@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/chunk-4ZPE6SKS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/dependency-analyzer.ts","../src/with-formula/materialized-views/query-hash.ts","../src/with-formula/materialized-views/projection-legs.ts","../src/with-formula/materialized-views/registry.ts"],"sourcesContent":["import type { Query, QueryPlan } from '../../kernel/query/builder.js'\nimport type { JoinContext } from '../../kernel/query/join.js'\nimport type { MaterializedViewSpec } from './types.js'\n\n/**\n * Walks a `Query<T>` plan and returns the set of source collection\n * names that any source-write should trigger a refresh on.\n *\n * Handles:\n *   - root collection (the one the query was built from)\n *   - FK join targets (`.join(field, { as })`)\n *\n * Also handles:\n *   - cross-join targets (`.crossJoin(target, { as })`) — v3\n *\n * Deferred:\n *   - `.wherePredicate(name)` — v2 predicate primitive\n *   - Overlay-name expansion to {base, overlay}\n *\n * The set is materialized at MV registration time. The MV registry\n * uses it to (a) dispatch `onSourceWrite` only to MVs that actually\n * care, and (b) contribute edges to the shared cycle-detection graph.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function analyzeDependencies(query: Query<any>): Set<string> {\n  const deps = new Set<string>()\n  const plan = query._plan()\n  const ctx = query._joinContext()\n\n  // The root collection is always a dependency.\n  if (ctx?.leftCollection) {\n    deps.add(ctx.leftCollection)\n  }\n\n  // FK join targets contribute additional sources.\n  for (const leg of plan.joins) {\n    deps.add(leg.target)\n  }\n\n  // Cross-join targets are also dependency sources — writes to either side\n  // must trigger MV refresh. Symmetric with FK-join target handling above.\n  for (const clause of plan.clauses) {\n    if (clause.type === 'crossJoin') {\n      deps.add(clause.target)\n    }\n  }\n\n  // Sub-plans inside OR clauses can carry nested joins. Walk them.\n  // (Today only top-level `.join()` populates `plan.joins`, but the\n  // OR-group machinery permits sub-plans, so we recurse defensively.)\n  walkClausesForJoins(plan, deps, ctx)\n\n  return deps\n}\n\nfunction walkClausesForJoins(\n  plan: QueryPlan,\n  deps: Set<string>,\n  ctx: JoinContext | undefined,\n): void {\n  void ctx\n  // Today `plan.joins` carries all join legs at top level. Sub-plans\n  // inside OR groups don't currently support nested joins, so the loop\n  // below is a no-op safety net for future builder extensions.\n  for (const clause of plan.clauses) {\n    if (clause.type === 'group') {\n      // Group clauses don't (yet) carry their own joins; this is a\n      // forward-compat anchor for when OR-groups support nested\n      // sources.\n    }\n  }\n}\n\n/**\n * Convenience: produce a stable string summary of the query plan\n * suitable for `queryHash` derivation. Captures everything the\n * dependency analyzer reads + the where/orderBy/limit/offset\n * structure that affects materialized rows.\n *\n * `joinContext` is intentionally NOT included — the join-resolution\n * function references would defeat hash determinism. The set of join\n * TARGETS (collection names) IS included via the plan.joins legs.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function summarizeQueryPlan(query: Query<any>): string {\n  const plan = query._plan()\n  const ctx = query._joinContext()\n  return JSON.stringify({\n    root: ctx?.leftCollection ?? null,\n    clauses: plan.clauses.map(c => {\n      if (c.type === 'crossJoin') {\n        return {\n          type: 'crossJoin',\n          target: c.target,\n          as: c.as,\n          // Inline on: callback: use sentinel — drift detection disabled for this MV\n          onPredicateName: c.onPredicateName ?? (c.on ? '[inline]' : null),\n          maxRows: c.maxRows ?? null,\n          // `outer` changes the row set, so it is part of the plan's identity\n          // for drift detection, not decoration (#1130).\n          outer: c.outer ?? false,\n        }\n      }\n      return c\n    }),\n    orderBy: plan.orderBy,\n    limit: plan.limit ?? null,\n    offset: plan.offset,\n    joins: plan.joins.map(j => ({ field: j.field, as: j.as, target: j.target, mode: j.mode })),\n  })\n}\n\n/**\n * Canonical string description of a UNION MV's plan, used as input to\n * `computeQueryHash`.\n *\n * Asymmetry note:\n *   - Arm collection names are NOT sorted. Declaration order is\n *     semantically meaningful for the dedup-only UNION path —\n *     `materializeUnionResult` iterates `spec.unionSources` in\n *     declaration order and keeps the first-seen row per composite key\n *     (tie-break precedence). If we sorted arms here, a consumer who\n *     reordered `unionSources` to change precedence would compute the\n *     same `queryHash`, refresh would be a no-op, and stale MV rows\n *     would persist. Hashing in declaration order makes any reorder\n *     trigger a refresh.\n *   - `groupBy` fields ARE sorted. Multi-key groupBy buckets are\n *     commutative (`canonicalGroupKey` produces the same composite key\n *     regardless of field order in the input spec).\n *   - `aggregate` keys ARE sorted. Reducer-spec keys are independent\n *     of each other — order of declaration doesn't change output.\n *\n * Per-arm `map` functions are NOT fingerprinted; consumers must bump\n * the MV's `name` (or rely on application-level cache busting) when\n * `map` semantics change non-equivalently.\n */\nexport function summarizeUnionPlan<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  return `union(${summarizeUnionArms(spec)})${summarizeGroupingTail(spec)}`\n}\n\n/**\n * Canonical string description of a projection MV's plan (#810), used\n * as input to `computeQueryHash`.\n *\n * Leg descriptors ARE sorted (contrast with UNION arm order): every\n * leg attaches under a distinct `as` alias, forward legs are\n * one-to-one attachments and collect legs are independent\n * hash-grouped passes, so declaration order never changes the\n * materialized rows — a pure reorder must NOT force a refresh.\n * `from` (#1140) constrains the legal orderings (a leg must follow the\n * alias it attaches to) without making order meaningful: each descriptor\n * carries its own `@alias`, and aliases are unique, so the sorted set\n * still determines the leg graph exactly.\n *\n * The projection `map` is NOT fingerprinted (identical limitation as\n * the UNION arm `map`); consumers must bump the MV's `name` when\n * `map` semantics change non-equivalently.\n */\nexport function summarizeProjectionPlan<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  const projection = spec.projection!\n  const legs = projection.joins\n    .map(leg => {\n      // #1140 — `from` changes which rows a leg attaches to, so it is part of\n      // the plan's identity. Omitting it would let two structurally different\n      // projections share a queryHash and silently skip a refresh.\n      const at = leg.from !== undefined ? `@${leg.from}` : ''\n      return 'collect' in leg\n        ? `collect${at}:${leg.collect}.${leg.on}→${leg.as}`\n        : `field${at}:${leg.field}→${leg.as}`\n    })\n    .sort()\n  const body = JSON.stringify({ source: projection.source, legs })\n  return `projection(${body})${summarizeGroupingTail(spec)}`\n}\n\n/** Arm descriptors for `summarizeUnionPlan` — declaration order preserved (see its doc). */\nfunction summarizeUnionArms<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  return (spec.unionSources ?? [])\n    .map(s => {\n      // Fold each arm's join legs into the summary so adding or\n      // reordering joins (which changes the materialized rows) bumps\n      // queryHash. Leg order is declaration-significant (legs chain), so\n      // it is NOT sorted — same rationale as arm declaration order.\n      const joins = s.join?.length\n        ? `[${s.join.map(j => `${j.field}→${j.as}`).join(';')}]`\n        : ''\n      return `${s.collection}${joins}`\n    })\n    .join(',')\n}\n\n/**\n * Shared `|groupBy(…)|aggregate(…)|money(…)` tail for the UNION and\n * projection summaries — both feed the same post-map grouping pipeline,\n * so the same spec fields fold into both hashes with the same rules.\n */\nfunction summarizeGroupingTail<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  const groupBy: string = Array.isArray(spec.groupBy)\n    ? [...spec.groupBy].sort().join(',')\n    : typeof spec.groupBy === 'string'\n      ? spec.groupBy\n      : ''\n  const aggKeys = spec.aggregate ? Object.keys(spec.aggregate).sort().join(',') : ''\n  // `moneyFields` changes reducer semantics (float → exact BigInt), so\n  // declaring / removing / re-keying it must bump queryHash. Keys are\n  // sorted — they're independent of each other (one descriptor per\n  // output field), same rationale as aggregate keys.\n  const moneyKeys = spec.moneyFields ? Object.keys(spec.moneyFields).sort().join(',') : ''\n  return `|groupBy(${groupBy})|aggregate(${aggKeys})|money(${moneyKeys})`\n}\n","/**\n * Deterministic hash of a materialized view strategy's \"shape\": MV\n * name + canonical query-plan summary + sorted dependency-set.\n *\n * Used to detect strategy drift: a row whose `_materializedFrom.queryHash`\n * doesn't match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps. Mirrors the v1\n * `computeStrategyHash` pattern.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeQueryHash(\n  mvName: string,\n  /**\n   * Source-collection set the query depends on. Sorted before\n   * canonicalization so set iteration order doesn't affect the hash.\n   */\n  dependencies: ReadonlySet<string>,\n  /**\n   * Stringified query-plan summary. The caller produces this from the\n   * `Query<T>` builder — concretely: a JSON serialization of clauses +\n   * orderBy + limit + offset + joins. Function bodies inside\n   * `wherePredicate` are NOT included here (those carry their own\n   * `predicateHash` to be folded in by a later sub-issue).\n   */\n  queryPlanSummary: string,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    mvName,\n    dependencies: [...dependencies].sort(),\n    queryPlanSummary,\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n\n/**\n * Canonicalize a query plan for hashing. Walks the plan structure\n * with sorted keys so insertion order doesn't perturb the result.\n * Lives here rather than in `query/builder.ts` to keep that module\n * stable across MV-specific evolutions.\n *\n * @internal exported for testing\n */\nexport function canonicalizeQueryPlan(plan: unknown): string {\n  return JSON.stringify(plan, (_key, value) => {\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      const sorted: Record<string, unknown> = {}\n      for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n        sorted[k] = (value as Record<string, unknown>)[k]\n      }\n      return sorted\n    }\n    return value\n  })\n}\n","/**\n * Projection-leg topology (#810, extended by #1140).\n *\n * A projection MV's legs originally all attached to the PRIMARY row: a forward\n * leg named an FK field on `projection.source`, and a reverse `collect` leg's\n * `on` field had to `ref()` the source itself. Anything two FKs away was\n * therefore inexpressible — `bill → entity → client` has no leg shape, because\n * the bill has no `clientId` and `clients.entityId` refs `entities`, not\n * `bills`.\n *\n * `from` closes that: a leg may attach to a previously-declared ALIAS instead of\n * to the primary row. This module owns the two questions that follow from it —\n * *is this leg graph well-formed?* and *which collection does a leg's rows come\n * from?* — so neither the registry nor the executor has to re-derive them.\n *\n * **Why cycles are impossible by construction, and there is no depth cap.**\n * `from` may only name an alias declared EARLIER in `joins`. A leg can therefore\n * never reach forward, the graph is a forest rooted at the primary row, and its\n * depth is bounded by the number of legs. Validation refuses an unknown or\n * not-yet-declared alias, which is the same check.\n */\n\nimport { MaterializedViewConfigError } from '../../kernel/errors.js'\nimport type { ProjectionJoinLeg, ProjectionSpec } from './types.js'\n\n/** Reverse (one-to-many) leg — discriminated on `collect`, as the type is. */\nexport function isCollectLeg(\n  leg: ProjectionJoinLeg,\n): leg is Extract<ProjectionJoinLeg, { collect: string }> {\n  return 'collect' in leg\n}\n\n/**\n * Refuse a malformed leg graph where `withMaterializedView()` checks the rest of\n * the leg shape — at spec CONSTRUCTION, not at vault open and not at first\n * materialization. Alias wiring is pure configuration: it needs no refs, no\n * records and no store, so the earliest failure is the best one.\n * (Ref EXISTENCE still resolves at first materialization, unchanged — refs\n * cannot exist until after `openVault()` returns.)\n */\nexport function validateProjectionLegs<T extends Record<string, unknown>>(\n  mvName: string,\n  projection: ProjectionSpec<T>,\n): void {\n  // Non-empty and unique `as` are already refused by `withMaterializedView()`\n  // itself, earlier and with its own message — not re-checked here. This\n  // function owns the `from` wiring and nothing else.\n  const seen = new Map<string, ProjectionJoinLeg>()\n  for (const leg of projection.joins) {\n    if (leg.from !== undefined) {\n      const parent = seen.get(leg.from)\n      if (!parent) {\n        throw new MaterializedViewConfigError(\n          `\"${mvName}\": projection leg \"${leg.as}\" declares from: \"${leg.from}\", which is not an ` +\n            `alias declared EARLIER in \\`joins\\`. A leg may only attach to the primary row or to a ` +\n            `preceding leg — that ordering rule is what makes a cycle impossible. Known so far: ` +\n            `${[...seen.keys()].map(a => `\"${a}\"`).join(', ') || '(none)'}`,\n        )\n      }\n      if (isCollectLeg(parent)) {\n        throw new MaterializedViewConfigError(\n          `\"${mvName}\": projection leg \"${leg.as}\" declares from: \"${leg.from}\", but \"${leg.from}\" ` +\n            `is a collect leg and holds an ARRAY of rows, not one record. A leg can only hang off a ` +\n            `forward leg (record | null). Attach it to the primary row instead, or collect the ` +\n            `far side directly if its ref() reaches \"${projection.source}\".`,\n        )\n      }\n    }\n    seen.set(leg.as, leg)\n  }\n}\n\n/**\n * The collection a leg's rows come from — the primary source for a root leg, the\n * `from` leg's own target otherwise.\n *\n * Returns `null` when a forward `ref()` somewhere along the chain is not\n * declared yet, which at registration time is the normal case rather than an\n * error: refs are declared after `openVault()` returns, so the registry retries\n * this on every dispatch until it resolves (`_pendingForwardDeps`).\n *\n * `resolveRef` is passed in rather than imported so this module stays free of\n * vault wiring — the registry hands it the ref registry's `getOutbound`, the\n * executor hands it a join context lookup. Both answer the same question.\n */\nexport type RefLookup = (collection: string, field: string) => { target: string } | null\n\nexport function resolveLegOwner(\n  leg: ProjectionJoinLeg,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  source: string,\n  resolveRef: RefLookup,\n): string | null {\n  if (leg.from === undefined) return source\n  const parent = joins.find(l => l.as === leg.from)\n  if (!parent) return null // refused by validateProjectionLegs; defensive here\n  if (isCollectLeg(parent)) return parent.collect // refused too, same reason\n  const parentOwner = resolveLegOwner(parent, joins, source, resolveRef)\n  if (parentOwner === null) return null\n  return resolveRef(parentOwner, parent.field)?.target ?? null\n}\n\n/**\n * The collection a FORWARD leg resolves INTO — i.e. its dependency. `null` while\n * any ref in the chain (including this leg's own) is still undeclared.\n */\nexport function resolveForwardLegTarget(\n  leg: Extract<ProjectionJoinLeg, { field: string }>,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  source: string,\n  resolveRef: RefLookup,\n): string | null {\n  const owner = resolveLegOwner(leg, joins, source, resolveRef)\n  if (owner === null) return null\n  return resolveRef(owner, leg.field)?.target ?? null\n}\n","import { MaterializedViewSourceUnknownError, RefNotDeclaredError } from '../../kernel/errors.js'\nimport type { ViaGraph, FieldRef, EdgeKind, Grain } from '../../kernel/via/graph.js'\nimport type { Clause, FieldClause } from '../../kernel/query/predicate.js'\nimport type { DeclaredPredicate } from '../../kernel/query/builder.js'\nimport { analyzeDependencies, summarizeQueryPlan, summarizeUnionPlan, summarizeProjectionPlan } from './dependency-analyzer.js'\nimport { computeQueryHash } from './query-hash.js'\nimport { isCollectLeg, resolveForwardLegTarget } from './projection-legs.js'\nimport type { MaterializedViewSpec, MVQueryContext } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2) — MUST match\n * `derivations/registry.ts`'s and `vault.ts`'s overlay-edge marker so\n * cross-registry edges (a derivation feeding an MV, or vice versa) resolve\n * to the SAME graph node. See that file's `WHOLE_RECORD` doc comment.\n */\nconst WHOLE_RECORD = '*'\n\n/**\n * One registered MV strategy alongside its derived metadata. Stored\n * type-erased on `TRow` so the registry can hold heterogeneous MVs.\n */\nexport interface RegisteredMV {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly spec: MaterializedViewSpec<any>\n  /** Output collection name (`spec.output?.collection ?? spec.name`). */\n  readonly outputCollection: string\n  /** Set of source collections; populated at registration via the analyzer. */\n  readonly dependencies: ReadonlySet<string>\n  /** Canonical `queryHash` — `_materializedFrom.queryHash` for every emitted row. */\n  readonly queryHash: string\n  /**\n   * Top-level FieldClauses on the partition field, captured at\n   * registration time. Used by the cycle detector to resolve\n   * same-collection-as-source edges via the partition-discriminator\n   * check. Empty when `spec.output?.partition` is undefined.\n   */\n  readonly partitionClauses: readonly FieldClause[]\n  /**\n   * #638 Task 2 — `'record'` for a row-per-source-row Query<T> or\n   * `unionSources` MV, `'aggregate'` for a `.groupBy().aggregate()` MV\n   * (the shape that requires explicit `sources`, since the dependency\n   * analyzer can't walk an aggregate plan). Feeds `edges()`'s grain.\n   */\n  readonly grain: Grain\n}\n\n/**\n * Vault-internal registry of MV strategies. Owned by `Vault`; not\n * exported. Parallel to v1's `DerivationRegistry`; the two graphs share\n * a single cycle-detection pass at vault open (see `validate`).\n *\n * @internal\n */\nexport class MaterializedViewRegistry {\n  /** Keyed by `spec.name`. */\n  private readonly _byName = new Map<string, RegisteredMV>()\n  /** Keyed by dependency source-collection → MVs that depend on it. */\n  private readonly _bySource = new Map<string, RegisteredMV[]>()\n  /**\n   * Projection MVs (#810) whose forward-leg ref() targets could not be\n   * resolved at registration time. A forward leg names only the FK\n   * FIELD; its dependency is the field's ref() TARGET, declared on the\n   * source collection — but registration runs at vault open, BEFORE\n   * user code declares collections (and their refs). Constructing the\n   * source collection here to look them up would be worse: a later\n   * `vault.collection(source, { refs })` call only registers refs on a\n   * cache miss, so an early construction would silently drop them.\n   * Instead each entry carries a non-constructive ref-registry probe;\n   * `mvsForSource` retries on every dispatch until every forward\n   * target has resolved (see `_resolvePendingForwardDeps`).\n   */\n  private readonly _pendingForwardDeps: Array<{\n    reg: RegisteredMV\n    /** Forward-leg ALIASES still awaiting resolution (#1140 — a leg is identified\n     *  by its alias, not its field: with `from`, two legs may name the same FK\n     *  field on different collections). */\n    aliases: Set<string>\n    resolveTarget: (alias: string) => string | null\n  }> = []\n\n  /**\n   * Query-form strategies whose `query()` callback could not be planned at\n   * registration time because a `.join()` names a field whose `ref()` is not\n   * declared YET (#1139).\n   *\n   * Registration runs inside `openVault()`; a collection's refs can only be\n   * declared afterwards, so for a query-form MV that joins a declared FK there\n   * is NO call ordering the consumer can choose — the plan is simply built too\n   * early. Rather than failing the vault open, the strategy is parked here and\n   * replanned from {@link resolvePendingPlans}, which every write dispatch and\n   * `vault.refreshView()` call runs first. This is the query-form counterpart\n   * of `_pendingForwardDeps`, one level up: that defers a leg's TARGET, this\n   * defers the whole plan.\n   *\n   * Only `RefNotDeclaredError` parks a strategy. Every other planning failure\n   * still throws out of `openVault()` exactly as before, so a typo'd source or\n   * a malformed spec keeps its loud, early error.\n   *\n   * A parked strategy is invisible until it resolves: it contributes no\n   * `_bySource` entries and no cycle-detection edges (same caveat as a\n   * late-resolved forward target — `edges()` runs once at vault open). It also\n   * cannot be dispatched, which is why {@link hasPendingPlans} forces the\n   * conservative branch in `Collection._txAtomicSafe`: the atomic write path\n   * skips MV dispatch, and skipping it here would mean the write that was\n   * supposed to trigger the first replan is the one that gets missed.\n   */\n  private readonly _pendingPlans: Array<{\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: MaterializedViewSpec<any>\n    db: MVQueryContext\n    options?: { knownCollections?: (name: string) => boolean }\n  }> = []\n\n  /**\n   * Register an MV. Invokes `spec.query()` once at registration time to\n   * read the plan + join context; the resulting `Query<T>` is discarded\n   * after dependency extraction. `vault.collection(...)` must therefore\n   * be functional by the time this runs — typically wired from\n   * `Vault._initMaterializedViews` after collection bootstrap.\n   *\n   * Throws `MaterializedViewSourceUnknownError` if the analyzer\n   * surfaces a dependency the vault doesn't know about (when a\n   * `knownCollections` checker is supplied).\n   */\n  async register(\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: MaterializedViewSpec<any>,\n    db: MVQueryContext,\n    options?: { knownCollections?: (name: string) => boolean },\n  ): Promise<void> {\n    // Build a predicate-aware db wrapper. If `spec.predicates` is\n    // declared, the wrapper intercepts `.collection().query()` and\n    // attaches the predicates map to the resulting Query<T>. With no\n    // predicates declared, the wrapper is the original db unchanged.\n    const dbForQuery = spec.predicates ? wrapDbWithPredicates(db, spec.predicates) : db\n\n    // Invoke the query callback once to inspect its plan / dependencies.\n    // For Query<T> shapes the analyzer extracts deps + plan summary\n    // automatically. Reduction / GroupedReduction shapes don't\n    // expose the underlying Query, so the spec must declare `sources`\n    // explicitly. `partitionClauses` are only populated for Query<T>\n    // since same-collection-partition is a non-aggregate concern.\n    // UNION-form strategies: dependencies and plan summary come\n    // straight off the strategy — no `query` callback to introspect.\n    // The dependency-analyzer + summarizer are bypassed entirely; the\n    // executor handles materialization via `materializeUnionResult`.\n    let dependencies: Set<string>\n    let queryPlanSummary: string\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let qAny: any = null\n    let isQuery = false\n    // Projection-form (#810): forward legs whose ref() target wasn't\n    // resolvable at registration time — folded in lazily, see\n    // `_pendingForwardDeps`.\n    const pendingForwardFields: string[] = []\n    if (spec.unionSources) {\n      dependencies = new Set(spec.unionSources.map(s => s.collection))\n      // Per-arm joins resolve right-side collections that aren't among\n      // the arm `collection`s. The consumer lists those in `sources`;\n      // fold them into the dependency set so a write to a join-target\n      // collection triggers MV refresh (and contributes a cycle edge).\n      if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      queryPlanSummary = summarizeUnionPlan(spec)\n    } else if (spec.projection) {\n      // Projection-form (#810): dependencies are all AUTO — the primary\n      // source, every collect leg's collection (both literal names), and\n      // every forward leg's ref() target. Forward targets usually can't\n      // resolve yet (refs are declared after vault open) — those go\n      // through the pending-resolution path below. Explicit `sources`\n      // remains additive, same as the other two forms.\n      const projection = spec.projection\n      dependencies = new Set([projection.source])\n      for (const leg of projection.joins) {\n        // A collect leg's dependency is its literal collection name, whatever it\n        // attaches to — which is why `from` needs no new dependency machinery on\n        // that side. A forward leg's dependency is a ref() target, still unknown.\n        if (isCollectLeg(leg)) dependencies.add(leg.collect)\n        else pendingForwardFields.push(leg.as)\n      }\n      if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      queryPlanSummary = summarizeProjectionPlan(spec)\n    } else {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      let q: any\n      try {\n        q = spec.query!(dbForQuery)\n      } catch (e) {\n        // #1139 — a join on a ref that is not declared YET. Park and replan;\n        // see `_pendingPlans`. Anything else is a real registration failure.\n        if (!(e instanceof RefNotDeclaredError)) throw e\n        this._pendingPlans.push({ spec, db, ...(options !== undefined ? { options } : {}) })\n        return\n      }\n      qAny = q // already `any` — see the declaration above\n      isQuery = typeof qAny._plan === 'function'\n      if (isQuery) {\n        // `q` is the `Query` arm of the union here (runtime-confirmed via\n        // `qAny._plan` above); reuse the already-`any` `qAny` the block uses\n        // for `_plan()` rather than re-narrowing.\n        dependencies = analyzeDependencies(qAny)\n        queryPlanSummary = summarizeQueryPlan(qAny)\n        // Fold `.wherePredicate(name, ctx)` references into the plan\n        // summary so predicate function or ctx changes (signalled by\n        // bumping `hash` or supplying a different ctx) propagate into\n        // `queryHash` and force refresh on next visit.\n        const predicateRefs = extractPredicateRefs(qAny._plan())\n        if (predicateRefs.length > 0) {\n          queryPlanSummary = JSON.stringify({ plan: queryPlanSummary, predicates: predicateRefs })\n        }\n        // If `sources` is ALSO declared, take the union (consumer's\n        // explicit list extends the auto-analyzed set).\n        if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      } else {\n        // Aggregate shape: require explicit `sources`.\n        if (!spec.sources || spec.sources.length === 0) {\n          throw new Error(\n            `withMaterializedView \"${spec.name}\": query() returned an aggregate ` +\n              `(Reduction or GroupedReduction) but no \\`sources\\` field is declared. ` +\n              `The dependency analyzer cannot walk through groupBy().aggregate() ` +\n              `back to the source — declare sources: [...] explicitly.`,\n          )\n        }\n        dependencies = new Set(spec.sources)\n        // Aggregate plans don't carry a chainable query plan for summary\n        // purposes; the dep-set + spec.name serve as the queryHash inputs.\n        queryPlanSummary = JSON.stringify({ aggregate: true, sources: [...spec.sources].sort() })\n      }\n    }\n\n    // Sanity-check declared dependencies against the vault's known\n    // collections. Optional — when the checker isn't supplied (test\n    // wiring, in-process composition) the registration succeeds and\n    // any typo surfaces at first onSourceWrite as a no-op.\n    if (options?.knownCollections) {\n      for (const dep of dependencies) {\n        if (!options.knownCollections(dep)) {\n          throw new MaterializedViewSourceUnknownError(spec.name, dep)\n        }\n      }\n    }\n\n    const outputCollection = spec.output?.collection ?? spec.name\n    const queryHash = await computeQueryHash(spec.name, dependencies, queryPlanSummary)\n    // For same-collection-as-source MVs, capture the where-clauses on\n    // the partition field so cycle detection can prove disjointness.\n    // Only applicable to Query<T> shapes — aggregate MVs don't carry\n    // a chainable plan to inspect (and same-collection aggregation\n    // doesn't make sense for same-collection aggregation).\n    const partitionClauses: FieldClause[] = []\n    const partitionField = spec.output?.partition?.field\n    if (partitionField !== undefined && isQuery) {\n      const plan = qAny._plan()\n      for (const clause of plan.clauses) {\n        if (isFieldClauseOnField(clause, partitionField)) partitionClauses.push(clause)\n      }\n    }\n    // #638 Task 2 — 'aggregate' only for the explicit-sources aggregate shape\n    // (groupBy().aggregate() with no chainable plan); a row-per-source-row\n    // Query<T>, unionSources, or projection MV is 'record'.\n    const grain: Grain = spec.unionSources || spec.projection || isQuery ? 'record' : 'aggregate'\n    const reg: RegisteredMV = { spec, outputCollection, dependencies, queryHash, partitionClauses, grain }\n\n    this._byName.set(spec.name, reg)\n    for (const dep of dependencies) {\n      const arr = this._bySource.get(dep)\n      if (arr) arr.push(reg)\n      else this._bySource.set(dep, [reg])\n    }\n    if (pendingForwardFields.length > 0) {\n      // Non-constructive ref-registry probe: the Vault (the real\n      // MVQueryContext) carries its RefRegistry as a private field,\n      // reachable structurally at runtime. Test stubs without one simply\n      // never resolve — forward deps then come only from explicit `sources`.\n      const refRegistry = (db as unknown as {\n        refRegistry?: { getOutbound(collection: string): Record<string, { target: string }> }\n      }).refRegistry\n      const projectionSpec = spec.projection!\n      const resolveRef = (c: string, f: string): { target: string } | null =>\n        refRegistry?.getOutbound(c)[f] ?? null\n      this._pendingForwardDeps.push({\n        reg,\n        aliases: new Set(pendingForwardFields),\n        resolveTarget: (alias) => {\n          const leg = projectionSpec.joins.find(l => l.as === alias)\n          if (!leg || isCollectLeg(leg)) return null\n          // Walks the `from` chain — every hop needs its own ref declared, so a\n          // two-hop leg simply resolves one dispatch later than a one-hop one.\n          return resolveForwardLegTarget(leg, projectionSpec.joins, projectionSpec.source, resolveRef)\n        },\n      })\n      // Immediate attempt — covers refs already declared by the time\n      // this MV registers (re-registration flows, test wiring).\n      this._resolvePendingForwardDeps()\n    }\n  }\n\n  /**\n   * `true` while any query-form strategy is still unplanned (#1139). Read by\n   * `Collection._txAtomicSafe`, which must refuse the atomic write path while\n   * this holds — see the `_pendingPlans` doc comment for why.\n   */\n  hasPendingPlans(): boolean {\n    return this._pendingPlans.length > 0\n  }\n\n  /**\n   * Replan every parked query-form strategy (#1139). Called at the head of both\n   * write dispatchers and of `vault.refreshView()`, so a strategy resolves on the\n   * first write or refresh after its source collection's refs are declared —\n   * which is the earliest moment it could produce a correct plan, and strictly\n   * before the first moment it could have any output to produce.\n   *\n   * Each entry is handed straight back to {@link register}, so a strategy that\n   * is STILL unplannable simply re-parks itself and the next dispatch tries\n   * again. Idempotent and cheap: the array empties as strategies resolve, and\n   * both callers skip the await entirely once it is empty.\n   *\n   * A late-resolved strategy does NOT retro-feed `edges()` — the unified cycle\n   * pass runs once at vault open, before refs exist. Same caveat, and the same\n   * reason, as a late-resolved forward-leg target.\n   */\n  async resolvePendingPlans(): Promise<void> {\n    if (this._pendingPlans.length === 0) return\n    // Splice first: `register` re-parks anything still unplannable, and reading\n    // a live array it is concurrently pushing to would loop.\n    const parked = this._pendingPlans.splice(0)\n    for (const entry of parked) {\n      await this.register(entry.spec, entry.db, entry.options)\n    }\n  }\n\n  /** All MVs that depend on `source`, in registration order. */\n  mvsForSource(source: string): ReadonlyArray<RegisteredMV> {\n    if (this._pendingForwardDeps.length > 0) this._resolvePendingForwardDeps()\n    return this._bySource.get(source) ?? []\n  }\n\n  /**\n   * Retry ref() resolution for every pending projection forward leg\n   * (#810). A field resolves once its source collection's refs have\n   * been declared; the target then folds into the owning MV's\n   * dependency set and `_bySource`, so subsequent writes to it\n   * dispatch a refresh. Idempotent and cheap — the pending list\n   * empties as fields resolve, and `mvsForSource` skips the call\n   * entirely once it's empty.\n   *\n   * Late-resolved targets do NOT retro-feed `edges()` — the cycle\n   * pass runs once at vault open, before refs exist. A cycle routed\n   * exclusively through a forward leg is therefore not detected at\n   * open (collect + source edges, the literal names, are).\n   */\n  private _resolvePendingForwardDeps(): void {\n    for (let i = this._pendingForwardDeps.length - 1; i >= 0; i--) {\n      const entry = this._pendingForwardDeps[i]!\n      for (const alias of [...entry.aliases]) {\n        const target = entry.resolveTarget(alias)\n        if (target === null) continue\n        entry.aliases.delete(alias)\n        if (entry.reg.dependencies.has(target)) continue\n        // `dependencies` is declared ReadonlySet for consumers; the\n        // registry owns the underlying Set and is the one writer.\n        ;(entry.reg.dependencies as Set<string>).add(target)\n        const arr = this._bySource.get(target)\n        if (arr) arr.push(entry.reg)\n        else this._bySource.set(target, [entry.reg])\n      }\n      if (entry.aliases.size === 0) this._pendingForwardDeps.splice(i, 1)\n    }\n  }\n\n  /** Single MV by name, or `undefined`. */\n  byName(name: string): RegisteredMV | undefined {\n    return this._byName.get(name)\n  }\n\n  /** Iterate over every registered MV. */\n  all(): ReadonlyArray<RegisteredMV> {\n    return [...this._byName.values()]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'mv'` edge per registered MV — target\n   * = the output collection (a `WHOLE_RECORD` artifact node), sources =\n   * every dependency (also `WHOLE_RECORD` nodes). Same-collection edges\n   * (`dep === outputCollection`) are skipped IFF the MV declares an\n   * `output.partition` discriminator AND the query has a where-clause that\n   * provably excludes the partition value (`partitionDisjoint`) — the SAME\n   * condition the old local DFS used. Grain comes from the registration-time\n   * `RegisteredMV.grain`.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this._byName.values()) {\n      const sources: FieldRef[] = []\n      for (const dep of reg.dependencies) {\n        if (dep === reg.outputCollection && partitionDisjoint(reg)) continue\n        sources.push({ collection: dep, field: WHOLE_RECORD })\n      }\n      if (sources.length === 0) continue\n      out.push({ target: { collection: reg.outputCollection, field: WHOLE_RECORD }, sources, kind: 'mv', grain: reg.grain })\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). `graph` is the caller's shared per-vault graph,\n   * ALREADY carrying this registry's `edges()` AND `DerivationRegistry`'s\n   * (registered by the caller — see `Vault._initMaterializedViews`, which\n   * runs after `_initDerivations`, so a pure-derivation cycle already threw\n   * `DerivationCycleError` there; any cycle surfacing here necessarily\n   * touches an MV edge). Throws `MaterializedViewCycleError` — SAME class as\n   * before.\n   */\n  validate(graph: ViaGraph): void {\n    graph.assertAcyclic()\n  }\n}\n\n/**\n * Type guard: is the clause a top-level `FieldClause` on the given\n * field? Used by the partition-disjoint check.\n *\n * @internal\n */\nfunction isFieldClauseOnField(clause: Clause, field: string): clause is FieldClause {\n  return clause.type === 'field' && clause.field === field\n}\n\n/**\n * Wrap an `MVQueryContext` so its `.collection().query()` returns a\n * Query<T> with the MV's declared predicates attached. Bare Queries\n * (outside of any MV) don't gain `.wherePredicate()` — only Queries\n * obtained through this wrapped db do.\n *\n * @internal\n */\nexport function wrapDbWithPredicates(\n  db: MVQueryContext,\n  predicates: NonNullable<MaterializedViewSpec<Record<string, unknown>>['predicates']>,\n): MVQueryContext {\n  // Build the predicate map once — the fn signature in the MV spec\n  // is row-typed but the QueryBuilder casts to unknown, so we widen\n  // here for the Map.\n  const map = new Map<string, DeclaredPredicate>()\n  for (const [name, decl] of Object.entries(predicates)) {\n    map.set(name, {\n      hash: decl.hash,\n      fn: decl.fn as (record: unknown, ctx?: unknown) => boolean,\n    })\n  }\n  return {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    collection<T extends Record<string, unknown>>(name: string): any {\n      const c = db.collection<T>(name)\n      // Return an object that delegates everything to `c` but\n      // overrides `.query()` to attach predicates via the new\n      // `Query._withPredicates()` accessor.\n      return new Proxy(c, {\n        get(target, prop, receiver) {\n          if (prop === 'query') {\n            return (...args: unknown[]) => {\n              // eslint-disable-next-line @typescript-eslint/no-explicit-any\n              const q = (target.query as any)(...args)\n              // For non-aggregate Query<T>, attach predicates. For\n              // legacy predicate-arg overload that returns T[] (sync\n              // filter), pass through unchanged.\n               \n              if (q && typeof q._withPredicates === 'function') {\n                return q._withPredicates(map)\n              }\n              return q\n            }\n          }\n          return Reflect.get(target, prop, receiver)\n        },\n      })\n    },\n  }\n}\n\n/**\n * Walk a QueryPlan's clauses and collect predicate-reference markers\n * for `queryHash` derivation. Returns a sorted array (deterministic\n * order) of `{ name, predicateHash, ctxHash }` tuples — these are the\n * hashable identity of each `.wherePredicate()` call site.\n *\n * @internal\n */\nfunction extractPredicateRefs(\n  plan: { clauses: readonly Clause[] },\n): Array<{ name: string; predicateHash: string; ctxHash: string }> {\n  const refs: Array<{ name: string; predicateHash: string; ctxHash: string }> = []\n  const walk = (clauses: readonly Clause[]): void => {\n    for (const c of clauses) {\n      if (c.type === 'wherePredicate') {\n        refs.push({ name: c.name, predicateHash: c.predicateHash, ctxHash: c.ctxHash })\n      } else if (c.type === 'group') {\n        walk(c.clauses)\n      }\n    }\n  }\n  walk(plan.clauses)\n  // Stable-sort by (name, predicateHash, ctxHash) — same predicate\n  // appearing twice with different ctx hashes both flow through.\n  refs.sort((a, b) => {\n    if (a.name !== b.name) return a.name < b.name ? -1 : 1\n    if (a.predicateHash !== b.predicateHash) return a.predicateHash < b.predicateHash ? -1 : 1\n    return a.ctxHash < b.ctxHash ? -1 : a.ctxHash > b.ctxHash ? 1 : 0\n  })\n  return refs\n}\n\n/**\n * Provability check for the same-collection partition-discriminator.\n * Returns `true` when\n * the captured partition clauses on the MV's query provably exclude\n * the partition's value — meaning the input filter and the output\n * partition are disjoint and the same-collection edge isn't really a\n * cycle.\n *\n * Supported provability shapes (narrow on purpose — DERIV-PP30-001\n * is the load-bearing case):\n *\n * - `.where(field, '==', X)` where X !== partition.value → disjoint\n * - `.where(field, '!=', partition.value)` → disjoint\n * - `.where(field, 'in', [...])` where partition.value NOT in list → disjoint\n *\n * Anything else (no clause on the partition field, an 'in' list that\n * contains partition.value, unsupported operators) → not disjoint,\n * the cycle detector surfaces `MaterializedViewCycleError`.\n *\n * @internal\n */\nfunction partitionDisjoint(reg: RegisteredMV): boolean {\n  const partition = reg.spec.output?.partition\n  if (partition === undefined) return false\n  const value = partition.value\n  // The OR-semantics of multiple where-clauses on the same field\n  // would muddy this check. v2 only treats AND-chained clauses;\n  // any clause that proves disjoint is sufficient.\n  for (const c of reg.partitionClauses) {\n    if (c.op === '==' && c.value !== value) return true\n    if (c.op === '!=' && c.value === value) return true\n    if (c.op === 'in' && Array.isArray(c.value)) {\n      const list = c.value as readonly unknown[]\n      if (!list.includes(value)) return true\n    }\n  }\n  return false\n}\n"],"mappings":";;;;;;;;;;AAwBO,SAAS,oBAAoB,OAAgC;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAO,MAAM,MAAM;AACzB,QAAM,MAAM,MAAM,aAAa;AAG/B,MAAI,KAAK,gBAAgB;AACvB,SAAK,IAAI,IAAI,cAAc;AAAA,EAC7B;AAGA,aAAW,OAAO,KAAK,OAAO;AAC5B,SAAK,IAAI,IAAI,MAAM;AAAA,EACrB;AAIA,aAAW,UAAU,KAAK,SAAS;AACjC,QAAI,OAAO,SAAS,aAAa;AAC/B,WAAK,IAAI,OAAO,MAAM;AAAA,IACxB;AAAA,EACF;AAKA,sBAAoB,MAAM,MAAM,GAAG;AAEnC,SAAO;AACT;AAEA,SAAS,oBACP,MACA,MACA,KACM;AACN,OAAK;AAIL,aAAW,UAAU,KAAK,SAAS;AACjC,QAAI,OAAO,SAAS,SAAS;AAAA,IAI7B;AAAA,EACF;AACF;AAaO,SAAS,mBAAmB,OAA2B;AAC5D,QAAM,OAAO,MAAM,MAAM;AACzB,QAAM,MAAM,MAAM,aAAa;AAC/B,SAAO,KAAK,UAAU;AAAA,IACpB,MAAM,KAAK,kBAAkB;AAAA,IAC7B,SAAS,KAAK,QAAQ,IAAI,OAAK;AAC7B,UAAI,EAAE,SAAS,aAAa;AAC1B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,EAAE;AAAA,UACV,IAAI,EAAE;AAAA;AAAA,UAEN,iBAAiB,EAAE,oBAAoB,EAAE,KAAK,aAAa;AAAA,UAC3D,SAAS,EAAE,WAAW;AAAA;AAAA;AAAA,UAGtB,OAAO,EAAE,SAAS;AAAA,QACpB;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IACD,SAAS,KAAK;AAAA,IACd,OAAO,KAAK,SAAS;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK,MAAM,IAAI,QAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,IAAI,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK,EAAE;AAAA,EAC3F,CAAC;AACH;AA0BO,SAAS,mBACd,MACQ;AACR,SAAO,SAAS,mBAAmB,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC;AACzE;AAoBO,SAAS,wBACd,MACQ;AACR,QAAM,aAAa,KAAK;AACxB,QAAM,OAAO,WAAW,MACrB,IAAI,SAAO;AAIV,UAAM,KAAK,IAAI,SAAS,SAAY,IAAI,IAAI,IAAI,KAAK;AACrD,WAAO,aAAa,MAChB,UAAU,EAAE,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,SAAI,IAAI,EAAE,KAC/C,QAAQ,EAAE,IAAI,IAAI,KAAK,SAAI,IAAI,EAAE;AAAA,EACvC,CAAC,EACA,KAAK;AACR,QAAM,OAAO,KAAK,UAAU,EAAE,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAC/D,SAAO,cAAc,IAAI,IAAI,sBAAsB,IAAI,CAAC;AAC1D;AAGA,SAAS,mBACP,MACQ;AACR,UAAQ,KAAK,gBAAgB,CAAC,GAC3B,IAAI,OAAK;AAKR,UAAM,QAAQ,EAAE,MAAM,SAClB,IAAI,EAAE,KAAK,IAAI,OAAK,GAAG,EAAE,KAAK,SAAI,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,MACnD;AACJ,WAAO,GAAG,EAAE,UAAU,GAAG,KAAK;AAAA,EAChC,CAAC,EACA,KAAK,GAAG;AACb;AAOA,SAAS,sBACP,MACQ;AACR,QAAM,UAAkB,MAAM,QAAQ,KAAK,OAAO,IAC9C,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,IACjC,OAAO,KAAK,YAAY,WACtB,KAAK,UACL;AACN,QAAM,UAAU,KAAK,YAAY,OAAO,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;AAKhF,QAAM,YAAY,KAAK,cAAc,OAAO,KAAK,KAAK,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;AACtF,SAAO,YAAY,OAAO,eAAe,OAAO,WAAW,SAAS;AACtE;;;AC7MA,eAAsB,iBACpB,QAKA,cAQA,kBACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;AAUO,SAAS,sBAAsB,MAAuB;AAC3D,SAAO,KAAK,UAAU,MAAM,CAAC,MAAM,UAAU;AAC3C,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,SAAkC,CAAC;AACzC,iBAAW,KAAK,OAAO,KAAK,KAAgC,EAAE,KAAK,GAAG;AACpE,eAAO,CAAC,IAAK,MAAkC,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACH;;;AC9BO,SAAS,aACd,KACwD;AACxD,SAAO,aAAa;AACtB;AAUO,SAAS,uBACd,QACA,YACM;AAIN,QAAM,OAAO,oBAAI,IAA+B;AAChD,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,IAAI,SAAS,QAAW;AAC1B,YAAM,SAAS,KAAK,IAAI,IAAI,IAAI;AAChC,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,qBAAqB,IAAI,IAAI,oMAG9D,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,QACjE;AAAA,MACF;AACA,UAAI,aAAa,MAAM,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,qBAAqB,IAAI,IAAI,WAAW,IAAI,IAAI,sNAGzC,WAAW,MAAM;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,SAAK,IAAI,IAAI,IAAI,GAAG;AAAA,EACtB;AACF;AAiBO,SAAS,gBACd,KACA,OACA,QACA,YACe;AACf,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,SAAS,MAAM,KAAK,OAAK,EAAE,OAAO,IAAI,IAAI;AAChD,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,aAAa,MAAM,EAAG,QAAO,OAAO;AACxC,QAAM,cAAc,gBAAgB,QAAQ,OAAO,QAAQ,UAAU;AACrE,MAAI,gBAAgB,KAAM,QAAO;AACjC,SAAO,WAAW,aAAa,OAAO,KAAK,GAAG,UAAU;AAC1D;AAMO,SAAS,wBACd,KACA,OACA,QACA,YACe;AACf,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,UAAU;AAC5D,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,WAAW,OAAO,IAAI,KAAK,GAAG,UAAU;AACjD;;;ACpGA,IAAM,eAAe;AAsCd,IAAM,2BAAN,MAA+B;AAAA;AAAA,EAEnB,UAAU,oBAAI,IAA0B;AAAA;AAAA,EAExC,YAAY,oBAAI,IAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAc5C,sBAOZ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BW,gBAKZ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaN,MAAM,SAEJ,MACA,IACA,SACe;AAKf,UAAM,aAAa,KAAK,aAAa,qBAAqB,IAAI,KAAK,UAAU,IAAI;AAYjF,QAAI;AACJ,QAAI;AAEJ,QAAI,OAAY;AAChB,QAAI,UAAU;AAId,UAAM,uBAAiC,CAAC;AACxC,QAAI,KAAK,cAAc;AACrB,qBAAe,IAAI,IAAI,KAAK,aAAa,IAAI,OAAK,EAAE,UAAU,CAAC;AAK/D,UAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAClE,yBAAmB,mBAAmB,IAAI;AAAA,IAC5C,WAAW,KAAK,YAAY;AAO1B,YAAM,aAAa,KAAK;AACxB,qBAAe,oBAAI,IAAI,CAAC,WAAW,MAAM,CAAC;AAC1C,iBAAW,OAAO,WAAW,OAAO;AAIlC,YAAI,aAAa,GAAG,EAAG,cAAa,IAAI,IAAI,OAAO;AAAA,YAC9C,sBAAqB,KAAK,IAAI,EAAE;AAAA,MACvC;AACA,UAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAClE,yBAAmB,wBAAwB,IAAI;AAAA,IACjD,OAAO;AAEL,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAO,UAAU;AAAA,MAC5B,SAAS,GAAG;AAGV,YAAI,EAAE,aAAa,qBAAsB,OAAM;AAC/C,aAAK,cAAc,KAAK,EAAE,MAAM,IAAI,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AACnF;AAAA,MACF;AACA,aAAO;AACP,gBAAU,OAAO,KAAK,UAAU;AAChC,UAAI,SAAS;AAIX,uBAAe,oBAAoB,IAAI;AACvC,2BAAmB,mBAAmB,IAAI;AAK1C,cAAM,gBAAgB,qBAAqB,KAAK,MAAM,CAAC;AACvD,YAAI,cAAc,SAAS,GAAG;AAC5B,6BAAmB,KAAK,UAAU,EAAE,MAAM,kBAAkB,YAAY,cAAc,CAAC;AAAA,QACzF;AAGA,YAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAAA,MACpE,OAAO;AAEL,YAAI,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,GAAG;AAC9C,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UAIpC;AAAA,QACF;AACA,uBAAe,IAAI,IAAI,KAAK,OAAO;AAGnC,2BAAmB,KAAK,UAAU,EAAE,WAAW,MAAM,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,MAC1F;AAAA,IACF;AAMA,QAAI,SAAS,kBAAkB;AAC7B,iBAAW,OAAO,cAAc;AAC9B,YAAI,CAAC,QAAQ,iBAAiB,GAAG,GAAG;AAClC,gBAAM,IAAI,mCAAmC,KAAK,MAAM,GAAG;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,QAAQ,cAAc,KAAK;AACzD,UAAM,YAAY,MAAM,iBAAiB,KAAK,MAAM,cAAc,gBAAgB;AAMlF,UAAM,mBAAkC,CAAC;AACzC,UAAM,iBAAiB,KAAK,QAAQ,WAAW;AAC/C,QAAI,mBAAmB,UAAa,SAAS;AAC3C,YAAM,OAAO,KAAK,MAAM;AACxB,iBAAW,UAAU,KAAK,SAAS;AACjC,YAAI,qBAAqB,QAAQ,cAAc,EAAG,kBAAiB,KAAK,MAAM;AAAA,MAChF;AAAA,IACF;AAIA,UAAM,QAAe,KAAK,gBAAgB,KAAK,cAAc,UAAU,WAAW;AAClF,UAAM,MAAoB,EAAE,MAAM,kBAAkB,cAAc,WAAW,kBAAkB,MAAM;AAErG,SAAK,QAAQ,IAAI,KAAK,MAAM,GAAG;AAC/B,eAAW,OAAO,cAAc;AAC9B,YAAM,MAAM,KAAK,UAAU,IAAI,GAAG;AAClC,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC;AAAA,IACpC;AACA,QAAI,qBAAqB,SAAS,GAAG;AAKnC,YAAM,cAAe,GAElB;AACH,YAAM,iBAAiB,KAAK;AAC5B,YAAM,aAAa,CAAC,GAAW,MAC7B,aAAa,YAAY,CAAC,EAAE,CAAC,KAAK;AACpC,WAAK,oBAAoB,KAAK;AAAA,QAC5B;AAAA,QACA,SAAS,IAAI,IAAI,oBAAoB;AAAA,QACrC,eAAe,CAAC,UAAU;AACxB,gBAAM,MAAM,eAAe,MAAM,KAAK,OAAK,EAAE,OAAO,KAAK;AACzD,cAAI,CAAC,OAAO,aAAa,GAAG,EAAG,QAAO;AAGtC,iBAAO,wBAAwB,KAAK,eAAe,OAAO,eAAe,QAAQ,UAAU;AAAA,QAC7F;AAAA,MACF,CAAC;AAGD,WAAK,2BAA2B;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,WAAO,KAAK,cAAc,SAAS;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,sBAAqC;AACzC,QAAI,KAAK,cAAc,WAAW,EAAG;AAGrC,UAAM,SAAS,KAAK,cAAc,OAAO,CAAC;AAC1C,eAAW,SAAS,QAAQ;AAC1B,YAAM,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,MAAM,OAAO;AAAA,IACzD;AAAA,EACF;AAAA;AAAA,EAGA,aAAa,QAA6C;AACxD,QAAI,KAAK,oBAAoB,SAAS,EAAG,MAAK,2BAA2B;AACzE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,6BAAmC;AACzC,aAAS,IAAI,KAAK,oBAAoB,SAAS,GAAG,KAAK,GAAG,KAAK;AAC7D,YAAM,QAAQ,KAAK,oBAAoB,CAAC;AACxC,iBAAW,SAAS,CAAC,GAAG,MAAM,OAAO,GAAG;AACtC,cAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAI,WAAW,KAAM;AACrB,cAAM,QAAQ,OAAO,KAAK;AAC1B,YAAI,MAAM,IAAI,aAAa,IAAI,MAAM,EAAG;AAGvC,QAAC,MAAM,IAAI,aAA6B,IAAI,MAAM;AACnD,cAAM,MAAM,KAAK,UAAU,IAAI,MAAM;AACrC,YAAI,IAAK,KAAI,KAAK,MAAM,GAAG;AAAA,YACtB,MAAK,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA,MAC7C;AACA,UAAI,MAAM,QAAQ,SAAS,EAAG,MAAK,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACpE;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,MAAwC;AAC7C,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,YAAM,UAAsB,CAAC;AAC7B,iBAAW,OAAO,IAAI,cAAc;AAClC,YAAI,QAAQ,IAAI,oBAAoB,kBAAkB,GAAG,EAAG;AAC5D,gBAAQ,KAAK,EAAE,YAAY,KAAK,OAAO,aAAa,CAAC;AAAA,MACvD;AACA,UAAI,QAAQ,WAAW,EAAG;AAC1B,UAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,IAAI,kBAAkB,OAAO,aAAa,GAAG,SAAS,MAAM,MAAM,OAAO,IAAI,MAAM,CAAC;AAAA,IACvH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,OAAuB;AAC9B,UAAM,cAAc;AAAA,EACtB;AACF;AAQA,SAAS,qBAAqB,QAAgB,OAAsC;AAClF,SAAO,OAAO,SAAS,WAAW,OAAO,UAAU;AACrD;AAUO,SAAS,qBACd,IACA,YACgB;AAIhB,QAAM,MAAM,oBAAI,IAA+B;AAC/C,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,QAAI,IAAI,MAAM;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,IAAI,KAAK;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AAAA;AAAA,IAEL,WAA8C,MAAmB;AAC/D,YAAM,IAAI,GAAG,WAAc,IAAI;AAI/B,aAAO,IAAI,MAAM,GAAG;AAAA,QAClB,IAAI,QAAQ,MAAM,UAAU;AAC1B,cAAI,SAAS,SAAS;AACpB,mBAAO,IAAI,SAAoB;AAE7B,oBAAM,IAAK,OAAO,MAAc,GAAG,IAAI;AAKvC,kBAAI,KAAK,OAAO,EAAE,oBAAoB,YAAY;AAChD,uBAAO,EAAE,gBAAgB,GAAG;AAAA,cAC9B;AACA,qBAAO;AAAA,YACT;AAAA,UACF;AACA,iBAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,SAAS,qBACP,MACiE;AACjE,QAAM,OAAwE,CAAC;AAC/E,QAAM,OAAO,CAAC,YAAqC;AACjD,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,SAAS,kBAAkB;AAC/B,aAAK,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,EAAE,eAAe,SAAS,EAAE,QAAQ,CAAC;AAAA,MAChF,WAAW,EAAE,SAAS,SAAS;AAC7B,aAAK,EAAE,OAAO;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,OAAK,KAAK,OAAO;AAGjB,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,QAAI,EAAE,kBAAkB,EAAE,cAAe,QAAO,EAAE,gBAAgB,EAAE,gBAAgB,KAAK;AACzF,WAAO,EAAE,UAAU,EAAE,UAAU,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI;AAAA,EAClE,CAAC;AACD,SAAO;AACT;AAuBA,SAAS,kBAAkB,KAA4B;AACrD,QAAM,YAAY,IAAI,KAAK,QAAQ;AACnC,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,QAAQ,UAAU;AAIxB,aAAW,KAAK,IAAI,kBAAkB;AACpC,QAAI,EAAE,OAAO,QAAQ,EAAE,UAAU,MAAO,QAAO;AAC/C,QAAI,EAAE,OAAO,QAAQ,EAAE,UAAU,MAAO,QAAO;AAC/C,QAAI,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC3C,YAAM,OAAO,EAAE;AACf,UAAI,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-7TSYBD3E.js → chunk-5263OEM3.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCycleError,
   MaterializedViewCycleError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 
 // src/kernel/via/graph.ts
 var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
@@ -341,4 +341,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-7TSYBD3E.js.map
+//# sourceMappingURL=chunk-5263OEM3.js.map

package/dist/{chunk-WFUIE565.js → chunk-57JTHWLQ.js}

@@ -1,13 +1,13 @@
 import {
   envelopePayloadHash
-} from "./chunk-6SAFL5YE.js";
+} from "./chunk-RC4BROYR.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YPYHVOXP.js";
+} from "./chunk-RK7N4OQ5.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 
 // src/via/lookup/handle.ts
 function isDeleteMarker(envelope) {
@@ -102,14 +102,17 @@ var LookupHandle = class {
         _by: this.keyring.userId
       };
     }
-    const envelope = await this.reservedEnvelopes.encrypt(this.collName, JSON.stringify(entry), version);
-    return { ...envelope, _by: this.keyring.userId };
+    return this.reservedEnvelopes.encrypt(
+      { collection: this.collName, id: entry.key, by: this.keyring.userId },
+      JSON.stringify(entry),
+      version
+    );
   }
-  async decryptEntry(envelope) {
+  async decryptEntry(key, envelope) {
     if (!this.encrypted) {
       return JSON.parse(envelope._data);
     }
-    const json = await this.reservedEnvelopes.decrypt(this.collName, envelope);
+    const json = await this.reservedEnvelopes.decrypt(this.collName, key, envelope);
     return JSON.parse(json);
   }
   /** @internal #650 Task 4 — re-read `key`'s CURRENT adapter truth into `_syncCache` (delete the
@@ -123,7 +126,7 @@ var LookupHandle = class {
       this._syncCache.delete(key);
       return;
     }
-    this._syncCache.set(key, await this.decryptEntry(envelope));
+    this._syncCache.set(key, await this.decryptEntry(key, envelope));
   }
   // ─── Public API ───────────────────────────────────────────────────
   /**
@@ -194,7 +197,7 @@ var LookupHandle = class {
       key
     );
     if (!envelope || isDeleteMarker(envelope)) return null;
-    const entry = await this.decryptEntry(envelope);
+    const entry = await this.decryptEntry(key, envelope);
     return entry.labels;
   }
   /**
@@ -224,7 +227,7 @@ var LookupHandle = class {
     }
     const nextVersion = existing._v + 1;
     if (this.onDirty) {
-      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker(nextVersion, this.keyring.userId));
+      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker({ collection: this.collName, id: key }, nextVersion, this.keyring.userId));
     } else {
       await this.adapter.delete(this.compartmentName, this.collName, key);
     }
@@ -280,7 +283,7 @@ var LookupHandle = class {
     if (!existing || isDeleteMarker(existing)) {
       throw new DictKeyMissingError(this.dictionaryName, oldKey);
     }
-    const oldEntry = await this.decryptEntry(existing);
+    const oldEntry = await this.decryptEntry(oldKey, existing);
     const newEntry = { key: newKey, labels: oldEntry.labels };
     const newEnvelope = await this.encryptEntry(newEntry, 1);
     await this.adapter.put(
@@ -295,7 +298,7 @@ var LookupHandle = class {
     }
     const oldKeyNextVersion = existing._v + 1;
     if (this.onDirty) {
-      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker(oldKeyNextVersion, this.keyring.userId));
+      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker({ collection: this.collName, id: oldKey }, oldKeyNextVersion, this.keyring.userId));
     } else {
       await this.adapter.delete(this.compartmentName, this.collName, oldKey);
     }
@@ -353,7 +356,7 @@ var LookupHandle = class {
         this._syncCache.delete(key);
         continue;
       }
-      const entry = await this.decryptEntry(envelope);
+      const entry = await this.decryptEntry(key, envelope);
       entries.push(entry);
       this._syncCache.set(key, entry);
     }
@@ -389,4 +392,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-WFUIE565.js.map
+//# sourceMappingURL=chunk-57JTHWLQ.js.map

package/dist/chunk-57JTHWLQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/lookup/handle.ts"],"sourcesContent":["/**\n * `_dict_*` reserved-collection storage engine — `LookupHandle`.\n *\n * Verbatim move of `DictionaryHandle` out of `via/i18n/dictionary.ts`\n * (#650 Task 1 — via-lookup extraction, phase D). The class is renamed to\n * `LookupHandle` (the dict tier is one backing kind the eventual lookup\n * layer supports); `via/i18n/dictionary.ts` re-exports it as\n * `DictionaryHandle` for one release so existing importers compile\n * unchanged. `DictEntry` / `DictionaryOptions` / `DICT_COLLECTION_PREFIX` /\n * `dictCollectionName` move with it — they were exclusively consumed by\n * this class's constructor/methods.\n *\n * No behavior change from the pre-move class: same encryption door\n * (`reservedEnvelopes('_dict_')`, #629 Task 4), same ACL, same ledger\n * shape, same sync-cache/snapshot contract for dict joins.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { ViaCryptoCtx } from '../../kernel/via/index.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport { envelopePayloadHash } from '../../with-commit/history/ledger/hash.js'\nimport {\n  PermissionDeniedError,\n  DictKeyMissingError,\n} from '../../kernel/errors.js'\n\n/**\n * Delete-marker predicate, duplicated (not imported) from\n * `kernel/enclave/record-keys/tombstone.ts`'s `isDeleteMarker` (#647 fix wave 1).\n * `via/lookup/**` may not statically import `kernel/enclave/` — not even the barrel\n * (Check 15, `via-enclave-isolation`) — and this predicate carries zero crypto/protected-body\n * surface (just the `_del` protocol-header field, not `_iv`/`_data`), so duplicating it here\n * mirrors the same call `port/with/i18n-strategy.ts` already makes for `isDictCollectionName`\n * (see its doc comment). Keep the two in sync if the marker shape ever changes.\n *\n * `buildDeleteMarker` (which DOES construct the protected `_iv`/`_data` body fields — Check 11,\n * `enclave-body-only`) can't be duplicated the same way; it's injected via the constructor\n * instead, built from the real `kernel/enclave` function at the Vault call site.\n */\nfunction isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/** Reserved collection name prefix. Never collides with user collections. */\nexport const DICT_COLLECTION_PREFIX = '_dict_'\n\n/** Return the adapter collection name for a named dictionary. */\nexport function dictCollectionName(dictionaryName: string): string {\n  return `${DICT_COLLECTION_PREFIX}${dictionaryName}`\n}\n\n// ─── Dictionary entry shape ────────────────────────────────────────────\n\n/**\n * One entry in a `_dict_*` collection. The record `id` (adapter-side\n * key) IS the stable dictionary key (e.g. `'paid'`). The `labels`\n * record maps locale codes to display strings.\n */\nexport interface DictEntry {\n  /** Stable key — same as the record id in the adapter. */\n  readonly key: string\n  /** Locale → label map, e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`. */\n  readonly labels: Record<string, string>\n}\n\n// ─── Per-dictionary options ────────────────────────────────────────────\n\n/**\n * Options for `vault.dictionary(name, options?)`.\n *\n * `writableBy` controls the minimum role for write operations (put,\n * putAll, delete, rename). Defaults to `'admin'` to match the standard\n * \"dictionary contents are owned by admins\" convention; set to\n * `'operator'` for user-editable dictionaries like custom tags.\n */\nexport interface DictionaryOptions {\n  /** Minimum role allowed to write dictionary entries. Default: `'admin'`. */\n  readonly writableBy?: 'owner' | 'admin' | 'operator'\n}\n\n// ─── LookupHandle ───────────────────────────────────────────────────────\n\n/**\n * Handle to a named dictionary within a vault.\n *\n * Obtained via `vault.dictionary(name)`. Provides strongly-typed\n * CRUD for dictionary entries, plus the `rename()` operation that is the\n * only sanctioned mass-mutation path for dictKey fields.\n *\n * All writes are encrypted under the compartment's DEK for the\n * `_dict_<name>` collection. Adapters never see plaintext.\n */\nexport class LookupHandle<Keys extends string = string> {\n  private readonly collName: string\n\n  /**\n   * Synchronous write-through cache for dict-join support.\n   * Populated on every `put()`, `delete()`, and `rename()`. The snapshot\n   * is built from this cache by `snapshotEntries()` — the query executor\n   * calls this synchronously inside `.toArray()`.\n   *\n   * `null` means \"not yet initialized\" — callers should use `list()`\n   * to warm the cache before using dict joins on pre-existing data.\n   */\n  private readonly _syncCache = new Map<string, DictEntry>()\n\n  /**\n   * Return all cached entries as `{ key, labels, ...labels }` records —\n   * usable synchronously by the join executor's `snapshot()` call.\n   * Returns an empty array when the cache has never been populated.\n   */\n  snapshotEntries(): readonly Record<string, unknown>[] {\n    return Array.from(this._syncCache.values()).map((e) => ({\n      key: e.key,\n      labels: e.labels,\n      ...e.labels,\n    }))\n  }\n\n  constructor(\n    private readonly adapter: NoydbStore,\n    private readonly compartmentName: string,\n    private readonly dictionaryName: string,\n    private readonly keyring: UnlockedKeyring,\n    /**\n     * The `reservedEnvelopes('_dict_')` capability — this handle's sanctioned\n     * crypto door onto its `_dict_<name>` collection (#629 Task 4). Bound by\n     * the Vault; never a keyring, raw DEK, or enclave import.\n     */\n    private readonly reservedEnvelopes: ReturnType<ViaCryptoCtx['reservedEnvelopes']>,\n    private readonly encrypted: boolean,\n    private readonly ledger: LedgerStore | undefined,\n    private readonly options: DictionaryOptions,\n    /**\n     * Callback provided by the Vault to find and rewrite records\n     * in any registered collection that has a dictKeyField pointing at\n     * this dictionary, used by `rename()`.\n     */\n    private readonly findAndUpdateReferences:\n      | ((\n          dictionaryName: string,\n          oldKey: string,\n          newKey: string,\n        ) => Promise<void>)\n      | undefined,\n    private readonly emitter: NoydbEventEmitter,\n    /**\n     * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier\n     * mirror of #589's ordinary-collection delete marker). Injected rather than imported:\n     * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and\n     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11\n     * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real\n     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.\n     */\n    private readonly buildDeleteMarker: (identity: { collection: string; id: string }, version: number, actor: string) => EncryptedEnvelope,\n    /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */\n    private readonly onDirty?: (collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>,\n    /** #650 Task 4 — thin `graphDispatch.collect`-equivalent; opens/collects/flushes a one-shot wave for this touch. */\n    private readonly onRecordMutated?: (collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>,\n    /** #650 Task 5 (#648) — the real reference check `delete()`'s strict branch calls: restrict\n     *  throws `DictKeyInUseError`, cascade/nullify apply their propagation. Vault-bound; a no-op\n     *  when the dimension has no declared lookup-referencing edges. */\n    private readonly checkReferencesOnDelete?: (key: string) => Promise<unknown>,\n  ) {\n    this.collName = dictCollectionName(dictionaryName)\n  }\n\n  // ─── Access checks ────────────────────────────────────────────────\n\n  private requireWriteAccess(): void {\n    const minRole = this.options.writableBy ?? 'admin'\n    const roleRank: Record<string, number> = {\n      client: 1,\n      viewer: 2,\n      operator: 3,\n      admin: 4,\n      owner: 5,\n    }\n    const callerRank = roleRank[this.keyring.role] ?? 0\n    const requiredRank = roleRank[minRole] ?? 4\n    if (callerRank < requiredRank) {\n      throw new PermissionDeniedError(\n        `Dictionary \"${this.dictionaryName}\" writes require \"${minRole}\" role or above. ` +\n          `Current role: \"${this.keyring.role}\".`,\n      )\n    }\n  }\n\n  // ─── Internal helpers ─────────────────────────────────────────────\n\n  private async encryptEntry(entry: DictEntry, version: number): Promise<EncryptedEnvelope> {\n    if (!this.encrypted) {\n      // Plaintext/debug vault: no AEAD, therefore no AAD to bind — this literal\n      // has nothing `buildRecordEnvelope` could authenticate, and `via/lookup/**`\n      // may not import `kernel/enclave/` to reach it anyway (Check 15,\n      // `via-enclave-isolation`). The ENCRYPTED branch below is the one that\n      // matters, and it is bound: `reservedEnvelopes.encrypt` holds the DEK, so\n      // it is where identity AAD is applied (#1051).\n      return {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: version,\n        _ts: new Date().toISOString(),\n        _iv: '',\n        _data: JSON.stringify(entry),\n        _by: this.keyring.userId,\n      }\n    }\n    // `entry.key` IS the record id this envelope is stored under. `_by` goes\n    // IN, not on afterwards: stamping it on the returned envelope would leave\n    // it outside the AAD the door just sealed (#1041).\n    return this.reservedEnvelopes.encrypt(\n      { collection: this.collName, id: entry.key, by: this.keyring.userId },\n      JSON.stringify(entry),\n      version,\n    )\n  }\n\n  private async decryptEntry(key: string, envelope: EncryptedEnvelope): Promise<DictEntry> {\n    if (!this.encrypted) {\n      return JSON.parse(envelope._data) as DictEntry\n    }\n    // `key` IS the record id this envelope is stored under, and the identity the\n    // writer sealed it against (#1041).\n    const json = await this.reservedEnvelopes.decrypt(this.collName, key, envelope)\n    return JSON.parse(json) as DictEntry\n  }\n\n  /** @internal #650 Task 4 — re-read `key`'s CURRENT adapter truth into `_syncCache` (delete the\n   *  cache entry when the key is now gone). Called by `Vault._invalidateSyncApplied` after a\n   *  reserved-lookup row applies via sync, so an already-warmed snapshot/membership/altIndex read\n   *  never sees a stale verdict for a pulled vocabulary edit — the same invalidation a local\n   *  put()/delete()/rename() already triggers via `_syncCache.set`/`delete` above. */\n  async _refreshSyncCache(key: string): Promise<void> {\n    const envelope = await this.adapter.get(this.compartmentName, this.collName, key)\n    if (!envelope || isDeleteMarker(envelope)) { this._syncCache.delete(key); return }\n    this._syncCache.set(key, await this.decryptEntry(key, envelope))\n  }\n\n  // ─── Public API ───────────────────────────────────────────────────\n\n  /**\n   * Add or overwrite a single dictionary entry.\n   *\n   * @param key    The stable key to store (e.g. `'paid'`).\n   * @param labels Locale → label map (e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`).\n   */\n  async put(key: Keys, labels: Record<string, string>): Promise<void> {\n    this.requireWriteAccess()\n\n    const entry: DictEntry = { key, labels }\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    const version = existing ? existing._v + 1 : 1\n    const envelope = await this.encryptEntry(entry, version)\n\n    await this.adapter.put(\n      this.compartmentName,\n      this.collName,\n      key,\n      envelope,\n      existing ? existing._v : undefined,\n    )\n\n    // Maintain synchronous cache for dict-join snapshot\n    this._syncCache.set(key, entry)\n\n    // #650 Task 4 (#647) — choke-point participation: dirty-log tracking BEFORE the emit (mirrors\n    // Collection._onRecordMutated's local-write order), then the wave-open hook AFTER.\n    await this.onDirty?.(this.collName, key, 'put', version)\n\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: key,\n      action: 'put',\n    })\n\n    await this.onRecordMutated?.(this.collName, key, 'put', version)\n\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'put',\n        collection: this.collName,\n        id: key,\n        version,\n        actor: this.keyring.userId,\n        //  — must be the real envelope hash so\n        // vault.verifyBackupIntegrity()'s data-cross-check matches.\n        payloadHash: await envelopePayloadHash(envelope),\n      })\n    }\n  }\n\n  /**\n   * Batch-add or overwrite multiple dictionary entries in one call.\n   *\n   * @param entries  `{ key: { locale: label } }` map.\n   */\n  async putAll(entries: Record<Keys, Record<string, string>>): Promise<void> {\n    this.requireWriteAccess()\n    for (const [key, labels] of Object.entries(entries) as [Keys, Record<string, string>][]) {\n      await this.put(key, labels)\n    }\n  }\n\n  /**\n   * Load the label map for a single key.\n   *\n   * @returns The label map, or `null` if the key doesn't exist.\n   */\n  async get(key: Keys): Promise<Record<string, string> | null> {\n    const envelope = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    if (!envelope || isDeleteMarker(envelope)) return null\n    const entry = await this.decryptEntry(key, envelope)\n    return entry.labels\n  }\n\n  /**\n   * Delete a dictionary key.\n   *\n   * Default mode is `'strict'` — throws `DictKeyInUseError` if any\n   * registered collection has a record referencing this key. Pass\n   * `{ mode: 'warn' }` to skip the check (dev-mode cleanup only).\n   *\n   * Under sync, deletion writes a version-ordered delete-marker row rather than removing the\n   * adapter key outright (#647 fix wave 1) — markers accumulate over time; GC is future work,\n   * acceptable for vocabulary-scale data.\n   */\n  async delete(key: Keys, opts: { mode?: 'strict' | 'warn' } = {}): Promise<void> {\n    this.requireWriteAccess()\n\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    if (!existing || isDeleteMarker(existing)) {\n      throw new DictKeyMissingError(this.dictionaryName, key)\n    }\n\n    // #650 Task 5 (#648) — the real reference check: restrict throws `DictKeyInUseError` naming\n    // the referencing collection, cascade/nullify apply their propagation. `mode: 'warn'` skips\n    // this entirely (today's dev-mode-cleanup escape hatch, unconditional delete). A dimension\n    // with no declared lookup-referencing edges is a no-op (undeclared refs keep dangling).\n    const mode = opts.mode ?? 'strict'\n    if (mode === 'strict') {\n      await this.checkReferencesOnDelete?.(key)\n    }\n\n    // #647 fix wave 1 — mirrors Collection._doDelete's identical `this.onDirty`-gated branch\n    // (#589): under sync, a raw adapter.delete() is invisible to a peer's next pull (the key\n    // simply stops appearing in remote.list()) — a deleted key never propagates and can be\n    // silently resurrected by a later edit. Write a version-ordered DELETE-MARKER instead, so\n    // the removal round-trips like any other row. No-op (plain adapter.delete) when sync isn't wired.\n    const nextVersion = existing._v + 1\n    if (this.onDirty) {\n      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker({ collection: this.collName, id: key }, nextVersion, this.keyring.userId))\n    } else {\n      await this.adapter.delete(this.compartmentName, this.collName, key)\n    }\n\n    // Maintain synchronous cache for dict-join snapshot\n    this._syncCache.delete(key)\n\n    // #650 Task 4 (#647) — same choke-point ordering as put() above.\n    // #647 fix wave 1: the dirty entry's ACTION is 'put' (not 'delete') — mirrors\n    // Collection._onRecordMutated's 'local-delete' case exactly: the marker rides push's\n    // CAS-put path, not push's raw remote.delete() path (which would strip the marker off the\n    // remote too and reopen this same hole). The version is the MARKER's version, so push's CAS\n    // (expectedVersion = entry.version - 1) matches the pre-delete remote copy.\n    await this.onDirty?.(this.collName, key, 'put', nextVersion)\n\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: key,\n      action: 'delete',\n    })\n\n    await this.onRecordMutated?.(this.collName, key, 'delete', nextVersion)\n\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'delete',\n        collection: this.collName,\n        id: key,\n        version: existing._v,\n        actor: this.keyring.userId,\n        //  — for delete the prior envelope is what was just\n        // removed; we hash it so the chain captures intent. The\n        // verifyBackupIntegrity data-cross-check skips delete\n        // entries entirely (the live record is gone), but the\n        // chain still benefits from a stable non-empty hash.\n        payloadHash: await envelopePayloadHash(existing),\n      })\n    }\n  }\n\n  /**\n   * Rename a dictionary key — the only sanctioned mass-mutation path.\n   *\n   * Atomically:\n   * 1. Adds the new key with the same labels as the old key.\n   * 2. Updates every registered record that stores the old key to\n   *    store the new key instead.\n   * 3. Deletes the old key.\n   * 4. Appends a single ledger entry recording the rename.\n   *\n   * Respects ACL: throws `PermissionDeniedError` before any mutation\n   * if the caller can't write. The cascade is best-effort atomic\n   * within this call — no two-phase commit across adapter calls.\n   *\n   * Cascade-on-delete is NOT supported. Use `rename()` when you need\n   * to change a key that records reference.\n   */\n  async rename(oldKey: Keys, newKey: string): Promise<void> {\n    this.requireWriteAccess()\n\n    // 1. Load old entry\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      oldKey,\n    )\n    if (!existing || isDeleteMarker(existing)) {\n      throw new DictKeyMissingError(this.dictionaryName, oldKey)\n    }\n    const oldEntry = await this.decryptEntry(oldKey, existing)\n\n    // 2. Write new key\n    const newEntry: DictEntry = { key: newKey, labels: oldEntry.labels }\n    const newEnvelope = await this.encryptEntry(newEntry, 1)\n    await this.adapter.put(\n      this.compartmentName,\n      this.collName,\n      newKey,\n      newEnvelope,\n    )\n\n    // #670 — publish newKey to the sync cache BEFORE step 3 rewrites referencing records: a\n    // vocabulary:'closed' referencing field's enforceWrite reads checkLookupMembership ->\n    // snapshotEntries() -> this._syncCache, so if newKey isn't a member yet, step 3's own write of\n    // newKey into those records self-refuses with UnknownLookupKeyError. Transition semantics:\n    // mid-rename BOTH oldKey and newKey are legitimately members (records are transitioning\n    // old->new during the rewrite) — oldKey stays a member until its removal completes below.\n    this._syncCache.set(newKey, newEntry)\n\n    // 3. Update all referencing records in registered collections\n    if (this.findAndUpdateReferences) {\n      await this.findAndUpdateReferences(this.dictionaryName, oldKey, newKey)\n    }\n\n    // 4. Remove old key — #647 fix wave 1: same delete-marker convention as delete() above, so\n    // the old key's removal propagates on sync instead of leaving a phantom stale row on a peer\n    // that only observes the new key arriving.\n    const oldKeyNextVersion = existing._v + 1\n    if (this.onDirty) {\n      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker({ collection: this.collName, id: oldKey }, oldKeyNextVersion, this.keyring.userId))\n    } else {\n      await this.adapter.delete(this.compartmentName, this.collName, oldKey)\n    }\n\n    // Maintain synchronous cache for dict-join snapshot — oldKey's removal from the cache lands\n    // here (after step 3), completing the old->new membership transition begun above.\n    this._syncCache.delete(oldKey)\n\n    // #650 Task 4 (#647) — same choke-point ordering as put()/delete() above, for BOTH touches.\n    // #647 fix wave 1: oldKey's dirty action is 'put' (not 'delete') — see delete()'s comment\n    // above for why the marker must ride push's CAS-put path, at the marker's version.\n    await this.onDirty?.(this.collName, oldKey, 'put', oldKeyNextVersion)\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: oldKey,\n      action: 'delete',\n    })\n    await this.onRecordMutated?.(this.collName, oldKey, 'delete', oldKeyNextVersion)\n\n    await this.onDirty?.(this.collName, newKey, 'put', 1)\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: newKey,\n      action: 'put',\n    })\n    await this.onRecordMutated?.(this.collName, newKey, 'put', 1)\n\n    // 5. Ledger — record the rename as delete(oldKey) + put(newKey)\n    // so verifyBackupIntegrity()'s data-cross-check matches reality\n    // (the oldKey envelope is gone; the newKey envelope is what was\n    // just written). Two entries instead of one — the chain still\n    // captures the rename intent via the matching ts + actor.\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'delete',\n        collection: this.collName,\n        id: oldKey,\n        version: existing._v,\n        actor: this.keyring.userId,\n        payloadHash: await envelopePayloadHash(existing),\n      })\n      await this.ledger.append({\n        op: 'put',\n        collection: this.collName,\n        id: newKey,\n        version: 1,\n        actor: this.keyring.userId,\n        payloadHash: await envelopePayloadHash(newEnvelope),\n      })\n    }\n  }\n\n  /**\n   * List all entries in this dictionary.\n   *\n   * @returns Array of `{ key, labels }` objects.\n   */\n  async list(): Promise<DictEntry[]> {\n    const keys = await this.adapter.list(this.compartmentName, this.collName)\n    const entries: DictEntry[] = []\n    for (const key of keys) {\n      const envelope = await this.adapter.get(\n        this.compartmentName,\n        this.collName,\n        key,\n      )\n      // #647 fix wave 1 — a delete-marker row is a removed key, not a live entry: exclude it\n      // from the listing and drop any stale cache entry a prior warm may have left under it.\n      if (!envelope || isDeleteMarker(envelope)) { this._syncCache.delete(key); continue }\n      const entry = await this.decryptEntry(key, envelope)\n      entries.push(entry)\n      // Warm the synchronous cache\n      this._syncCache.set(key, entry)\n    }\n    return entries\n  }\n\n  /**\n   * Resolve a key to its label for the given locale.\n   *\n   * Used by the collection's locale-aware read path to populate\n   * `<field>Label` virtual fields. Returns `undefined` when the\n   * key doesn't exist or has no label for the requested locale\n   * (after exhausting the fallback chain).\n   */\n  async resolveLabel(\n    key: string,\n    locale: string,\n    fallback?: string | readonly string[],\n  ): Promise<string | undefined> {\n    const labels = await this.get(key as Keys)\n    if (!labels) return undefined\n\n    // Try primary locale\n    if (labels[locale] !== undefined) return labels[locale]\n\n    // Try fallback chain\n    const chain = Array.isArray(fallback) ? (fallback as readonly string[]) : fallback ? [fallback as string] : []\n    for (const fb of chain) {\n      if (fb === 'any') {\n        // Return any available label\n        const any = Object.values(labels)[0]\n        if (any !== undefined) return any\n      } else if (labels[fb] !== undefined) {\n        return labels[fb]\n      }\n    }\n\n    return undefined\n  }\n}\n\n// Compat alias — existing importers of `DictionaryHandle` (the pre-#650\n// name) keep compiling unchanged. `via/i18n/dictionary.ts` re-exports\n// this same binding for one release.\nexport { LookupHandle as DictionaryHandle }\n"],"mappings":";;;;;;;;;;;;AA0CA,SAAS,eAAe,UAAsC;AAC5D,SAAO,SAAS,SAAS;AAC3B;AAGO,IAAM,yBAAyB;AAG/B,SAAS,mBAAmB,gBAAgC;AACjE,SAAO,GAAG,sBAAsB,GAAG,cAAc;AACnD;AA2CO,IAAM,eAAN,MAAiD;AAAA,EA2BtD,YACmB,SACA,iBACA,gBACA,SAMA,mBACA,WACA,QACA,SAMA,yBAOA,SASA,mBAEA,SAEA,iBAIA,yBACjB;AA3CiB;AACA;AACA;AACA;AAMA;AACA;AACA;AACA;AAMA;AAOA;AASA;AAEA;AAEA;AAIA;AAEjB,SAAK,WAAW,mBAAmB,cAAc;AAAA,EACnD;AAAA,EA7CmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EAOA;AAAA,EASA;AAAA,EAEA;AAAA,EAEA;AAAA,EAIA;AAAA,EArEF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzD,kBAAsD;AACpD,WAAO,MAAM,KAAK,KAAK,WAAW,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACtD,KAAK,EAAE;AAAA,MACP,QAAQ,EAAE;AAAA,MACV,GAAG,EAAE;AAAA,IACP,EAAE;AAAA,EACJ;AAAA;AAAA,EAoDQ,qBAA2B;AACjC,UAAM,UAAU,KAAK,QAAQ,cAAc;AAC3C,UAAM,WAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,UAAM,aAAa,SAAS,KAAK,QAAQ,IAAI,KAAK;AAClD,UAAM,eAAe,SAAS,OAAO,KAAK;AAC1C,QAAI,aAAa,cAAc;AAC7B,YAAM,IAAI;AAAA,QACR,eAAe,KAAK,cAAc,qBAAqB,OAAO,mCAC1C,KAAK,QAAQ,IAAI;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,aAAa,OAAkB,SAA6C;AACxF,QAAI,CAAC,KAAK,WAAW;AAOnB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,IAAI;AAAA,QACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC5B,KAAK;AAAA,QACL,OAAO,KAAK,UAAU,KAAK;AAAA,QAC3B,KAAK,KAAK,QAAQ;AAAA,MACpB;AAAA,IACF;AAIA,WAAO,KAAK,kBAAkB;AAAA,MAC5B,EAAE,YAAY,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,KAAK,QAAQ,OAAO;AAAA,MACpE,KAAK,UAAU,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,aAAa,KAAa,UAAiD;AACvF,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,KAAK,MAAM,SAAS,KAAK;AAAA,IAClC;AAGA,UAAM,OAAO,MAAM,KAAK,kBAAkB,QAAQ,KAAK,UAAU,KAAK,QAAQ;AAC9E,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,KAA4B;AAClD,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,GAAG;AAChF,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AAAE,WAAK,WAAW,OAAO,GAAG;AAAG;AAAA,IAAO;AACjF,SAAK,WAAW,IAAI,KAAK,MAAM,KAAK,aAAa,KAAK,QAAQ,CAAC;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAI,KAAW,QAA+C;AAClE,SAAK,mBAAmB;AAExB,UAAM,QAAmB,EAAE,KAAK,OAAO;AACvC,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,UAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,UAAM,WAAW,MAAM,KAAK,aAAa,OAAO,OAAO;AAEvD,UAAM,KAAK,QAAQ;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW,SAAS,KAAK;AAAA,IAC3B;AAGA,SAAK,WAAW,IAAI,KAAK,KAAK;AAI9B,UAAM,KAAK,UAAU,KAAK,UAAU,KAAK,OAAO,OAAO;AAEvD,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,kBAAkB,KAAK,UAAU,KAAK,OAAO,OAAO;AAE/D,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,KAAK,QAAQ;AAAA;AAAA;AAAA,QAGpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAA8D;AACzE,SAAK,mBAAmB;AACxB,eAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,OAAO,GAAuC;AACvF,YAAM,KAAK,IAAI,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAI,KAAmD;AAC3D,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,EAAG,QAAO;AAClD,UAAM,QAAQ,MAAM,KAAK,aAAa,KAAK,QAAQ;AACnD,WAAO,MAAM;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,OAAO,KAAW,OAAqC,CAAC,GAAkB;AAC9E,SAAK,mBAAmB;AAExB,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AACzC,YAAM,IAAI,oBAAoB,KAAK,gBAAgB,GAAG;AAAA,IACxD;AAMA,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,SAAS,UAAU;AACrB,YAAM,KAAK,0BAA0B,GAAG;AAAA,IAC1C;AAOA,UAAM,cAAc,SAAS,KAAK;AAClC,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,KAAK,KAAK,kBAAkB,EAAE,YAAY,KAAK,UAAU,IAAI,IAAI,GAAG,aAAa,KAAK,QAAQ,MAAM,CAAC;AAAA,IACnK,OAAO;AACL,YAAM,KAAK,QAAQ,OAAO,KAAK,iBAAiB,KAAK,UAAU,GAAG;AAAA,IACpE;AAGA,SAAK,WAAW,OAAO,GAAG;AAQ1B,UAAM,KAAK,UAAU,KAAK,UAAU,KAAK,OAAO,WAAW;AAE3D,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,kBAAkB,KAAK,UAAU,KAAK,UAAU,WAAW;AAEtE,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS,SAAS;AAAA,QAClB,OAAO,KAAK,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,QAAc,QAA+B;AACxD,SAAK,mBAAmB;AAGxB,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AACzC,YAAM,IAAI,oBAAoB,KAAK,gBAAgB,MAAM;AAAA,IAC3D;AACA,UAAM,WAAW,MAAM,KAAK,aAAa,QAAQ,QAAQ;AAGzD,UAAM,WAAsB,EAAE,KAAK,QAAQ,QAAQ,SAAS,OAAO;AACnE,UAAM,cAAc,MAAM,KAAK,aAAa,UAAU,CAAC;AACvD,UAAM,KAAK,QAAQ;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAQA,SAAK,WAAW,IAAI,QAAQ,QAAQ;AAGpC,QAAI,KAAK,yBAAyB;AAChC,YAAM,KAAK,wBAAwB,KAAK,gBAAgB,QAAQ,MAAM;AAAA,IACxE;AAKA,UAAM,oBAAoB,SAAS,KAAK;AACxC,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,QAAQ,KAAK,kBAAkB,EAAE,YAAY,KAAK,UAAU,IAAI,OAAO,GAAG,mBAAmB,KAAK,QAAQ,MAAM,CAAC;AAAA,IAC/K,OAAO;AACL,YAAM,KAAK,QAAQ,OAAO,KAAK,iBAAiB,KAAK,UAAU,MAAM;AAAA,IACvE;AAIA,SAAK,WAAW,OAAO,MAAM;AAK7B,UAAM,KAAK,UAAU,KAAK,UAAU,QAAQ,OAAO,iBAAiB;AACpE,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,KAAK,kBAAkB,KAAK,UAAU,QAAQ,UAAU,iBAAiB;AAE/E,UAAM,KAAK,UAAU,KAAK,UAAU,QAAQ,OAAO,CAAC;AACpD,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,KAAK,kBAAkB,KAAK,UAAU,QAAQ,OAAO,CAAC;AAO5D,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS,SAAS;AAAA,QAClB,OAAO,KAAK,QAAQ;AAAA,QACpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AACD,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO,KAAK,QAAQ;AAAA,QACpB,aAAa,MAAM,oBAAoB,WAAW;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAA6B;AACjC,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,iBAAiB,KAAK,QAAQ;AACxE,UAAM,UAAuB,CAAC;AAC9B,eAAW,OAAO,MAAM;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,QAClC,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,MACF;AAGA,UAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AAAE,aAAK,WAAW,OAAO,GAAG;AAAG;AAAA,MAAS;AACnF,YAAM,QAAQ,MAAM,KAAK,aAAa,KAAK,QAAQ;AACnD,cAAQ,KAAK,KAAK;AAElB,WAAK,WAAW,IAAI,KAAK,KAAK;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,KACA,QACA,UAC6B;AAC7B,UAAM,SAAS,MAAM,KAAK,IAAI,GAAW;AACzC,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,OAAO,MAAM,MAAM,OAAW,QAAO,OAAO,MAAM;AAGtD,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAK,WAAiC,WAAW,CAAC,QAAkB,IAAI,CAAC;AAC7G,eAAW,MAAM,OAAO;AACtB,UAAI,OAAO,OAAO;AAEhB,cAAM,MAAM,OAAO,OAAO,MAAM,EAAE,CAAC;AACnC,YAAI,QAAQ,OAAW,QAAO;AAAA,MAChC,WAAW,OAAO,EAAE,MAAM,QAAW;AACnC,eAAO,OAAO,EAAE;AAAA,MAClB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-FNSMZQS4.js → chunk-5ACAVJUI.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-FNSMZQS4.js.map
+//# sourceMappingURL=chunk-5ACAVJUI.js.map

package/dist/{chunk-PDLLCOGD.js → chunk-5AFMP532.js}

@@ -1,19 +1,20 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-HNHCQ556.js";
+} from "./chunk-WLLUM35R.js";
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-3URQC7EH.js";
+} from "./chunk-2LPVI4PX.js";
 import {
-  encrypt
-} from "./chunk-VCETL77O.js";
+  buildRecordEnvelope
+} from "./chunk-N4CNVSUF.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YPYHVOXP.js";
+  encrypt
+} from "./chunk-W5LHQXZU.js";
 import {
   NoydbError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -44,15 +45,17 @@ var LinkSet = class {
     if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
     return this.dekPromise;
   }
-  async encryptEntry(entry, version) {
+  async encryptEntry(entry, version, key) {
     const json = JSON.stringify(entry);
-    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
-    if (!this.encrypted) return { ...base, _iv: "", _data: json };
-    const { iv, data } = await encrypt(json, await this.dek());
-    return { ...base, _iv: iv, _data: data };
+    const identity = { collection: this.collName, id: key, by: this.actor, version };
+    if (!this.encrypted) {
+      return buildRecordEnvelope(identity, { iv: "", data: json });
+    }
+    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity));
+    return buildRecordEnvelope(identity, { iv, data });
   }
-  async decryptEntry(env) {
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+  async decryptEntry(key, env) {
+    const json = this.encrypted ? await openEnvelopeJson({ collection: this.collName, id: key }, env, await this.dek()) : env._data;
     return JSON.parse(json);
   }
   async connect(aId, bId, meta) {
@@ -65,7 +68,7 @@ var LinkSet = class {
     const key = linkRowKey(aId, bId);
     const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
     const existing = await this.adapter.get(this.vault, this.collName, key);
-    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
+    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1, key);
     await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
     this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
   }
@@ -89,7 +92,7 @@ var LinkSet = class {
     for (const key of keys) {
       const env = await this.adapter.get(this.vault, this.collName, key);
       if (!env) continue;
-      const e = await this.decryptEntry(env);
+      const e = await this.decryptEntry(key, env);
       out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
     }
     return out;
@@ -127,4 +130,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-PDLLCOGD.js.map
+//# sourceMappingURL=chunk-5AFMP532.js.map

package/dist/chunk-5AFMP532.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/links/link-set.ts"],"sourcesContent":["/**\n * `_links_*` reserved collections — managed bidirectional many-to-many\n * junctions (design B).\n *\n * Where `refArray` (design A) stores an id-array on one owning record,\n * `vault.link()` creates a first-class junction: a dedicated encrypted\n * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.\n * It is queryable from BOTH sides (`of(id)`), carries optional per-link\n * metadata, and cascades on endpoint delete.\n *\n * Each link is slot-typed: `a` is an id in the `a` endpoint collection,\n * `b` an id in the `b` endpoint collection (they may be the same\n * collection for self-links). A link's identity is the ordered pair\n * `(a, b)`; `of(id)` matches either slot.\n *\n * Rows are encrypted under a dedicated `_links_<name>` DEK — same\n * zero-knowledge stack as every other collection (the store sees only\n * ciphertext). Backup/restore rides the normal `loadAll` path.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\n\n// Naming helpers, declaration types, and LinkIntegrityError live in\n// `names.ts` (the always-loadable slice — #553); re-exported here so\n// existing import paths and the root barrel are unchanged.\nexport {\n  LINK_COLLECTION_PREFIX,\n  linkCollectionName,\n  isLinkCollectionName,\n  linkRowKey,\n  LinkIntegrityError,\n} from './names.js'\nexport type { LinkOnDelete, LinkSpec, LinkRow, LinkSetHandle } from './names.js'\nimport { linkCollectionName, linkRowKey } from './names.js'\nimport type { LinkSpec, LinkRow, LinkSetHandle } from './names.js'\n\n/** Stored form (also the row key derivation source). */\ninterface LinkEntry {\n  a: string\n  b: string\n  meta?: Record<string, unknown>\n}\n\n/**\n * @internal — the concrete handle. The Vault owns construction (one per\n * link name) and the cascade hooks; consumers use the {@link LinkSetHandle}\n * surface via `vault.links(name)`.\n */\nexport class LinkSet implements LinkSetHandle {\n  private readonly collName: string\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(\n    private readonly adapter: NoydbStore,\n    private readonly vault: string,\n    private readonly name: string,\n    private readonly spec: LinkSpec,\n    private readonly encrypted: boolean,\n    private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>,\n    private readonly actor: string,\n    private readonly emitter: NoydbEventEmitter,\n    /** Vault-provided existence check for endpoint validation on connect(). */\n    private readonly endpointExists: (collection: string, id: string) => Promise<boolean>,\n  ) {\n    this.collName = linkCollectionName(name)\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName)\n    return this.dekPromise\n  }\n\n  private async encryptEntry(entry: LinkEntry, version: number, key: string): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(entry)\n    const identity = { collection: this.collName, id: key, by: this.actor, version }\n    if (!this.encrypted) {\n      return buildRecordEnvelope(identity, { iv: '', data: json})\n    }\n    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity))\n    return buildRecordEnvelope(identity, { iv, data})\n  }\n\n  private async decryptEntry(key: string, env: EncryptedEnvelope): Promise<LinkEntry> {\n    const json = this.encrypted ? await openEnvelopeJson({ collection: this.collName, id: key }, env, await this.dek()) : env._data\n    return JSON.parse(json) as LinkEntry\n  }\n\n  async connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void> {\n    if (!(await this.endpointExists(this.spec.a, aId))) {\n      throw new LinkEndpointError(this.name, this.spec.a, aId)\n    }\n    if (!(await this.endpointExists(this.spec.b, bId))) {\n      throw new LinkEndpointError(this.name, this.spec.b, bId)\n    }\n    const key = linkRowKey(aId, bId)\n    const entry: LinkEntry = meta !== undefined ? { a: aId, b: bId, meta } : { a: aId, b: bId }\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1, key)\n    await this.adapter.put(this.vault, this.collName, key, env, existing?._v)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'put' })\n  }\n\n  async disconnect(aId: string, bId: string): Promise<void> {\n    const key = linkRowKey(aId, bId)\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    if (!existing) return\n    await this.adapter.delete(this.vault, this.collName, key)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'delete' })\n  }\n\n  async has(aId: string, bId: string): Promise<boolean> {\n    return (await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId))) !== null\n  }\n\n  async of(id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter((r) => r.a === id || r.b === id)\n  }\n\n  async list(): Promise<LinkRow[]> {\n    const keys = await this.adapter.list(this.vault, this.collName)\n    const out: LinkRow[] = []\n    for (const key of keys) {\n      const env = await this.adapter.get(this.vault, this.collName, key)\n      if (!env) continue\n      const e = await this.decryptEntry(key, env)\n      out.push(e.meta !== undefined ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b })\n    }\n    return out\n  }\n\n  // ── Vault-internal cascade helpers ──────────────────────────────────\n\n  /** @internal — rows where the deleted endpoint id matches the relevant slot. */\n  async _rowsTouchingEndpoint(collection: string, id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter(\n      (r) => (this.spec.a === collection && r.a === id) || (this.spec.b === collection && r.b === id),\n    )\n  }\n\n  /** @internal — the storage collection name (for tx pre-image capture). */\n  get _collectionName(): string {\n    return this.collName\n  }\n}\n\n/** Thrown by `connect()` when an endpoint record does not exist. */\nexport class LinkEndpointError extends NoydbError {\n  readonly link: string\n  readonly endpoint: string\n  readonly missingId: string\n  constructor(link: string, endpoint: string, missingId: string) {\n    super(\n      'LINK_ENDPOINT',\n      `link(\"${link}\").connect: endpoint \"${endpoint}\" has no record \"${missingId}\".`,\n    )\n    this.name = 'LinkEndpointError'\n    this.link = link\n    this.endpoint = endpoint\n    this.missingId = missingId\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmDO,IAAM,UAAN,MAAuC;AAAA,EAI5C,YACmB,SACA,OACA,MACA,MACA,WACA,QACA,OACA,SAEA,gBACjB;AAViB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEjB,SAAK,WAAW,mBAAmB,IAAI;AAAA,EACzC;AAAA,EAZmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAbF;AAAA,EACT,aAAyC;AAAA,EAiBzC,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,KAAK,QAAQ;AACjE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,aAAa,OAAkB,SAAiB,KAAyC;AACrG,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAM,WAAW,EAAE,YAAY,KAAK,UAAU,IAAI,KAAK,IAAI,KAAK,OAAO,QAAQ;AAC/E,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAI,CAAC;AAAA,IAC5D;AACA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,eAAe,QAAQ,CAAC;AACnF,WAAO,oBAAoB,UAAU,EAAE,IAAI,KAAI,CAAC;AAAA,EAClD;AAAA,EAEA,MAAc,aAAa,KAAa,KAA4C;AAClF,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,EAAE,YAAY,KAAK,UAAU,IAAI,IAAI,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAC1H,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAM,QAAQ,KAAa,KAAa,MAA+C;AACrF,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,QAAmB,SAAS,SAAY,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,GAAG,IAAI;AAC1F,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,UAAM,MAAM,MAAM,KAAK,aAAa,QAAQ,UAAU,MAAM,KAAK,GAAG,GAAG;AACvE,UAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,KAAK,KAAK,UAAU,EAAE;AACxE,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,MAAM,CAAC;AAAA,EACtG;AAAA,EAEA,MAAM,WAAW,KAAa,KAA4B;AACxD,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,GAAG;AACxD,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,SAAS,CAAC;AAAA,EACzG;AAAA,EAEA,MAAM,IAAI,KAAa,KAA+B;AACpD,WAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,GAAG,CAAC,MAAO;AAAA,EACvF;AAAA,EAEA,MAAM,GAAG,IAAgC;AACvC,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,OAA2B;AAC/B,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,KAAK,QAAQ;AAC9D,UAAM,MAAiB,CAAC;AACxB,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACjE,UAAI,CAAC,IAAK;AACV,YAAM,IAAI,MAAM,KAAK,aAAa,KAAK,GAAG;AAC1C,UAAI,KAAK,EAAE,SAAS,SAAY,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAoB,IAAgC;AAC9E,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK;AAAA,MACV,CAAC,MAAO,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM,MAAQ,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM;AAAA,IAC9F;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,kBAA0B;AAC5B,WAAO,KAAK;AAAA,EACd;AACF;AAGO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,MAAc,UAAkB,WAAmB;AAC7D;AAAA,MACE;AAAA,MACA,SAAS,IAAI,yBAAyB,QAAQ,oBAAoB,SAAS;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,YAAY;AAAA,EACnB;AACF;","names":[]}