@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/chunk-OHOKBMTM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/record-aad.ts","../src/kernel/enclave/record-keys/lifecycle.ts","../src/kernel/enclave/record-keys/rekey.ts","../src/kernel/enclave/record-keys/rekey-blob.ts","../src/kernel/enclave/record-keys/sealed-slots.ts","../src/kernel/enclave/classify/write.ts","../src/kernel/schema.ts","../src/kernel/enclave/record-keys/record-codec.ts","../src/kernel/enclave/record-keys/sealing.ts","../src/kernel/enclave/record-keys/deterministic.ts","../src/kernel/enclave/record-keys/envelope-body.ts","../src/kernel/enclave/broker/proof.ts"],"sourcesContent":["/**\n * Record-identity AAD (#1041).\n *\n * AES-GCM authenticates its *additional authenticated data* alongside the\n * ciphertext without encrypting it. Binding a record's identity here is what\n * stops an untrusted store from silently **relocating** an envelope — moving\n * it to another collection or id, re-tiering it, or rewriting who\n * wrote it — while keeping a body whose auth tag still verifies.\n *\n * Scope, stated plainly: this closes cross-COLLECTION relocation, the `_tier`\n * silent-hide, provenance forgery — and, since #1093, **version rollback**.\n *\n * ## `_v` is bound, and what it took to get there\n *\n * `_v` was deliberately left out at first, for a reason that was real rather\n * than cautious: the sync engine re-stamped `_v` on existing ciphertext without\n * holding a DEK (`advancePastRemote`), so binding it would have made every\n * conflict-superseded record undecryptable. #1042's `MergeAuthority` removed\n * that obstacle by giving the merge a DEK-holding capability, so advancing a\n * version became a **re-seal** instead of a metadata edit — and only then could\n * `_v` join the tuple.\n *\n * ⚠️ **What that buys, stated exactly** — the harness measured this, and the\n * loose version (\"rollback is prevented\") is wrong.\n *\n * A body can no longer be presented at a version it was not sealed at. So the\n * *restamped* rollback — take v1's bytes, label them v9, win the convergence\n * comparison, overwrite the newer copy — is refused, and refused **before**\n * `local.put`, so nothing is lost.\n *\n * A store re-serving the genuine v1 **at its own `_v: 1`** is still served, and\n * has to be: that envelope is internally consistent, and a reader arriving\n * fresh has nothing to compare it against. AAD binds a body to the version it\n * claims; it cannot know which version *should* have arrived.\n *\n * So rollback stops being forgery and becomes **withholding** — hiding the newer\n * version rather than faking one — which is `withVaultHead()`'s job (#1044).\n *\n * ## Why `vault` is not bound\n *\n * It was, briefly, and it broke `adoptPartition`. That path re-homes a whole\n * partition into a new vault name by moving envelopes **verbatim** —\n * `with-cargo/adopt-partition.ts:140` is a bare\n * `destinationStore.saveAll(vaultName, backup.collections)` with no\n * re-encryption, because it does not hold the keys to re-encrypt at that\n * point. Binding the vault name makes every adopted record undecryptable.\n *\n * The uncomfortable truth behind that: **relocation is not purely an attack.**\n * Adoption is a legitimate, supported relocation, and AAD cannot tell the two\n * apart. So the vault boundary has to be defended by something that can\n * distinguish intent — an authenticated head or an explicit re-key — rather\n * than by sealing a name the product deliberately changes.\n *\n * Cross-*collection* relocation has no such legitimate counterpart, so it stays\n * bound.\n *\n * @packageDocumentation\n */\n\n/**\n * Where an envelope was fetched from — the **read** side's half of identity.\n *\n * A reader supplies only the address, because that is genuinely all it knows:\n * `_tier`, `_by` and `_v` are read back off the envelope itself\n * ({@link recordAadFor}). Splitting this out of {@link RecordIdentity} is what\n * lets `version` be *required* on the write side without forcing dozens of read\n * call sites to invent one.\n */\nexport interface RecordRef {\n  readonly collection: string\n  readonly id: string\n}\n\n/**\n * The identity an envelope's body is sealed against — the **write** side.\n *\n * Every field here is stamped onto the envelope by `buildRecordEnvelope` from\n * this one object, so what a writer *seals* and what it *stamps* cannot drift.\n */\nexport interface RecordIdentity extends RecordRef {\n  /**\n   * The `_v` this body is sealed at (#1093).\n   *\n   * Required, and required is the point: a version that could be omitted would\n   * be a version some writer forgets, and a record sealed at a version nobody\n   * chose is one a reader cannot open. The compiler asks the question at every\n   * write site instead of leaving it to review.\n   */\n  readonly version: number\n  /** Absent is identical to `0` — the read paths treat them as one record. */\n  readonly tier?: number | undefined\n  /** Absent (no `_by` on the envelope) is distinct from an empty string. */\n  readonly by?: string | undefined\n}\n\n/** Bumped from `/1` when `_v` joined the tuple (#1093). Nothing branches on it. */\nconst SCHEME = 'noydb-aad/2'\n\nconst encoder = new TextEncoder()\n\n/**\n * Length-prefixed, order-fixed encoding.\n *\n * The obvious `${collection}:${id}` is unsafe: an attacker who\n * controls a collection name can choose one that re-splits the same joined\n * string a different way, so two different identities produce identical AAD\n * and the relocation this exists to prevent goes through. Every field is\n * therefore written as a 4-byte big-endian length followed by its UTF-8 bytes,\n * which no field content can imitate.\n *\n * A one-byte presence flag precedes `by` so that \"no author recorded\" and\n * \"author recorded as the empty string\" cannot be swapped for one another.\n */\nexport function buildRecordAad(identity: RecordIdentity): Uint8Array {\n  // ⚠️ Assert on the VALUE, not on the caller's type. `version` is required in\n  // TypeScript, so this can only fire for a caller the compiler never saw — a\n  // hand-built test fixture, a JS consumer, a `Partial` widened somewhere. It\n  // matters because the failure it prevents is invisible: `String(undefined)`\n  // is a perfectly good AAD field, so the record seals happily and becomes\n  // undecryptable at the next read, with a TamperedError pointing at the READ\n  // path where the code is correct. Several fixtures did exactly this (#1093).\n  if (!Number.isFinite(identity.version)) {\n    throw new TypeError(\n      `record AAD: version must be a finite number for \"${identity.collection}/${identity.id}\", ` +\n      `received ${String(identity.version)}. Sealing without one produces a record no reader can open.`,\n    )\n  }\n  const parts: Uint8Array[] = [encoder.encode(SCHEME)]\n\n  const pushField = (value: string): void => {\n    const bytes = encoder.encode(value)\n    const len = new Uint8Array(4)\n    new DataView(len.buffer).setUint32(0, bytes.length, false)\n    parts.push(len, bytes)\n  }\n\n  pushField(identity.collection)\n  pushField(identity.id)\n  // Absent tier ≡ tier 0: `collection.ts` reads `(envelope._tier ?? 0) > 0`,\n  // so treating them differently here would make a record written without a\n  // tier undecryptable once read through a tier-aware path.\n  pushField(String(identity.tier ?? 0))\n\n  parts.push(new Uint8Array([identity.by === undefined ? 0 : 1]))\n  if (identity.by !== undefined) pushField(identity.by)\n  // `_v` (#1093). Written as its decimal string through the same length-prefixed\n  // field encoding as everything else, so a version cannot be confused with the\n  // author beside it.\n  pushField(String(identity.version))\n\n  const total = parts.reduce((n, p) => n + p.length, 0)\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const p of parts) {\n    out.set(p, offset)\n    offset += p.length\n  }\n  return out\n}\n\n/**\n * The AAD a **reader** must supply to open `envelope`, given where it fetched\n * it from.\n *\n * This is the read-side counterpart of {@link buildRecordAad}, and the split\n * exists because of one asymmetry: **a writer always knows what it is writing;\n * a reader often does not.** Query execution, sync merge and backup restore\n * hold an envelope that arrived from a map or a batch, having discarded the\n * address it came from.\n *\n * What makes the read side tractable is that only `{collection, id}` has to be\n * threaded — precisely what the caller passed to `store.get`. `_tier`, `_by`\n * and `_v` are read back **off the envelope**, so no extra plumbing carries\n * them.\n *\n * That is not a weakening. An attacker who edits `_tier` to hide a record,\n * `_by` to forge provenance, or `_v` to pass an old body off as the current\n * one, changes the AAD the reader computes — and AES-GCM then fails to\n * authenticate. The tampered field defeats itself.\n */\nexport function recordAadFor(\n  ref: RecordRef,\n  envelope: {\n    readonly _v: number\n    readonly _tier?: number | undefined\n    readonly _by?: string | undefined\n  },\n): Uint8Array {\n  return buildRecordAad({\n    collection: ref.collection,\n    id: ref.id,\n    version: envelope._v,\n    tier: envelope._tier,\n    by: envelope._by,\n  })\n}\n","/**\n * Per-record CEK lifecycle helpers for the WRITE path.\n *\n * These are the collection-coupled CEK operations, lifted off `Collection`\n * behind narrow deps so the kernel file delegates instead of carrying the\n * crypto inline:\n *\n *   - {@link resolveStableCek} — the stable-CEK rule: an update or history\n *     snapshot reuses the record's existing CEK so a single CEK delete kills\n *     the whole version chain; a genuine insert (or legacy record being\n *     migrated) mints a fresh one.\n *   - {@link rewrapBodyToDek} — move a record body's wrapping from one DEK to\n *     another (tier elevate/demote, bundle re-key) WITHOUT changing the body\n *     key: unwrap the CEK under the source DEK, re-encrypt the body under the\n *     same CEK, re-wrap the CEK under the destination DEK. History-chain\n *     identity is preserved because the body key never changes.\n *\n * Both are pure functions over their deps — the `cekCache` ownership stays on\n * the collection (its lifetime is tied to `load()`), so callers cache the\n * returned key themselves.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, type EnclaveKey } from '../crypto.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport { buildRecordAad, type RecordIdentity } from '../record-aad.js'\nimport type { Lru } from '../../cache/index.js'\n\n/** Dependencies {@link resolveStableCek} needs from its collection. */\nexport interface StableCekDeps {\n  /** The collection's per-record CEK cache (`null` → no caching). */\n  readonly cache: Lru<string, EnclaveKey> | null\n  /** Read the record's live envelope (to recover an existing `_cek`). */\n  getLive(id: string): Promise<EncryptedEnvelope | null>\n  /** The DEK the CEK is wrapped under (the collection DEK on the normal path). */\n  getDEK(): Promise<EnclaveKey>\n}\n\n/**\n * Resolve the stable CEK for a record on the write path. Caches the resolved\n * key under `id` so an update + its history snapshot share one CEK.\n */\nexport async function resolveStableCek(deps: StableCekDeps, id: string): Promise<EnclaveKey> {\n  const cached = deps.cache?.get(id)\n  if (cached) return cached\n\n  const live = await deps.getLive(id)\n  if (live?._cek !== undefined) {\n    const cek = await unwrapCek(live._cek, await deps.getDEK())\n    deps.cache?.set(id, cek, 1)\n    return cek\n  }\n\n  const fresh = await generateDEK()\n  deps.cache?.set(id, fresh, 1)\n  return fresh\n}\n\n/** Re-wrapped body bytes + the (optional) CEK to cache. */\nexport interface RewrappedBody {\n  readonly _iv: string\n  readonly _data: string\n  /** Present iff the source envelope carried a CEK (per-record-key record). */\n  readonly _cek?: string\n  /** The body key when one exists, so the caller can cache it; `null` for a legacy record. */\n  readonly cek: EnclaveKey | null\n}\n\n/**\n * Move a record body from `fromDek`/`from` to `toDek`/`to`.\n *\n * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,\n *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The\n *   body key is unchanged → history-chain identity preserved.\n * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`\n *   directly.\n *\n * ## Why it takes TWO identities (#1041)\n *\n * A rewrap is the one operation where the identity genuinely **changes**. A\n * tier move rewrites `_tier`; a history snapshot lands at a different\n * `(collection, id)` entirely. Since AAD binds both, the body must be opened\n * under the identity it currently has and re-sealed under the one it is moving\n * to. A single identity would be wrong for one end or the other.\n *\n * ⚠️ **This retires an optimisation, deliberately.** Callers used to compute\n * ONE rewrap and reuse the bytes for both a tier move's live write and its\n * `_history` snapshot (#728). Those now have different destination identities,\n * so they need different AAD and therefore different ciphertext — the same\n * bytes cannot satisfy both. Reusing one rewrap for two destinations is now a\n * silent corruption, not a saving: it produces a record that opens at one\n * address and not the other.\n */\nexport async function rewrapBodyToDek(\n  from: RecordIdentity,\n  to: RecordIdentity,\n  envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek' | '_tier' | '_by'>,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n): Promise<RewrappedBody> {\n  const openAad = buildRecordAad(from)\n  const sealAad = buildRecordAad(to)\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, fromDek)\n    const plaintext = await decrypt(envelope._iv, envelope._data, cek, openAad)\n    const { iv, data } = await encrypt(plaintext, cek, sealAad)\n    return { _iv: iv, _data: data, _cek: await wrapCek(cek, toDek), cek }\n  }\n  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek, openAad)\n  const { iv, data } = await encrypt(plaintext, toDek, sealAad)\n  return { _iv: iv, _data: data, cek: null }\n}\n\n/**\n * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping\n * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.\n *\n * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave;\n * this lets callers outside it get back a ready-to-store envelope without\n * reading those fields themselves. Takes a body the caller has ALREADY\n * computed (vs. {@link rewrapEnvelope}, which also runs `rewrapBodyToDek`)\n * so a caller building a SECOND envelope from the same rewrap — a tier\n * move's live write AND its pre-move `_history` snapshot, #728 — pays the\n * unwrap/decrypt/encrypt/wrap crypto once, not twice.\n */\nexport function applyRewrappedBody(envelope: EncryptedEnvelope, body: RewrappedBody): EncryptedEnvelope {\n  const next: EncryptedEnvelope = {\n    ...envelope,\n    _iv: body._iv,\n    _data: body._data,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  if (body._cek === undefined && envelope._cek !== undefined) {\n    delete (next as { _cek?: string })._cek\n  }\n  return next\n}\n\n/**\n * Move a FULL stored envelope from `fromDek` to `toDek`, preserving every\n * field other than the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.\n * Mirrors the spread-merge idiom `with-audit/tiers/index.ts`'s\n * `elevate()`/`demote()` use to apply `rewrapBodyToDek`'s result to the live\n * envelope, generalized to any envelope shape (history callers don't bump\n * `_v`/`_ts`/`_tier` the way a tier move does).\n */\nexport async function rewrapEnvelope(\n  identity: RecordIdentity,\n  envelope: EncryptedEnvelope,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n): Promise<EncryptedEnvelope> {\n  // Identity is UNCHANGED here — this rewrap only moves the wrapping key\n  // (history re-key after a rotation), never the record's address or tags. So\n  // the same identity opens and re-seals (#1041).\n  return applyRewrappedBody(envelope, await rewrapBodyToDek(identity, identity, envelope, fromDek, toDek))\n}\n\n/**\n * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under\n * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?\n *\n * A toDek-first idempotency check for retry-safe rewrap loops (#712 crash\n * atomicity, `with-commit/history/history.ts`'s `rewrapHistory`): a crash\n * mid-rewrap can strand some entries already moved to `toDek` while others\n * remain under `fromDek`. Calling this with `toDek` before attempting the\n * `fromDek` rewrap lets the caller skip an already-migrated entry instead of\n * re-wrapping it (a re-wrap would be a correctness no-op but doubles as an\n * unnecessary write) — and, more importantly, tells a retry loop that this\n * entry needs no `fromDek` unwrap attempt at all, so a crash that landed some\n * entries under `toDek` doesn't wedge on those already-moved entries.\n *\n * AES-KW (CEK unwrap) and AES-GCM (direct decrypt) are both authenticated —\n * unwrap/decrypt under the wrong key throws, never silently returns garbage\n * — so a caught error here reliably means \"not wrapped under `dek`\", not a\n * corrupt envelope (a genuinely corrupt envelope also throws under the\n * correct key, but callers that reach this helper only do so as a\n * best-effort probe before their own decisive fromDek attempt, which still\n * surfaces real corruption).\n *\n * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave —\n * this is the sanctioned door so callers outside it (history.ts) never read\n * those fields themselves, preserving the check-architecture body-access\n * ratchet.\n */\nexport async function isRewrappedUnder(\n  identity: RecordIdentity,\n  envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>,\n  dek: EnclaveKey,\n): Promise<boolean> {\n  try {\n    if (envelope._cek !== undefined) {\n      await unwrapCek(envelope._cek, dek)\n    } else {\n      // MUST pass AAD: without it this trial decrypt fails for every bound\n      // record, the answer is always `false`, and the crash-idempotency skip\n      // it exists to provide silently stops working (#1041).\n      await decrypt(envelope._iv, envelope._data, dek, buildRecordAad(identity))\n    }\n    return true\n  } catch {\n    return false\n  }\n}\n","/**\n * Re-key one envelope from an old collection DEK to a new one (#1074).\n *\n * Lives in the enclave because it is envelope surgery: it reads and writes the\n * protected body slots (`_iv`/`_data`/`_cek`), which `enclave-body-only`\n * reserves to `kernel/enclave/**`. `rotateKeys` previously did this inline in\n * `with-party/team/keyring.ts` and got it wrong in two ways that the guard\n * would have caught had the code lived here.\n *\n * @packageDocumentation\n */\nimport { encrypt, decrypt, wrapCek, unwrapCek, type EnclaveKey } from '../crypto.js'\nimport { recordAadFor } from '../record-aad.js'\nimport type { EncryptedEnvelope } from '../../types.js'\n\n/**\n * Produce the envelope `envelope` becomes once its collection's DEK rotates\n * from `oldDek` to `newDek`.\n *\n * **Every slot is carried forward except `_bidx`.** The previous inline version\n * built a fresh literal holding only `_noydb/_v/_ts/_iv/_data`, silently\n * discarding `_by`, `_tier`, `_cek`, `_sealed`, `_vdig` and `_source`. Losing\n * `_tier` was the worst of those: tier-0 reads treat elevated as missing, so an\n * elevated record did not error after a rotation — it simply disappeared.\n *\n * `_bidx` is dropped deliberately. It is a DEK-rooted equality tag, so a tag\n * carried across a DEK rotation can never be re-derived to match a query again\n * while still leaking the old equality partition. Index coverage regrows\n * per-record on the next `put()` under the new DEK.\n *\n * Two shapes, and picking the wrong one is why this needed a helper:\n *\n * - **per-record CEK** (`_cek` present) — the body is sealed under the CEK and\n *   the CEK is wrapped under the collection DEK, so rotation re-wraps the CEK\n *   and leaves the body **untouched**. The old inline code instead ran\n *   `decrypt(body, oldDek)` on these, which throws: rotation could not complete\n *   on a collection containing any CEK record.\n * - **bare** — body sealed directly under the DEK, so decrypt and re-encrypt.\n *\n * Idempotence is the caller's problem, not this function's: it assumes\n * `envelope` is still under `oldDek`. A resumable rotation must know which side\n * of the migration each record is on before calling.\n */\nexport async function rekeyEnvelopeToDek(\n  ref: { readonly collection: string; readonly id: string },\n  envelope: EncryptedEnvelope,\n  oldDek: EnclaveKey,\n  newDek: EnclaveKey,\n): Promise<EncryptedEnvelope> {\n  // A DEK rotation moves the WRAPPING key only — the record keeps its address\n  // and its tags — so the same AAD opens and re-seals it (#1041).\n  const aad = recordAadFor(ref, envelope)\n  const { _bidx, ...carried } = envelope\n  void _bidx // dropped deliberately — see above\n\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, oldDek)\n    return { ...carried, _cek: await wrapCek(cek, newDek) }\n  }\n\n  const plaintext = await decrypt(envelope._iv, envelope._data, oldDek, aad)\n  const { iv, data } = await encrypt(plaintext, newDek, aad)\n  return { ...carried, _ts: new Date().toISOString(), _iv: iv, _data: data }\n}\n\n/**\n * Resumable variant: returns the re-keyed envelope, or `null` when `envelope`\n * is **already** under `newDek` and needs no work (#1074 part 2).\n *\n * A rotation interrupted mid-collection leaves records on both sides of the\n * migration. Resuming means re-running the rotation with the *same* new DEK,\n * which requires distinguishing \"not yet moved\" from \"already moved\" without\n * the caller touching protected slots.\n *\n * Detection is by trial decryption under `oldDek`. There is no metadata that\n * says which DEK sealed a record — deliberately, since such a marker would be\n * store-writable and therefore a downgrade lever (the same reasoning that\n * keeps the reader from branching on `_noydb`).\n *\n * A record that opens under *neither* key is genuinely damaged and rethrows,\n * rather than being silently skipped: a rotation that quietly walked past\n * unreadable records would convert a loud failure into permanent silent loss,\n * which is the defect this whole issue is about.\n */\nexport async function rekeyEnvelopeIfNeeded(\n  ref: { readonly collection: string; readonly id: string },\n  envelope: EncryptedEnvelope,\n  oldDek: EnclaveKey,\n  newDek: EnclaveKey,\n): Promise<EncryptedEnvelope | null> {\n  try {\n    return await rekeyEnvelopeToDek(ref, envelope, oldDek, newDek)\n  } catch (errUnderOld) {\n    // Already migrated? Then it opens under the new DEK and there is nothing\n    // to do. Verified rather than assumed.\n    try {\n      if (envelope._cek !== undefined) await unwrapCek(envelope._cek, newDek)\n      else await decrypt(envelope._iv, envelope._data, newDek, recordAadFor(ref, envelope))\n      return null\n    } catch {\n      throw errUnderOld\n    }\n  }\n}\n","/**\n * Re-key a vault's blob set from an old `_blob` DEK to a new one (#1122).\n *\n * ## The defect this closes\n *\n * `rotateKeys` re-keys `store.list(vault, <slot>)` plus the derived refs\n * `derivedRefsFor` declares. That assumes a DEK slot named `X` protects data\n * filed under collection `X`. For `_blob` it is false: the slot is `_blob`, but\n * every byte it protects lives in `_blob_index` and `_blob_chunks`. So rotating\n * `_blob` minted a fresh DEK, re-encrypted **nothing**, and made every blob in\n * the vault permanently unreadable — reported to the user as `TamperedError`,\n * i.e. as an attack, when it was self-inflicted. An ordinary `revoke` of a\n * whole-vault grantee reaches it, because such a grantee's DEK map contains\n * `_blob`.\n *\n * ## Why this cannot be done by `rekeyEnvelopeIfNeeded` alone\n *\n * Two of the three surfaces do not have the shape that helper assumes:\n *\n * - a **chunk** envelope is sealed over raw bytes under a bespoke AAD\n *   (`{eTag}:{index}:{count}`), not under the record AAD, so the generic\n *   helper cannot open it;\n * - an **index** envelope's body is JSON that may itself carry a wrapped\n *   per-blob content CEK (`_cek` / `_cekPending`). Re-encrypting the body under\n *   the new DEK without re-wrapping that CEK leaves a blob whose metadata opens\n *   and whose bytes never will.\n *\n * ## Why it lives in the enclave\n *\n * It reads and writes protected body slots and it unwraps/re-wraps keys — the\n * two things `enclave-body-only` reserves to `kernel/enclave/**`, and the same\n * reason `rekeyEnvelopeToDek` moved here in #1074. `with-party` orchestrates\n * the rotation and must not touch a body to do it.\n *\n * The blob layout below is duplicated from its owner rather than imported:\n * `with-shape/blobs/blob-set.ts` already imports `with-party/team/tiers.js`, so\n * a `with-party → with-shape` import would close a cycle, and the kernel may\n * not depend on a service. `BlobObject` itself is a kernel type, so only the\n * three collection/id string layouts are copied, with their owner named.\n *\n * @packageDocumentation\n */\nimport {\n  encrypt,\n  decrypt,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  wrapCek,\n  unwrapCek,\n  type EnclaveKey,\n} from '../crypto.js'\nimport { recordAadFor } from '../record-aad.js'\nimport type { BlobObject, EncryptedEnvelope, NoydbStore } from '../../types.js'\n\n/** Blob metadata envelopes, keyed by eTag. owner: with-shape/blobs/blob-set.ts */\nconst BLOB_INDEX_COLLECTION = '_blob_index'\n/** Chunk envelopes, keyed by `{eTag}_{chunkIndex}`. owner: with-shape/blobs/blob-set.ts */\nconst BLOB_CHUNKS_COLLECTION = '_blob_chunks'\n\n/**\n * Chunk integrity binding: `{eTag}:{chunkIndex}:{chunkCount}`.\n * Mirrors `chunkAAD` in `with-shape/blobs/blob-set.ts` — the same duplication\n * `with-cargo/extract-partition.ts` already carries, for the same reason.\n */\nfunction chunkAad(eTag: string, index: number, chunkCount: number): Uint8Array {\n  return new TextEncoder().encode(`${eTag}:${index}:${chunkCount}`)\n}\n\n/**\n * What a rotation did to the blob set.\n *\n * Deliberately NOT on the enclave barrel: no caller outside this module binds\n * it, and that surface is the fork-swap trust boundary, so exporting a type\n * nobody consumes is pure widening.\n *\n * It is a return value rather than a log line because `foreign` and `blobs`\n * are the only way to tell \"left alone, correctly\" from \"left alone, because\n * the caller passed a wrong `otherDeks` set\". Both re-key nothing and both\n * return successfully. `rotate-preserves-blobs.test.ts` asserts these counts\n * against a direct call for exactly that reason.\n */\nexport interface BlobRekeyReport {\n  /** Index envelopes moved onto the new DEK. */\n  readonly blobs: number\n  /** Chunk envelopes re-encrypted under the new DEK. */\n  readonly chunks: number\n  /**\n   * Index envelopes left alone because they open under a DEK the caller holds\n   * for a DIFFERENT slot — an elevated blob, sealed under `_blob#<tier>`. Those\n   * are that slot's rotation to do, not this one's.\n   */\n  readonly foreign: number\n  /** Index envelopes already under the new DEK — a resumed rotation. */\n  readonly alreadyMoved: number\n}\n\n/** Did `key` open this envelope's JSON body? */\nasync function opensJson(\n  ref: { collection: string; id: string },\n  env: EncryptedEnvelope,\n  key: EnclaveKey,\n): Promise<string | null> {\n  try {\n    return await decrypt(env._iv, env._data, key, recordAadFor(ref, env))\n  } catch {\n    return null\n  }\n}\n\n/**\n * Move every blob sealed under `oldDek` onto `newDek`.\n *\n * Chunks are re-encrypted BEFORE their index entry is re-sealed, and that order\n * is the resume property: an index entry still readable under `oldDek` means\n * its chunks may be half-moved (each one is probed individually), and an index\n * entry readable under `newDek` means its chunks are already done. An\n * interrupted rotation is finished by re-running it with the same `newDek`.\n *\n * `otherDeks` is what keeps a tier-elevated blob from being mistaken for a\n * damaged one. Membership in `_blob_index` is by DEK, not by collection name:\n * a record elevated to tier N has its blob metadata sealed under `_blob#N`. An\n * envelope that opens under NONE of the keys the caller holds is genuinely\n * unreadable and throws, exactly as `rekeyEnvelopeIfNeeded` does — silently\n * walking past it would turn a loud failure into permanent quiet loss.\n */\nexport async function rekeyBlobSet(\n  adapter: NoydbStore,\n  vault: string,\n  oldDek: EnclaveKey,\n  newDek: EnclaveKey,\n  otherDeks: readonly EnclaveKey[] = [],\n): Promise<BlobRekeyReport> {\n  let blobs = 0\n  let chunks = 0\n  let foreign = 0\n  let alreadyMoved = 0\n\n  let eTags: string[]\n  try {\n    eTags = await adapter.list(vault, BLOB_INDEX_COLLECTION)\n  } catch {\n    return { blobs, chunks, foreign, alreadyMoved }\n  }\n\n  for (const eTag of eTags) {\n    const idxEnv = await adapter.get(vault, BLOB_INDEX_COLLECTION, eTag)\n    if (!idxEnv || !idxEnv._iv) continue // no sealed body — nothing to move\n\n    const ref = { collection: BLOB_INDEX_COLLECTION, id: eTag }\n    const json = await opensJson(ref, idxEnv, oldDek)\n    if (json === null) {\n      if ((await opensJson(ref, idxEnv, newDek)) !== null) { alreadyMoved++; continue }\n      let claimed = false\n      for (const key of otherDeks) {\n        if ((await opensJson(ref, idxEnv, key)) !== null) { claimed = true; break }\n      }\n      if (claimed) { foreign++; continue }\n      throw new Error(\n        `[noy-db] rotateKeys: blob index entry \"${eTag}\" opens under neither the retiring `\n        + 'nor the new `_blob` DEK, nor any other key this keyring holds. Rotation stopped '\n        + 'rather than leaving it unreadable and unreported.',\n      )\n    }\n\n    const blob = JSON.parse(json) as BlobObject\n\n    // Chunks first. A legacy blob's bytes sit under the `_blob` DEK itself; an\n    // erasable blob's sit under its per-blob content CEK and must NOT be\n    // touched — re-wrapping that CEK below is the whole of its rotation. A\n    // blob interrupted mid-`migrate()` is mixed, so every chunk is probed.\n    for (let i = 0; i < blob.chunkCount; i++) {\n      const id = `${eTag}_${i}`\n      const chunkEnv = await adapter.get(vault, BLOB_CHUNKS_COLLECTION, id)\n      if (!chunkEnv || !chunkEnv._iv) continue\n      const aad = chunkAad(eTag, i, blob.chunkCount)\n      let plain: Uint8Array\n      try {\n        plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, oldDek, aad)\n      } catch {\n        // A blob that holds a content CEK (settled or pending) keeps its bytes\n        // under that CEK, not under the `_blob` DEK — re-wrapping the CEK below\n        // is the whole of its rotation, and a chunk that refuses `oldDek` is\n        // simply one of those. Nothing to do, and nothing suspicious.\n        if (blob._cek !== undefined || blob._cekPending !== undefined) continue\n        // Otherwise the blob is legacy: every one of its chunks MUST be under a\n        // `_blob` DEK. `newDek` means a previous run already moved this one —\n        // verified, not assumed. Neither key means the chunk is damaged, and it\n        // throws for the same reason `rekeyEnvelopeIfNeeded` does: the index\n        // entry opened fine under `oldDek` and says nothing about its chunks, so\n        // continuing here would walk past unreadable data and report success.\n        try {\n          await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, newDek, aad)\n          continue\n        } catch {\n          throw new Error(\n            `[noy-db] rotateKeys: blob chunk \"${id}\" (${i + 1}/${blob.chunkCount} of eTag `\n            + `\"${eTag}\") opens under neither the retiring nor the new \\`_blob\\` DEK, and its `\n            + 'blob holds no content CEK that could explain it. Rotation stopped rather than '\n            + 'leaving it unreadable and unreported.',\n          )\n        }\n      }\n      const { iv, data } = await encryptBytesWithAAD(plain, newDek, aad)\n      await adapter.put(vault, BLOB_CHUNKS_COLLECTION, id, { ...chunkEnv, _iv: iv, _data: data })\n      chunks++\n    }\n\n    // The wrapped content CEKs travel with the metadata: they are wrapped under\n    // the `_blob` DEK, so a rotation that re-encrypted the body and left them\n    // alone would produce metadata that opens and bytes that never do.\n    const rewrapped: BlobObject = {\n      ...blob,\n      ...(blob._cek !== undefined\n        ? { _cek: await wrapCek(await unwrapCek(blob._cek, oldDek), newDek) }\n        : {}),\n      ...(blob._cekPending !== undefined\n        ? { _cekPending: await wrapCek(await unwrapCek(blob._cekPending, oldDek), newDek) }\n        : {}),\n    }\n\n    const { iv, data } = await encrypt(JSON.stringify(rewrapped), newDek, recordAadFor(ref, idxEnv))\n    await adapter.put(vault, BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data })\n    blobs++\n  }\n\n  return { blobs, chunks, foreign, alreadyMoved }\n}\n","/**\n * Sealed-slot sub-step — the \"seal these declared fields into their own\n * `iv:data` slots\" mechanism, extracted byte-parity from `RecordCodec`\n * (#629 Task 1; see `.superpowers/sdd/seam-map-classified-blobs.md` §2).\n *\n * This is the ONE genuinely separable sub-step `RecordCodec.encryptRecord`/\n * `decryptRecord` perform (the digest-only `_vdig`/`_bidx` mechanism is NOT\n * separable the same way — it needs write-history `prev` context, see the\n * seam map's separability verdict). `sealFields`/`unsealFields` are the\n * natural shape of a `via` `encodeAtRest`/`decodeAtRest` hook for a \"seal\n * this field\" via-feature, and `makeSealedSlotCapability`/\n * `makeReservedEnvelopes` (below) are the `ViaCryptoCtx` capability\n * factories built on top of them.\n *\n * The capability factories live here (rather than a sibling\n * `kernel/via-crypto.ts`) so they can call `deriveSealedFieldKey`/\n * `deriveSealedFieldKeyFromCek`/`encrypt`/`decrypt` directly — this file IS\n * kernel enclave code (C3), so it is exempt from `enclave-barrel-only` the\n * same way `record-codec.ts`/`sealing.ts` are. A file outside\n * `kernel/enclave/**` would have had to go through the enclave barrel\n * (`kernel/enclave/index.ts`), which does not (yet) export these symbols.\n */\nimport { encrypt, decrypt, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, type EnclaveKey } from '../crypto.js'\nimport { dualReadSealedSlot } from './sealed-slot.js'\nimport { buildRecordEnvelope } from '../record-envelope.js'\nimport { buildRecordAad, recordAadFor } from '../record-aad.js'\nimport { SealedHandle, type EncryptedEnvelope } from '../../types.js'\nimport { ValidationError } from '../../errors.js'\nimport type { SealedSlotRef, ViaCryptoCtx } from '../../via/index.js'\n\n/**\n * Key material for one collection's sealed-field derivation. `cek`, when\n * supplied, is preferred (record-scoped); `getDEK` is the fallback (and,\n * for legacy/no-CEK collections, the only key) — mirrors the dual-read\n * `RecordCodec` has always done.\n */\nexport interface SealKeyMaterial {\n  readonly collection: string\n  readonly cek?: EnclaveKey\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport interface SealFieldsResult {\n  readonly openRecord: Record<string, unknown>\n  readonly sealed: Record<string, string> | undefined\n}\n\n/** Seal one field's value to an `iv:data` slot under its derived per-field key. */\nasync function sealOneFieldWithDek(\n  field: string,\n  value: unknown,\n  dek: EnclaveKey,\n  keyMaterial: SealKeyMaterial,\n): Promise<SealedSlotRef> {\n  const fieldKey = keyMaterial.cek !== undefined\n    ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field)\n    : await deriveSealedFieldKey(dek, keyMaterial.collection, field)\n  return encrypt(JSON.stringify(value), fieldKey)\n}\n\n/**\n * Seal one field's value on demand — fetches the DEK itself. A singular\n * counterpart to {@link sealFields} for callers that seal one field at a\n * time rather than a whole record. Not exported — `makeSealedSlotCapability`\n * is the only caller (#629 Task 11: knip-flagged unused export, dropped;\n * intra-module use only).\n */\nasync function sealOneField(\n  field: string,\n  value: unknown,\n  keyMaterial: SealKeyMaterial,\n): Promise<SealedSlotRef> {\n  const dek = await keyMaterial.getDEK()\n  return sealOneFieldWithDek(field, value, dek, keyMaterial)\n}\n\n/**\n * Peel declared `sensitiveFields` out of `record` BEFORE building `_data`,\n * sealing each into its own `iv:data` slot. Extracted byte-parity from\n * `RecordCodec.encryptRecord` step 2 (pre-#629 `record-codec.ts:261-288`).\n * Returns `record` untouched (and `sealed: undefined`) when no declared\n * field is present with a defined value — the envelope stays byte-identical\n * to legacy output, exactly as before.\n */\nexport async function sealFields(\n  record: Record<string, unknown>,\n  sensitiveFields: ReadonlySet<string>,\n  keyMaterial: SealKeyMaterial,\n): Promise<SealFieldsResult> {\n  const dek = await keyMaterial.getDEK()\n  const open: Record<string, unknown> = { ...record }\n  const slots: Record<string, string> = {}\n  for (const field of sensitiveFields) {\n    if (!(field in record)) continue\n    const value = record[field]\n    if (value === undefined) continue\n    const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial)\n    slots[field] = `${iv}:${data}`\n    delete open[field]\n  }\n  if (Object.keys(slots).length === 0) return { openRecord: record, sealed: undefined }\n  return { openRecord: open, sealed: slots }\n}\n\n/**\n * Unseal one `_sealed[field]` slot to its plaintext value: dual-read (try\n * the CEK-derived key, fall back to the DEK-derived key for legacy\n * records), AES-GCM-decrypt the `iv:data` blob, and JSON-parse the result.\n * Extracted byte-parity from `RecordCodec.unsealField`\n * (pre-#629 `record-codec.ts:485-493`).\n */\nexport async function unsealOneField(field: string, blob: string, keyMaterial: SealKeyMaterial): Promise<unknown> {\n  const dek = await keyMaterial.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek))\n}\n\n/**\n * Build a non-leaking {@link SealedHandle} producer over sealed key\n * material: each call captures only the ciphertext `blob` and a closure to\n * {@link unsealOneField} — the plaintext is never stored on the handle, and\n * (crucially) the DEK is fetched lazily on `reveal()`, never at handle-\n * construction time. Extracted byte-parity from\n * `RecordCodec.makeSealedHandle` (pre-#629 `record-codec.ts:552-554`).\n */\nexport function makeHandleProducer(keyMaterial: SealKeyMaterial): (field: string, blob: string) => SealedHandle<unknown> {\n  return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial))\n}\n\n/**\n * Restore every `[field]: blob` entry in `sealed` onto `record` (mutated in\n * place, matching the original's mutate-then-return shape): eagerly unseal\n * to plaintext (`opts.asHandles` falsy) or wrap each in a\n * {@link SealedHandle} (`opts.asHandles: true`) so the plaintext is never\n * materialised. Extracted byte-parity from `RecordCodec.decryptRecord`'s\n * sealed-handle block (pre-#629 `record-codec.ts:615-623`).\n */\nexport async function unsealFields(\n  record: Record<string, unknown>,\n  sealed: Record<string, string>,\n  keyMaterial: SealKeyMaterial,\n  opts?: { asHandles?: boolean },\n): Promise<Record<string, unknown>> {\n  const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : undefined\n  for (const [field, blob] of Object.entries(sealed)) {\n    record[field] = makeHandle !== undefined ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial)\n  }\n  return record\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// ViaCryptoCtx capability factories (#629 Task 1, second commit)\n// ─────────────────────────────────────────────────────────────────────────\n\n/** What {@link makeSealedSlotCapability} needs — a subset of `RecordCodecContext`. */\nexport interface SealedSlotCapabilityCtx {\n  readonly name: string\n  getDEK(): Promise<EnclaveKey>\n}\n\n/**\n * Build a `ViaCryptoCtx.sealedSlots` capability pre-bound to one\n * `(collection, recordId)`. The key material (`cek`/DEK resolver) is closed\n * over and never placed on the returned object — `Object.keys`/\n * `Object.values` of the capability expose only the three methods, never a\n * key (zero-knowledge: capabilities never expose keys).\n *\n * `delete(field)` is **advisory and capability-instance-local, not real\n * erasure** — it has no store to reach and never will by itself: it just\n * adds `field` to a `Set` closed over by THIS ONE capability object, so a\n * later `unseal` call on that SAME object refuses. No I/O happens. A fresh\n * capability for the same record (e.g. `seal()`'d again, or a new\n * `makeSealedSlotCapability(...)` call) has an empty set and sees no\n * deletion at all — `seal()` on a given field also clears any prior mark\n * for it. Do not build production logic on `delete()` persisting anything.\n * The real erasure guarantee for a forgotten record is `vault.forget()`'s\n * unconditional `_writeTombstone` call, which replaces the whole live\n * envelope with a fresh, `_sealed`-free tombstone — `_sealed` disappears\n * from the store regardless of what any capability's `delete()` marked.\n * (#629 Task 10 traced this end-to-end; see task-10-report.md \"sealedSlots\n * .delete()\" section. Removing/changing this method's shape is a phase-E\n * decision, not implied by this comment.)\n */\nexport function makeSealedSlotCapability(\n  ctx: SealedSlotCapabilityCtx,\n  recordId: string,\n  cek?: EnclaveKey,\n): ViaCryptoCtx['sealedSlots'] {\n  const keyMaterial: SealKeyMaterial = {\n    collection: ctx.name,\n    ...(cek !== undefined ? { cek } : {}),\n    getDEK: () => ctx.getDEK(),\n  }\n  const deletedFields = new Set<string>()\n\n  return {\n    async seal(field, plaintext) {\n      const ref = await sealOneField(field, plaintext, keyMaterial)\n      deletedFields.delete(field)\n      return ref\n    },\n    async unseal(field, ref) {\n      if (deletedFields.has(field)) {\n        throw new ValidationError(`sealedSlots.unseal: field \"${field}\" on record \"${recordId}\" was deleted from this capability`)\n      }\n      return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial)\n    },\n    async delete(field) {\n      deletedFields.add(field)\n    },\n  }\n}\n\n/** Resolve the DEK for an arbitrary (possibly synthetic, e.g. `_dict_en`) collection name. */\nexport type ReservedEnvelopeDekResolver = (collection: string) => Promise<EnclaveKey>\n\n/**\n * Build a `ViaCryptoCtx.reservedEnvelopes` capability: a whole-envelope\n * encrypt/decrypt door scoped to collection names under a declared prefix\n * (e.g. `_dict_`) — the shape `via/i18n/dictionary.ts`'s\n * `DictionaryHandle` needs (seam map Part 3): build JSON → encrypt under a\n * DEK → wrap in an `EncryptedEnvelope`; decrypt → JSON text. No per-record\n * CEK — reserved envelopes are whole-DEK-encrypted, same as the dictionary\n * grandfather.\n *\n * `reservedEnvelopes(prefix)` throws `ValidationError` immediately when\n * `prefix` is not in `declaredPrefixes`; each `encrypt`/`decrypt` call\n * throws `ValidationError` when its `collection` argument does not start\n * with `prefix`.\n */\nexport function makeReservedEnvelopes(\n  dekResolver: ReservedEnvelopeDekResolver,\n  declaredPrefixes: readonly string[],\n): ViaCryptoCtx['reservedEnvelopes'] {\n  const declared = new Set(declaredPrefixes)\n\n  return (prefix: string) => {\n    if (!declared.has(prefix)) {\n      throw new ValidationError(`reservedEnvelopes: prefix \"${prefix}\" is not declared by this binding's reservedPrefixes`)\n    }\n\n    const assertPrefixed = (collection: string, method: 'encrypt' | 'decrypt'): void => {\n      if (!collection.startsWith(prefix)) {\n        throw new ValidationError(\n          `reservedEnvelopes('${prefix}').${method}: collection \"${collection}\" does not start with \"${prefix}\"`,\n        )\n      }\n    }\n\n    const encryptForPrefix = async (\n      ref: { readonly collection: string; readonly id: string; readonly by?: string },\n      json: string,\n      v: number,\n    ): Promise<EncryptedEnvelope> => {\n      assertPrefixed(ref.collection, 'encrypt')\n      const dek = await dekResolver(ref.collection)\n      // `v` folds INTO the identity — it is `_v`, which the AAD binds, so the\n      // version sealed and the version stamped come from one object (#1093).\n      const identity = { ...ref, version: v }\n      // `by` is part of the identity, so it is SEALED here and stamped by\n      // `buildRecordEnvelope` from the same source. A caller that added `_by`\n      // to the returned envelope afterwards would produce a record whose AAD\n      // no reader can reproduce — which is exactly what via/lookup did (#1041).\n      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n      return buildRecordEnvelope(identity, { iv, data })\n    }\n\n    const decryptForPrefix = async (collection: string, id: string, env: EncryptedEnvelope): Promise<string> => {\n      assertPrefixed(collection, 'decrypt')\n      const dek = await dekResolver(collection)\n      return decrypt(env._iv, env._data, dek, recordAadFor({ collection, id }, env))\n    }\n\n    return { encrypt: encryptForPrefix, decrypt: decryptForPrefix }\n  }\n}\n","/**\n * Digest-only write engine (C6 rotate branch + notLastN ring, spec §2/§4).\n * Called ONLY by RecordCodec.encryptRecord — both live inside the enclave.\n * @module\n */\nimport { generateSalt, bufferToBase64, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { sealVdigPayload, openVdigPayload, type VdigPayload, type VdigDigestEntry } from './vdig.js'\nimport { ClassifiedRotationError, TamperedError } from '../../errors.js'\nimport type { VdigFieldPolicy } from '../../types.js'\n\nexport async function mintVdigSlot(\n  rawValue: string,\n  policy: VdigFieldPolicy,\n  prevBlob: string | undefined,\n  cek: EnclaveKey,\n  collection: string,\n  recordId: string,\n  field: string,\n): Promise<string> {\n  const normalized = normalizeForVerify(policy.normalize, rawValue)\n\n  let prev: VdigPayload | null = null\n  if (prevBlob !== undefined) {\n    try {\n      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field)\n    } catch {\n      // Any failure opening a prior _vdig slot (auth-tag mismatch, malformed\n      // JSON, wrong AAD) is a tamper/false condition — normalize to\n      // TamperedError so the write path never sees a distinct error shape.\n      throw new TamperedError()\n    }\n    if (!Number.isInteger(prev.iter) || prev.iter < 1) {\n      // A corrupted/tampered iter count would silently weaken (or break)\n      // the reuse-check PBKDF2 pass — floor/validate before trusting it.\n      throw new TamperedError()\n    }\n  }\n\n  // notLastN reuse refusal: candidate vs cur + every ring entry, each a full\n  // PBKDF2 at the payload's own iteration count (n × 600K is the documented\n  // write-time cost ceiling, cap 8 — spec Q4).\n  if (prev !== null && policy.notLastN > 0) {\n    const history: readonly VdigDigestEntry[] = [prev.cur, ...(prev.ring ?? [])]\n    for (const entry of history) {\n      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter)\n      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {\n        throw new ClassifiedRotationError(collection, field, 'password was used recently')\n      }\n    }\n  }\n\n  const salt = generateSalt()\n  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS)\n  const ring = prev !== null && policy.notLastN > 0\n    ? [...(prev.ring ?? []), { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN)\n    : undefined\n\n  const payload: VdigPayload = {\n    v: 1,\n    alg: 'PBKDF2-SHA256',\n    iter: VDIG_ITERATIONS,\n    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: new Date().toISOString() },\n    ...(ring !== undefined && ring.length > 0 ? { ring } : {}),\n  }\n  return sealVdigPayload(payload, cek, collection, recordId, field)\n}\n","/**\n * Standard Schema v1 integration.\n *\n * This file is the entry point for **schema validation**. Any\n * validator that implements the [Standard Schema v1\n * protocol](https://standardschema.dev) — Zod, Valibot, ArkType, Effect\n * Schema, etc. — can be attached to a `Collection` or `defineNoydbStore`\n * and will:\n *\n *   1. Validate the record BEFORE encryption on `put()` — bad data is\n *      rejected at the store boundary with a rich issue list.\n *   2. Validate the record AFTER decryption on `get()`/`list()`/`query()`\n *      — stored data that has drifted from the current schema throws\n *      loudly instead of silently propagating garbage to the UI.\n *\n * ## Why vendor the types?\n *\n * Standard Schema is a protocol, not a library. The spec is <200 lines of\n * TypeScript and has no runtime. There's an official `@standard-schema/spec`\n * types package on npm, but pulling it in would add a dependency edge\n * purely for type definitions. Vendoring the minimal surface keeps\n * `@noy-db/core` at **zero runtime dependencies** and gives us freedom to\n * evolve the helpers without a version-lock on the spec package.\n *\n * If the spec changes in a breaking way (unlikely — it's frozen at v1),\n * we update this file and bump our minor.\n *\n * ## Why not just run `schema.parse(value)` directly?\n *\n * Because then we'd be locked to whichever validator happens to have\n * `.parse`. Standard Schema's `'~standard'.validate` contract is the same\n * across every implementation and includes a structured issues list,\n * which is much more useful than a thrown error for programmatic error\n * handling (e.g., rendering field-level messages in a Vue component).\n */\n\nimport { SchemaValidationError } from './errors.js'\n\n/**\n * The Standard Schema v1 protocol. A schema is any object that exposes a\n * `'~standard'` property with `version: 1` and a `validate` function.\n *\n * The type parameters are:\n *   - `Input`  — the type accepted by `validate` (what the user passes in)\n *   - `Output` — the type produced by `validate` (what we store/return,\n *                may differ from Input if the schema transforms or coerces)\n *\n * In most cases `Input === Output`, but validators that transform\n * (Zod's `.transform`, Valibot's `transform`, etc.) can narrow or widen.\n *\n * We intentionally keep the `types` field `readonly` and optional — the\n * spec marks it as optional because it's only used for inference, and\n * not every implementation bothers populating it at runtime.\n */\nexport interface StandardSchemaV1<Input = unknown, Output = Input> {\n  readonly '~standard': {\n    readonly version: 1\n    readonly vendor: string\n    readonly validate: (\n      value: unknown,\n    ) =>\n      | StandardSchemaV1SyncResult<Output>\n      | Promise<StandardSchemaV1SyncResult<Output>>\n    readonly types?:\n      | {\n          readonly input: Input\n          readonly output: Output\n        }\n      | undefined\n  }\n}\n\n/**\n * The result of a single call to `schema['~standard'].validate`. Either\n * `{ value }` on success or `{ issues }` on failure — never both.\n *\n * The spec allows `issues` to be undefined on success (and some\n * validators leave it that way), so consumers should discriminate on\n * `issues?.length` rather than on truthiness of `value`.\n */\nexport type StandardSchemaV1SyncResult<Output> =\n  | { readonly value: Output; readonly issues?: undefined }\n  | {\n      readonly value?: undefined\n      readonly issues: readonly StandardSchemaV1Issue[]\n    }\n\n/**\n * A single validation issue. The `message` is always present; the `path`\n * is optional and points at the offending field when the schema tracks\n * it (virtually every validator does for object types).\n *\n * The path is deliberately permissive — both a plain `PropertyKey` and a\n * `{ key }` wrapper are allowed so validators that wrap path segments in\n * objects (Zod does this in some modes) don't need special handling.\n */\nexport interface StandardSchemaV1Issue {\n  readonly message: string\n  readonly path?:\n    | ReadonlyArray<PropertyKey | { readonly key: PropertyKey }>\n    | undefined\n}\n\n/**\n * Infer the output type of a Standard Schema. Consumers use this to\n * pull the type out of a schema instance when they want to declare a\n * Collection<T> or defineNoydbStore<T> with `T` derived from the schema.\n *\n * Example:\n * ```ts\n * const InvoiceSchema = z.object({ id: z.string(), amount: z.number() })\n * type Invoice = InferOutput<typeof InvoiceSchema>\n * ```\n */\nexport type InferOutput<T extends StandardSchemaV1> =\n  T extends StandardSchemaV1<unknown, infer O> ? O : never\n\n/**\n * Validate an input value against a schema. Throws\n * `SchemaValidationError` if the schema rejects, with the rich issue\n * list attached. Otherwise returns the (possibly transformed) output\n * value.\n *\n * The `context` string is included in the thrown error's message so the\n * caller knows where the failure happened (e.g. `\"put(inv-001)\"`) without\n * every caller having to wrap the throw in a try/catch.\n *\n * This function is ALWAYS async because some validators (notably Effect\n * Schema and Zod's `.refine` with async predicates) can return a\n * Promise. We `await` the result unconditionally to normalize the\n * contract — the extra microtask is free compared to the cost of an\n * encrypt/decrypt round-trip.\n */\nexport async function validateSchemaInput<Output>(\n  schema: StandardSchemaV1<unknown, Output>,\n  value: unknown,\n  context: string,\n): Promise<Output> {\n  const result = await schema['~standard'].validate(value)\n  if (result.issues !== undefined && result.issues.length > 0) {\n    throw new SchemaValidationError(\n      `Schema validation failed on ${context}: ${summarizeIssues(result.issues)}`,\n      result.issues,\n      'input',\n    )\n  }\n  // Safe: the spec guarantees `value` is present when `issues` is absent.\n  return result.value as Output\n}\n\n/**\n * Validate an already-stored value coming OUT of the collection. This\n * is a distinct helper from `validateSchemaInput` because the error\n * semantics differ: an output-validation failure means the data in\n * storage has drifted from the current schema (an unexpected state),\n * whereas an input-validation failure means the user passed bad data\n * (an expected state for a UI that isn't guarding its inputs).\n *\n * We still throw — silently returning bad data would be worse — but\n * the error carries `direction: 'output'` so upstream code (and a\n * potential migrate hook) can distinguish the two cases.\n */\nexport async function validateSchemaOutput<Output>(\n  schema: StandardSchemaV1<unknown, Output>,\n  value: unknown,\n  context: string,\n): Promise<Output> {\n  const result = await schema['~standard'].validate(value)\n  if (result.issues !== undefined && result.issues.length > 0) {\n    throw new SchemaValidationError(\n      `Stored data for ${context} does not match the current schema — ` +\n        `schema drift? ${summarizeIssues(result.issues)}`,\n      result.issues,\n      'output',\n    )\n  }\n  return result.value as Output\n}\n\n/**\n * Produce a short human-readable summary of an issue list for the\n * thrown error's message. The full issue array is still attached to the\n * error as a property — this is only for the `.message` string that\n * shows up in console.error / stack traces.\n *\n * Format: `field: message; field2: message2` (up to 3 issues, then `…`).\n * Issues without a path are shown as `root: message`.\n */\nfunction summarizeIssues(\n  issues: readonly StandardSchemaV1Issue[],\n): string {\n  const shown = issues.slice(0, 3).map((issue) => {\n    const pathStr = formatPath(issue.path)\n    return `${pathStr}: ${issue.message}`\n  })\n  const suffix = issues.length > 3 ? ` (+${issues.length - 3} more)` : ''\n  return shown.join('; ') + suffix\n}\n\nfunction formatPath(\n  path: StandardSchemaV1Issue['path'],\n): string {\n  if (!path || path.length === 0) return 'root'\n  return path\n    .map((segment) =>\n      typeof segment === 'object' && segment !== null\n        ? String(segment.key)\n        : String(segment),\n    )\n    .join('.')\n}\n","/**\n * RecordCodec — the per-record envelope build + encrypt/decrypt + per-record-CEK\n * + sealed-field crypto.\n *\n * `Collection` holds one `RecordCodec` instance and delegates the crypto write\n * path (`encryptRecord` / `encryptJsonString` / `buildDebugEnvelope`), the read\n * path (`decryptRecord` / `decryptJsonString` / `resolveEnvelopeCek`), and the\n * sealed-field helpers (`unsealField` / `makeSealedHandle` / `toCacheRecord` /\n * `classifySealedShred`) to it. The codec receives every `this.*` dependency\n * it needs via {@link RecordCodecContext}.\n *\n * The crux is `cekCache`: it is the SAME `Lru` reference `Collection` owns (not\n * a copy). `resolveEnvelopeCek` reads/writes it, and tier methods +\n * `vault.invalidateRecordCaches` keep mutating that same object — a copy would\n * silently break the \"single CEK delete kills the version chain\" invariant.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nimport { encrypt, decrypt, encryptDeterministic, deriveDeterministicKey, wrapCek, unwrapCek, deriveSealedFieldKeyFromCek, type EnclaveKey } from '../crypto.js'\nimport { NOYDB_FORMAT_VERSION, type EncryptedEnvelope, type CrdtMode, type CrdtState, type CrdtStrategy, type VdigFieldPolicy, type SealedHandle } from '../../types.js'\nimport { isTombstone, isDeleteMarker } from './tombstone.js'\nimport { parseSealedSlot } from './sealed-slot.js'\nimport { buildRecordEnvelope } from '../record-envelope.js'\nimport { buildRecordAad, recordAadFor, type RecordIdentity, type RecordRef } from '../record-aad.js'\nimport { sealFields, unsealOneField, unsealFields, makeHandleProducer, makeSealedSlotCapability, makeReservedEnvelopes, type SealKeyMaterial } from './sealed-slots.js'\nimport { DebugReservedFieldError, ClassifiedConfigError, ValidationError } from '../../errors.js'\nimport { mintVdigSlot } from '../classify/write.js'\nimport { mintBidxTag } from '../classify/bidx.js'\nimport { normalizeForVerify } from '../classify/normalize.js'\nimport { validateSchemaOutput, type StandardSchemaV1 } from '../../schema.js'\nimport type { Lru } from '../../cache/index.js'\nimport type { ViaCryptoCtx, SealedSlotRef } from '../../via/index.js'\nimport type { ViaPipeline } from '../../via/pipeline.js'\n\n/**\n * One classified per-slot verdict from {@link RecordCodec.classifySealedShred}.\n * `shreddable` — CEK-only, tombstone makes it undecryptable. `dekResidue` —\n * collection-DEK-keyed, survives in synced/backup copies. The third class is\n * BOTH: a `_bidx` blind-index tag is live-dropped by the tombstone yet retained\n * under the surviving DEK in any pre-forget backup (honest dual accounting).\n */\nexport type SealedShredSlot = {\n  readonly field: string\n  readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups'\n}\n\n/** Everything the moving crypto methods touched on `this.*`, as a flat context. */\nexport interface RecordCodecContext<T> {\n  /** Collection name — the crypto AAD scope and schema-error context. */\n  readonly name: string\n  /** Actor id stamped on `_by` (the collection's keyring.userId). */\n  readonly actor: string\n  /** False on plaintext collections — selects the no-ciphertext envelope branch. */\n  readonly storeCiphertext: boolean\n  /** keyring.debugPlaintext — debug-inline envelope on user collections. */\n  readonly debugPlaintext: boolean\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared `sensitive` fields → sealed into `_sealed[field]`. */\n  readonly sensitiveFields: ReadonlySet<string>\n  /** Declared deterministic-index fields, or null. */\n  readonly deterministicFields: ReadonlySet<string> | null\n  /** Digest-only classified fields → verify policy (stage 2). Null when none. */\n  readonly vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null\n  /**\n   * C-A / R10 config-drift signal: the persisted `x-classified` marker's\n   * declared digest-only field set (empty when the collection carries no\n   * marker). Lazy, memoized (O(1) per handle after the first call). The R10\n   * superset guard refuses whenever a field in this set is absent from\n   * `vdigFields`. Consulted once per handle on any encrypted write path — the\n   * cross-session, prev-free signal a fully-naive create has no `prev` for.\n   * Undefined on codecs with no store access (direct-construction tests).\n   */\n  classifiedMarkerDigestOnly?(): Promise<readonly string[]>\n  /** CRDT mode (decrypt resolves CrdtState→snapshot when set). */\n  readonly crdtMode: CrdtMode | undefined\n  /** CRDT strategy seam (resolveCrdtSnapshot). */\n  readonly crdtStrategy: CrdtStrategy\n  /** Output-schema validator, or undefined. */\n  readonly schema: StandardSchemaV1<unknown, T> | undefined\n  /**\n   * Resolve a collection's DEK. Called with no argument for `this.name`'s\n   * own DEK (every ordinary codec use); `viaCryptoCtx`'s `reservedEnvelopes`\n   * door passes an explicit OTHER collection name (e.g. a reserved\n   * `_dict_status` collection) so a binding's at-rest hook can address a\n   * different collection's DEK without ever holding the resolver itself.\n   */\n  getDEK(collection?: string): Promise<EnclaveKey>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * Ownership/lifetime stays on Collection; codec reads+writes it in\n   * resolveEnvelopeCek exactly as the inline code did. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /**\n   * Compiled Via pipeline (money, i18n, …), or undefined for a collection\n   * with none declared. `encryptRecord`/`decryptRecord` consult\n   * `via?.hasAtRestHooks` at the sealed-slot sub-step to choose between a\n   * binding's `encodeAtRest`/`decodeAtRest` hooks and today's inline path.\n   * The zero-via fast path (`via` undefined, or no binding declares an\n   * at-rest hook) stays byte/behavior-identical (#629 Task 3).\n   *\n   * Mutable (not `readonly`, #638 Task 3): `Collection.via` can be\n   * reassigned post-construction (the taint overlay, `via/graph-wiring.ts#\n   * applyTaintOverlay`) — `RecordCodec.setVia` below keeps this in sync so\n   * at-rest hooks read the LIVE pipeline, not a stale construction-time\n   * snapshot.\n   */\n  via: ViaPipeline | undefined\n}\n\nexport class RecordCodec<T> {\n  constructor(private readonly ctx: RecordCodecContext<T>) {}\n\n  /**\n   * @internal Update the live Via pipeline this codec's at-rest hooks read\n   * (#638 Task 3) — called by `via/graph-wiring.ts#applyTaintOverlay` right\n   * after it reassigns `Collection.via`, so `hasAtRestHooks`/`encodeAtRest`/\n   * `decodeAtRest` see the newly-added `taint` binding instead of the\n   * pipeline snapshot captured when this codec was constructed.\n   */\n  setVia(via: ViaPipeline | undefined): void {\n    this.ctx.via = via\n  }\n\n  /** Sealed-slot key material for this codec's collection, for a given per-record CEK (or none). */\n  private sealKeyMaterial(cek: EnclaveKey | undefined): SealKeyMaterial {\n    return {\n      collection: this.ctx.name,\n      ...(cek !== undefined ? { cek } : {}),\n      getDEK: () => this.ctx.getDEK(),\n    }\n  }\n\n  /**\n   * Build the `ViaCryptoCtx` handed to a binding's `encodeAtRest`/\n   * `decodeAtRest` hook: `sealedSlots` pre-bound to `(this.ctx.name,\n   * recordId)` — always threading `cek` when the caller has one, so the\n   * capability's record-binding stays cryptographic rather than degrading\n   * to collection-scope. `reservedEnvelopes`'s DEK resolver forwards its\n   * `collection` argument straight to `this.ctx.getDEK` (#629 Task 4) — it\n   * resolves the RESERVED collection's own DEK (e.g. `_dict_status`), never\n   * `this.ctx.name`'s, matching `Vault.getDEK`'s per-collection-name\n   * resolution (the same resolver `DictionaryHandle` used pre-cutover).\n   */\n  private viaCryptoCtx(recordId: string, cek: EnclaveKey | undefined): ViaCryptoCtx {\n    const declaredPrefixes = this.ctx.via?.bindings.flatMap((b) => b.reservedPrefixes ?? []) ?? []\n    return {\n      sealedSlots: makeSealedSlotCapability(this.ctx, recordId, cek),\n      reservedEnvelopes: makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes),\n    }\n  }\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Low-level literal builders\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Assemble a canonical ciphertext body envelope literal from already-computed\n   * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries\n   * a SEPARATE timestamp (computed by the caller), so the two never share one.\n   */\n  static buildEnvelope(identity: RecordIdentity, p: {\n    iv: string\n    data: string\n    // No `by` — `_by` is stamped from `identity`, the single source (#1041).\n    // It was declared here and silently ignored, which is exactly how a\n    // dropped field hides.\n    cek?: string\n    provenance?: { source: string; sourceTs: string } | undefined\n    extra?: Partial<Pick<EncryptedEnvelope, '_tier' | '_det' | '_sealed'>>\n  }): EncryptedEnvelope {\n    return buildRecordEnvelope(identity, p)\n  }\n\n  /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */\n  static buildPlaintextEnvelope(identity: RecordIdentity, p: {\n    data: string\n    provenance?: { source: string; sourceTs: string } | undefined\n  }): EncryptedEnvelope {\n    return buildRecordEnvelope(identity, { ...p, iv: '' })\n  }\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Write path\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Build a debug-plaintext envelope: the record's own fields inlined as\n   * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an\n   * empty `_data`. Lets native store tooling read the record without\n   * unwrapping. Only reached for user collections under `debugPlaintext`\n   * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which\n   * would collide with the reserved metadata namespace.\n   */\n  buildDebugEnvelope(id: string, record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope {\n    const rec = record as unknown as Record<string, unknown>\n    for (const key of Object.keys(rec)) {\n      if (key.startsWith('_')) throw new DebugReservedFieldError(this.ctx.name, key)\n    }\n    const base = buildRecordEnvelope(\n      { collection: this.ctx.name, id, by: this.ctx.actor, version },\n      {\n        iv: '',\n        data: '',\n        \n        ...(this.ctx.provenance && source !== undefined\n          ? { provenance: { source, sourceTs: sourceTs ?? new Date().toISOString() } }\n          : {}),\n      },\n    )\n    // `_debug` and the inlined record fields are this envelope's own shape —\n    // they are not part of the canonical constructor's contract.\n    return { ...base, _debug: NOYDB_FORMAT_VERSION, ...rec } as unknown as EncryptedEnvelope\n  }\n\n  /**\n   * Encrypt a JSON body into an envelope.\n   *\n   * When `cek` is supplied (per-record CEK collections), the body is\n   * encrypted under the CEK and the CEK is AES-KW-wrapped under the\n   * collection DEK and stamped on `_cek`. When `cek` is omitted, the legacy\n   * path encrypts the body directly under the collection DEK — byte-identical\n   * to pre-CEK behaviour, so non-adopting collections pay nothing.\n   */\n  /**\n   * `ref` is the identity the envelope is sealed against, and it is **the\n   * location the bytes are stored at** — not necessarily this codec's own\n   * collection (#1051).\n   *\n   * That distinction was discovered here rather than assumed. Several callers\n   * put the result somewhere else entirely: search's vector sidecar lands in\n   * `_vec` under `encodeVecId(name, id)`, the lexical index under `_ft/<name>`,\n   * indexing's entries under a synthetic `idxId`. A codec that supplied\n   * `this.ctx.name` for those would seal them against a collection they are not\n   * in, and once AAD binds identity every one of them would fail to verify.\n   *\n   * ⚠️ **`_history` is the open case, and it is #1041's to settle.** Snapshots\n   * are produced with the LIVE record's identity here and then re-homed by\n   * `saveHistory` into `_history/<historyId(collection,id,_v)>`. Both readings\n   * are defensible — bind where it lives, or bind what it is a copy of — and\n   * the choice must be made before AAD is switched on, not inferred from this\n   * migration.\n   */\n  async encryptJsonString(\n    ref: RecordRef,\n    json: string,\n    version: number,\n    cek?: EnclaveKey,\n    source?: string,\n    sourceTs?: string,\n  ): Promise<EncryptedEnvelope> {\n    // `version` folds into the identity HERE rather than travelling beside it,\n    // so what is sealed and what is stamped come from one object (#1093).\n    const identity: RecordIdentity = { ...ref, version, by: this.ctx.actor }\n    const provenance = this.ctx.provenance && source !== undefined\n      ? { source, sourceTs: sourceTs ?? new Date().toISOString() }\n      : undefined\n\n    if (!this.ctx.storeCiphertext) {\n      return RecordCodec.buildPlaintextEnvelope(identity, { data: json, provenance })\n    }\n\n    const dek = await this.ctx.getDEK()\n\n    const aad = buildRecordAad(identity)\n\n    if (cek !== undefined) {\n      const { iv, data } = await encrypt(json, cek, aad)\n      const wrapped = await wrapCek(cek, dek)\n      return RecordCodec.buildEnvelope(identity, { iv, data, cek: wrapped, provenance })\n    }\n\n    const { iv, data } = await encrypt(json, dek, aad)\n    return RecordCodec.buildEnvelope(identity, { iv, data, provenance })\n  }\n\n  /**\n   * `ref` is FIRST and required (#1051). It was previously a trailing optional\n   * `id?: string`, which TypeScript cannot promote to required because it sits\n   * after other optionals — so the migration would have needed an `id ?? ''`\n   * fallback. That is exactly the silent default this issue exists to remove:\n   * once identity is bound into the AEAD, every record written with an empty id\n   * binds to the SAME identity and becomes interchangeable with the others.\n   * An object, not a bare string, so a swap with `version`/`source` cannot\n   * compile on the hottest write path. Carries the collection too — see\n   * {@link encryptJsonString} for why the codec must not assume its own.\n   */\n  async encryptRecord(\n    ref: RecordRef,\n    record: T,\n    version: number,\n    cek?: EnclaveKey,\n    source?: string,\n    sourceTs?: string,\n    vdig?: { readonly id: string; readonly prev: EncryptedEnvelope | null },\n  ): Promise<EncryptedEnvelope> {\n    const id = ref.id\n    // Debug-plaintext: write user-collection records with their fields inlined\n    // beside the envelope metadata so native store tools read them directly.\n    // Internal (`_`-prefixed) collections keep the classic shape — some store\n    // `_`-prefixed fields that the inline layout would collide with.\n    if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith('_')) {\n      return this.buildDebugEnvelope(id, record, version, source, sourceTs)\n    }\n\n    // ── C-A / R10 config-drift guard (superset) ────────────────────────\n    // A handle may write a classified collection only if its DECLARED\n    // digest-only set is a SUPERSET of the collection's stored/marked\n    // classified set. Any classified field this handle does NOT declare is a\n    // field it cannot maintain: the `_vdig` loop below iterates only declared\n    // fields, so an undeclared classified field is neither stripped nor tagged —\n    // its value would be serialized into `_data` as DEK-recoverable plaintext\n    // (the C-A leak), or its stored tag silently dropped. Fail loud.\n    //\n    // This subsumes the old naive-only guard (a fully-naive handle has an empty\n    // declared set, so ANY stored classified field violates the superset) AND\n    // closes the partial-handle door (declares Y, not X, over a record carrying\n    // `_vdig[X]`/`_bidx[X]`): the narrow `vdigFields === null || size === 0`\n    // gate skipped that entire case. The stored/marked set is the union of:\n    //   1. the persisted `x-classified` marker's declared digest-only set\n    //      (cross-session, prev-free — the only signal a fully-naive create has);\n    //   2. the keys the target `prev` already carries in `_vdig`/`_bidx` (the\n    //      overwrite arm; a classified-declaring handle DOES pass `prev`).\n    // Only encrypted collections can be classified, so plaintext collections skip.\n    if (this.ctx.storeCiphertext) {\n      const declared = this.ctx.vdigFields\n      const storedClassified = new Set<string>()\n      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k)\n      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k)\n      if (this.ctx.classifiedMarkerDigestOnly !== undefined) {\n        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k)\n      }\n      let undeclared: string | undefined\n      for (const field of storedClassified) {\n        if (declared === null || !declared.has(field)) { undeclared = field; break }\n      }\n      if (undeclared !== undefined) {\n        throw new ClassifiedConfigError(\n          this.ctx.name,\n          `this collection has classified digest-only field \"${undeclared}\" but this handle does not declare it — ` +\n          'refusing to write (would drop its tag or serialize the secret as plaintext)',\n        )\n      }\n    }\n\n    // Structural group-encryption: peel declared sensitive fields out\n    // of the record BEFORE building `_data`, sealing each into its own\n    // `_sealed[field]` slot under a per-field key. Default-off — with no\n    // sensitive fields the open record is unchanged and no `_sealed` is\n    // emitted, so the envelope stays byte-identical to legacy output.\n    // A collection whose via pipeline declares at-rest hooks (#629 Task 3)\n    // seals through THOSE instead — the inline `sensitiveFields` path and\n    // the hook path are mutually exclusive per collection, gated on\n    // `hasAtRestHooks` (the inline path now serves only the plain\n    // `sensitive: [...]` collection option; since #629, `classifiedFields`-\n    // declared fields seal through their own via-binding hook, and since\n    // #638 so does any field the taint graph seals — `via/classified/\n    // binding.ts` and `kernel/via/taint-binding.ts`, respectively). The\n    // zero-via fast path (no `via`, or a pipeline with no at-rest hooks,\n    // e.g. money-only) always takes the `else if` branch, unchanged.\n    let openRecord = record\n    let sealed: Record<string, string> | undefined\n    if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {\n      // Was `id === undefined`, which #1051 made UNREACHABLE — `ref.id` is a\n      // required `string` now, so the compiler asks the question instead. The\n      // backstop is retargeted rather than deleted: an EMPTY id still gets\n      // through, and it is the realistic hazard, not a hypothetical one. The\n      // first draft of this very migration wrote `id ?? ''` to satisfy a\n      // trailing-optional signature. Once identity is bound into the AEAD every\n      // record written with `''` binds to the SAME identity and they become\n      // mutually interchangeable — the failure would be silent at write time\n      // and unrecoverable later.\n      if (id === '') {\n        throw new Error(\n          `RecordCodec.encryptRecord: collection \"${this.ctx.name}\" has via at-rest hooks but this write ` +\n          'path supplied an empty record id (needed to scope the sealed-slot capability) — caller bug.',\n        )\n      }\n      const src = record as unknown as Record<string, unknown>\n      const result = await this.ctx.via.encodeAtRest(src, this.viaCryptoCtx(id, cek))\n      openRecord = result.record as unknown as T\n      if (result.sealed !== undefined) {\n        sealed = {}\n        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`\n      }\n    } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {\n      const src = record as unknown as Record<string, unknown>\n      const result = await sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek))\n      if (result.sealed !== undefined) {\n        sealed = result.sealed\n        openRecord = result.openRecord as unknown as T\n      }\n    }\n\n    // ── Digest-only classified fields (stage 2, C6) ────────────────────\n    // Per field, exactly one of: carry-forward (absent) / rotate (string) /\n    // clear (null) / loud error (anything else). Runs on a CLONE so the\n    // caller's record object is never mutated.\n    let vdigOut: Record<string, string> | undefined\n    let bidxOutMap: Record<string, string> | undefined\n    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {\n      if (vdig === undefined) {\n        throw new Error(\n          `RecordCodec.encryptRecord: collection \"${this.ctx.name}\" declares digest-only classified ` +\n          `fields but this write path supplied no { id, prev } context — it would silently destroy _vdig (C6). Caller bug.`,\n        )\n      }\n      if (cek === undefined) {\n        throw new Error(\n          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) — ` +\n          `collection \"${this.ctx.name}\" wrote without one. Caller bug.`,\n        )\n      }\n      const open: Record<string, unknown> = { ...(openRecord as unknown as Record<string, unknown>) }\n      const out: Record<string, string> = {}\n      // _bidx (blind-index equality tags) rides the SAME iteration as _vdig,\n      // so the structural invariant _bidx[field] ⇒ _vdig[field] holds by\n      // construction: a tag is only ever written where the _vdig slot is\n      // written/carried. DEK is fetched lazily — only an equatable rotate needs it.\n      const bidxOut: Record<string, string> = {}\n      let bidxDek: EnclaveKey | undefined\n      for (const [field, policy] of this.ctx.vdigFields) {\n        const value = open[field]\n        const prevBlob = vdig.prev?._vdig?.[field]\n        if (vdig.prev?._sealed?.[field] !== undefined) {\n          // R6 transition evidence: never silently delete recoverable\n          // plaintext. Checked BEFORE the value-type dispatch so the\n          // carry-forward (absent) and clear (null) branches refuse too —\n          // both would otherwise drop the `_sealed` slot from the new\n          // envelope, silently destroying the recoverable ciphertext.\n          throw new ClassifiedConfigError(\n            this.ctx.name,\n            `field \"${field}\" carries a recoverable _sealed slot from a previous storage form — ` +\n            `recoverable ↔ digest-only transitions are refused (R6); migrate explicitly`,\n          )\n        }\n        if (value === undefined) {\n          // 1. carry-forward: verbatim bytes (CEK version-stable, AAD _v-free;\n          //    byte-identity keeps the ledger payload hash deterministic).\n          // I-3 monotonic carry: whenever the _vdig slot is carried, ALSO copy\n          // prev._bidx[field] verbatim — regardless of THIS handle's equatable\n          // knob. An unrelated put by a handle with equatable removed must not\n          // drop another handle's tag (anti-flip-flop). If prev has no tag,\n          // there is nothing to mint from (no plaintext) → stays uncovered.\n          if (prevBlob !== undefined) {\n            out[field] = prevBlob\n            const prevTag = vdig.prev?._bidx?.[field]\n            if (prevTag !== undefined) bidxOut[field] = prevTag\n          }\n          continue\n        }\n        if (value === null) {\n          // 3. clear: the defined deletion short of forget().\n          delete open[field]\n          continue\n        }\n        if (typeof value !== 'string') {\n          // 4. caller bug, fail-loud.\n          throw new ValidationError(\n            `digest-only classified field \"${field}\" in \"${this.ctx.name}\" must be a string (rotate) or null (clear), got ${typeof value}`,\n          )\n        }\n        // 2. rotate: validate ran in the stage-1 write seam; digest + ring here.\n        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field)\n        // _bidx branch 2: if this handle is equatable, mint a fresh tag through\n        // the SAME normalization pipeline mintVdigSlot uses (normalizeForVerify)\n        // — the tag provably equals computeBidxTarget for this value. If the\n        // knob is OFF, emit nothing: the stale prev tag points at the now-\n        // superseded value (carrying it would be wrong) and minting is disallowed\n        // (knob off) → the tag is dropped. Confirm-by-verify keeps this sound.\n        if (policy.equatable === true) {\n          if (bidxDek === undefined) bidxDek = await this.ctx.getDEK()\n          const normalized = normalizeForVerify(policy.normalize, value)\n          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field)\n        }\n        delete open[field] // strip from _data — digest-only never persists plaintext\n      }\n      openRecord = open as unknown as T\n      if (Object.keys(out).length > 0) vdigOut = out\n      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut\n    }\n\n    const base = await this.encryptJsonString(ref, JSON.stringify(openRecord), version, cek, source, sourceTs)\n    const withSealed = sealed ? { ...base, _sealed: sealed } : base\n    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed\n    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig\n    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx\n\n    // compute deterministic-ciphertext slots for every\n    // declared field. Non-primitive values are JSON-stringified so\n    // objects/arrays still dedupe on structural equality. Sealed fields are\n    // excluded — they live only in `_sealed`, never the `_det` index.\n    // L-1: `_det` encrypts under a dedicated HKDF-derived key (salt\n    // `noydb-det`), never the raw DEK — the DEK's randomized-IV `_data`\n    // regime and `_det`'s deterministic-IV regime must not share a key.\n    const dek = await this.ctx.getDEK()\n    const detKey = await deriveDeterministicKey(dek)\n    const rec = record as unknown as Record<string, unknown>\n    const det: Record<string, string> = {}\n    for (const field of this.ctx.deterministicFields) {\n      if (this.ctx.sensitiveFields.has(field)) continue\n      if (this.ctx.vdigFields?.has(field)) continue // I5: digest-only never equality-correlatable\n      const value = rec[field]\n      if (value === undefined || value === null) continue\n      const plaintext = typeof value === 'string' ? value : JSON.stringify(value)\n      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`)\n      det[field] = `${iv}:${data}`\n    }\n    if (Object.keys(det).length === 0) return withBidx\n    return { ...withBidx, _det: det }\n  }\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Read path\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Resolve the per-record CEK for a stored envelope, or `undefined` for a\n   * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and\n   * memoises it in the CEK cache under `id` (when supplied) so repeated reads of\n   * the same record skip the unwrap. Shared by the body-decrypt path\n   * ({@link decryptJsonString}) and the sealed-field path ({@link decryptRecord}\n   * / {@link toCacheRecord}) so both agree on the record's key.\n   */\n  async resolveEnvelopeCek(envelope: EncryptedEnvelope, id?: string): Promise<EnclaveKey | undefined> {\n    if (envelope._cek === undefined) return undefined\n    const cached = id !== undefined ? this.ctx.cekCache?.get(id) : undefined\n    if (cached !== undefined) return cached\n    const dek = await this.ctx.getDEK()\n    const cek = await unwrapCek(envelope._cek, dek)\n    if (id !== undefined) this.ctx.cekCache?.set(id, cek, 1)\n    return cek\n  }\n\n  /**\n   * Low-level: decrypt an envelope and return the raw JSON string.\n   *\n   * `_cek` presence is the format discriminant (NOT `this.perRecordCek`),\n   * so a mixed vault — and a recipient that never opted into\n   * `perRecordKeys` — decrypts both legacy and CEK records:\n   *  - `_cek` present → unwrap the CEK under the collection DEK, decrypt the\n   *    body under the CEK (cache the unwrapped CEK so repeated reads skip it).\n   *  - `_cek` absent → legacy path, body decrypts directly under the\n   *    collection DEK.\n   *\n   * The optional `id` lets reads populate the CEK cache; it is omitted by\n   * callers (history, conflict merge) that have only the envelope.\n   */\n  /**\n   * `ref` must be the SAME identity the writer sealed against — which is the\n   * storage address, not necessarily this codec's own collection. Search's\n   * vector sidecar lives in `_vec`, its lexical index in `_ft`; passing\n   * `this.ctx.name` for those would recompute the wrong AAD and fail to open a\n   * perfectly good record (#1041).\n   */\n  async decryptJsonString(ref: RecordRef, envelope: EncryptedEnvelope): Promise<string | null> {\n    const id = ref.id\n    // RISK #1 (forget cascade): a shred tombstone carries `_data: ''` and no\n    // `_cek`. Decrypting it would call `decrypt('', '', dek)` → AES-GCM\n    // OperationError → TamperedError. Return null so every read callsite\n    // treats it as \"absent / skip\", matching how get()/list already drop\n    // tombstones. Legacy plaintext collections (`!this.storeCiphertext`) legitimately\n    // have empty `_iv`/`_data`, so `isTombstone` is false for them — preserved.\n    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null\n    if (!this.ctx.storeCiphertext) {\n      // Debug-plaintext layout: record fields were inlined as top-level keys\n      // (see buildDebugEnvelope). Reconstruct the record from the non-`_`\n      // keys. Self-describing via `_debug`, so a classic plaintext reader\n      // handles debug-written envelopes too.\n      if (envelope._debug !== undefined) {\n        const rec: Record<string, unknown> = {}\n        for (const [key, value] of Object.entries(envelope)) {\n          if (!key.startsWith('_')) rec[key] = value\n        }\n        return JSON.stringify(rec)\n      }\n      // #598: a real record never serializes to '' (JSON.stringify's floor is\n      // '{}'), so an empty `_data` here is the sync engine's shape-only\n      // tombstone (`isTombstoneShape` in team/sync.ts) landing on an\n      // unencrypted collection, where the encryption-gated `isTombstone()`\n      // check above doesn't fire. Treat it the same as an encrypted\n      // tombstone: null, not a `JSON.parse('')` crash.\n      return envelope._data === '' ? null : envelope._data\n    }\n    const aad = recordAadFor(ref, envelope)\n    const cek = await this.resolveEnvelopeCek(envelope, id)\n    if (cek !== undefined) return decrypt(envelope._iv, envelope._data, cek, aad)\n    const dek = await this.ctx.getDEK()\n    return decrypt(envelope._iv, envelope._data, dek, aad)\n  }\n\n  /**\n   * Unseal a single `_sealed[field]` slot to its plaintext value: derive the\n   * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,\n   * and JSON-parse the result. Shared by both the inline-decrypt path and a\n   * {@link Sealed} handle's `reveal()` — so the on-demand reveal and the eager\n   * materialisation always agree byte-for-byte.\n   */\n  async unsealField(field: string, blob: string, cek?: EnclaveKey): Promise<unknown> {\n    // Dual-read. Current writes seal under a key derived from the record's\n    // per-record CEK; legacy records (even ones whose body is\n    // CEK-encrypted) are sealed under the collection-DEK key. Try the CEK key\n    // first; on its AES-GCM auth failure, fall back to the DEK key. Without this\n    // fallback every legacy `_sealed` record would throw TamperedError (data loss).\n    return unsealOneField(field, blob, this.sealKeyMaterial(cek))\n  }\n\n  /**\n   * Build the `ViaCryptoCtx` for forget()'s per-ref via-erase fold (#629\n   * Task 10) — resolves the live envelope's CEK exactly like\n   * `decryptRecord` does, then delegates to the same capability factory\n   * `encodeAtRest`/`decodeAtRest` use.\n   */\n  async eraseCryptoCtx(id: string, live: EncryptedEnvelope): Promise<ViaCryptoCtx> {\n    return this.viaCryptoCtx(id, await this.resolveEnvelopeCek(live, id))\n  }\n\n  /**\n   * Classify a live envelope's `_sealed` slots for crypto-shred completeness.\n   * `forget()` drops `_cek`/`_sealed` but\n   * RETAINS the collection DEK, so only a slot keyed off the per-record CEK is\n   * genuinely shredded by the tombstone; a legacy slot keyed off the\n   * collection DEK survives in any synced/backup copy.\n   *\n   * Mirrors {@link unsealField}'s dual-read split: try the CEK-derived key per\n   * slot — success → `shreddable`, AES-GCM auth failure → `dekResidue`. With no\n   * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.\n   */\n  async classifySealedShred(\n    live: EncryptedEnvelope,\n  ): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n    const slots: SealedShredSlot[] = []\n    // Verify-digest slots are CEK-only by construction (I3): dropping `_cek`\n    // makes every `_vdig[field]` permanently undecryptable — shreddable\n    // unconditionally, no vdig-dekResidue class (spec §2 forget()). Same\n    // honesty caveats as #306 D5 for synced/backup copies of the ciphertext.\n    // A `_vdig` field ALSO carrying a `_bidx` tag is the third category: the\n    // tombstone drops it from the live store, but a pre-forget backup retains\n    // the blind-index tag under the surviving collection DEK — live-shreddable\n    // yet dekResidue-in-backups. `_bidx[field] ⇒ _vdig[field]` (I4), so we\n    // decide per vdig field and emit exactly one slot each (count-preserving).\n    if (live._vdig !== undefined && live._cek !== undefined) {\n      for (const field of Object.keys(live._vdig)) {\n        slots.push({\n          field,\n          class: live._bidx?.[field] !== undefined\n            ? 'live-shreddable+dekResidue-in-backups'\n            : 'shreddable',\n        })\n      }\n    }\n    const sealed = live._sealed\n    if (sealed === undefined) return { slots }\n    const cek = await this.resolveEnvelopeCek(live)\n    for (const [field, blob] of Object.entries(sealed)) {\n      if (cek === undefined) { slots.push({ field, class: 'dekResidue' }); continue }\n      const { iv, data } = parseSealedSlot(blob)\n      try {\n        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field))\n        slots.push({ field, class: 'shreddable' })\n      } catch {\n        slots.push({ field, class: 'dekResidue' })\n      }\n    }\n    return { slots }\n  }\n\n  /**\n   * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.\n   * The handle captures only the ciphertext `blob` and a closure to\n   * {@link unsealField}; the plaintext is never stored on it — so the handle\n   * may sit in the working-set cache (or be logged/serialised) without\n   * exposing the value, which decrypts only on `reveal()`.\n   */\n  makeSealedHandle(field: string, blob: string, cek?: EnclaveKey): SealedHandle<unknown> {\n    return makeHandleProducer(this.sealKeyMaterial(cek))(field, blob)\n  }\n\n  /**\n   * Replace every field the just-written envelope actually sealed with a\n   * {@link Sealed} handle, leaving every other field as its plaintext value.\n   * Used to populate the cache on the write path without ever materialising\n   * sealed plaintext into it. Returns `record` untouched when nothing was\n   * sealed. Keys off `envelope._sealed` itself (#642 fix) — NOT\n   * `this.ctx.sensitiveFields`, which only names the inline `sensitive:[...]`/\n   * classified-recoverable field set: a collection whose sealing comes\n   * entirely from the `taint` via-binding (a derivation/MV output or rollup\n   * target folded sealed from a classified SOURCE collection, #642) declares\n   * no local `sensitiveFields` at all, so that stale gate skipped this\n   * conversion and left a just-written taint-sealed field as cached\n   * plaintext — read back correctly ONLY after a cold cache miss (`get()`'s\n   * own `decodeAtRest` call, unaffected by this gate) forced a fresh decrypt.\n   */\n  async toCacheRecord(record: T, envelope: EncryptedEnvelope, id?: string): Promise<T> {\n    const sealed = envelope._sealed\n    if (sealed === undefined || !this.ctx.storeCiphertext) {\n      return record\n    }\n    const cek = await this.resolveEnvelopeCek(envelope, id)\n    const clone = { ...(record as unknown as Record<string, unknown>) }\n    for (const [field, blob] of Object.entries(sealed)) {\n      clone[field] = this.makeSealedHandle(field, blob, cek)\n    }\n    return clone as unknown as T\n  }\n\n  /**\n   * Apply `_sealed`-slot post-processing to an ALREADY-DECRYPTED `record`:\n   * restore each `_sealed[field]` blob inline (`sealedAsHandles` falsy) or\n   * as an opaque {@link Sealed} handle (`sealedAsHandles: true`), routing\n   * through a via pipeline's `decodeAtRest` hook when one is declared.\n   * Extracted byte-parity from `decryptRecord`'s inline block (#635) so a\n   * caller that resolves its OWN per-record CEK under a DIFFERENT DEK than\n   * this codec's `this.ctx.getDEK()` — namely the tier>0 `getAtTier` leg in\n   * `with-audit/tiers/index.ts`, whose `_cek` is wrapped under the TIER DEK,\n   * not the collection DEK `decryptRecord`/`resolveEnvelopeCek` always\n   * unwrap under — can still get correct sealed-slot handling without\n   * routing its whole read through `decryptRecord` (which would resolve the\n   * wrong DEK for it).\n   *\n   * Zero-knowledge: takes only the already-resolved per-record `cek` (or\n   * `undefined` for a legacy/no-CEK record) — the same shape `makeSealedHandle`\n   * already takes above. Never the keyring, never a raw DEK: the legacy\n   * fallback key stays fully internal to `sealKeyMaterial`/`viaCryptoCtx`,\n   * which close over THIS codec's own `getDEK` (permanently bound to\n   * `this.ctx.name`'s tier-0 DEK at construction) — so even when called from\n   * a tier>0 context, the legacy-fallback key resolution is correct: sealed\n   * fields are always sealed under the CEK or the collection's tier-0 DEK,\n   * never a tier DEK (tier writes don't seal fields; `_sealed` reaches a\n   * tiered envelope only via a tier-0 write later elevated).\n   */\n  async applySealedSlots(\n    record: T,\n    sealed: Record<string, string>,\n    cek: EnclaveKey | undefined,\n    opts: { id?: string; sealedAsHandles?: boolean } = {},\n  ): Promise<T> {\n    if (this.ctx.via?.hasAtRestHooks) {\n      // Retargeted from `=== undefined`, which #1041 made unreachable on the\n      // read path too: `decryptRecord` now takes a required identity, so the\n      // compiler asks that question. An EMPTY id can still get through, and it\n      // would scope every record's sealed slots to the same capability.\n      if (opts.id === undefined || opts.id === '') {\n        throw new Error(\n          `RecordCodec.decryptRecord: collection \"${this.ctx.name}\" has via at-rest hooks but this read ` +\n          'path supplied no record id (needed to scope the sealed-slot capability) — caller bug.',\n        )\n      }\n      const sealedRefs: Record<string, SealedSlotRef> = {}\n      for (const [field, blob] of Object.entries(sealed)) {\n        const { iv, data } = parseSealedSlot(blob)\n        sealedRefs[field] = { iv, data }\n      }\n      return await this.ctx.via.decodeAtRest(\n        record as unknown as Record<string, unknown>,\n        sealedRefs,\n        this.viaCryptoCtx(opts.id, cek),\n        { asHandles: opts.sealedAsHandles === true },\n      ) as unknown as T\n    }\n    return await unsealFields(\n      record as unknown as Record<string, unknown>,\n      sealed,\n      this.sealKeyMaterial(cek),\n      { asHandles: opts.sealedAsHandles === true },\n    ) as unknown as T\n  }\n\n  /**\n   * Decrypt an envelope under an EXPLICIT `dek` instead of this codec's own\n   * `ctx.getDEK()` / cekCache resolution — for a from-tier>0 pre-move decode\n   * (`with-audit/tiers/index.ts`'s `putAtTier`/`elevate`/`demote` sites,\n   * #722 whole-branch review). Mirrors the manual unwrap-then-decrypt\n   * `getAtTier`'s own tier>0 leg performs there (same primitives, same\n   * `applySealedSlots` extraction point #635 built for exactly this caller).\n   *\n   * `decryptRecord` is tier-UNAWARE: `resolveEnvelopeCek` reads the cekCache\n   * or falls back to `ctx.getDEK()` — this codec's DEFAULT (tier-0/\n   * collection) DEK — never the envelope's OWN tier. That only happens to\n   * decrypt a from-tier>0 envelope correctly when some other call in the\n   * SAME op already primed the cekCache with this record's CEK (true for an\n   * ordinary put()-then-elevate(0→1); NOT true for a `putAtTier`-origin\n   * envelope, whose body is encrypted directly under its tier DEK with no\n   * `_cek` ever minted, or a non-`perRecordKeys` collection, which has no\n   * `_cek` at all) — those throw `TamperedError`. Decrypting under the\n   * caller-resolved `dek` is correct regardless of cache state or\n   * `perRecordKeys`.\n   *\n   * No CRDT resolution, no schema validation — same scope as `getAtTier`'s\n   * tier>0 branch (the established precedent for a tier-aware read), which\n   * skips both for the same reason: a tier>0 read is an internal/derived-\n   * output-recompute path, not the public per-record read surface schema\n   * validation guards.\n   */\n  async decryptRecordAtDek(ref: RecordRef, envelope: EncryptedEnvelope, dek: EnclaveKey): Promise<T | null> {\n    const id = ref.id\n    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null\n    let plaintext: string\n    let cek: EnclaveKey | undefined\n    const aad = recordAadFor(ref, envelope)\n    if (envelope._cek !== undefined) {\n      cek = await unwrapCek(envelope._cek, dek)\n      plaintext = await decrypt(envelope._iv, envelope._data, cek, aad)\n    } else {\n      plaintext = await decrypt(envelope._iv, envelope._data, dek, aad)\n    }\n    let record = JSON.parse(plaintext) as T\n    if (envelope._sealed !== undefined && this.ctx.storeCiphertext) {\n      record = await this.applySealedSlots(record, envelope._sealed, cek, { ...(id !== undefined ? { id } : {}), sealedAsHandles: true })\n    }\n    return record\n  }\n\n  /**\n   * Decrypt an envelope into a record of type `T`.\n   *\n   * When a schema is attached, the decrypted value is validated before\n   * being returned. A divergence between the stored bytes and the\n   * current schema throws `SchemaValidationError` with\n   * `direction: 'output'` — silently returning drifted data would\n   * propagate garbage into the UI and break the whole point of having\n   * a schema.\n   *\n   * `skipValidation` exists for history reads: when calling\n   * `getVersion()` the caller is explicitly asking for an old snapshot\n   * that may predate a schema change, so validating it would be a\n   * false positive. Every non-history read leaves this flag `false`.\n   */\n  async decryptRecord(\n    ref: RecordRef,\n    envelope: EncryptedEnvelope,\n    opts: { skipValidation?: boolean; sealedAsHandles?: boolean } = {},\n  ): Promise<T | null> {\n    const json = await this.decryptJsonString(ref, envelope)\n    // Tombstone (shredded record) → null, propagated from decryptJsonString.\n    // Callers skip null exactly as they already skip a tombstone envelope.\n    if (json === null) return null\n    let parsed: unknown = JSON.parse(json)\n\n    // CRDT resolution: if this collection is in CRDT mode, the\n    // stored JSON is a CrdtState, not T directly. Resolve to the snapshot.\n    if (this.ctx.crdtMode && parsed !== null && typeof parsed === 'object' && '_crdt' in parsed) {\n      parsed = this.ctx.crdtStrategy.resolveCrdtSnapshot(parsed as CrdtState)\n    }\n\n    let record = parsed as T\n\n    // Structural group-encryption + sealed access gate.\n    // Each `_sealed[field]` slot is restored under its own per-field key.\n    // `sealedAsHandles: false` (default — internal callers that compute on\n    // real values) inline-decrypts to the plaintext value; `true` (the\n    // public / cache path) yields an opaque {@link Sealed} handle so the\n    // plaintext is never materialised into the working-set cache. A\n    // collection whose via pipeline declares at-rest hooks (#629 Task 3)\n    // decodes through THOSE instead of the inline dual-read below — the\n    // zero-via fast path (no `via`, or a pipeline with no at-rest hooks)\n    // always takes the `else` branch, unchanged.\n    if (envelope._sealed !== undefined && this.ctx.storeCiphertext) {\n      const sealedCek = await this.resolveEnvelopeCek(envelope, ref.id)\n      record = await this.applySealedSlots(record, envelope._sealed, sealedCek, {\n        id: ref.id,\n        ...(opts.sealedAsHandles !== undefined ? { sealedAsHandles: opts.sealedAsHandles } : {}),\n      })\n    }\n\n    // Skip output validation when sealed fields are returned as handles:\n    // the record carries opaque `Sealed` handles in place of the declared\n    // values, so a whole-record schema check would false-positive on them.\n    // (The values were validated on input/write; the open fields are\n    // unchanged from the validated body.) The inline-value path below still\n    // validates fully.\n    const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== undefined\n    if (this.ctx.schema !== undefined && !opts.skipValidation && !sealedAsHandles) {\n      // Context string deliberately avoids leaking the record id — the\n      // envelope only carries the version, not the id (the id lives in\n      // the adapter-side key). `<collection>@v<n>` is enough for the\n      // developer to find the offending record.\n      record = await validateSchemaOutput(\n        this.ctx.schema,\n        record,\n        `${this.ctx.name}@v${envelope._v}`,\n      )\n    }\n\n    return record\n  }\n}\n","/**\n * Record-scoped CEK sealing — grantor side.\n *\n * The **grantor** holds the collection DEK and seals ONE record's CEK to an\n * `at-*` host so that host — and only that host — can decrypt exactly that\n * record, with no access to the vault DEK and no ability to read any other\n * record. This is the counterpart to the host-side `openSealedRecord`\n * (`@noy-db/hub/sealed-record`), which holds no DEK.\n *\n * These functions are the orchestration behind `vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`, lifted off `Vault`\n * behind a narrow {@link SealingContext} so the kernel file delegates. They\n * live in `record-keys/` (the vault-side CEK policy layer), NOT in\n * `sealed-record/`, so the host-side subpath stays DEK-free — the wire\n * *types* they share are spine-owned (`kernel/types.ts`), not imported from\n * `sealed-record/` directly.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, bufferToBase64, deriveSealedFieldKeyFromCek, type EnclaveKey } from '../crypto.js'\nimport { buildRecordAad, recordAadFor, type RecordIdentity } from '../record-aad.js'\nimport {\n  type EncryptedEnvelope,\n  type NoydbStore,\n  type RecipientSealer,\n  type SealedCekBinding,\n  type SealedCekDeliveryEnvelope,\n} from '../../types.js'\nimport { dualReadSealedSlot } from './sealed-slot.js'\nimport { openVdigPayload, sealVdigPayload } from '../classify/vdig.js'\nimport { RecordCekNotFoundError, ValidationError } from '../../errors.js'\nimport { buildRecordEnvelope } from '../record-envelope.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** The `_sealed_cek` delivery namespace (one envelope per `collection/id/pid`). */\nexport const SEALED_CEK_NS = '_sealed_cek'\n\n/** What the grantor functions need from their `Vault`. */\nexport interface SealingContext {\n  readonly adapter: NoydbStore\n  /** Vault id (the adapter's first coordinate). */\n  readonly vault: string\n  /** Resolve the DEK a record's CEK is wrapped under. */\n  getDEK(collection: string): Promise<EnclaveKey>\n  /** Actor id stamped on `_by` (empty string → omit). */\n  readonly actor: string\n  /** Evict the per-record CEK cache + decrypted-record cache after a rotation. */\n  invalidateRecordCaches(collection: string, id: string): Promise<void>\n}\n\n/**\n * Seal a record's CEK to a host. See `vault.sealRecordToHost` for the contract.\n * Returns `{ pid, envelopeKey }`.\n */\nexport async function sealRecordToHost(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  hostSealer: RecipientSealer,\n  opts: { expiresAt: string },\n): Promise<{ pid: string; envelopeKey: string }> {\n  // Guard separators: the `_sealed_cek` id is `collection/id/pid`, so a `/` in\n  // any component would make the prefix-delete in rotateRecordCek() (which\n  // matches `${collection}/${id}/`) ambiguous and could over- or under-match.\n  if (collection.includes('/')) throw new ValidationError(`sealRecordToHost: collection \"${collection}\" must not contain \"/\"`)\n  if (id.includes('/')) throw new ValidationError(`sealRecordToHost: id \"${id}\" must not contain \"/\"`)\n  // M-4: reject a malformed/empty expiry at seal time. `Date.parse('')` (and any\n  // non-ISO string) is NaN, and the open-time check `NaN <= now` is `false` — so\n  // a malformed expiry would silently mint an ETERNAL grant. A *past* (but valid)\n  // timestamp is still allowed: it seals, then fails closed at open time.\n  if (Number.isNaN(Date.parse(opts.expiresAt))) {\n    throw new ValidationError(`sealRecordToHost: expiresAt \"${opts.expiresAt}\" is not a valid ISO 8601 timestamp`)\n  }\n\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const cek = await unwrapCek(live._cek, dek)\n  const rawCek = await subtle.exportKey('raw', cek)\n  const cekB64 = bufferToBase64(rawCek)\n\n  const hint = await hostSealer.publishRecipientHint()\n  if (hint.pid.includes('/')) throw new ValidationError(`sealRecordToHost: recipient pid \"${hint.pid}\" must not contain \"/\"`)\n\n  const binding: SealedCekBinding = {\n    collection,\n    id,\n    cek: cekB64,\n    expiresAt: opts.expiresAt,\n  }\n  const sealed = await hostSealer.sealForRecipient(\n    new TextEncoder().encode(JSON.stringify(binding)),\n    hint,\n  )\n\n  const delivery: SealedCekDeliveryEnvelope = {\n    v: 1,\n    _noydb_sealed_cek: 1,\n    pid: hint.pid,\n    payload: bufferToBase64(sealed),\n    expiresAt: opts.expiresAt,\n  }\n\n  const envelopeKey = `${collection}/${id}/${hint.pid}`\n  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey)\n  // Identity is the STORAGE address — `(SEALED_CEK_NS, envelopeKey)` — not the\n  // record this delivery describes. Binding the subject record's collection/id\n  // here would produce an envelope that cannot be read back from where it lives.\n  const env: EncryptedEnvelope = buildRecordEnvelope(\n    { collection: SEALED_CEK_NS, id: envelopeKey, version: (prior?._v ?? 0) + 1 },\n    {\n      // AES-GCM bypassed — the sealing layer is the security boundary, exactly\n      // like the managed-secret `_meta/sealed-secret` envelope.\n      iv: '',\n      data: JSON.stringify(delivery),\n      ...(ctx.actor ? { by: ctx.actor } : {}),\n    },\n  )\n  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env)\n\n  return { pid: hint.pid, envelopeKey }\n}\n\n/**\n * Revoke one sealed-CEK grant.\n *\n * **Default (`{ hard: false }`) is SOFT** — it only deletes the delivery\n * envelope from the store. A host that already fetched (or cached the unsealed\n * CEK from) that envelope KEEPS decrypt capability for the record; soft revoke\n * is a \"stop new fetches\" control, not a cryptographic cutoff.\n *\n * **`{ hard: true }`** additionally rotates the record's CEK (via\n * {@link rotateRecordCek}): the live body is re-encrypted under a fresh CEK and\n * EVERY sealed-CEK delivery envelope for the record (all pids) is deleted, so\n * any previously-sealed CEK fails the AES-GCM auth tag on the rotated body —\n * future opens are cryptographically denied. (PRE-rotation history versions,\n * which keep their old `_cek`, remain openable — same semantics as\n * `rotateRecordCek`.)\n */\nexport async function revokeSealedRecord(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  pid: string,\n  opts?: { hard?: boolean },\n): Promise<void> {\n  if (opts?.hard === true) {\n    // Hard revocation supersedes the single-pid soft delete: rotateRecordCek\n    // re-keys the record and drops every delivery envelope for it.\n    await rotateRecordCek(ctx, collection, id)\n    return\n  }\n  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`)\n}\n\n/**\n * HARD-rotate a record's CEK: re-encrypt the live body under a fresh CEK, evict\n * caches, and delete EVERY sealed-CEK delivery envelope for the record. See\n * `vault.rotateRecordCek` for why this bypasses `Collection.put` (no guards, no\n * history bump — a key rotation must not re-encrypt prior history under the new\n * CEK).\n */\nexport async function rotateRecordCek(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n): Promise<void> {\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const oldCek = await unwrapCek(live._cek, dek)\n  // A CEK rotation moves the body key, not the record's address — but it MAY\n  // restamp `_by` (the rotating actor). So the identity is not symmetric: open\n  // under what the live record carries, re-seal under what the new envelope\n  // will carry (#1041).\n  const openAad = recordAadFor({ collection, id }, live)\n  const json = await decrypt(live._iv, live._data, oldCek, openAad)\n\n  const rotatedIdentity: RecordIdentity = {\n    // A CEK rotation DOES bump `_v` (asserted in `record-scoped-cek-sealing`:\n    // \"the live envelope was re-keyed — new `_cek`, bumped `_v`\"), so it seals\n    // at the new version, not the one it just opened.\n    //\n    // ⚠️ Do not confuse this with `rekeyEnvelopeToDek`, the DEK-rotation helper,\n    // which PRESERVES `_v` (#1074) because it re-keys a record without writing\n    // one. Two rotations, opposite answers — and with `_v` bound (#1093) getting\n    // it backwards no longer produces a wrong number, it produces an\n    // unreadable record.\n    collection, id, version: live._v + 1,\n    ...(live._tier !== undefined ? { tier: live._tier } : {}),\n    ...(ctx.actor ? { by: ctx.actor } : live._by !== undefined ? { by: live._by } : {}),\n  }\n  const newCek = await generateDEK()\n  const { iv, data } = await encrypt(json, newCek, buildRecordAad(rotatedIdentity))\n\n  // Sealed fields are keyed off the per-record CEK, so a rotation\n  // must RE-ENCRYPT each `_sealed[field]` under the new CEK (carrying the old\n  // slots forward would orphan them — the old CEK is gone after this rotate).\n  // Dual-read the old slot: try the old-CEK-derived key, fall\n  // back to the collection-DEK key (legacy), then re-seal under newCek.\n  let sealedOut: Record<string, string> | undefined\n  if (live._sealed !== undefined) {\n    const out: Record<string, string> = {}\n    for (const [field, slot] of Object.entries(live._sealed)) {\n      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek)\n      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field))\n      out[field] = `${resealed.iv}:${resealed.data}`\n    }\n    sealedOut = out\n  }\n\n  // Verify-digest slots are keyed off the per-record CEK too (I3: CEK-only,\n  // no DEK fallback → single read, not a dual-read). Rotation must re-seal\n  // each `_vdig[field]` under the new CEK with the SAME reconstructed AAD, or\n  // the correct password would false-reject forever (C3).\n  let vdigOut: Record<string, string> | undefined\n  if (live._vdig !== undefined) {\n    const out: Record<string, string> = {}\n    for (const [field, blob] of Object.entries(live._vdig)) {\n      const payload = await openVdigPayload(blob, oldCek, collection, id, field)\n      out[field] = await sealVdigPayload(payload, newCek, collection, id, field)\n    }\n    vdigOut = out\n  }\n\n  // `_by`/`_tier` ride on `rotatedIdentity` — the same value the AAD above was\n  // built from. They used to be passed in the body via a conditional SPREAD,\n  // which TypeScript does not excess-property-check, so they flowed silently\n  // into a shape that no longer reads them: stamped nowhere, sealed as if\n  // present. Exactly the mismatch class this issue exists to close.\n  const env: EncryptedEnvelope = buildRecordEnvelope(rotatedIdentity, {\n    iv,\n    data,\n    cek: await wrapCek(newCek, dek),\n    extra: {\n    ...(live._det !== undefined ? { _det: live._det } : {}),\n    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is\n    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`\n    // below, which are CEK-bound and must be re-sealed under the new CEK.\n    // Dropping this line would silently orphan the equality index on rotation\n    // (the #306 Slice-A data-loss bug, replayed on the index).\n    ...(live._bidx !== undefined ? { _bidx: live._bidx } : {}),\n    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed\n    // keys derive off the per-record CEK, so the rotated record's old CEK is\n    // destroyed here — carrying the old `_sealed` slots forward verbatim would\n    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots\n    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.\n    ...(sealedOut !== undefined ? { _sealed: sealedOut } : {}),\n    ...(vdigOut !== undefined ? { _vdig: vdigOut } : {}),\n    },\n  })\n  await ctx.adapter.put(ctx.vault, collection, id, env)\n\n  // Evict BOTH caches synchronously so no read returns the stale old-CEK record.\n  await ctx.invalidateRecordCaches(collection, id)\n\n  // Delete every sealed-CEK delivery envelope for this record — all pids.\n  const prefix = `${collection}/${id}/`\n  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS)\n  for (const key of keys) {\n    if (key.startsWith(prefix)) {\n      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key)\n    }\n  }\n}\n","/**\n * Deterministic-index lookups (`findByDet` / `queryByDet`).\n *\n * A collection that declares `deterministicFields` stamps a deterministic\n * AES-GCM ciphertext for each such field on the envelope's `_det` slot at write\n * time (the encrypt side lives in {@link RecordCodec.encryptRecord}). These\n * helpers are the READ side: recompute the deterministic ciphertext for a query\n * value and scan the adapter for envelopes whose `_det[field]` matches — no\n * record bodies are decrypted during the scan, which is the whole point of a\n * deterministic index.\n *\n * Both functions take a small {@link DeterministicContext} (the exact `this.*`\n * the moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code they replaced.\n * Elevated records (_tier > 0) are skipped: invisible to tier-0 scans (#691).\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nimport { encryptDeterministic, deriveDeterministicKey, type EnclaveKey } from '../crypto.js'\nimport type { NoydbStore } from '../../types.js'\nimport type { RecordCodec } from './record-codec.js'\n\n/** Everything the moving deterministic-index methods touched on `this.*`. */\nexport interface DeterministicContext<T> {\n  /** Collection name — the deterministic-encryption AAD scope. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store (scanned envelope-by-envelope). */\n  readonly adapter: NoydbStore\n  /** Declared deterministic-index fields, or null when the feature is off. */\n  readonly deterministicFields: ReadonlySet<string> | null\n  /** False on plaintext collections — det lookups are encrypted-only. */\n  readonly storeCiphertext: boolean\n  /** The collection DEK resolver. */\n  getDEK(): Promise<EnclaveKey>\n  /** The record codec — decrypts a matched envelope to T. */\n  readonly codec: RecordCodec<T>\n}\n\n/**\n * Recompute the deterministic ciphertext targets for a query value.\n *\n * L-1: _det migrated to a dedicated HKDF key (salt noydb-det); dual-query\n * keeps pre-migration envelopes findable — they self-heal to the new key on\n * their next write. Index 0 is the current (derived-key) target, index 1 the\n * legacy raw-DEK target. Both are derived once per query call, not per\n * envelope, so the extra derivation is a fixed cost.\n */\nasync function detTargets<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<[string, string]> {\n  const dek = await ctx.getDEK()\n  const detKey = await deriveDeterministicKey(dek)\n  const plaintext = typeof value === 'string' ? value : JSON.stringify(value)\n  const context = `${ctx.name}/${field}`\n  const [current, legacy] = await Promise.all([\n    encryptDeterministic(plaintext, detKey, context),\n    encryptDeterministic(plaintext, dek, context),\n  ])\n  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`]\n}\n\nfunction assertDetField<T>(ctx: DeterministicContext<T>, field: string, method: string): void {\n  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": field \"${field}\" is not declared in deterministicFields`,\n    )\n  }\n  if (!ctx.storeCiphertext) {\n    throw new Error(\n      `Collection \"${ctx.name}\": ${method} is only meaningful on encrypted collections`,\n    )\n  }\n}\n\n/**\n * Find the first record whose deterministic field matches the given plaintext.\n * Returns `null` when no match exists.\n *\n * Reads every envelope via the adapter and compares the stored `_det[field]` to\n * a freshly computed deterministic ciphertext — no record bodies are decrypted\n * during the search.\n *\n * Throws when the field is not declared in `deterministicFields`, so a typo\n * fails loudly at the call site rather than silently returning null forever.\n */\nexport async function findByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T | null> {\n  assertDetField(ctx, field, 'findByDet')\n  const [target, legacyTarget] = await detTargets(ctx, field, value)\n\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    // #691: an elevated record's _det slot is tier-independent (#662 carries\n    // it), so it MATCHES — but its key material is tier-wrapped. Skip it\n    // explicitly: invisible to tier-0 det scans regardless of cekCache state\n    // (a catch-based fix would still leak plaintext, audit-free, in the\n    // session that performed the elevate).\n    if (!env || !env._det || (env._tier ?? 0) > 0) continue\n    if (env._det[field] === target || env._det[field] === legacyTarget) {\n      return ctx.codec.decryptRecord({ collection: ctx.name, id }, env)\n    }\n  }\n  return null\n}\n\n/**\n * Return every record whose deterministic field matches. Same semantics as\n * {@link findByDet} but without the short-circuit.\n */\nexport async function queryByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T[]> {\n  assertDetField(ctx, field, 'queryByDet')\n  const [target, legacyTarget] = await detTargets(ctx, field, value)\n\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const matches: T[] = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    // #691: skip elevated — see findByDet above\n    if (!env || !env._det || (env._tier ?? 0) > 0) continue\n    if (env._det[field] === target || env._det[field] === legacyTarget) {\n      const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env)\n      if (rec !== null) matches.push(rec) // skip tombstone (defensive)\n    }\n  }\n  return matches\n}\n","/**\n * Enclave body helpers — the C1 protected-body access contract.\n *\n * `EncryptedEnvelope` splits into a protocol header (family-owned; `_noydb`,\n * `_v`, `_ts`, `_by`, `_source`, `_sourceTs`, `_tier`, `_elevatedBy`) and a\n * protected body (enclave-owned; `_iv`, `_data`, `_cek`, `_det`, `_sealed`,\n * `_debug`). The four helpers below are the ONLY sanctioned way for code\n * outside `kernel/enclave/**` to read or construct the protected body —\n * later migration batches move the ~121 direct `_iv`/`_data`/`_cek`/`_sealed`\n * access sites in `with-*` services onto these.\n *\n * Each helper reproduces an EXISTING behavior byte-for-byte (see the\n * per-function doc for its oracle call site) — this file introduces no new\n * crypto or semantics, only a narrower door onto what already runs.\n */\nimport { buildRecordAad, recordAadFor, type RecordIdentity, type RecordRef } from '../record-aad.js'\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, type EnclaveKey } from '../crypto.js'\nimport type { EncryptedEnvelope } from '../../types.js'\n\n/**\n * Open an envelope's protected body to its JSON text.\n *\n * Mirrors the dominant direct-decrypt call-site shape (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`):\n *  - `opts.encrypted === false` (default `true`) → plaintext collection;\n *    returns `env._data` as-is, `key` untouched.\n *  - `env._cek` present → per-record-key envelope (mirrors\n *    `record-codec.ts`'s `resolveEnvelopeCek`): unwrap the CEK under `key`\n *    (the collection DEK), decrypt the body under the unwrapped CEK.\n *  - `env._cek` absent → legacy path, decrypt the body directly under `key`.\n */\nexport async function openEnvelopeJson(\n  ref: RecordRef,\n  env: EncryptedEnvelope,\n  key: EnclaveKey,\n  opts?: { encrypted?: boolean },\n): Promise<string> {\n  // A plaintext collection has no AEAD, so there is nothing to authenticate —\n  // `_data` is returned as-is and identity binding does not apply to it.\n  if (opts?.encrypted === false) return env._data\n  // Recomputed from the ADDRESS this was fetched from plus `_tier`/`_by` read\n  // off the envelope. A store that edited either one changes this value, and\n  // AES-GCM then refuses the body (#1041).\n  const aad = recordAadFor(ref, env)\n  if (env._cek !== undefined) {\n    const cek = await unwrapCek(env._cek, key)\n    return decrypt(env._iv, env._data, cek, aad)\n  }\n  return decrypt(env._iv, env._data, key, aad)\n}\n\n/**\n * Produce the protected-body fields (`_iv`/`_data`/`_cek`) for an envelope a\n * caller is assembling.\n *\n *  - `opts.encrypted === false` (default `true`) → plaintext collection;\n *    emits `{ _iv: '', _data: json }` (today's `buildPlaintextEnvelope`\n *    shape), `key` untouched.\n *  - `opts.perRecordKey === true` → mints a fresh per-record CEK, encrypts\n *    the body under it, and AES-KW-wraps the CEK under `key` (mirrors\n *    `encryptJsonString`'s `cek !== undefined` branch, except the CEK is\n *    generated here rather than supplied by the caller).\n *  - otherwise → legacy path, body encrypted directly under `key`.\n */\nexport async function writeEnvelopeBody(\n  identity: RecordIdentity,\n  json: string,\n  key: EnclaveKey,\n  opts?: { encrypted?: boolean; perRecordKey?: boolean },\n): Promise<Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>> {\n  if (opts?.encrypted === false) return { _iv: '', _data: json }\n\n  const aad = buildRecordAad(identity)\n\n  if (opts?.perRecordKey === true) {\n    const cek = await generateDEK()\n    const { iv, data } = await encrypt(json, cek, aad)\n    const wrapped = await wrapCek(cek, key)\n    return { _iv: iv, _data: data, _cek: wrapped }\n  }\n\n  const { iv, data } = await encrypt(json, key, aad)\n  return { _iv: iv, _data: data }\n}\n\n/**\n * Approximate protected-body payload size for KPI/telemetry (#807's\n * period-scoped pull download counters): `_data` + `_iv` string length —\n * ≈ ciphertext bytes for base64 payloads, exact for plaintext (`_iv: ''`)\n * collections. A measuring door, not a crypto one: callers get a size\n * without touching the protected fields directly.\n */\nexport function envelopeBodySize(env: EncryptedEnvelope): number {\n  return env._data.length + env._iv.length\n}\n\n/**\n * Discriminant: does this envelope carry a per-record key?\n *\n * Replaces raw `envelope._cek !== undefined` checks scattered across\n * services — `_cek` presence is the format discriminant (see\n * `record-codec.ts`'s `resolveEnvelopeCek` doc).\n */\nexport function hasPerRecordKey(env: EncryptedEnvelope): boolean {\n  return env._cek !== undefined\n}\n\n/**\n * Canonical body string for the ledger hash chain — the exact bytes\n * `with-commit/history/ledger/hash.ts`'s `envelopePayloadHash` derives from\n * `_data` + `_sealed` + `_vdig` + `_bidx` before hashing:\n *  - no `_sealed`, no `_vdig`, no `_bidx` → `_data` alone (back-compat: every\n *    pre-existing ledger entry and non-sealed backup hashes byte-identically).\n *  - any map present → canonical JSON of `{ _data, _sealed?, _vdig?, _bidx? }`\n *    with sorted keys at every level, each map bound ONLY when present, so\n *    the result is independent of the maps' field-insertion / store-\n *    serialization order. `_bidx` is always the LAST segment, so a legacy\n *    `_vdig`-only / `_bidx`-absent envelope hashes byte-identically to its\n *    stage-2 value.\n *\n * Deliberately reimplements the two-key-object canonicalization inline\n * rather than importing `with-commit/history/ledger/entry.ts`'s general\n * `canonicalJson` — `kernel/enclave/**` may import only spine types (C3),\n * never a `with-*` service. For this fixed `{ _data: string; _sealed:\n * Record<string, string> }` shape the two produce byte-identical output\n * (verified against that exact call site's oracle expression in\n * `envelope-body.test.ts`).\n */\nexport function envelopeBodyForHash(env: EncryptedEnvelope): string {\n  // Conditional widen (stage 2): bind `_vdig` exactly the way `_sealed` is\n  // bound — only when present. No existing envelope carries `_vdig`, so this\n  // ships with no flag-day PROVIDED it lands in the same slice as the first\n  // `_vdig` writer (it does — Tasks 7/8/11 are one branch). This binding is\n  // the temporal-rollback detector completing C1: AAD stops cross-record/\n  // cross-field splices; the ledger hash catches same-slot rollbacks.\n  //\n  // Conditional widen (slice 2b, SM #5): bind `_bidx` the same way, appended\n  // LAST (after `_vdig`) so a `_bidx`-absent envelope keeps its stage-2\n  // byte-identical hash.\n  if (env._sealed === undefined && env._vdig === undefined && env._bidx === undefined) return env._data\n  const mapPart = (key: '_sealed' | '_vdig' | '_bidx', map: Record<string, string>): string => {\n    const parts = Object.keys(map).sort().map(\n      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`,\n    )\n    return `${JSON.stringify(key)}:{${parts.join(',')}}`\n  }\n  const segments = [`\"_data\":${JSON.stringify(env._data)}`]\n  if (env._sealed !== undefined) segments.push(mapPart('_sealed', env._sealed))\n  if (env._vdig !== undefined) segments.push(mapPart('_vdig', env._vdig))\n  if (env._bidx !== undefined) segments.push(mapPart('_bidx', env._bidx))\n  return `{${segments.join(',')}}`\n}\n\n/**\n * Does `env` carry an AEAD-sealed body at all?\n *\n * The one question callers outside the enclave legitimately need to ask about\n * `_iv` — a tombstone and a plaintext-collection record have none, so there is\n * nothing to authenticate and nothing to re-seal. Both {@link\n * verifyRecordIdentity} (which treats them as vacuously authentic) and the\n * merge authority's `advance` (which stamps them without re-sealing) turn on\n * it, and asking it here keeps `_iv` from leaking back out to the callers —\n * which `enclave-body-only` refused, correctly, when `advance` tested it inline.\n */\nexport function hasSealedBody(env: Pick<EncryptedEnvelope, '_iv'>): boolean {\n  return env._iv !== ''\n}\n\n/**\n * Does `env` authenticate at the identity `ref` claims, under `key`? (#1042)\n *\n * The merge's fail-closed check, living here because it is envelope surgery:\n * deciding \"is there a sealed body at all\" reads `_iv`, which\n * `enclave-body-only` reserves to this folder. An earlier draft did that test\n * in `kernel/noydb.ts` and the guard refused it — correctly, since a caller\n * outside the enclave inspecting protected fields is how envelope knowledge\n * leaks back out.\n *\n * Returns a boolean rather than throwing: `applyRemote` must be able to reject\n * one poisoned record without halting an entire sync, and a hostile store\n * would very much like the opposite.\n *\n * **A record with no sealed body is vacuously authentic** — a tombstone carries\n * none, and a plaintext collection has no AEAD to verify. Those are pass-through\n * by construction, not by omission.\n */\nexport async function verifyRecordIdentity(\n  ref: RecordRef,\n  env: EncryptedEnvelope,\n  key: EnclaveKey,\n): Promise<boolean> {\n  if (!hasSealedBody(env)) return true\n  try {\n    await openEnvelopeJson(ref, env, key)\n    return true\n  } catch {\n    return false\n  }\n}\n","/**\n * Credential-broker proof crypto (#479, credential-broker spec §3).\n *\n * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by\n * the party layer) is never transmitted. Instead, a **proof key** is\n * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the\n * derived bits are registered with the broker host once at enrol. Steady\n * state, the client re-derives the same key from the seed and signs a\n * **canonical** string binding the request's identity/context, so the broker\n * can verify a fresh HMAC on every mint without ever holding the seed itself.\n *\n * ## Derivation (spec §3, follow verbatim)\n *\n * ```\n * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])\n * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',\n *                          salt: utf8(BROKER_PROOF_DOMAIN),\n *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },\n *                        hkdf, 256)\n * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])\n * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))\n * ```\n *\n * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array\n * element (the injective-JSON-array convention `deriveClassifyIndexKey`\n * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the\n * separate MAC version tag, the first element of the `canonical` array.\n *\n * ## Canonical (spec §2 step 3)\n *\n * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,\n * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding\n * field folded into ONE MAC input:\n *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,\n *    never reparsed/reformatted (F8): a byte-identical ISO string is\n *    required, so e.g. `Z` vs `+00:00` for the same instant fails.\n *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be\n *    replayed at another.\n *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker\n *    endpoint reusing the same `brokerId`.\n *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in\n *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent\n *    (the field omitted) and `''` must stay distinguishable, or `?? ''`\n *    would alias \"no instance\" onto a real registered instance.\n *\n * ## Verify order (spec §3, non-negotiable, F2/F6)\n *\n * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge\n * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work\n * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the\n * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,\n * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);\n * (3) assert `now < expiresAt` — the client clock is never trusted, so this\n * check only matters once the MAC (which covers `expiresAt`) has verified.\n *\n * ## Zeroing (F5)\n *\n * `seed` and the transient HKDF output are raw, durable secret material —\n * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not\n * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}\n * zeroes the `seed` argument in a `finally` on every path including a throw;\n * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the\n * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists\n * so the party layer can register the raw bits at one-time enrol (the value\n * that must survive the call to be base64-encoded and POSTed).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer, bufferToBase64 } from '../crypto.js'\nimport { ValidationError } from '../../errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the broker proof key — also the first `info` array element. */\nexport const BROKER_PROOF_DOMAIN = 'noydb-broker-proof'\n\n/** MAC version tag — the first element of the `canonical` array signed/verified. */\nexport const BROKER_PROOF_VERSION = 'noydb-broker-proof-v1'\n\n/** Default challenge TTL (spec §2 step 2: \"TTL ≤ 60 s\"). */\nconst DEFAULT_CHALLENGE_TTL_MS = 60_000\n\n/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */\nexport interface BrokerProofCanonicalParts {\n  readonly endpointOrigin: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */\nexport interface IssuedChallenge {\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** Arguments the broker host passes to verify a submitted proof (spec §3). */\nexport interface VerifyBrokerProofArgs {\n  /**\n   * Atomically test-and-delete the challenge, returning whether it was still\n   * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn\n   * on presentation, not on successful verification (F2).\n   */\n  readonly consumeChallenge: (challenge: string) => Promise<boolean>\n  /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */\n  readonly registeredProofKey: Uint8Array\n  readonly vaultId: string\n  readonly endpointOrigin: string\n  readonly brokerId: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n  /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */\n  readonly proof: string\n}\n\n/** Build the canonical MAC input verbatim — never reparses/reformats a field (F8). */\nfunction buildCanonical(vaultId: string, brokerId: string, parts: BrokerProofCanonicalParts): string {\n  return JSON.stringify([\n    BROKER_PROOF_VERSION,\n    vaultId,\n    parts.endpointOrigin,\n    brokerId,\n    parts.profile ?? '',\n    parts.instancePid ?? '',\n    parts.challenge,\n    parts.expiresAt,\n  ])\n}\n\n/**\n * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,\n * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the\n * value registered with the broker host once at enrol (spec §2 step 2/3).\n * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.\n */\nexport async function deriveBrokerProofBits(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<Uint8Array> {\n  const hkdfKey = await subtle.importKey('raw', seed as BufferSource, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Derive the steady-state, non-extractable `['sign']` HMAC proof key from\n * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`\n * once the key has been imported (F5) — the raw bits never leave this\n * function in usable form after import.\n */\nexport async function deriveBrokerProofKey(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<EnclaveKey> {\n  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId)\n  try {\n    return await subtle.importKey('raw', proofBits as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  } finally {\n    proofBits.fill(0)\n  }\n}\n\n/**\n * Compose derive + sign for the client: re-derive the proof key from the\n * seed and sign the canonical over `canonicalParts` (spec §2 step 3).\n *\n * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).\n * Zeroes the `seed` argument in a `finally` on EVERY path including a throw\n * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one\n * layer down, inside {@link deriveBrokerProofKey}.\n */\nexport async function computeBrokerProof(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  canonicalParts: BrokerProofCanonicalParts,\n): Promise<string> {\n  try {\n    if (canonicalParts.instancePid === '') {\n      throw new ValidationError(\n        \"computeBrokerProof: instancePid must not be an empty string — omit the field entirely for \" +\n          \"'no instance' (F7); '' would alias onto a registered instance.\",\n      )\n    }\n    const canonical = buildCanonical(vaultId, brokerId, canonicalParts)\n    const key = await deriveBrokerProofKey(seed, vaultId, brokerId)\n    const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(canonical) as BufferSource)\n    return bufferToBase64(new Uint8Array(mac))\n  } finally {\n    seed.fill(0)\n  }\n}\n\n/**\n * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO\n * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller\n * (the broker host) persists both returned strings **verbatim** and MACs\n * those exact bytes on verify — never a reparsed/reformatted copy (F8).\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  return {\n    challenge: bufferToBase64(bytes),\n    expiresAt: new Date(Date.now() + ttlMs).toISOString(),\n  }\n}\n\n/**\n * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):\n *\n * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a\n *    not-fresh (already-consumed or unknown) challenge short-circuits to\n *    `false` before any MAC work (F2).\n * 2. Empty-string `instancePid` is rejected (F7), then the canonical is\n *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/\n *    `instancePid`/`challenge`/`expiresAt` and compared via\n *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a\n *    manual compare or Node `timingSafeEqual` (F6).\n * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`\n *    rides inside the already-verified MAC (F4/F8).\n */\nexport async function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean> {\n  const fresh = await args.consumeChallenge(args.challenge)\n  if (!fresh) return false\n\n  if (args.instancePid === '') return false\n\n  const canonical = buildCanonical(args.vaultId, args.brokerId, {\n    endpointOrigin: args.endpointOrigin,\n    profile: args.profile,\n    instancePid: args.instancePid,\n    challenge: args.challenge,\n    expiresAt: args.expiresAt,\n  })\n  const key = await subtle.importKey(\n    'raw',\n    args.registeredProofKey as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n  const ok = await subtle.verify(\n    'HMAC',\n    key,\n    base64ToBuffer(args.proof) as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n  if (!ok) return false\n\n  return Date.now() < Date.parse(args.expiresAt)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgGA,IAAM,SAAS;AAEf,IAAM,UAAU,IAAI,YAAY;AAezB,SAAS,eAAe,UAAsC;AAQnE,MAAI,CAAC,OAAO,SAAS,SAAS,OAAO,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,oDAAoD,SAAS,UAAU,IAAI,SAAS,EAAE,eAC1E,OAAO,SAAS,OAAO,CAAC;AAAA,IACtC;AAAA,EACF;AACA,QAAM,QAAsB,CAAC,QAAQ,OAAO,MAAM,CAAC;AAEnD,QAAM,YAAY,CAAC,UAAwB;AACzC,UAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,UAAM,MAAM,IAAI,WAAW,CAAC;AAC5B,QAAI,SAAS,IAAI,MAAM,EAAE,UAAU,GAAG,MAAM,QAAQ,KAAK;AACzD,UAAM,KAAK,KAAK,KAAK;AAAA,EACvB;AAEA,YAAU,SAAS,UAAU;AAC7B,YAAU,SAAS,EAAE;AAIrB,YAAU,OAAO,SAAS,QAAQ,CAAC,CAAC;AAEpC,QAAM,KAAK,IAAI,WAAW,CAAC,SAAS,OAAO,SAAY,IAAI,CAAC,CAAC,CAAC;AAC9D,MAAI,SAAS,OAAO,OAAW,WAAU,SAAS,EAAE;AAIpD,YAAU,OAAO,SAAS,OAAO,CAAC;AAElC,QAAM,QAAQ,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC;AACpD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAsBO,SAAS,aACd,KACA,UAKY;AACZ,SAAO,eAAe;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,IAAI,IAAI;AAAA,IACR,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,IAAI,SAAS;AAAA,EACf,CAAC;AACH;;;AC3JA,eAAsB,iBAAiB,MAAqB,IAAiC;AAC3F,QAAM,SAAS,KAAK,OAAO,IAAI,EAAE;AACjC,MAAI,OAAQ,QAAO;AAEnB,QAAM,OAAO,MAAM,KAAK,QAAQ,EAAE;AAClC,MAAI,MAAM,SAAS,QAAW;AAC5B,UAAM,MAAM,MAAM,UAAU,KAAK,MAAM,MAAM,KAAK,OAAO,CAAC;AAC1D,SAAK,OAAO,IAAI,IAAI,KAAK,CAAC;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,YAAY;AAChC,OAAK,OAAO,IAAI,IAAI,OAAO,CAAC;AAC5B,SAAO;AACT;AAqCA,eAAsB,gBACpB,MACA,IACA,UACA,SACA,OACwB;AACxB,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,UAAU,eAAe,EAAE;AACjC,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,OAAO;AAClD,UAAMA,aAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,OAAO;AAC1E,UAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQF,YAAW,KAAK,OAAO;AAC1D,WAAO,EAAE,KAAKC,KAAI,OAAOC,OAAM,MAAM,MAAM,QAAQ,KAAK,KAAK,GAAG,IAAI;AAAA,EACtE;AACA,QAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,SAAS,OAAO;AAC9E,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,OAAO,OAAO;AAC5D,SAAO,EAAE,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK;AAC3C;AAcO,SAAS,mBAAmB,UAA6B,MAAwC;AACtG,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,MAAI,KAAK,SAAS,UAAa,SAAS,SAAS,QAAW;AAC1D,WAAQ,KAA2B;AAAA,EACrC;AACA,SAAO;AACT;AAUA,eAAsB,eACpB,UACA,UACA,SACA,OAC4B;AAI5B,SAAO,mBAAmB,UAAU,MAAM,gBAAgB,UAAU,UAAU,UAAU,SAAS,KAAK,CAAC;AACzG;AA6BA,eAAsB,iBACpB,UACA,UACA,KACkB;AAClB,MAAI;AACF,QAAI,SAAS,SAAS,QAAW;AAC/B,YAAM,UAAU,SAAS,MAAM,GAAG;AAAA,IACpC,OAAO;AAIL,YAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,eAAe,QAAQ,CAAC;AAAA,IAC3E;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC9JA,eAAsB,mBACpB,KACA,UACA,QACA,QAC4B;AAG5B,QAAM,MAAM,aAAa,KAAK,QAAQ;AACtC,QAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,OAAK;AAEL,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,MAAM;AACjD,WAAO,EAAE,GAAG,SAAS,MAAM,MAAM,QAAQ,KAAK,MAAM,EAAE;AAAA,EACxD;AAEA,QAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,QAAQ,GAAG;AACzE,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,QAAQ,GAAG;AACzD,SAAO,EAAE,GAAG,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK;AAC3E;AAqBA,eAAsB,sBACpB,KACA,UACA,QACA,QACmC;AACnC,MAAI;AACF,WAAO,MAAM,mBAAmB,KAAK,UAAU,QAAQ,MAAM;AAAA,EAC/D,SAAS,aAAa;AAGpB,QAAI;AACF,UAAI,SAAS,SAAS,OAAW,OAAM,UAAU,SAAS,MAAM,MAAM;AAAA,UACjE,OAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,QAAQ,aAAa,KAAK,QAAQ,CAAC;AACpF,aAAO;AAAA,IACT,QAAQ;AACN,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AChDA,IAAM,wBAAwB;AAE9B,IAAM,yBAAyB;AAO/B,SAAS,SAAS,MAAc,OAAe,YAAgC;AAC7E,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,UAAU,EAAE;AAClE;AA+BA,eAAe,UACb,KACA,KACA,KACwB;AACxB,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,aAAa,KAAK,GAAG,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkBA,eAAsB,aACpB,SACA,OACA,QACA,QACA,YAAmC,CAAC,GACV;AAC1B,MAAI,QAAQ;AACZ,MAAI,SAAS;AACb,MAAI,UAAU;AACd,MAAI,eAAe;AAEnB,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,OAAO,qBAAqB;AAAA,EACzD,QAAQ;AACN,WAAO,EAAE,OAAO,QAAQ,SAAS,aAAa;AAAA,EAChD;AAEA,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,MAAM,QAAQ,IAAI,OAAO,uBAAuB,IAAI;AACnE,QAAI,CAAC,UAAU,CAAC,OAAO,IAAK;AAE5B,UAAM,MAAM,EAAE,YAAY,uBAAuB,IAAI,KAAK;AAC1D,UAAM,OAAO,MAAM,UAAU,KAAK,QAAQ,MAAM;AAChD,QAAI,SAAS,MAAM;AACjB,UAAK,MAAM,UAAU,KAAK,QAAQ,MAAM,MAAO,MAAM;AAAE;AAAgB;AAAA,MAAS;AAChF,UAAI,UAAU;AACd,iBAAW,OAAO,WAAW;AAC3B,YAAK,MAAM,UAAU,KAAK,QAAQ,GAAG,MAAO,MAAM;AAAE,oBAAU;AAAM;AAAA,QAAM;AAAA,MAC5E;AACA,UAAI,SAAS;AAAE;AAAW;AAAA,MAAS;AACnC,YAAM,IAAI;AAAA,QACR,0CAA0C,IAAI;AAAA,MAGhD;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,MAAM,IAAI;AAM5B,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,KAAK,GAAG,IAAI,IAAI,CAAC;AACvB,YAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,wBAAwB,EAAE;AACpE,UAAI,CAAC,YAAY,CAAC,SAAS,IAAK;AAChC,YAAM,MAAM,SAAS,MAAM,GAAG,KAAK,UAAU;AAC7C,UAAI;AACJ,UAAI;AACF,gBAAQ,MAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,QAAQ,GAAG;AAAA,MAC7E,QAAQ;AAKN,YAAI,KAAK,SAAS,UAAa,KAAK,gBAAgB,OAAW;AAO/D,YAAI;AACF,gBAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,QAAQ,GAAG;AACnE;AAAA,QACF,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR,oCAAoC,EAAE,MAAM,IAAI,CAAC,IAAI,KAAK,UAAU,aAC9D,IAAI;AAAA,UAGZ;AAAA,QACF;AAAA,MACF;AACA,YAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,oBAAoB,OAAO,QAAQ,GAAG;AACjE,YAAM,QAAQ,IAAI,OAAO,wBAAwB,IAAI,EAAE,GAAG,UAAU,KAAKD,KAAI,OAAOC,MAAK,CAAC;AAC1F;AAAA,IACF;AAKA,UAAM,YAAwB;AAAA,MAC5B,GAAG;AAAA,MACH,GAAI,KAAK,SAAS,SACd,EAAE,MAAM,MAAM,QAAQ,MAAM,UAAU,KAAK,MAAM,MAAM,GAAG,MAAM,EAAE,IAClE,CAAC;AAAA,MACL,GAAI,KAAK,gBAAgB,SACrB,EAAE,aAAa,MAAM,QAAQ,MAAM,UAAU,KAAK,aAAa,MAAM,GAAG,MAAM,EAAE,IAChF,CAAC;AAAA,IACP;AAEA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,SAAS,GAAG,QAAQ,aAAa,KAAK,MAAM,CAAC;AAC/F,UAAM,QAAQ,IAAI,OAAO,uBAAuB,MAAM,EAAE,GAAG,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC;AACzF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,QAAQ,SAAS,aAAa;AAChD;;;AClLA,eAAe,oBACb,OACA,OACA,KACA,aACwB;AACxB,QAAM,WAAW,YAAY,QAAQ,SACjC,MAAM,4BAA4B,YAAY,KAAK,YAAY,YAAY,KAAK,IAChF,MAAM,qBAAqB,KAAK,YAAY,YAAY,KAAK;AACjE,SAAO,QAAQ,KAAK,UAAU,KAAK,GAAG,QAAQ;AAChD;AASA,eAAe,aACb,OACA,OACA,aACwB;AACxB,QAAM,MAAM,MAAM,YAAY,OAAO;AACrC,SAAO,oBAAoB,OAAO,OAAO,KAAK,WAAW;AAC3D;AAUA,eAAsB,WACpB,QACA,iBACA,aAC2B;AAC3B,QAAM,MAAM,MAAM,YAAY,OAAO;AACrC,QAAM,OAAgC,EAAE,GAAG,OAAO;AAClD,QAAM,QAAgC,CAAC;AACvC,aAAW,SAAS,iBAAiB;AACnC,QAAI,EAAE,SAAS,QAAS;AACxB,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,oBAAoB,OAAO,OAAO,KAAK,WAAW;AAC7E,UAAM,KAAK,IAAI,GAAG,EAAE,IAAI,IAAI;AAC5B,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,YAAY,QAAQ,QAAQ,OAAU;AACpF,SAAO,EAAE,YAAY,MAAM,QAAQ,MAAM;AAC3C;AASA,eAAsB,eAAe,OAAe,MAAc,aAAgD;AAChH,QAAM,MAAM,MAAM,YAAY,OAAO;AACrC,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,YAAY,YAAY,YAAY,KAAK,GAAG,CAAC;AACvG;AAUO,SAAS,mBAAmB,aAAsF;AACvH,SAAO,CAAC,OAAO,SAAS,IAAI,aAAa,MAAM,eAAe,OAAO,MAAM,WAAW,CAAC;AACzF;AAUA,eAAsB,aACpB,QACA,QACA,aACA,MACkC;AAClC,QAAM,aAAa,MAAM,cAAc,OAAO,mBAAmB,WAAW,IAAI;AAChF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,WAAO,KAAK,IAAI,eAAe,SAAY,WAAW,OAAO,IAAI,IAAI,MAAM,eAAe,OAAO,MAAM,WAAW;AAAA,EACpH;AACA,SAAO;AACT;AAmCO,SAAS,yBACd,KACA,UACA,KAC6B;AAC7B,QAAM,cAA+B;AAAA,IACnC,YAAY,IAAI;AAAA,IAChB,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,IAAI,OAAO;AAAA,EAC3B;AACA,QAAM,gBAAgB,oBAAI,IAAY;AAEtC,SAAO;AAAA,IACL,MAAM,KAAK,OAAO,WAAW;AAC3B,YAAM,MAAM,MAAM,aAAa,OAAO,WAAW,WAAW;AAC5D,oBAAc,OAAO,KAAK;AAC1B,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,OAAO,KAAK;AACvB,UAAI,cAAc,IAAI,KAAK,GAAG;AAC5B,cAAM,IAAI,gBAAgB,8BAA8B,KAAK,gBAAgB,QAAQ,oCAAoC;AAAA,MAC3H;AACA,aAAO,eAAe,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,WAAW;AAAA,IACnE;AAAA,IACA,MAAM,OAAO,OAAO;AAClB,oBAAc,IAAI,KAAK;AAAA,IACzB;AAAA,EACF;AACF;AAmBO,SAAS,sBACd,aACA,kBACmC;AACnC,QAAM,WAAW,IAAI,IAAI,gBAAgB;AAEzC,SAAO,CAAC,WAAmB;AACzB,QAAI,CAAC,SAAS,IAAI,MAAM,GAAG;AACzB,YAAM,IAAI,gBAAgB,8BAA8B,MAAM,sDAAsD;AAAA,IACtH;AAEA,UAAM,iBAAiB,CAAC,YAAoB,WAAwC;AAClF,UAAI,CAAC,WAAW,WAAW,MAAM,GAAG;AAClC,cAAM,IAAI;AAAA,UACR,sBAAsB,MAAM,MAAM,MAAM,iBAAiB,UAAU,0BAA0B,MAAM;AAAA,QACrG;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,OACvB,KACA,MACA,MAC+B;AAC/B,qBAAe,IAAI,YAAY,SAAS;AACxC,YAAM,MAAM,MAAM,YAAY,IAAI,UAAU;AAG5C,YAAM,WAAW,EAAE,GAAG,KAAK,SAAS,EAAE;AAKtC,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,aAAO,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,IACnD;AAEA,UAAM,mBAAmB,OAAO,YAAoB,IAAY,QAA4C;AAC1G,qBAAe,YAAY,SAAS;AACpC,YAAM,MAAM,MAAM,YAAY,UAAU;AACxC,aAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,aAAa,EAAE,YAAY,GAAG,GAAG,GAAG,CAAC;AAAA,IAC/E;AAEA,WAAO,EAAE,SAAS,kBAAkB,SAAS,iBAAiB;AAAA,EAChE;AACF;;;ACrQA,eAAsB,aACpB,UACA,QACA,UACA,KACA,YACA,UACA,OACiB;AACjB,QAAM,aAAa,mBAAmB,OAAO,WAAW,QAAQ;AAEhE,MAAI,OAA2B;AAC/B,MAAI,aAAa,QAAW;AAC1B,QAAI;AACF,aAAO,MAAM,gBAAgB,UAAU,KAAK,YAAY,UAAU,KAAK;AAAA,IACzE,QAAQ;AAIN,YAAM,IAAI,cAAc;AAAA,IAC1B;AACA,QAAI,CAAC,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,GAAG;AAGjD,YAAM,IAAI,cAAc;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,SAAS,QAAQ,OAAO,WAAW,GAAG;AACxC,UAAM,UAAsC,CAAC,KAAK,KAAK,GAAI,KAAK,QAAQ,CAAC,CAAE;AAC3E,eAAW,SAAS,SAAS;AAC3B,YAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,MAAM,IAAI,GAAG,KAAK,IAAI;AACzF,UAAI,MAAM,aAAa,QAAQ,eAAe,MAAM,IAAI,CAAC,GAAG;AAC1D,cAAM,IAAI,wBAAwB,YAAY,OAAO,4BAA4B;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,aAAa;AAC1B,QAAM,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe;AACvE,QAAM,OAAO,SAAS,QAAQ,OAAO,WAAW,IAC5C,CAAC,GAAI,KAAK,QAAQ,CAAC,GAAI,EAAE,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,IAAI,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,QAAQ,IAC3F;AAEJ,QAAM,UAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK,EAAE,MAAM,eAAe,IAAI,GAAG,MAAM,eAAe,IAAI,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC5F,GAAI,SAAS,UAAa,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,SAAO,gBAAgB,SAAS,KAAK,YAAY,UAAU,KAAK;AAClE;;;ACiEA,eAAsB,oBACpB,QACA,OACA,SACiB;AACjB,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,SAAS,KAAK;AACvD,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,SAAS,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,+BAA+B,OAAO,KAAK,gBAAgB,OAAO,MAAM,CAAC;AAAA,MACzE,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,SAAO,OAAO;AAChB;AAcA,eAAsB,qBACpB,QACA,OACA,SACiB;AACjB,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,SAAS,KAAK;AACvD,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,SAAS,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mBAAmB,OAAO,2DACP,gBAAgB,OAAO,MAAM,CAAC;AAAA,MACjD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAWA,SAAS,gBACP,QACQ;AACR,QAAM,QAAQ,OAAO,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU;AAC9C,UAAM,UAAU,WAAW,MAAM,IAAI;AACrC,WAAO,GAAG,OAAO,KAAK,MAAM,OAAO;AAAA,EACrC,CAAC;AACD,QAAM,SAAS,OAAO,SAAS,IAAI,MAAM,OAAO,SAAS,CAAC,WAAW;AACrE,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEA,SAAS,WACP,MACQ;AACR,MAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO;AACvC,SAAO,KACJ;AAAA,IAAI,CAAC,YACJ,OAAO,YAAY,YAAY,YAAY,OACvC,OAAO,QAAQ,GAAG,IAClB,OAAO,OAAO;AAAA,EACpB,EACC,KAAK,GAAG;AACb;;;ACnGO,IAAM,cAAN,MAAM,aAAe;AAAA,EAC1B,YAA6B,KAA4B;AAA5B;AAAA,EAA6B;AAAA,EAA7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS7B,OAAO,KAAoC;AACzC,SAAK,IAAI,MAAM;AAAA,EACjB;AAAA;AAAA,EAGQ,gBAAgB,KAA8C;AACpE,WAAO;AAAA,MACL,YAAY,KAAK,IAAI;AAAA,MACrB,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC;AAAA,MACnC,QAAQ,MAAM,KAAK,IAAI,OAAO;AAAA,IAChC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,aAAa,UAAkB,KAA2C;AAChF,UAAM,mBAAmB,KAAK,IAAI,KAAK,SAAS,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC;AAC7F,WAAO;AAAA,MACL,aAAa,yBAAyB,KAAK,KAAK,UAAU,GAAG;AAAA,MAC7D,mBAAmB,sBAAsB,CAAC,eAAe,KAAK,IAAI,OAAO,UAAU,GAAG,gBAAgB;AAAA,IACxG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,cAAc,UAA0B,GASzB;AACpB,WAAO,oBAAoB,UAAU,CAAC;AAAA,EACxC;AAAA;AAAA,EAGA,OAAO,uBAAuB,UAA0B,GAGlC;AACpB,WAAO,oBAAoB,UAAU,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,mBAAmB,IAAY,QAAW,SAAiB,QAAiB,UAAsC;AAChH,UAAM,MAAM;AACZ,eAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAClC,UAAI,IAAI,WAAW,GAAG,EAAG,OAAM,IAAI,wBAAwB,KAAK,IAAI,MAAM,GAAG;AAAA,IAC/E;AACA,UAAM,OAAO;AAAA,MACX,EAAE,YAAY,KAAK,IAAI,MAAM,IAAI,IAAI,KAAK,IAAI,OAAO,QAAQ;AAAA,MAC7D;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QAEN,GAAI,KAAK,IAAI,cAAc,WAAW,SAClC,EAAE,YAAY,EAAE,QAAQ,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,EAAE,IACzE,CAAC;AAAA,MACP;AAAA,IACF;AAGA,WAAO,EAAE,GAAG,MAAM,QAAQ,sBAAsB,GAAG,IAAI;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAM,kBACJ,KACA,MACA,SACA,KACA,QACA,UAC4B;AAG5B,UAAM,WAA2B,EAAE,GAAG,KAAK,SAAS,IAAI,KAAK,IAAI,MAAM;AACvE,UAAM,aAAa,KAAK,IAAI,cAAc,WAAW,SACjD,EAAE,QAAQ,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IACzD;AAEJ,QAAI,CAAC,KAAK,IAAI,iBAAiB;AAC7B,aAAO,aAAY,uBAAuB,UAAU,EAAE,MAAM,MAAM,WAAW,CAAC;AAAA,IAChF;AAEA,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAElC,UAAM,MAAM,eAAe,QAAQ;AAEnC,QAAI,QAAQ,QAAW;AACrB,YAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AACjD,YAAM,UAAU,MAAM,QAAQ,KAAK,GAAG;AACtC,aAAO,aAAY,cAAc,UAAU,EAAE,IAAAD,KAAI,MAAAC,OAAM,KAAK,SAAS,WAAW,CAAC;AAAA,IACnF;AAEA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AACjD,WAAO,aAAY,cAAc,UAAU,EAAE,IAAI,MAAM,WAAW,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,cACJ,KACA,QACA,SACA,KACA,QACA,UACA,MAC4B;AAC5B,UAAM,KAAK,IAAI;AAKf,QAAI,CAAC,KAAK,IAAI,mBAAmB,KAAK,IAAI,kBAAkB,CAAC,KAAK,IAAI,KAAK,WAAW,GAAG,GAAG;AAC1F,aAAO,KAAK,mBAAmB,IAAI,QAAQ,SAAS,QAAQ,QAAQ;AAAA,IACtE;AAqBA,QAAI,KAAK,IAAI,iBAAiB;AAC5B,YAAM,WAAW,KAAK,IAAI;AAC1B,YAAM,mBAAmB,oBAAI,IAAY;AACzC,UAAI,MAAM,MAAM,MAAO,YAAW,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,EAAG,kBAAiB,IAAI,CAAC;AAC3F,UAAI,MAAM,MAAM,MAAO,YAAW,KAAK,OAAO,KAAK,KAAK,KAAK,KAAK,EAAG,kBAAiB,IAAI,CAAC;AAC3F,UAAI,KAAK,IAAI,+BAA+B,QAAW;AACrD,mBAAW,KAAK,MAAM,KAAK,IAAI,2BAA2B,EAAG,kBAAiB,IAAI,CAAC;AAAA,MACrF;AACA,UAAI;AACJ,iBAAW,SAAS,kBAAkB;AACpC,YAAI,aAAa,QAAQ,CAAC,SAAS,IAAI,KAAK,GAAG;AAAE,uBAAa;AAAO;AAAA,QAAM;AAAA,MAC7E;AACA,UAAI,eAAe,QAAW;AAC5B,cAAM,IAAI;AAAA,UACR,KAAK,IAAI;AAAA,UACT,qDAAqD,UAAU;AAAA,QAEjE;AAAA,MACF;AAAA,IACF;AAiBA,QAAI,aAAa;AACjB,QAAI;AACJ,QAAI,KAAK,IAAI,mBAAmB,KAAK,IAAI,KAAK,gBAAgB;AAU5D,UAAI,OAAO,IAAI;AACb,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,IAAI,IAAI;AAAA,QAEzD;AAAA,MACF;AACA,YAAM,MAAM;AACZ,YAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,KAAK,KAAK,aAAa,IAAI,GAAG,CAAC;AAC9E,mBAAa,OAAO;AACpB,UAAI,OAAO,WAAW,QAAW;AAC/B,iBAAS,CAAC;AACV,mBAAW,CAAC,OAAOC,IAAG,KAAK,OAAO,QAAQ,OAAO,MAAM,EAAG,QAAO,KAAK,IAAI,GAAGA,KAAI,EAAE,IAAIA,KAAI,IAAI;AAAA,MACjG;AAAA,IACF,WAAW,KAAK,IAAI,mBAAmB,KAAK,IAAI,gBAAgB,OAAO,GAAG;AACxE,YAAM,MAAM;AACZ,YAAM,SAAS,MAAM,WAAW,KAAK,KAAK,IAAI,iBAAiB,KAAK,gBAAgB,GAAG,CAAC;AACxF,UAAI,OAAO,WAAW,QAAW;AAC/B,iBAAS,OAAO;AAChB,qBAAa,OAAO;AAAA,MACtB;AAAA,IACF;AAMA,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,IAAI,eAAe,QAAQ,KAAK,IAAI,WAAW,OAAO,KAAK,KAAK,IAAI,iBAAiB;AAC5F,UAAI,SAAS,QAAW;AACtB,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,IAAI,IAAI;AAAA,QAEzD;AAAA,MACF;AACA,UAAI,QAAQ,QAAW;AACrB,cAAM,IAAI;AAAA,UACR,4GACe,KAAK,IAAI,IAAI;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,OAAgC,EAAE,GAAI,WAAkD;AAC9F,YAAM,MAA8B,CAAC;AAKrC,YAAM,UAAkC,CAAC;AACzC,UAAI;AACJ,iBAAW,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,YAAY;AACjD,cAAM,QAAQ,KAAK,KAAK;AACxB,cAAM,WAAW,KAAK,MAAM,QAAQ,KAAK;AACzC,YAAI,KAAK,MAAM,UAAU,KAAK,MAAM,QAAW;AAM7C,gBAAM,IAAI;AAAA,YACR,KAAK,IAAI;AAAA,YACT,UAAU,KAAK;AAAA,UAEjB;AAAA,QACF;AACA,YAAI,UAAU,QAAW;AAQvB,cAAI,aAAa,QAAW;AAC1B,gBAAI,KAAK,IAAI;AACb,kBAAM,UAAU,KAAK,MAAM,QAAQ,KAAK;AACxC,gBAAI,YAAY,OAAW,SAAQ,KAAK,IAAI;AAAA,UAC9C;AACA;AAAA,QACF;AACA,YAAI,UAAU,MAAM;AAElB,iBAAO,KAAK,KAAK;AACjB;AAAA,QACF;AACA,YAAI,OAAO,UAAU,UAAU;AAE7B,gBAAM,IAAI;AAAA,YACR,iCAAiC,KAAK,SAAS,KAAK,IAAI,IAAI,oDAAoD,OAAO,KAAK;AAAA,UAC9H;AAAA,QACF;AAEA,YAAI,KAAK,IAAI,MAAM,aAAa,OAAO,QAAQ,UAAU,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,KAAK;AAO3F,YAAI,OAAO,cAAc,MAAM;AAC7B,cAAI,YAAY,OAAW,WAAU,MAAM,KAAK,IAAI,OAAO;AAC3D,gBAAM,aAAa,mBAAmB,OAAO,WAAW,KAAK;AAC7D,kBAAQ,KAAK,IAAI,MAAM,YAAY,YAAY,SAAS,KAAK,IAAI,MAAM,KAAK;AAAA,QAC9E;AACA,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,mBAAa;AACb,UAAI,OAAO,KAAK,GAAG,EAAE,SAAS,EAAG,WAAU;AAC3C,UAAI,OAAO,KAAK,OAAO,EAAE,SAAS,EAAG,cAAa;AAAA,IACpD;AAEA,UAAM,OAAO,MAAM,KAAK,kBAAkB,KAAK,KAAK,UAAU,UAAU,GAAG,SAAS,KAAK,QAAQ,QAAQ;AACzG,UAAM,aAAa,SAAS,EAAE,GAAG,MAAM,SAAS,OAAO,IAAI;AAC3D,UAAM,WAAW,UAAU,EAAE,GAAG,YAAY,OAAO,QAAQ,IAAI;AAC/D,UAAM,WAAW,aAAa,EAAE,GAAG,UAAU,OAAO,WAAW,IAAI;AACnE,QAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,KAAK,IAAI,gBAAiB,QAAO;AASvE,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,UAAM,SAAS,MAAM,uBAAuB,GAAG;AAC/C,UAAM,MAAM;AACZ,UAAM,MAA8B,CAAC;AACrC,eAAW,SAAS,KAAK,IAAI,qBAAqB;AAChD,UAAI,KAAK,IAAI,gBAAgB,IAAI,KAAK,EAAG;AACzC,UAAI,KAAK,IAAI,YAAY,IAAI,KAAK,EAAG;AACrC,YAAM,QAAQ,IAAI,KAAK;AACvB,UAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,YAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1E,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,qBAAqB,WAAW,QAAQ,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;AAC9F,UAAI,KAAK,IAAI,GAAG,EAAE,IAAI,IAAI;AAAA,IAC5B;AACA,QAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,WAAO,EAAE,GAAG,UAAU,MAAM,IAAI;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,mBAAmB,UAA6B,IAA8C;AAClG,QAAI,SAAS,SAAS,OAAW,QAAO;AACxC,UAAM,SAAS,OAAO,SAAY,KAAK,IAAI,UAAU,IAAI,EAAE,IAAI;AAC/D,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AAC9C,QAAI,OAAO,OAAW,MAAK,IAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,kBAAkB,KAAgB,UAAqD;AAC3F,UAAM,KAAK,IAAI;AAOf,QAAI,YAAY,UAAU,KAAK,IAAI,eAAe,KAAK,eAAe,QAAQ,EAAG,QAAO;AACxF,QAAI,CAAC,KAAK,IAAI,iBAAiB;AAK7B,UAAI,SAAS,WAAW,QAAW;AACjC,cAAM,MAA+B,CAAC;AACtC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,cAAI,CAAC,IAAI,WAAW,GAAG,EAAG,KAAI,GAAG,IAAI;AAAA,QACvC;AACA,eAAO,KAAK,UAAU,GAAG;AAAA,MAC3B;AAOA,aAAO,SAAS,UAAU,KAAK,OAAO,SAAS;AAAA,IACjD;AACA,UAAM,MAAM,aAAa,KAAK,QAAQ;AACtC,UAAM,MAAM,MAAM,KAAK,mBAAmB,UAAU,EAAE;AACtD,QAAI,QAAQ,OAAW,QAAO,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAC5E,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,WAAO,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAY,OAAe,MAAc,KAAoC;AAMjF,WAAO,eAAe,OAAO,MAAM,KAAK,gBAAgB,GAAG,CAAC;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAAe,IAAY,MAAgD;AAC/E,WAAO,KAAK,aAAa,IAAI,MAAM,KAAK,mBAAmB,MAAM,EAAE,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,oBACJ,MACyD;AACzD,UAAM,QAA2B,CAAC;AAUlC,QAAI,KAAK,UAAU,UAAa,KAAK,SAAS,QAAW;AACvD,iBAAW,SAAS,OAAO,KAAK,KAAK,KAAK,GAAG;AAC3C,cAAM,KAAK;AAAA,UACT;AAAA,UACA,OAAO,KAAK,QAAQ,KAAK,MAAM,SAC3B,0CACA;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,OAAW,QAAO,EAAE,MAAM;AACzC,UAAM,MAAM,MAAM,KAAK,mBAAmB,IAAI;AAC9C,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,UAAI,QAAQ,QAAW;AAAE,cAAM,KAAK,EAAE,OAAO,OAAO,aAAa,CAAC;AAAG;AAAA,MAAS;AAC9E,YAAM,EAAE,IAAI,KAAK,IAAI,gBAAgB,IAAI;AACzC,UAAI;AACF,cAAM,QAAQ,IAAI,MAAM,MAAM,4BAA4B,KAAK,KAAK,IAAI,MAAM,KAAK,CAAC;AACpF,cAAM,KAAK,EAAE,OAAO,OAAO,aAAa,CAAC;AAAA,MAC3C,QAAQ;AACN,cAAM,KAAK,EAAE,OAAO,OAAO,aAAa,CAAC;AAAA,MAC3C;AAAA,IACF;AACA,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,OAAe,MAAc,KAAyC;AACrF,WAAO,mBAAmB,KAAK,gBAAgB,GAAG,CAAC,EAAE,OAAO,IAAI;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,cAAc,QAAW,UAA6B,IAAyB;AACnF,UAAM,SAAS,SAAS;AACxB,QAAI,WAAW,UAAa,CAAC,KAAK,IAAI,iBAAiB;AACrD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,mBAAmB,UAAU,EAAE;AACtD,UAAM,QAAQ,EAAE,GAAI,OAA8C;AAClE,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,YAAM,KAAK,IAAI,KAAK,iBAAiB,OAAO,MAAM,GAAG;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,iBACJ,QACA,QACA,KACA,OAAmD,CAAC,GACxC;AACZ,QAAI,KAAK,IAAI,KAAK,gBAAgB;AAKhC,UAAI,KAAK,OAAO,UAAa,KAAK,OAAO,IAAI;AAC3C,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,IAAI,IAAI;AAAA,QAEzD;AAAA,MACF;AACA,YAAM,aAA4C,CAAC;AACnD,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,cAAM,EAAE,IAAI,KAAK,IAAI,gBAAgB,IAAI;AACzC,mBAAW,KAAK,IAAI,EAAE,IAAI,KAAK;AAAA,MACjC;AACA,aAAO,MAAM,KAAK,IAAI,IAAI;AAAA,QACxB;AAAA,QACA;AAAA,QACA,KAAK,aAAa,KAAK,IAAI,GAAG;AAAA,QAC9B,EAAE,WAAW,KAAK,oBAAoB,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA,KAAK,gBAAgB,GAAG;AAAA,MACxB,EAAE,WAAW,KAAK,oBAAoB,KAAK;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,MAAM,mBAAmB,KAAgB,UAA6B,KAAoC;AACxG,UAAM,KAAK,IAAI;AACf,QAAI,YAAY,UAAU,KAAK,IAAI,eAAe,KAAK,eAAe,QAAQ,EAAG,QAAO;AACxF,QAAI;AACJ,QAAI;AACJ,UAAM,MAAM,aAAa,KAAK,QAAQ;AACtC,QAAI,SAAS,SAAS,QAAW;AAC/B,YAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AACxC,kBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,IAClE,OAAO;AACL,kBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,IAClE;AACA,QAAI,SAAS,KAAK,MAAM,SAAS;AACjC,QAAI,SAAS,YAAY,UAAa,KAAK,IAAI,iBAAiB;AAC9D,eAAS,MAAM,KAAK,iBAAiB,QAAQ,SAAS,SAAS,KAAK,EAAE,GAAI,OAAO,SAAY,EAAE,GAAG,IAAI,CAAC,GAAI,iBAAiB,KAAK,CAAC;AAAA,IACpI;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,cACJ,KACA,UACA,OAAgE,CAAC,GAC9C;AACnB,UAAM,OAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAGvD,QAAI,SAAS,KAAM,QAAO;AAC1B,QAAI,SAAkB,KAAK,MAAM,IAAI;AAIrC,QAAI,KAAK,IAAI,YAAY,WAAW,QAAQ,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC3F,eAAS,KAAK,IAAI,aAAa,oBAAoB,MAAmB;AAAA,IACxE;AAEA,QAAI,SAAS;AAYb,QAAI,SAAS,YAAY,UAAa,KAAK,IAAI,iBAAiB;AAC9D,YAAM,YAAY,MAAM,KAAK,mBAAmB,UAAU,IAAI,EAAE;AAChE,eAAS,MAAM,KAAK,iBAAiB,QAAQ,SAAS,SAAS,WAAW;AAAA,QACxE,IAAI,IAAI;AAAA,QACR,GAAI,KAAK,oBAAoB,SAAY,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,MACxF,CAAC;AAAA,IACH;AAQA,UAAM,kBAAkB,KAAK,oBAAoB,QAAQ,SAAS,YAAY;AAC9E,QAAI,KAAK,IAAI,WAAW,UAAa,CAAC,KAAK,kBAAkB,CAAC,iBAAiB;AAK7E,eAAS,MAAM;AAAA,QACb,KAAK,IAAI;AAAA,QACT;AAAA,QACA,GAAG,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE;AAAA,MAClC;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACx1BA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,gBAAgB;AAmB7B,eAAsB,iBACpB,KACA,YACA,IACA,YACA,MAC+C;AAI/C,MAAI,WAAW,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,iCAAiC,UAAU,wBAAwB;AAC3H,MAAI,GAAG,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,yBAAyB,EAAE,wBAAwB;AAKnG,MAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;AAC5C,UAAM,IAAI,gBAAgB,gCAAgC,KAAK,SAAS,qCAAqC;AAAA,EAC/G;AAEA,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,MAAM,MAAM,UAAU,KAAK,MAAM,GAAG;AAC1C,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,SAAS,eAAe,MAAM;AAEpC,QAAM,OAAO,MAAM,WAAW,qBAAqB;AACnD,MAAI,KAAK,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,oCAAoC,KAAK,GAAG,wBAAwB;AAE1H,QAAM,UAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,WAAW,KAAK;AAAA,EAClB;AACA,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,WAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,mBAAmB;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,eAAe,MAAM;AAAA,IAC9B,WAAW,KAAK;AAAA,EAClB;AAEA,QAAM,cAAc,GAAG,UAAU,IAAI,EAAE,IAAI,KAAK,GAAG;AACnD,QAAM,QAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,WAAW;AAIzE,QAAM,MAAyB;AAAA,IAC7B,EAAE,YAAY,eAAe,IAAI,aAAa,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA,IAC5E;AAAA;AAAA;AAAA,MAGE,IAAI;AAAA,MACJ,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC7B,GAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,aAAa,GAAG;AAEhE,SAAO,EAAE,KAAK,KAAK,KAAK,YAAY;AACtC;AAkBA,eAAsB,mBACpB,KACA,YACA,IACA,KACA,MACe;AACf,MAAI,MAAM,SAAS,MAAM;AAGvB,UAAM,gBAAgB,KAAK,YAAY,EAAE;AACzC;AAAA,EACF;AACA,QAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE;AACjF;AASA,eAAsB,gBACpB,KACA,YACA,IACe;AACf,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG;AAK7C,QAAM,UAAU,aAAa,EAAE,YAAY,GAAG,GAAG,IAAI;AACrD,QAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO;AAEhE,QAAM,kBAAkC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUtC;AAAA,IAAY;AAAA,IAAI,SAAS,KAAK,KAAK;AAAA,IACnC,GAAI,KAAK,UAAU,SAAY,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,IACvD,GAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,MAAM,IAAI,KAAK,QAAQ,SAAY,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC;AAAA,EACnF;AACA,QAAM,SAAS,MAAM,YAAY;AACjC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,QAAQ,eAAe,eAAe,CAAC;AAOhF,MAAI;AACJ,MAAI,KAAK,YAAY,QAAW;AAC9B,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AACxD,YAAM,YAAY,MAAM,mBAAmB,MAAM,OAAO,YAAY,QAAQ,GAAG;AAC/E,YAAM,WAAW,MAAM,QAAQ,WAAW,MAAM,4BAA4B,QAAQ,YAAY,KAAK,CAAC;AACtG,UAAI,KAAK,IAAI,GAAG,SAAS,EAAE,IAAI,SAAS,IAAI;AAAA,IAC9C;AACA,gBAAY;AAAA,EACd;AAMA,MAAI;AACJ,MAAI,KAAK,UAAU,QAAW;AAC5B,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACtD,YAAM,UAAU,MAAM,gBAAgB,MAAM,QAAQ,YAAY,IAAI,KAAK;AACzE,UAAI,KAAK,IAAI,MAAM,gBAAgB,SAAS,QAAQ,YAAY,IAAI,KAAK;AAAA,IAC3E;AACA,cAAU;AAAA,EACZ;AAOA,QAAM,MAAyB,oBAAoB,iBAAiB;AAAA,IAClE;AAAA,IACA;AAAA,IACA,KAAK,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC9B,OAAO;AAAA,MACP,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMrD,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMxD,GAAI,cAAc,SAAY,EAAE,SAAS,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,YAAY,SAAY,EAAE,OAAO,QAAQ,IAAI,CAAC;AAAA,IAClD;AAAA,EACF,CAAC;AACD,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,IAAI,GAAG;AAGpD,QAAM,IAAI,uBAAuB,YAAY,EAAE;AAG/C,QAAM,SAAS,GAAG,UAAU,IAAI,EAAE;AAClC,QAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,aAAa;AAC5D,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG;AAAA,IACxD;AAAA,EACF;AACF;;;AC5NA,eAAe,WAAc,KAA8B,OAAe,OAA2C;AACnH,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,SAAS,MAAM,uBAAuB,GAAG;AAC/C,QAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1E,QAAM,UAAU,GAAG,IAAI,IAAI,IAAI,KAAK;AACpC,QAAM,CAAC,SAAS,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1C,qBAAqB,WAAW,QAAQ,OAAO;AAAA,IAC/C,qBAAqB,WAAW,KAAK,OAAO;AAAA,EAC9C,CAAC;AACD,SAAO,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE,IAAI,OAAO,IAAI,EAAE;AACxE;AAEA,SAAS,eAAkB,KAA8B,OAAe,QAAsB;AAC5F,MAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,oBAAoB,IAAI,KAAK,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,aAAa,KAAK;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,CAAC,IAAI,iBAAiB;AACxB,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,MAAM,MAAM;AAAA,IACrC;AAAA,EACF;AACF;AAaA,eAAsB,UAAa,KAA8B,OAAe,OAAmC;AACjH,iBAAe,KAAK,OAAO,WAAW;AACtC,QAAM,CAAC,QAAQ,YAAY,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK;AAEjE,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAMzD,QAAI,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,SAAS,KAAK,EAAG;AAC/C,QAAI,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,KAAK,KAAK,MAAM,cAAc;AAClE,aAAO,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,GAAG;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,WAAc,KAA8B,OAAe,OAA8B;AAC7G,iBAAe,KAAK,OAAO,YAAY;AACvC,QAAM,CAAC,QAAQ,YAAY,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK;AAEjE,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,UAAe,CAAC;AACtB,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAEzD,QAAI,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,SAAS,KAAK,EAAG;AAC/C,QAAI,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,KAAK,KAAK,MAAM,cAAc;AAClE,YAAM,MAAM,MAAM,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,GAAG;AAC3E,UAAI,QAAQ,KAAM,SAAQ,KAAK,GAAG;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;;;AC9FA,eAAsB,iBACpB,KACA,KACA,KACA,MACiB;AAGjB,MAAI,MAAM,cAAc,MAAO,QAAO,IAAI;AAI1C,QAAM,MAAM,aAAa,KAAK,GAAG;AACjC,MAAI,IAAI,SAAS,QAAW;AAC1B,UAAM,MAAM,MAAM,UAAU,IAAI,MAAM,GAAG;AACzC,WAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,GAAG;AAAA,EAC7C;AACA,SAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,GAAG;AAC7C;AAeA,eAAsB,kBACpB,UACA,MACA,KACA,MAC4D;AAC5D,MAAI,MAAM,cAAc,MAAO,QAAO,EAAE,KAAK,IAAI,OAAO,KAAK;AAE7D,QAAM,MAAM,eAAe,QAAQ;AAEnC,MAAI,MAAM,iBAAiB,MAAM;AAC/B,UAAM,MAAM,MAAM,YAAY;AAC9B,UAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AACjD,UAAM,UAAU,MAAM,QAAQ,KAAK,GAAG;AACtC,WAAO,EAAE,KAAKD,KAAI,OAAOC,OAAM,MAAM,QAAQ;AAAA,EAC/C;AAEA,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AACjD,SAAO,EAAE,KAAK,IAAI,OAAO,KAAK;AAChC;AASO,SAAS,iBAAiB,KAAgC;AAC/D,SAAO,IAAI,MAAM,SAAS,IAAI,IAAI;AACpC;AASO,SAAS,gBAAgB,KAAiC;AAC/D,SAAO,IAAI,SAAS;AACtB;AAuBO,SAAS,oBAAoB,KAAgC;AAWlE,MAAI,IAAI,YAAY,UAAa,IAAI,UAAU,UAAa,IAAI,UAAU,OAAW,QAAO,IAAI;AAChG,QAAM,UAAU,CAAC,KAAoC,QAAwC;AAC3F,UAAM,QAAQ,OAAO,KAAK,GAAG,EAAE,KAAK,EAAE;AAAA,MACpC,CAAC,MAAM,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,IACvD;AACA,WAAO,GAAG,KAAK,UAAU,GAAG,CAAC,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,QAAM,WAAW,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,EAAE;AACxD,MAAI,IAAI,YAAY,OAAW,UAAS,KAAK,QAAQ,WAAW,IAAI,OAAO,CAAC;AAC5E,MAAI,IAAI,UAAU,OAAW,UAAS,KAAK,QAAQ,SAAS,IAAI,KAAK,CAAC;AACtE,MAAI,IAAI,UAAU,OAAW,UAAS,KAAK,QAAQ,SAAS,IAAI,KAAK,CAAC;AACtE,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;AAaO,SAAS,cAAc,KAA8C;AAC1E,SAAO,IAAI,QAAQ;AACrB;AAoBA,eAAsB,qBACpB,KACA,KACA,KACkB;AAClB,MAAI,CAAC,cAAc,GAAG,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,iBAAiB,KAAK,KAAK,GAAG;AACpC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC9HA,IAAMC,UAAS,WAAW,OAAO;AAG1B,IAAM,sBAAsB;AAG5B,IAAM,uBAAuB;AAGpC,IAAM,2BAA2B;AAuCjC,SAAS,eAAe,SAAiB,UAAkB,OAA0C;AACnG,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM,eAAe;AAAA,IACrB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;AAQA,eAAsB,sBACpB,MACA,SACA,UACqB;AACrB,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,MAAsB,QAAQ,OAAO,CAAC,YAAY,CAAC;AACjG,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,mBAAmB;AACzD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,qBAAqB,SAAS,QAAQ,CAAC,CAAC;AAC9F,QAAM,OAAO,MAAMA,QAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AAQA,eAAsB,qBACpB,MACA,SACA,UACqB;AACrB,QAAM,YAAY,MAAM,sBAAsB,MAAM,SAAS,QAAQ;AACrE,MAAI;AACF,WAAO,MAAMA,QAAO,UAAU,OAAO,WAA2B,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,EACpH,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AACF;AAWA,eAAsB,mBACpB,MACA,SACA,UACA,gBACiB;AACjB,MAAI;AACF,QAAI,eAAe,gBAAgB,IAAI;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,SAAS,UAAU,cAAc;AAClE,UAAM,MAAM,MAAM,qBAAqB,MAAM,SAAS,QAAQ;AAC9D,UAAM,MAAM,MAAMA,QAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAiB;AAC9F,WAAO,eAAe,IAAI,WAAW,GAAG,CAAC;AAAA,EAC3C,UAAE;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AACF;AAQO,SAAS,eAAe,MAA4C;AACzE,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,SAAO;AAAA,IACL,WAAW,eAAe,KAAK;AAAA,IAC/B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACtD;AACF;AAgBA,eAAsB,kBAAkB,MAA+C;AACrF,QAAM,QAAQ,MAAM,KAAK,iBAAiB,KAAK,SAAS;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,gBAAgB,GAAI,QAAO;AAEpC,QAAM,YAAY,eAAe,KAAK,SAAS,KAAK,UAAU;AAAA,IAC5D,gBAAgB,KAAK;AAAA,IACrB,SAAS,KAAK;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,QAAM,MAAM,MAAMA,QAAO;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,QAAM,KAAK,MAAMA,QAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe,KAAK,KAAK;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EACpC;AACA,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS;AAC/C;","names":["plaintext","iv","data","iv","data","iv","data","ref","iv","data","subtle"]}

package/dist/{chunk-W3TVWF6N.js → chunk-OIBEJN5H.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -27,4 +27,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-W3TVWF6N.js.map
+//# sourceMappingURL=chunk-OIBEJN5H.js.map

package/dist/{chunk-QD724WDJ.js → chunk-OMYCSTXL.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-UHXCLPGC.js";
+} from "./chunk-JNMTN5D5.js";
 import {
   SealedHandle
-} from "./chunk-W5W6KHN2.js";
+} from "./chunk-IGNJOJEP.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/via/classified/descriptor.ts
 function isClassifiedFieldSpec(x) {
@@ -262,4 +262,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-QD724WDJ.js.map
+//# sourceMappingURL=chunk-OMYCSTXL.js.map

package/dist/{chunk-Z45YRGFO.js → chunk-ONVD6GBY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-Z45YRGFO.js.map
+//# sourceMappingURL=chunk-ONVD6GBY.js.map

package/dist/{chunk-TAGFGKHP.js → chunk-OTHHO3KI.js}

@@ -1,6 +1,6 @@
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 
 // src/with-party/team/managed-secret.ts
 var MemorySealingKeyProvider = class {
@@ -178,14 +178,11 @@ async function saveSealedSecret(store, vault, payload) {
     payload: bytesToBase64(payload.sealed)
   };
   const prior = await store.get(vault, "_meta", SEALED_SECRET_RECORD_ID);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+  const env = buildRecordEnvelope(
+    { collection: "_meta", id: SEALED_SECRET_RECORD_ID, version: (prior?._v ?? 0) + 1 },
     // AES-GCM bypassed — the sealing layer is the security boundary.
-    _iv: "",
-    _data: JSON.stringify(persisted)
-  };
+    { iv: "", data: JSON.stringify(persisted) }
+  );
   await store.put(vault, "_meta", SEALED_SECRET_RECORD_ID, env);
 }
 async function loadSealedSecret(store, vault) {
@@ -227,4 +224,4 @@ export {
   loadSealedSecret,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-TAGFGKHP.js.map
+//# sourceMappingURL=chunk-OTHHO3KI.js.map

package/dist/chunk-OTHHO3KI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/managed-secret.ts"],"sourcesContent":["/**\n * Managed-secret mode — rubber-hose-resistant vaults.\n *\n * A vault mode where the secret is machine-generated and never\n * exposed to the user, sealed under a developer-provided\n * {@link SealingKeyProvider} (macOS Keychain, Windows Credential\n * Manager, libsecret, AWS KMS, …). The user has no secret to give\n * up to coercion — they can't reveal what they don't know.\n *\n * ## Components in this file\n *\n *   - {@link SealingKeyProvider} — the interface concrete providers\n *     implement. Provider implementations live OUTSIDE hub (per-\n *     platform packages).\n *   - {@link MemorySealingKeyProvider} — in-memory test provider; uses\n *     a deterministic per-instance \"key\" so two providers with\n *     different ids cannot unseal each other's outputs.\n *   - {@link RecipientHint} — public material a sender uses to seal\n *     plaintext for a specific recipient; published by\n *     {@link RecipientSealer.publishRecipientHint} and transported\n *     out-of-band to the sender before bundle writes.\n *   - {@link RecipientSealer} — interface for asymmetric/granted\n *     providers that support recipient-target sealing (RSA-OAEP,\n *     cloud-KMS asymmetric, etc.); distinct from self-only\n *     {@link SealingKeyProvider} (macOS Keychain, WebAuthn-PRF).\n *   - {@link MemoryRecipientSealer} — in-process reference\n *     implementation of both `RecipientSealer` and\n *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;\n *     safe for tests and same-process sender/recipient scenarios.\n *   - {@link loadSealedSecret} / {@link saveSealedSecret} —\n *     plaintext envelope storage at `_meta/sealed-secret`.\n *     Mirrors the `_meta/handle` and `_meta/public-envelope` AES-\n *     GCM-bypassed patterns. The sealing layer (provider's job)\n *     is the security boundary; hub doesn't have a key to encrypt\n *     with at this layer — that's the whole point of the design.\n *   - {@link resolveManagedSecret} — orchestrates the \"generate +\n *     seal + persist on first open; unseal on reopen\" flow.\n *     Returns the plaintext secret string that the rest of the\n *     `createNoydb` keyring path consumes.\n *\n * Deferred to follow-ups:\n *   - Block `rotate-secret` policy gate under managed mode.\n *   - Mandatory strong-recovery enforcement.\n *   - Recovery flow under managed mode (generates fresh sealed phrase).\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode\n *\n * @module\n */\n\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, RecipientSealer } from '../../kernel/types.js'\n\n/**\n * The contract concrete providers (per-platform key stores) implement\n * to seal and unseal a hub-generated random secret. The plaintext\n * secret NEVER leaves hub-controlled memory in unsealed form —\n * the provider receives the bytes, returns opaque sealed bytes, and\n * later reverses the operation. Hub treats the sealed bytes as\n * fully opaque.\n *\n * Implementations live OUTSIDE `@noy-db/hub` (separate packages\n * per the issue's \"Concrete providers (live outside hub)\" note):\n *\n * | Platform | Package (TBD) | Backing |\n * |---|---|---|\n * | macOS | `@noy-db/seal-macos-keychain` | Security.framework |\n * | Windows | `@noy-db/seal-wincred` | Credential Manager |\n * | Linux | `@noy-db/seal-libsecret` | libsecret / secret-service |\n * | Cloud / server | `@noy-db/seal-aws-kms` | AWS KMS Decrypt |\n */\nexport interface SealingKeyProvider {\n  /**\n   * Non-sensitive identifier disclosed in the persisted envelope.\n   * Surfaced to consumers via `loadSealedSecret().providerId` so\n   * a vault opened with the wrong provider class can detect the\n   * mismatch and surface a clear error. NOT secret — fine to log.\n   *\n   * Suggested format: `<family>:<scope>` — e.g. `macos-keychain:com.acme.app`,\n   * `aws-kms:arn:aws:kms:us-east-1:123:key/abc`. The hub never\n   * parses this; it's purely audit metadata.\n   */\n  readonly id: string\n\n  /** Seal raw secret bytes. Output bytes are opaque to hub. */\n  seal(secret: Uint8Array): Promise<Uint8Array>\n\n  /**\n   * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or\n   * any other failure — hub treats a thrown error as \"this provider\n   * cannot unlock this vault\" and surfaces it to the caller.\n   */\n  unseal(sealed: Uint8Array): Promise<Uint8Array>\n}\n\n/**\n * In-memory test provider. NOT secure — uses a deterministic\n * per-instance \"key\" (16-byte SHA-256 of `id`) XOR'd over the\n * secret plus a 4-byte provider-id fingerprint prefix. The XOR is\n * sufficient to make different `id` values produce mutually-unsealable\n * outputs (the contract tests for that), but offers ZERO real\n * confidentiality — never use outside tests.\n *\n * Replace with a real platform provider in production.\n */\nexport class MemorySealingKeyProvider implements SealingKeyProvider {\n  readonly id: string\n  private readonly fingerprint: Uint8Array\n  private readonly keyBytes: Uint8Array\n\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    // Deterministic 4-byte fingerprint of the provider id, prepended\n    // to every sealed output so we can detect \"wrong provider\" at\n    // unseal time without leaking anything sensitive about either\n    // provider's actual key material.\n    const encoded = new TextEncoder().encode(opts.id)\n    let h = 0\n    for (let i = 0; i < encoded.length; i++) {\n      h = (h * 31 + encoded[i]!) >>> 0\n    }\n    this.fingerprint = new Uint8Array([\n      (h >>> 24) & 0xff, (h >>> 16) & 0xff, (h >>> 8) & 0xff, h & 0xff,\n    ])\n    // Deterministic 16-byte \"key\" derived from the id by repeating\n    // the fingerprint with offsets. Good enough for the XOR-stream\n    // test cipher; never confuse this with real key derivation.\n    this.keyBytes = new Uint8Array(16)\n    for (let i = 0; i < 16; i++) {\n      this.keyBytes[i] = this.fingerprint[i % 4]! ^ (i * 17)\n    }\n  }\n\n  async seal(secret: Uint8Array): Promise<Uint8Array> {\n    const out = new Uint8Array(4 + secret.length)\n    out.set(this.fingerprint, 0)\n    for (let i = 0; i < secret.length; i++) {\n      out[4 + i] = secret[i]! ^ this.keyBytes[i % 16]!\n    }\n    return out\n  }\n\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    if (sealed.length < 4) {\n      throw new Error('MemorySealingKeyProvider: sealed input too short')\n    }\n    for (let i = 0; i < 4; i++) {\n      if (sealed[i] !== this.fingerprint[i]) {\n        throw new Error(\n          `MemorySealingKeyProvider(\"${this.id}\"): provider-id mismatch on unseal `\n          + '(sealed bytes were produced by a different provider)',\n        )\n      }\n    }\n    const body = sealed.subarray(4)\n    const out = new Uint8Array(body.length)\n    for (let i = 0; i < body.length; i++) {\n      out[i] = body[i]! ^ this.keyBytes[i % 16]!\n    }\n    return out\n  }\n}\n\n/**\n * Public material a sender uses to seal-for-this-recipient. Published by\n * a recipient's RecipientSealer; transported to the sender out-of-band\n * (email, S3, in-app message). The sender obtains the hint, supplies it\n * to writePod's sealedCredentials.perUser[userId].hint, and the\n * hub seals each user's credential against it. Per foundation §11.4.\n */\nexport type RecipientHint = {\n  readonly v: 1\n  /** Recipient's provider id; matches the SealedAutoUnlockEntry.pid they'll unseal under. */\n  readonly pid: string\n  /** Algorithm the sender uses to produce the seal. Slice 1 ships RSA-OAEP-SHA256 only. */\n  readonly alg: 'rsa-oaep-sha256'\n  /** Public material — alg-specific. For 'rsa-oaep-sha256': { publicKeyPem: string }. */\n  readonly material: Readonly<Record<string, unknown>>\n}\n\n// Hoisted to kernel/types.ts (C3 — enclave self-containment: sealing.ts\n// consumes this as a spine-owned contract type). Re-exported here so existing\n// importers of this module are unaffected.\nexport type { RecipientSealer } from '../../kernel/types.js'\n\n/**\n * Shared RSA-OAEP-SHA256 + AES-GCM seal in the canonical recipient-target\n * TLV wire format. Mints a fresh 32-byte CEK, AES-GCM-encrypts `plaintext`\n * under it, RSA-OAEP-SHA256-wraps the CEK to `publicKeyPem`, and packs:\n *\n *   byte  0       : version (0x01)\n *   bytes 1..256  : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n *   bytes 257..268: AES-GCM IV (12 bytes)\n *   bytes 269..   : AES-GCM ciphertext ‖ 16-byte tag\n *\n * This is the single source of truth for the wire format — both\n * {@link MemoryRecipientSealer} and external sealers (e.g. `@noy-db/at-aws-kms`'s\n * asymmetric-KMS recipient sealer) call it so a blob sealed by one unseals\n * by the other. WebCrypto RSA-OAEP/SHA-256 here is wire-compatible with\n * AWS KMS `RSAES_OAEP_SHA_256` (both RSAES-OAEP, SHA-256 hash, MGF1-SHA256,\n * empty label).\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function sealRsaOaepTlv(plaintext: Uint8Array, publicKeyPem: string): Promise<Uint8Array> {\n  // Parse PEM → SPKI bytes.\n  const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, '').replace(/-----END PUBLIC KEY-----/, '').replace(/\\s+/g, '')\n  const spki = base64ToBytes(b64)\n  const recipientPub = await crypto.subtle.importKey(\n    'spki', spki as BufferSource,\n    { name: 'RSA-OAEP', hash: 'SHA-256' },\n    false, ['encrypt'],\n  )\n  // Mint fresh CEK + IV, AES-GCM encrypt plaintext.\n  const cekBytes = crypto.getRandomValues(new Uint8Array(32))\n  const cek = await crypto.subtle.importKey('raw', cekBytes as BufferSource, 'AES-GCM', false, ['encrypt'])\n  const iv = crypto.getRandomValues(new Uint8Array(12))\n  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: iv as BufferSource }, cek, plaintext as BufferSource))\n  // RSA-OAEP-wrap the CEK bytes.\n  const wrapped = new Uint8Array(await crypto.subtle.encrypt({ name: 'RSA-OAEP' }, recipientPub, cekBytes as BufferSource))\n  cekBytes.fill(0)\n  if (wrapped.length !== 256) {\n    throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`)\n  }\n  // TLV layout.\n  const out = new Uint8Array(1 + 256 + 12 + ct.length)\n  out[0] = 0x01\n  out.set(wrapped, 1)\n  out.set(iv, 1 + 256)\n  out.set(ct, 1 + 256 + 12)\n  return out\n}\n\n/**\n * Parse a {@link sealRsaOaepTlv} blob into its three segments without\n * decrypting. The `wrapped` CEK is RSA-OAEP-SHA256 ciphertext over a\n * 32-byte CEK — the unwrap step is pluggable: {@link MemoryRecipientSealer}\n * decrypts it with a local RSA private key; `@noy-db/at-aws-kms` hands it to\n * KMS `Decrypt`. After unwrapping, pass the CEK + `iv` + `ct` to\n * {@link aesGcmOpen}.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport function parseRsaOaepTlv(bytes: Uint8Array): { wrapped: Uint8Array; iv: Uint8Array; ct: Uint8Array } {\n  if (bytes.length < 1 + 256 + 12 + 16) {\n    throw new Error('parseRsaOaepTlv: sealed input too short')\n  }\n  if (bytes[0] !== 0x01) {\n    throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`)\n  }\n  return {\n    wrapped: bytes.subarray(1, 1 + 256),\n    iv: bytes.subarray(1 + 256, 1 + 256 + 12),\n    ct: bytes.subarray(1 + 256 + 12),\n  }\n}\n\n/**\n * AES-GCM-decrypt the `ct` segment of a {@link parseRsaOaepTlv} result under\n * the unwrapped 32-byte CEK and its `iv`. Throws on a bad tag (tamper) — the\n * same authenticated-decryption guarantee the TLV relies on.\n *\n * @public — re-exported from the hub barrel for external sealer packages.\n */\nexport async function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array): Promise<Uint8Array> {\n  const cek = await crypto.subtle.importKey('raw', cekBytes as BufferSource, 'AES-GCM', false, ['decrypt'])\n  return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: iv as BufferSource }, cek, ct as BufferSource))\n}\n\n/**\n * Reference implementation of `RecipientSealer` + `SealingKeyProvider`.\n * Uses WebCrypto RSA-OAEP-SHA256 (2048-bit) to wrap a fresh 32-byte\n * AES-GCM CEK, AES-GCM-encrypts plaintext under it, and packs the\n * result into a self-describing TLV:\n *\n *   byte  0       : version (0x01)\n *   bytes 1..256  : RSA-OAEP-wrapped CEK (fixed 256 bytes at RSA-2048)\n *   bytes 257..268: AES-GCM IV (12 bytes)\n *   bytes 269..   : AES-GCM ciphertext ‖ 16-byte tag\n *\n * Implements BOTH interfaces. `seal(plaintext)` (self-target) is just\n * `sealForRecipient(plaintext, this own hint)` — same TLV. Convenient\n * for tests where one provider plays both ends. Real cloud providers\n * (`at-aws-kms`, etc.) will pick their own internal layouts; the only\n * contract is round-trip identity.\n *\n * SAFE for production within its scope — the cryptography is real\n * (RSA-OAEP + AES-GCM via WebCrypto), but the keypair lives in-process\n * and is regenerated on every construction. Not suitable as a managed\n * keychain; use it for tests and for shipping bundles where the\n * recipient instance lives in the same process as the sender (rare).\n */\nexport class MemoryRecipientSealer implements SealingKeyProvider, RecipientSealer {\n  readonly id: string\n  private readonly keypair: Promise<CryptoKeyPair>\n\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keypair = crypto.subtle.generateKey(\n      { name: 'RSA-OAEP', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n  }\n\n  async publishRecipientHint(): Promise<RecipientHint> {\n    const { publicKey } = await this.keypair\n    const spki = await crypto.subtle.exportKey('spki', publicKey)\n    const pem = '-----BEGIN PUBLIC KEY-----\\n'\n      + bytesToBase64(new Uint8Array(spki)).match(/.{1,64}/g)!.join('\\n')\n      + '\\n-----END PUBLIC KEY-----\\n'\n    return { v: 1, pid: this.id, alg: 'rsa-oaep-sha256', material: { publicKeyPem: pem } }\n  }\n\n  async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n    if (hint.v !== 1) {\n      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n    }\n    if (hint.alg !== 'rsa-oaep-sha256') {\n      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n    }\n    const pem = hint.material['publicKeyPem']\n    if (typeof pem !== 'string') {\n      throw new Error('MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n    }\n    return sealRsaOaepTlv(plaintext, pem)\n  }\n\n  async seal(plaintext: Uint8Array): Promise<Uint8Array> {\n    const hint = await this.publishRecipientHint()\n    return this.sealForRecipient(plaintext, hint)\n  }\n\n  async unseal(bytes: Uint8Array): Promise<Uint8Array> {\n    const { wrapped, iv, ct } = parseRsaOaepTlv(bytes)\n    const { privateKey } = await this.keypair\n    // Local RSA-OAEP-SHA256 unwrap of the CEK — the pluggable step external\n    // sealers replace with KMS Decrypt.\n    const cekBytes = new Uint8Array(await crypto.subtle.decrypt({ name: 'RSA-OAEP' }, privateKey, wrapped as BufferSource))\n    const pt = await aesGcmOpen(cekBytes, iv, ct)\n    cekBytes.fill(0)\n    return pt\n  }\n}\n\n// ─── Persisted envelope ────────────────────────────────────────────────\n\n/** Reserved id for the managed-secret envelope under `_meta`. */\nexport const SEALED_SECRET_RECORD_ID = 'sealed-secret' as const\n\n/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */\nexport interface SealedSecret {\n  readonly _noydb_sealed: 1\n  readonly providerId: string\n  /** Sealed bytes. Base64-encoded on the wire; decoded on load. */\n  readonly sealed: Uint8Array\n}\n\n/**\n * Wire-format envelope persisted at `_meta/sealed-secret` for\n * managed-mode vaults. The provider produces raw sealed bytes via\n * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch\n * metadata hub needs to pick the right provider on the unseal path.\n *\n * Stability boundary: once shipped, the wire format only grows by\n * adding optional fields. See the at-* sealing dimension foundation\n * doc, §11.9.1.\n *\n * v1 shape (this release): `{ v: 1, _noydb_sealed: 1, pid, payload }`.\n *\n * Legacy shape (earlier releases): `{ _noydb_sealed: 1, providerId, sealed }`\n * — accepted on read for backwards compatibility; never produced on\n * write going forward.\n */\nexport interface SealedEnvelope {\n  /** Envelope schema version. v1 is the current shape. */\n  readonly v: 1\n  /** Magic marker for forensics + legacy-shape detection. */\n  readonly _noydb_sealed: 1\n  /** Matches the producing provider's `.id`. Dispatch key on unseal. */\n  readonly pid: string\n  /** Sealed bytes from the provider, base64-encoded on the wire. */\n  readonly payload: string\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n  return btoa(binary)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n  const binary = atob(b64)\n  const out = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i)\n  return out\n}\n\n/**\n * Parse a `_meta/sealed-secret` `_data` JSON string into the\n * in-memory {@link SealedSecret} representation. Accepts both:\n *\n *   1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —\n *      the current shape.\n *   2. Legacy wire format `{ _noydb_sealed: 1, providerId, sealed }` —\n *      read-only; never written\n *      going forward.\n *\n * Returns `undefined` for any input that doesn't match either shape,\n * so callers can fall back to \"no managed-mode envelope present.\"\n *\n * @internal — exported only for the migration safety-net test suite.\n */\nexport function parseSealedEnvelope(raw: unknown): SealedSecret | undefined {\n  if (typeof raw !== 'object' || raw === null) return undefined\n  const r = raw as Record<string, unknown>\n  if (r._noydb_sealed !== 1) return undefined\n\n  // v1 shape — preferred.\n  if (\n    r.v === 1\n    && typeof r.pid === 'string'\n    && typeof r.payload === 'string'\n  ) {\n    return {\n      _noydb_sealed: 1,\n      providerId: r.pid,\n      sealed: base64ToBytes(r.payload),\n    }\n  }\n\n  // Legacy shape — earlier releases. Accept on read for compat.\n  if (\n    typeof r.providerId === 'string'\n    && typeof r.sealed === 'string'\n  ) {\n    return {\n      _noydb_sealed: 1,\n      providerId: r.providerId,\n      sealed: base64ToBytes(r.sealed),\n    }\n  }\n\n  return undefined\n}\n\nexport async function saveSealedSecret(\n  store: NoydbStore,\n  vault: string,\n  payload: { readonly providerId: string; readonly sealed: Uint8Array },\n): Promise<void> {\n  const persisted: SealedEnvelope = {\n    v: 1,\n    _noydb_sealed: 1,\n    pid: payload.providerId,\n    payload: bytesToBase64(payload.sealed),\n  }\n  const prior = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: SEALED_SECRET_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the sealing layer is the security boundary.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', SEALED_SECRET_RECORD_ID, env)\n}\n\nexport async function loadSealedSecret(\n  store: NoydbStore,\n  vault: string,\n): Promise<SealedSecret | undefined> {\n  const envelope = await store.get(vault, '_meta', SEALED_SECRET_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    return parseSealedEnvelope(JSON.parse(envelope._data))\n  } catch {\n    return undefined\n  }\n}\n\n// ─── createNoydb orchestration ─────────────────────────────────────────\n\n/**\n * Resolve the effective plaintext secret string for a managed-mode\n * vault. Two paths:\n *\n *   1. **First open (no envelope persisted):** generate a 256-bit random\n *      via `crypto.getRandomValues`, base64-encode for use as a\n *      secret string, seal the underlying bytes under the\n *      provider, persist `_meta/sealed-secret`, return the\n *      base64 string.\n *\n *   2. **Reopen (envelope exists):** read + unseal + decode → return.\n *      A different provider whose `seal` output disagrees on the\n *      stored bytes throws here, surfaced as a clear error.\n *\n * The returned string is the same shape that `secret:` would take in\n * standard mode — the rest of the keyring path consumes it\n * unchanged.\n *\n * @internal — called from `createNoydb` / `getKeyringInternal`.\n */\nexport async function resolveManagedSecret(\n  store: NoydbStore,\n  vault: string,\n  provider: SealingKeyProvider,\n): Promise<string> {\n  const existing = await loadSealedSecret(store, vault)\n  if (existing) {\n    if (existing.providerId !== provider.id) {\n      throw new Error(\n        `Managed-mode vault \"${vault}\" was sealed under provider id `\n        + `\"${existing.providerId}\" but the current SealingKeyProvider is `\n        + `\"${provider.id}\". Pass the same provider that originally enrolled `\n        + 'the vault, or treat this as a fresh enrollment and clear '\n        + '`_meta/sealed-secret` first.',\n      )\n    }\n    const plaintext = await provider.unseal(existing.sealed)\n    return bytesToBase64(plaintext)\n  }\n\n  // First open: mint a 256-bit random, seal, persist.\n  const random = new Uint8Array(32)\n  globalThis.crypto.getRandomValues(random)\n  const sealed = await provider.seal(random)\n  await saveSealedSecret(store, vault, { providerId: provider.id, sealed })\n  return bytesToBase64(random)\n}\n"],"mappings":";;;;;AAyGO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AAKf,UAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAChD,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAK,IAAI,KAAK,QAAQ,CAAC,MAAQ;AAAA,IACjC;AACA,SAAK,cAAc,IAAI,WAAW;AAAA,MAC/B,MAAM,KAAM;AAAA,MAAO,MAAM,KAAM;AAAA,MAAO,MAAM,IAAK;AAAA,MAAM,IAAI;AAAA,IAC9D,CAAC;AAID,SAAK,WAAW,IAAI,WAAW,EAAE;AACjC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,WAAK,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAM,IAAI;AAAA,IACrD;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,QAAyC;AAClD,UAAM,MAAM,IAAI,WAAW,IAAI,OAAO,MAAM;AAC5C,QAAI,IAAI,KAAK,aAAa,CAAC;AAC3B,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAI,IAAI,CAAC,IAAI,OAAO,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,QAAyC;AACpD,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,EAAE;AAAA,QAEtC;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,OAAO,SAAS,CAAC;AAC9B,UAAM,MAAM,IAAI,WAAW,KAAK,MAAM;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAI,CAAC,IAAI,KAAK,CAAC,IAAK,KAAK,SAAS,IAAI,EAAE;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACF;AA2CA,eAAsB,eAAe,WAAuB,cAA2C;AAErG,QAAM,MAAM,aAAa,QAAQ,8BAA8B,EAAE,EAAE,QAAQ,4BAA4B,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAC7H,QAAM,OAAO,cAAc,GAAG;AAC9B,QAAM,eAAe,MAAM,OAAO,OAAO;AAAA,IACvC;AAAA,IAAQ;AAAA,IACR,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,IACpC;AAAA,IAAO,CAAC,SAAS;AAAA,EACnB;AAEA,QAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC1D,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,UAA0B,WAAW,OAAO,CAAC,SAAS,CAAC;AACxG,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,KAAK,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAuB,GAAG,KAAK,SAAyB,CAAC;AAElI,QAAM,UAAU,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,cAAc,QAAwB,CAAC;AACxH,WAAS,KAAK,CAAC;AACf,MAAI,QAAQ,WAAW,KAAK;AAC1B,UAAM,IAAI,MAAM,wDAAwD,QAAQ,MAAM,EAAE;AAAA,EAC1F;AAEA,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,MAAM;AACnD,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,SAAS,CAAC;AAClB,MAAI,IAAI,IAAI,IAAI,GAAG;AACnB,MAAI,IAAI,IAAI,IAAI,MAAM,EAAE;AACxB,SAAO;AACT;AAYO,SAAS,gBAAgB,OAA4E;AAC1G,MAAI,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI;AACpC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,MAAM,CAAC,MAAM,GAAM;AACrB,UAAM,IAAI,MAAM,wCAAwC,MAAM,CAAC,CAAC,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS,GAAG,IAAI,GAAG;AAAA,IAClC,IAAI,MAAM,SAAS,IAAI,KAAK,IAAI,MAAM,EAAE;AAAA,IACxC,IAAI,MAAM,SAAS,IAAI,MAAM,EAAE;AAAA,EACjC;AACF;AASA,eAAsB,WAAW,UAAsB,IAAgB,IAAqC;AAC1G,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,UAA0B,WAAW,OAAO,CAAC,SAAS,CAAC;AACxG,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAuB,GAAG,KAAK,EAAkB,CAAC;AACzH;AAyBO,IAAM,wBAAN,MAA2E;AAAA,EACvE;AAAA,EACQ;AAAA,EAEjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,UAAU,OAAO,OAAO;AAAA,MAC3B,EAAE,MAAM,YAAY,eAAe,MAAM,gBAAgB,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,MAAM,UAAU;AAAA,MACpG;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,uBAA+C;AACnD,UAAM,EAAE,UAAU,IAAI,MAAM,KAAK;AACjC,UAAM,OAAO,MAAM,OAAO,OAAO,UAAU,QAAQ,SAAS;AAC5D,UAAM,MAAM,iCACR,cAAc,IAAI,WAAW,IAAI,CAAC,EAAE,MAAM,UAAU,EAAG,KAAK,IAAI,IAChE;AACJ,WAAO,EAAE,GAAG,GAAG,KAAK,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,cAAc,IAAI,EAAE;AAAA,EACvF;AAAA,EAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,QAAI,KAAK,MAAM,GAAG;AAChB,YAAM,IAAI,MAAM,8DAA8D,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,IAC7G;AACA,QAAI,KAAK,QAAQ,mBAAmB;AAClC,YAAM,IAAI,MAAM,iEAAiE,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,IACnI;AACA,UAAM,MAAM,KAAK,SAAS,cAAc;AACxC,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI,MAAM,4FAA4F;AAAA,IAC9G;AACA,WAAO,eAAe,WAAW,GAAG;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,WAA4C;AACrD,UAAM,OAAO,MAAM,KAAK,qBAAqB;AAC7C,WAAO,KAAK,iBAAiB,WAAW,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,OAAO,OAAwC;AACnD,UAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,KAAK;AACjD,UAAM,EAAE,WAAW,IAAI,MAAM,KAAK;AAGlC,UAAM,WAAW,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,YAAY,OAAuB,CAAC;AACtH,UAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,aAAS,KAAK,CAAC;AACf,WAAO;AAAA,EACT;AACF;AAKO,IAAM,0BAA0B;AAqCvC,SAAS,cAAc,OAA2B;AAChD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAiBO,SAAS,oBAAoB,KAAwC;AAC1E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,kBAAkB,EAAG,QAAO;AAGlC,MACE,EAAE,MAAM,KACL,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,YAAY,UACxB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,OAAO;AAAA,IACjC;AAAA,EACF;AAGA,MACE,OAAO,EAAE,eAAe,YACrB,OAAO,EAAE,WAAW,UACvB;AACA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,YAAY,EAAE;AAAA,MACd,QAAQ,cAAc,EAAE,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,iBACpB,OACA,OACA,SACe;AACf,QAAM,YAA4B;AAAA,IAChC,GAAG;AAAA,IACH,eAAe;AAAA,IACf,KAAK,QAAQ;AAAA,IACb,SAAS,cAAc,QAAQ,MAAM;AAAA,EACvC;AACA,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACrE,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,yBAAyB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAElF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,yBAAyB,GAAG;AAC9D;AAEA,eAAsB,iBACpB,OACA,OACmC;AACnC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,uBAAuB;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,WAAO,oBAAoB,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwBA,eAAsB,qBACpB,OACA,OACA,UACiB;AACjB,QAAM,WAAW,MAAM,iBAAiB,OAAO,KAAK;AACpD,MAAI,UAAU;AACZ,QAAI,SAAS,eAAe,SAAS,IAAI;AACvC,YAAM,IAAI;AAAA,QACR,uBAAuB,KAAK,mCACtB,SAAS,UAAU,4CACnB,SAAS,EAAE;AAAA,MAGnB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,SAAS,OAAO,SAAS,MAAM;AACvD,WAAO,cAAc,SAAS;AAAA,EAChC;AAGA,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,aAAW,OAAO,gBAAgB,MAAM;AACxC,QAAM,SAAS,MAAM,SAAS,KAAK,MAAM;AACzC,QAAM,iBAAiB,OAAO,OAAO,EAAE,YAAY,SAAS,IAAI,OAAO,CAAC;AACxE,SAAO,cAAc,MAAM;AAC7B;","names":[]}