spec: GuardSpec<T> = {\n    collection,\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      const rec = incoming as Record<string, unknown>\n      const to = stateOf(rec, field)\n\n      // Insert — gate on the allowed initial set (any value if unset).\n      if (ctx.existing === null) {\n        if (initial !== undefined && !initial.includes(to)) {\n          throw new IllegalTransitionError(collection, recordId(rec), '(none)', to)\n        }\n        return\n      }\n\n      // Update — the arc (from → to) must be a declared edge.\n      const from = stateOf(ctx.existing as Record<string, unknown>, field)\n      if (from === to) {\n        if (allowIdempotent) return\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n      const allowed = transitions[from] ?? []\n      if (!allowed.includes(to)) {\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n    },\n    // The authorized override: inside an amendment transaction the check\n    // is skipped and the change is ledgered. By default no extra invariant\n    // — the amendment itself is the sanctioned exception. Callers may\n    // supply `amendmentInvariant` to keep a constraint inviolable even\n    // under amendment; a throw reverts the amendment as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n"],"mappings":";;;;;;;AAgBO,SAAS,UACd,UACkB;AAClB,MAAI,CAAC,SAAS,cAAc,SAAS,WAAW,WAAW,GAAG;AAC5D,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,MAAM;AAAA,EACR;AACF;;;ACwCA,SAAS,SAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAMO,SAAS,eACd,QACkB;AAClB,QAAM,EAAE,YAAY,OAAO,YAAY,gBAAgB,mBAAmB,IAAI;AAC9E,MAAI,cAAc,UAAU,QAAW;AACrC,UAAM,IAAI,gBAAgB,iEAAiE;AAAA,EAC7F;AACA,MAAI,CAAC,cAAc,UAAU,QAAW;AACtC,UAAM,IAAI,gBAAgB,uDAAuD;AAAA,EACnF;AAEA,QAAM,cAAsC,aAAa,MAAM,OAAO;AACtE,QAAM,SAAS,aAAa,2BAA2B;AAEvD,QAAM,OAAqB;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,OAAO,CAAC,UAAa,QAAyB;AAC5C,UAAI,IAAI,aAAa,QAAQ,YAAY,IAAI,QAAQ,GAAG;AACtD,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA,IAEA,UAAU,CAAC,aAAgB;AACzB,UAAI,YAAY,QAAQ,GAAG;AACzB,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;;;ACpCA,SAASA,UAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEA,SAAS,QAAQ,QAAiC,OAAuB;AACvE,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AAC7C;AAMO,SAAS,gBACd,QACkB;AAClB,QAAM,EAAE,YAAY,OAAO,aAAa,SAAS,gBAAgB,mBAAmB,IAAI;AACxF,QAAM,kBAAkB,OAAO,mBAAmB;AAElD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EAClE;AACA,MAAI,gBAAgB,UAAa,OAAO,gBAAgB,UAAU;AAChE,UAAM,IAAI,gBAAgB,gEAA2D;AAAA,EACvF;AAEA,QAAM,OAAqB;AAAA,IACzB;AAAA,IACA,OAAO,CAAC,UAAa,QAAyB;AAC5C,YAAM,MAAM;AACZ,YAAM,KAAK,QAAQ,KAAK,KAAK;AAG7B,UAAI,IAAI,aAAa,MAAM;AACzB,YAAI,YAAY,UAAa,CAAC,QAAQ,SAAS,EAAE,GAAG;AAClD,gBAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,UAAU,EAAE;AAAA,QAC1E;AACA;AAAA,MACF;AAGA,YAAM,OAAO,QAAQ,IAAI,UAAqC,KAAK;AACnE,UAAI,SAAS,IAAI;AACf,YAAI,gBAAiB;AACrB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AACA,YAAM,UAAU,YAAY,IAAI,KAAK,CAAC;AACtC,UAAI,CAAC,QAAQ,SAAS,EAAE,GAAG;AACzB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;","names":["recordId"]}