@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/chunk-YSK2CU2Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/indexing/index-snapshot.ts","../src/with-lookup/indexing/sorted-indexes.ts","../src/with-lookup/indexing/compound-indexes.ts","../src/with-lookup/indexing/eager-indexes.ts"],"sourcesContent":["/**\n * The on-disk shape of a persisted field index (#1359) — the format both\n * `SortedIndex` (#1344) and `CompoundIndex` (#1345) round-trip through, plus\n * the structural validator every load must pass.\n *\n * ⭐ **Nothing is flattened into a delimited string.** A compound entry keeps\n * its tuple as an ARRAY of per-component keys, each carrying its runtime KIND\n * alongside its value — which is the whole point of #1345's in-memory shape\n * and would be destroyed by a `join()`. Two properties depend on it:\n *\n *  - **Kind survives.** Entries rank by runtime kind FIRST (mirroring\n *    `predicate.ts`'s `isComparable`), so a `string` probe must not reach\n *    `number` entries. An encoding that wrote only the value would collapse\n *    `1` and `'1'` into one key space on the way back in.\n *  - **Per-component ordering survives.** A string component may contain any\n *    byte, including whatever a separator would have been.\n *\n * The validator is deliberately paranoid and its failure mode is a REBUILD,\n * never a partial load: a blob that is truncated, from a future format, or\n * internally out of order is rejected whole. See\n * {@link parseFieldIndexSnapshot}.\n */\n\n/** Bump on ANY incompatible change to the shapes below. An older stamp is rejected, not migrated. */\nexport const FIELD_INDEX_SNAPSHOT_VERSION = 1\n\n/** One `SortKey`, wire form: `[kind, key]`. `kind` IS the sort rank. */\nexport type WireKey = readonly [kind: number, key: number | string]\n\n/** One `SortedIndex` entry: `[kind, key, seq, id]`. */\nexport type WireSortedEntry = readonly [kind: number, key: number | string, seq: number, id: string]\n\n/** One `CompoundIndex` entry: `[tupleKeys, seq, id]` — the tuple stays an ARRAY. */\nexport type WireCompoundEntry = readonly [keys: readonly WireKey[], seq: number, id: string]\n\nexport interface SortedIndexSnapshot {\n  readonly v: number\n  readonly t: 'sorted'\n  readonly field: string\n  readonly nextSeq: number\n  readonly entries: readonly WireSortedEntry[]\n}\n\nexport interface CompoundIndexSnapshot {\n  readonly v: number\n  readonly t: 'compound'\n  readonly fields: readonly string[]\n  readonly nextSeq: number\n  readonly entries: readonly WireCompoundEntry[]\n}\n\nexport type FieldIndexSnapshot = SortedIndexSnapshot | CompoundIndexSnapshot\n\n/**\n * Sidecar key for a single-field sorted index. Field paths are\n * percent-encoded so no field name can collide with the `,` the compound\n * form joins on, nor with the `s:` / `c:` discriminator.\n */\nexport function sortedIndexKey(field: string): string {\n  return `s:${encodeURIComponent(field)}`\n}\n\n/** Sidecar key for a compound index over an ordered field tuple. */\nexport function compoundIndexKey(fields: readonly string[]): string {\n  return `c:${fields.map(encodeURIComponent).join(',')}`\n}\n\n/** A key is well-formed only if its declared kind matches its value's runtime type. */\nfunction isWireKey(x: unknown): x is WireKey {\n  if (!Array.isArray(x) || x.length !== 2) return false\n  const [kind, key] = x as [unknown, unknown]\n  // 0 = number, 1 = string, 2 = Date-as-epoch-millis. See `sorted-indexes.ts`.\n  if (kind === 0 || kind === 2) return typeof key === 'number' && Number.isFinite(key)\n  if (kind === 1) return typeof key === 'string'\n  return false\n}\n\nfunction isSeq(x: unknown): x is number {\n  return typeof x === 'number' && Number.isInteger(x) && x >= 0\n}\n\n/**\n * Decode + validate a persisted snapshot. Returns `null` — meaning \"rebuild\"\n * — for anything that is not exactly the current format: bad JSON (a torn\n * write), a version stamp from another release, a shape mismatch, a\n * malformed key, or entries out of the order the index's binary searches\n * require. A caller must never repair a snapshot; the source of truth is the\n * cache, and rebuilding from it is always available.\n */\nexport function parseFieldIndexSnapshot(json: string): FieldIndexSnapshot | null {\n  let raw: unknown\n  try {\n    raw = JSON.parse(json)\n  } catch {\n    return null\n  }\n  if (typeof raw !== 'object' || raw === null) return null\n  const o = raw as Record<string, unknown>\n  if (o['v'] !== FIELD_INDEX_SNAPSHOT_VERSION) return null\n  if (!isSeq(o['nextSeq']) || !Array.isArray(o['entries'])) return null\n  const nextSeq = o['nextSeq']\n  const entries = o['entries'] as unknown[]\n\n  if (o['t'] === 'sorted') {\n    if (typeof o['field'] !== 'string') return null\n    const out: WireSortedEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 4) return null\n      const [kind, key, seq, id] = e as [unknown, unknown, unknown, unknown]\n      if (!isWireKey([kind, key])) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([kind as number, key as number | string, seq, id])\n    }\n    if (!isAscending(out.map(e => [[e[0], e[1]] as WireKey]), out.map(e => e[2]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'sorted', field: o['field'], nextSeq, entries: out }\n  }\n\n  if (o['t'] === 'compound') {\n    const fields = o['fields']\n    if (!Array.isArray(fields) || fields.length === 0 || !fields.every(f => typeof f === 'string')) return null\n    const out: WireCompoundEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 3) return null\n      const [keys, seq, id] = e as [unknown, unknown, unknown]\n      if (!Array.isArray(keys) || keys.length !== fields.length || !keys.every(isWireKey)) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([keys as readonly WireKey[], seq, id])\n    }\n    if (!isAscending(out.map(e => e[0]), out.map(e => e[1]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'compound', fields, nextSeq, entries: out }\n  }\n\n  return null\n}\n\n/**\n * Every binary search in both index classes assumes `(keys…, seq)` ascending.\n * A blob that is not sorted would not merely be slow — it would answer\n * WRONGLY, so it is rejected rather than re-sorted (re-sorting would launder\n * a corrupt blob into a plausible-looking answer).\n */\nfunction isAscending(keys: ReadonlyArray<readonly WireKey[]>, seqs: readonly number[]): boolean {\n  for (let i = 1; i < keys.length; i++) {\n    const c = compareWireTuples(keys[i - 1]!, keys[i]!)\n    if (c > 0) return false\n    if (c === 0 && seqs[i - 1]! >= seqs[i]!) return false\n  }\n  return true\n}\n\nfunction compareWireTuples(a: readonly WireKey[], b: readonly WireKey[]): number {\n  for (let i = 0; i < a.length; i++) {\n    const x = a[i]!\n    const y = b[i]!\n    if (x[0] !== y[0]) return x[0] - y[0]\n    if (typeof x[1] === 'number' && typeof y[1] === 'number') {\n      if (x[1] !== y[1]) return x[1] - y[1]\n    } else if (x[1] !== y[1]) {\n      return x[1] < y[1] ? -1 : 1\n    }\n  }\n  return 0\n}\n","/**\n * Sorted (range) secondary indexes — the ordered sibling of the hash\n * index in `eager-indexes.ts` (#1344).\n *\n * A sorted index is an array of `{ kind, key, seq, id }` entries kept in\n * ascending `(kindRank, key, seq)` order. Binary search then answers\n * `<`, `<=`, `>`, `>=`, `between` and `startsWith` as a contiguous slice,\n * and `orderedIds()` walks the array for `orderBy(field).limit(n)`.\n *\n * Three properties are load-bearing, each mirroring the linear scan this\n * replaces (`kernel/query/predicate.ts`):\n *\n *  - **Kind-partitioned.** `evaluateFieldClause`'s `isComparable` refuses\n *    to order two values of different runtime types, so entries are ranked\n *    by kind FIRST. A `string` probe therefore cannot reach `number`\n *    entries, exactly as the scan cannot. Values with no order-defined\n *    type (booleans, objects, arrays) are not indexed at all.\n *  - **Nullish is not indexed**, same as the hash index.\n *  - **Ties keep insertion order** (`seq`), which after a `build()` is\n *    snapshot order — so an index-served `orderBy(...).limit(n)` returns\n *    the same rows the stable scan-and-sort would. An in-place UPDATE\n *    reinstates the rank it held rather than appending (#1369): the record\n *    cache does not move a re-`put` record, so neither may the index.\n *\n * Keys canonicalise through the SAME per-field closure the hash index\n * uses (`ViaPipeline.canonicalizeIndexKey`), so a Via-covered field's\n * entries live in one key space here too. Range DISPATCH for a\n * Via-covered clause is nevertheless declined by the query builder (a\n * money operand has no ordered stored-form probe) — see\n * `kernel/query/builder.ts`'s `candidateRecords`.\n *\n * PERSISTENCE (#1359) is OPT-IN, via `{ persist: true }` on the declaration.\n * {@link SortedIndex.toSnapshot} / {@link SortedIndex.loadSnapshot} are the\n * whole of this class's part in it — the encrypted sidecar, the freshness\n * stamp and the debounce live in `persisted-field-indexes.ts`. Without the\n * opt-in the index is in memory only and rebuilt on hydrate, as before.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type FieldIndexSnapshot,\n  type SortedIndexSnapshot,\n  type WireSortedEntry,\n} from './index-snapshot.js'\n\n/** Range operators a sorted index can answer. */\nexport type RangeOperator = '<' | '<=' | '>' | '>=' | 'between' | 'startsWith'\n\n// The ordered-key encoding itself moved to `kernel/query/sort-key.ts` (#1339):\n// #1339's declared joins key on it too, and the kernel spine may not\n// statically import a `with-*` service (`check-architecture.mjs`'s\n// port-layering ratchet). Re-exported here so every existing importer of this\n// module is unchanged, and so there is still exactly ONE definition of what\n// makes two stored values comparable.\nexport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\n\ninterface Entry extends SortKey {\n  readonly seq: number\n  readonly id: string\n}\n\n/** A single field's sorted index. */\nexport class SortedIndex {\n  private readonly entries: Entry[] = []\n  private nextSeq = 0\n\n  constructor(readonly field: string) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op when the value has no order-defined kind.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, value: unknown, canonicalKey: string | undefined, seq?: number): void {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return\n    const entry: Entry = { ...sk, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the value it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it (#1369):\n   * `sortRecords()` sorts a snapshot whose order does not change when a\n   * record is written in place, so a tie-breaking rank that drifted to the\n   * back on every `put` would make an index-served page disagree with the\n   * scan it must match. Same contract as `CompoundIndex.remove`.\n   */\n  remove(id: string, value: unknown, canonicalKey: string | undefined): number | undefined {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return undefined\n    // Every entry sharing this key is contiguous; walk that run for the id.\n    for (let i = this.lowerBound(sk); i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (compareKeys(e, sk) !== 0) break\n      if (e.id === id) {\n        this.entries.splice(i, 1)\n        return e.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids in ascending (or descending) key order. Ties keep INSERTION order\n   * in both directions — `sortRecords()` negates its comparator over a\n   * stable sort, which reverses the key order but not the order of equal\n   * keys. A plain `.reverse()` here would disagree on ties.\n   */\n  orderedIds(direction: 'asc' | 'desc'): string[] {\n    if (direction === 'asc') return this.entries.map(e => e.id)\n    const out: string[] = []\n    let end = this.entries.length\n    while (end > 0) {\n      let start = end - 1\n      while (start > 0 && compareKeys(this.entries[start - 1]!, this.entries[end - 1]!) === 0) start--\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  /**\n   * Ids matching a range clause. Returns an empty set when the probe has\n   * no comparable kind — which is what the linear scan would produce too.\n   */\n  lookup(op: RangeOperator, value: unknown): Set<string> {\n    if (op === 'startsWith') return this.prefix(value)\n    if (op === 'between') {\n      if (!Array.isArray(value) || value.length !== 2) return new Set()\n      const lo = toSortKey(value[0], undefined)\n      const hi = toSortKey(value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(this.lowerBound(lo), this.upperBound(hi))\n    }\n    const probe = toSortKey(value, undefined)\n    if (!probe) return new Set()\n    const lo = this.lowerBound(probe)\n    const hi = this.upperBound(probe)\n    // Kind-partitioned: `<`/`>` must stay inside the probe's own kind run.\n    const [kindStart, kindEnd] = this.kindBounds(probe.kind)\n    switch (op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  private prefix(value: unknown): Set<string> {\n    if (typeof value !== 'string') return new Set()\n    const out = new Set<string>()\n    const from = this.lowerBound({ kind: KIND_STRING, key: value })\n    for (let i = from; i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (e.kind !== KIND_STRING) break\n      if (!(e.key as string).startsWith(value)) break\n      out.add(e.id)\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the run of entries with the given kind — binary, not linear. */\n  private kindBounds(kind: KeyKind): [number, number] {\n    return [this.kindBoundary(k => k < kind), this.kindBoundary(k => k <= kind)]\n  }\n\n  private kindBoundary(before: (k: KeyKind) => boolean): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is >= `probe`. */\n  private lowerBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is > `probe`. */\n  private upperBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). `kind` travels with every\n   * key: entries rank by runtime kind first, so an encoding that dropped it\n   * would let a `string` probe reach `number` entries on the way back in.\n   */\n  toSnapshot(): SortedIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'sorted',\n      field: this.field,\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(e => [e.kind, e.key, e.seq, e.id] as WireSortedEntry),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Refusal (`false`) means the\n   * caller rebuilds — it NEVER means a partial index: the entries are staged\n   * and only swapped in once every one of them is accepted.\n   *\n   * `isLive` is the caller's liveness predicate over the record cache. An\n   * entry naming a record the cache does not hold means the blob and the\n   * collection have diverged (a crash between the two writes, say), so the\n   * whole blob is discarded. Crash residue must be a rebuild, never a wrong\n   * answer.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'sorted' || snap.field !== this.field) return false\n    const staged: Entry[] = []\n    for (const [kind, key, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ kind: kind as KeyKind, key, seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: Entry): number {\n    let i = this.upperBound(entry)\n    while (i > 0 && compareKeys(this.entries[i - 1]!, entry) === 0 && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildSortedIndex<T>(\n  idx: SortedIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    const value = readPath(record, idx.field)\n    if (value === null || value === undefined) continue\n    idx.add(id, value, canonicalize?.(idx.field, value))\n  }\n}\n\n","/**\n * Compound (multi-field) sorted indexes — the tuple-keyed sibling of\n * `sorted-indexes.ts` (#1345).\n *\n * A compound index is an array of `{ keys, seq, id }` entries kept in\n * ascending `(keys[0], keys[1], …, seq)` order, where each `keys[i]` is\n * the SAME `SortKey` the single-field sorted index builds — so the tuple\n * encoding is order-preserving per component BY CONSTRUCTION rather than\n * by a second, hand-rolled serialization. Nothing is flattened into a\n * delimited string: a string component can therefore contain any byte\n * without colliding with a separator, and a money field canonicalized to\n * a scaled-integer string (`ViaPipeline.canonicalizeIndexKey`) or a date\n * stored as ISO text sorts inside its own component exactly as it does in\n * the single-field index.\n *\n * The two load-bearing properties of #1344 hold PER COMPONENT:\n *\n *  - **Kind-partitioned.** `compareKeys` ranks by runtime kind first, so\n *    within any equality-prefix run a `string` probe on the next\n *    component cannot reach `number` entries — mirroring `predicate.ts`'s\n *    `isComparable`, exactly as the linear scan behaves.\n *  - **Ties keep insertion order** in both directions. `orderedIds()`\n *    walks equal-key runs forward even when emitting descending, because\n *    `sortRecords()` negates its comparator over a STABLE sort.\n *\n * **A record is indexed only when EVERY component has an order-defined\n * value.** One nullish or non-orderable component and the record is\n * absent — which is why the query builder compares {@link\n * CompoundIndex.size} against the snapshot size before dispatching, and\n * falls back to the scan when the index does not cover the collection.\n *\n * PERSISTENCE (#1359) is OPT-IN, same as its single-field sibling. The wire\n * form keeps the tuple as an ARRAY of per-component keys — see\n * `index-snapshot.ts`: flattening it to a delimited string would destroy\n * exactly the per-component ordering and kind partition this class is built\n * to preserve.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type RangeOperator, type SortKey } from './sorted-indexes.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type CompoundIndexSnapshot,\n  type FieldIndexSnapshot,\n  type WireCompoundEntry,\n  type WireKey,\n} from './index-snapshot.js'\n\n/** A range constraint on the component just past the equality prefix. */\nexport interface CompoundRangeProbe {\n  readonly op: RangeOperator\n  readonly value: unknown\n}\n\ninterface CompoundEntry {\n  readonly keys: readonly SortKey[]\n  readonly seq: number\n  readonly id: string\n}\n\n/** One collection's index over an ordered field tuple. */\nexport class CompoundIndex {\n  private readonly entries: CompoundEntry[] = []\n  private nextSeq = 0\n\n  constructor(readonly fields: readonly string[]) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op unless every component has an ordered key.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, keys: readonly SortKey[] | undefined, seq?: number): void {\n    if (!keys) return\n    const entry: CompoundEntry = { keys, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the tuple it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it: `sortRecords()`\n   * sorts a snapshot whose order does not change when a record is written in\n   * place, so a tie-breaking rank that drifted to the back on every `put`\n   * would make an index-served page disagree with the scan it must match.\n   */\n  remove(id: string, keys: readonly SortKey[] | undefined): number | undefined {\n    if (!keys) return undefined\n    const [from, to] = this.run(keys, keys.length)\n    for (let i = from; i < to; i++) {\n      if (this.entries[i]!.id === id) {\n        const [gone] = this.entries.splice(i, 1)\n        return gone!.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids matching an equality prefix, optionally narrowed by a range on\n   * the next component. An empty set is authoritative: the index covers\n   * these fields and nothing matches.\n   */\n  lookup(prefix: readonly SortKey[], range?: CompoundRangeProbe): Set<string> {\n    const [from, to] = this.run(prefix, prefix.length)\n    if (!range) return this.slice(from, to)\n    const k = prefix.length\n    if (k >= this.fields.length) return new Set()\n\n    if (range.op === 'startsWith') {\n      if (typeof range.value !== 'string') return new Set()\n      const out = new Set<string>()\n      const start = this.lowerBound([...prefix, { kind: KIND_STRING, key: range.value }], k + 1, from, to)\n      for (let i = start; i < to; i++) {\n        const key = this.entries[i]!.keys[k]!\n        if (key.kind !== KIND_STRING) break\n        if (!(key.key as string).startsWith(range.value)) break\n        out.add(this.entries[i]!.id)\n      }\n      return out\n    }\n\n    if (range.op === 'between') {\n      if (!Array.isArray(range.value) || range.value.length !== 2) return new Set()\n      const lo = toSortKey(range.value[0], undefined)\n      const hi = toSortKey(range.value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(\n        this.lowerBound([...prefix, lo], k + 1, from, to),\n        this.upperBound([...prefix, hi], k + 1, from, to),\n      )\n    }\n\n    const probe = toSortKey(range.value, undefined)\n    if (!probe) return new Set()\n    // Kind-partitioned per component: an open-ended bound stays inside the\n    // probe's own kind run, so `< '5'` never sweeps up numeric entries.\n    const [kindStart, kindEnd] = this.kindRun(from, to, k, probe.kind)\n    const lo = this.lowerBound([...prefix, probe], k + 1, from, to)\n    const hi = this.upperBound([...prefix, probe], k + 1, from, to)\n    switch (range.op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = range.op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  /**\n   * Ids matching an equality prefix, in the order of the remaining\n   * components. Ties keep INSERTION order in both directions — a plain\n   * `.reverse()` would disagree with `sortRecords()` on equal keys.\n   */\n  orderedIds(prefix: readonly SortKey[], direction: 'asc' | 'desc'): string[] {\n    const [from, to] = this.run(prefix, prefix.length)\n    const out: string[] = []\n    if (direction === 'asc') {\n      for (let i = from; i < to; i++) out.push(this.entries[i]!.id)\n      return out\n    }\n    let end = to\n    while (end > from) {\n      let start = end - 1\n      while (start > from && this.compare(this.entries[start - 1]!, this.entries[end - 1]!.keys, this.fields.length) === 0) {\n        start--\n      }\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the entries whose first `upto` components equal `probe`. */\n  private run(probe: readonly SortKey[], upto: number): [number, number] {\n    return [\n      this.lowerBound(probe, upto, 0, this.entries.length),\n      this.upperBound(probe, upto, 0, this.entries.length),\n    ]\n  }\n\n  /** [start, end) of the entries in [from,to) whose component `k` has this kind. */\n  private kindRun(from: number, to: number, k: number, kind: number): [number, number] {\n    return [\n      this.kindBoundary(from, to, k, x => x < kind),\n      this.kindBoundary(from, to, k, x => x <= kind),\n    ]\n  }\n\n  private kindBoundary(from: number, to: number, k: number, before: (kind: number) => boolean): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.keys[k]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are >= `probe`. */\n  private lowerBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are > `probe`. */\n  private upperBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). Each entry's tuple stays an\n   * ARRAY of `[kind, key]` pairs: nothing is joined into a string, so a\n   * string component may hold any byte and the per-component kind partition\n   * survives the round trip intact.\n   */\n  toSnapshot(): CompoundIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'compound',\n      fields: [...this.fields],\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(\n        e => [e.keys.map(k => [k.kind, k.key] as WireKey), e.seq, e.id] as WireCompoundEntry,\n      ),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Same contract as\n   * `SortedIndex.loadSnapshot`: all-or-nothing, and an entry naming a record\n   * the cache does not hold rejects the whole blob so crash residue becomes a\n   * rebuild rather than a wrong answer. A snapshot whose field tuple is not\n   * exactly this index's is refused — the declaration changed under it.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'compound') return false\n    if (snap.fields.length !== this.fields.length) return false\n    for (let i = 0; i < snap.fields.length; i++) if (snap.fields[i] !== this.fields[i]) return false\n    const staged: CompoundEntry[] = []\n    for (const [keys, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ keys: keys.map(k => ({ kind: k[0] as SortKey['kind'], key: k[1] })), seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: CompoundEntry): number {\n    const to = this.upperBound(entry.keys, this.fields.length, 0, this.entries.length)\n    let i = to\n    while (i > 0 && this.compare(this.entries[i - 1]!, entry.keys, this.fields.length) === 0\n      && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n\n  private compare(entry: CompoundEntry, probe: readonly SortKey[], upto: number): number {\n    for (let i = 0; i < upto; i++) {\n      const c = compareKeys(entry.keys[i]!, probe[i]!)\n      if (c !== 0) return c\n    }\n    return 0\n  }\n}\n\n/**\n * The tuple key for one record, or `undefined` when any component is\n * nullish or has no order-defined runtime type. Canonicalizes through the\n * same per-field closure the hash and sorted indexes use, so a Via-covered\n * component lives in one key space across all three.\n */\nexport function tupleKeyOf<T>(\n  fields: readonly string[],\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const field of fields) {\n    const value = readPath(record, field)\n    if (value === null || value === undefined) return undefined\n    const key = toSortKey(value, canonicalize?.(field, value))\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Probe keys for an equality prefix, or `undefined` if any operand is unorderable. */\nexport function probeKeysOf(values: readonly unknown[]): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const value of values) {\n    const key = toSortKey(value, undefined)\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildCompoundIndex<T>(\n  idx: CompoundIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    idx.add(id, tupleKeyOf(idx.fields, record, canonicalize))\n  }\n}\n\n/** Stable map key for a field tuple. `\\0` cannot appear in a field path. */\nexport function compoundKey(fields: readonly string[]): string {\n  return fields.join('\\u0000')\n}\n","/**\n * Secondary indexes for the query DSL.\n *\n * ships **in-memory hash indexes**:\n *   - Built during `Collection.ensureHydrated()` from the decrypted cache\n *   - Maintained incrementally on `put` and `delete`\n *   - Consulted by the query executor for `==` and `in` operators on\n *     indexed fields, falling back to a linear scan otherwise\n *   - Live entirely in memory — no adapter writes for the index itself\n *\n * Persistent encrypted index blobs (the spec's \"store as a separate\n * AES-256-GCM blob\" note) are deferred to a follow-up issue. The reasons\n * are documented in the PR body — short version: at the target\n * scale of 1K–50K records, building the index during hydrate is free,\n * so persistence buys nothing measurable.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { stringifyBucketKey, isProbeableBucketKey } from '../../kernel/query/distinct-key.js'\nimport { SortedIndex, buildSortedIndex, type RangeOperator } from './sorted-indexes.js'\nimport {\n  CompoundIndex,\n  buildCompoundIndex,\n  compoundKey,\n  probeKeysOf,\n  tupleKeyOf,\n  type CompoundRangeProbe,\n} from './compound-indexes.js'\nimport {\n  compoundIndexKey,\n  sortedIndexKey,\n  type FieldIndexSnapshot,\n} from './index-snapshot.js'\n\n/**\n * Index declaration accepted by `Collection`'s constructor.\n *\n * Accepts:\n *   - `string` — a single-field hash index (`'clientId'`)\n *   - `{ fields: [...] }` or `readonly string[]` — a composite index\n *     over an ordered field tuple. Only lazy-mode\n *     collections consume composite declarations today; eager mode\n *     silently treats a composite as equivalent to declaring each\n *     component field as its own single-field index.\n *\n * Additive variants (unique constraints, partial indexes) will land as\n * further union members without breaking existing declarations.\n */\nexport type IndexDef =\n  | string\n  | {\n      readonly fields: readonly string[]\n      /**\n       * Enforce that no two records share this field tuple. A MULTI-field\n       * tuple is a COMPOUND unique — uniqueness over the tuple, never over\n       * each component on its own (`['workerId','employerId']` allows one\n       * worker at many employers). Null-distinct: a record with `null` or\n       * `undefined` in any constrained field is exempt.\n       *\n       * ⚠️ **What \"unique\" means depends on the collection's mode (#1358),\n       * and one of the four cannot promise prevention at all:**\n       *\n       * - eager (default) — prevented, from the in-memory map.\n       * - lazy (`prefetch: false`) — prevented, by a point lookup through the\n       *   persisted `_idx/` mirror. Requires `withIndexing()`.\n       * - tiered (`tiers: [...]`) — prevented across every tier whose DEK the\n       *   writer holds. **A tier the writer cannot read is outside the\n       *   guarantee** — those records are unreadable, so no local check can\n       *   see them, and a duplicate against one is accepted.\n       * - CRDT (`crdt: '...'`) — **NOT prevented.** Uniqueness cannot be\n       *   enforced across concurrent replicas: two replicas that are offline\n       *   from each other can both accept the same value, and no local check\n       *   can prevent that. The write always succeeds and both records are\n       *   kept; the collision is reported on the `unique:violation` event as\n       *   a `UniqueConstraintError`, both when it happens and when a later\n       *   session first sees the two records together. What you get is\n       *   uniqueness within what this writer could see at write time, plus\n       *   detection when the replicas meet.\n       */\n      readonly unique?: boolean\n      readonly kind?: IndexKind\n      /**\n       * Persist this index as an encrypted sidecar so a restart reuses it\n       * instead of rebuilding (#1359). Only meaningful with `kind: 'sorted'`\n       * — the hash index is not persisted. OPT-IN until measured: at the\n       * 1K–50K target scale rebuild-on-open is free, and a sidecar is a\n       * write on every debounce window plus a blob at rest.\n       */\n      readonly persist?: boolean\n    }\n  | readonly string[]\n\n/**\n * The access structure an index declaration asks for (#1344).\n *\n * `'hash'` (the default, and what every pre-#1344 declaration means) is\n * the equality/`in` bucket map. `'sorted'` additionally maintains an\n * ordered array over the same canonicalized keys, which lights up\n * index-driven `<`, `<=`, `>`, `>=`, `between`, `startsWith` and\n * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash\n * index too — `==`/`in` stay O(1).\n */\nexport type IndexKind = 'hash' | 'sorted'\n\n/**\n * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`\n * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →\n * passthrough. Pure — used by `Collection`'s sensitive-field leak check\n * and by `getDeclaredIndexes()` (introspection).\n */\nexport function normalizeIndexDefs(\n  defs: readonly IndexDef[],\n): ReadonlyArray<{ readonly fields: readonly string[]; readonly unique?: boolean }> {\n  return defs.map((def) => {\n    if (typeof def === 'string') return { fields: [def] }\n    if (Array.isArray(def)) return { fields: def }\n    return def as { readonly fields: readonly string[]; readonly unique?: boolean }\n  })\n}\n\n/**\n * Internal representation of a built hash index.\n *\n * Maps stringified field values to the set of record ids whose value\n * for that field matches. Stringification keeps the index simple and\n * works uniformly for primitives (`'open'`, `'42'`, `'true'`).\n *\n * Records whose indexed field is `undefined` or `null` are NOT inserted\n * — `query().where('field', '==', undefined)` falls back to a linear\n * scan, which is the conservative behavior.\n */\nexport interface HashIndex {\n  readonly field: string\n  readonly buckets: Map<string, Set<string>>\n}\n\n/**\n * Container for all indexes on a single collection.\n *\n * Methods are pure with respect to the in-memory `buckets` Map — they\n * never touch the adapter or the keyring. The Collection class owns\n * lifecycle (build on hydrate, maintain on put/delete).\n */\nexport class CollectionIndexes {\n  private readonly indexes = new Map<string, HashIndex>()\n\n  /**\n   * Sorted (range) indexes, keyed by field — the #1344 half. Parallel to\n   * `indexes` above and maintained at the SAME mutation sites, through the\n   * SAME `canonicalize` closure, so the two can never disagree about which\n   * key space a field lives in.\n   */\n  private readonly sorted = new Map<string, SortedIndex>()\n\n  /**\n   * Compound (tuple-keyed) sorted indexes, keyed by the joined field\n   * tuple — the #1345 half. Third parallel map, maintained at the SAME\n   * mutation sites through the SAME `canonicalize` closure as the other\n   * two, so no field can end up in disagreeing key spaces.\n   */\n  private readonly compound = new Map<string, CompoundIndex>()\n\n  /**\n   * The indexes declared `persist: true` (#1359), keyed by their SIDECAR key\n   * (`s:<field>` / `c:<f1>,<f2>`). A separate map rather than a flag on the\n   * index classes: persistence is a property of the DECLARATION, and the\n   * index classes stay unaware of storage.\n   */\n  private readonly persistable = new Map<string, SortedIndex | CompoundIndex>()\n\n  /**\n   * Per-field bucket-key canonicalizer (#672 review C1), registered ONCE\n   * via {@link setCanonicalizer} when the collection wires indexing up\n   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by\n   * EVERY bucket-mutation site — `build`/`upsert`/`remove` — so bucket\n   * membership is symmetric by construction: a value can never be added\n   * under a canonical key and later removed under the raw one (or vice\n   * versa), which is what stranded ids on `put`/`delete` before this fix.\n   */\n  private canonicalize?: (field: string, value: unknown) => string | undefined\n\n  /**\n   * Register the bucket-key canonicalizer. Called once, where the\n   * collection constructs its indexing state — safe to call again (the\n   * closure is simply replaced) but there is normally only one caller.\n   */\n  setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void {\n    this.canonicalize = fn\n  }\n\n  /**\n   * Declare an index. Subsequent record additions are tracked under it.\n   * Calling this twice for the same field is a no-op (idempotent).\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { field, buckets: new Map() })\n  }\n\n  /**\n   * Declare a sorted (range) index on a field. Independent of\n   * {@link declare} — callers that want both `==` speed and range speed\n   * declare both (which is what `withIndexing()` does for a\n   * `kind: 'sorted'` declaration). Idempotent.\n   */\n  declareSorted(field: string, opts?: { readonly persist?: boolean }): void {\n    let idx = this.sorted.get(field)\n    if (!idx) {\n      idx = new SortedIndex(field)\n      this.sorted.set(field, idx)\n    }\n    if (opts?.persist) this.persistable.set(sortedIndexKey(field), idx)\n  }\n\n  /** True if the given field has a declared SORTED index. */\n  hasSorted(field: string): boolean {\n    return this.sorted.has(field)\n  }\n\n  /** All sorted-index field names, in declaration order. */\n  sortedFields(): string[] {\n    return [...this.sorted.keys()]\n  }\n\n  /** Number of entries in a field's sorted index (0 when undeclared). */\n  sortedSize(field: string): number {\n    return this.sorted.get(field)?.size ?? 0\n  }\n\n  /**\n   * Range lookup: ids whose `field` satisfies the operator. Returns\n   * `null` when no SORTED index covers the field — the caller falls back\n   * to a linear scan. An empty set means \"the index covers this field and\n   * nothing matches\", which is authoritative.\n   */\n  lookupRange(field: string, op: RangeOperator, value: unknown): ReadonlySet<string> | null {\n    return this.sorted.get(field)?.lookup(op, value) ?? null\n  }\n\n  /**\n   * Ids of every indexed record in `field` order. `null` when no sorted\n   * index covers the field. Records whose value is nullish or has no\n   * order-defined type are absent — compare against {@link sortedSize}\n   * before treating the result as the full collection.\n   */\n  orderedIds(field: string, direction: 'asc' | 'desc'): readonly string[] | null {\n    return this.sorted.get(field)?.orderedIds(direction) ?? null\n  }\n\n  /**\n   * Declare a compound (multi-field) sorted index over an ordered field\n   * tuple. A tuple shorter than two fields is a single-field sorted index\n   * and is ignored here. Idempotent.\n   */\n  declareCompound(fields: readonly string[], opts?: { readonly persist?: boolean }): void {\n    if (fields.length < 2) return\n    const key = compoundKey(fields)\n    let idx = this.compound.get(key)\n    if (!idx) {\n      idx = new CompoundIndex([...fields])\n      this.compound.set(key, idx)\n    }\n    if (opts?.persist) this.persistable.set(compoundIndexKey(fields), idx)\n  }\n\n  /** Every declared field tuple, in declaration order. */\n  compoundTuples(): ReadonlyArray<readonly string[]> {\n    return [...this.compound.values()].map(idx => idx.fields)\n  }\n\n  /**\n   * Number of records the tuple's index holds (0 when undeclared). A\n   * record with a nullish or non-orderable component is absent, so a\n   * caller that removes clauses from the plan MUST compare this against\n   * the snapshot size before trusting the result.\n   */\n  compoundSize(fields: readonly string[]): number {\n    return this.compound.get(compoundKey(fields))?.size ?? 0\n  }\n\n  /**\n   * Compound lookup: ids whose leading components equal `prefixValues`,\n   * optionally narrowed by a range on the component just past them.\n   * `null` when no compound index covers the tuple, or when an operand\n   * has no order-defined type — the caller falls back to a linear scan.\n   */\n  lookupCompound(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    range?: CompoundRangeProbe,\n  ): ReadonlySet<string> | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.lookup(prefix, range)\n  }\n\n  /**\n   * Ids matching an equality prefix, ordered by the remaining components.\n   * `null` when no compound index covers the tuple or an operand has no\n   * order-defined type. See {@link compoundSize} for the coverage caveat.\n   */\n  compoundOrderedIds(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    direction: 'asc' | 'desc',\n  ): readonly string[] | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.orderedIds(prefix, direction)\n  }\n\n  /** True if the given field has a declared index. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Build all declared indexes from a snapshot of records.\n   * Called once per hydration. O(N × indexes.size). Buckets through the\n   * registered {@link setCanonicalizer} closure, same as `upsert`/`remove`.\n   */\n  build<T>(records: ReadonlyArray<{ id: string; record: T }>, skip: ReadonlySet<string> = EMPTY_KEYS): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n      for (const { id, record } of records) {\n        addToIndex(idx, id, record, this.canonicalize)\n      }\n    }\n    // `skip` names the sidecar keys a persisted snapshot already restored\n    // (#1359) — rebuilding them would throw that work away AND renumber every\n    // `seq`, which is what the whole ordered fast path rests on.\n    for (const [field, idx] of this.sorted) {\n      if (skip.has(sortedIndexKey(field))) continue\n      buildSortedIndex(idx, records, this.canonicalize)\n    }\n    for (const idx of this.compound.values()) {\n      if (skip.has(compoundIndexKey(idx.fields))) continue\n      buildCompoundIndex(idx, records, this.canonicalize)\n    }\n  }\n\n  /** Sidecar keys of every index declared `persist: true`, in declaration order. */\n  persistableKeys(): readonly string[] {\n    return [...this.persistable.keys()]\n  }\n\n  /** The persistable snapshot behind one sidecar key, or `undefined` if it is not declared. */\n  snapshotIndex(key: string): FieldIndexSnapshot | undefined {\n    return this.persistable.get(key)?.toSnapshot()\n  }\n\n  /**\n   * Adopt a validated snapshot into the index behind `key`. `false` means the\n   * caller must rebuild that index from the cache — the index is left\n   * untouched, never half-loaded.\n   */\n  restoreIndex(key: string, snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    return this.persistable.get(key)?.loadSnapshot(snap, isLive) ?? false\n  }\n\n  /**\n   * Insert or update a single record across all indexes.\n   * Called by `Collection.put()` after the encrypted write succeeds.\n   *\n   * If `previousRecord` is provided, the record is removed from any old\n   * buckets first — this is the update path. Pass `null` for fresh adds.\n   */\n  upsert<T>(id: string, newRecord: T, previousRecord: T | null): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    // Detach the compound and sorted entries FIRST, holding the rank each one had. An\n    // in-place `put` does not move a record within `snapshot()`, so it must\n    // not move it within a tie run either — otherwise an index-served\n    // `orderBy(...).limit(n)` page disagrees with the stable scan-and-sort\n    // it is required to reproduce exactly (#1345, #1369). The `this.remove()`\n    // below re-runs both removals, which are then no-ops.\n    const ranks = new Map<string, number | undefined>()\n    const sortedRanks = new Map<string, number | undefined>()\n    if (previousRecord !== null) {\n      for (const [key, idx] of this.compound) {\n        ranks.set(key, idx.remove(id, tupleKeyOf(idx.fields, previousRecord, this.canonicalize)))\n      }\n      // Same for the single-field sorted indexes (#1369) — the defect and the\n      // remedy are identical, and the two implementations must agree.\n      for (const [key, idx] of this.sorted) {\n        const value = readPath(previousRecord, idx.field)\n        if (value === null || value === undefined) continue\n        sortedRanks.set(key, idx.remove(id, value, this.canonicalize?.(idx.field, value)))\n      }\n      this.remove(id, previousRecord)\n    }\n    for (const idx of this.indexes.values()) {\n      addToIndex(idx, id, newRecord, this.canonicalize)\n    }\n    for (const [key, idx] of this.sorted) {\n      const value = readPath(newRecord, idx.field)\n      if (value === null || value === undefined) continue\n      idx.add(id, value, this.canonicalize?.(idx.field, value), sortedRanks.get(key))\n    }\n    for (const [key, idx] of this.compound) {\n      idx.add(id, tupleKeyOf(idx.fields, newRecord, this.canonicalize), ranks.get(key))\n    }\n  }\n\n  /**\n   * Remove a record from all indexes. Called by `Collection.delete()`\n   * (and as the first half of `upsert` for the update path).\n   */\n  remove<T>(id: string, record: T): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    for (const idx of this.indexes.values()) {\n      removeFromIndex(idx, id, record, this.canonicalize)\n    }\n    for (const idx of this.sorted.values()) {\n      const value = readPath(record, idx.field)\n      if (value === null || value === undefined) continue\n      idx.remove(id, value, this.canonicalize?.(idx.field, value))\n    }\n    for (const idx of this.compound.values()) {\n      idx.remove(id, tupleKeyOf(idx.fields, record, this.canonicalize))\n    }\n  }\n\n  /** Drop all index data. Called when the collection is invalidated. */\n  clear(): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n    }\n    for (const idx of this.sorted.values()) {\n      idx.clear()\n    }\n    for (const idx of this.compound.values()) {\n      idx.clear()\n    }\n  }\n\n  /**\n   * Equality lookup: return the set of record ids whose `field` matches\n   * the given value. Returns `null` if no index covers the field — the\n   * caller should fall back to a linear scan.\n   *\n   * ⛔ ALSO `null` when the OPERAND has no bucket ADDRESS (#1402) — a\n   * nullish operand, or an object one, which every object-valued record in\n   * the collection shares. Answering those from the buckets returns rows\n   * the scan does not, silently, and only on the collections that happen to\n   * have an index. See `isProbeableBucketKey` for the two measurements.\n   *\n   * The returned Set is a reference to the index's internal storage —\n   * callers must NOT mutate it.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!isProbeableBucketKey(value)) return null\n    const key = stringifyKey(value)\n    return idx.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup: return the union of record ids whose `field` matches any\n   * of the given values. Returns `null` if no index covers the field.\n   *\n   * ⛔ ALSO `null` when ANY member of `values` has no bucket address\n   * (#1402) — one unaddressable member poisons the whole union, since the\n   * result is a union and there is no partial answer to hand back. Same\n   * measurement as {@link lookupEqual}.\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!values.every(isProbeableBucketKey)) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const key = stringifyKey(value)\n      const bucket = idx.buckets.get(key)\n      if (bucket) {\n        for (const id of bucket) out.add(id)\n      }\n    }\n    return out\n  }\n\n  /**\n   * One record id per NON-EMPTY bucket of `field`'s hash index, in bucket\n   * order — the index-backed spine of `Query.distinct()` (#1347). `null` when\n   * no hash index covers the field, so the caller scans instead.\n   *\n   * The bucket set IS the distinct key set, so this costs O(buckets) rather\n   * than O(records). It returns REPRESENTATIVE IDS rather than the keys\n   * themselves on purpose: a bucket key is a canonical string (money's\n   * BigInt-normalized scaled int, say), and `distinct()` owes its caller the\n   * field's real value, which only the record carries.\n   *\n   * Bucket insertion order is first-seen record order — `build()` walks the\n   * snapshot in order and `upsert()` appends — which is why an index-backed\n   * `distinct()` and a scanned one agree on ORDER too, not merely on the set.\n   * Empty buckets are skipped defensively; `removeFromIndex` already deletes\n   * them, so this is belt-and-braces against a future partial removal path.\n   */\n  bucketRepresentatives(field: string): readonly string[] | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    const out: string[] = []\n    for (const bucket of idx.buckets.values()) {\n      for (const id of bucket) {\n        out.push(id)\n        break\n      }\n    }\n    return out\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\nconst EMPTY_KEYS: ReadonlySet<string> = new Set()\n\n/**\n * Stringify a value into a stable bucket key.\n *\n * ⚠️ The DEFINITION moved to `kernel/query/distinct-key.ts` (#1347) and is\n * only aliased here. `distinct()` / `countDistinct()` recompute this key on\n * the scan path, and an index-backed `distinct()` reads the buckets it made —\n * one definition is what stops those two answers from drifting apart. Change\n * the shared function, not a copy.\n */\nconst stringifyKey = stringifyBucketKey\n\nfunction addToIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  let bucket = idx.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    idx.buckets.set(key, bucket)\n  }\n  bucket.add(id)\n}\n\nfunction removeFromIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  const bucket = idx.buckets.get(key)\n  if (!bucket) return\n  bucket.delete(id)\n  // Clean up empty buckets so the Map doesn't accumulate dead keys.\n  if (bucket.size === 0) idx.buckets.delete(key)\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBO,IAAM,+BAA+B;AAkCrC,SAAS,eAAe,OAAuB;AACpD,SAAO,KAAK,mBAAmB,KAAK,CAAC;AACvC;AAGO,SAAS,iBAAiB,QAAmC;AAClE,SAAO,KAAK,OAAO,IAAI,kBAAkB,EAAE,KAAK,GAAG,CAAC;AACtD;AAGA,SAAS,UAAU,GAA0B;AAC3C,MAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,QAAM,CAAC,MAAM,GAAG,IAAI;AAEpB,MAAI,SAAS,KAAK,SAAS,EAAG,QAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG;AACnF,MAAI,SAAS,EAAG,QAAO,OAAO,QAAQ;AACtC,SAAO;AACT;AAEA,SAAS,MAAM,GAAyB;AACtC,SAAO,OAAO,MAAM,YAAY,OAAO,UAAU,CAAC,KAAK,KAAK;AAC9D;AAUO,SAAS,wBAAwB,MAAyC;AAC/E,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,IAAI;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,GAAG,MAAM,6BAA8B,QAAO;AACpD,MAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAG,QAAO;AACjE,QAAM,UAAU,EAAE,SAAS;AAC3B,QAAM,UAAU,EAAE,SAAS;AAE3B,MAAI,EAAE,GAAG,MAAM,UAAU;AACvB,QAAI,OAAO,EAAE,OAAO,MAAM,SAAU,QAAO;AAC3C,UAAM,MAAyB,CAAC;AAChC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,KAAK,EAAE,IAAI;AAC7B,UAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAG,QAAO;AACpC,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAAgB,KAAwB,KAAK,EAAE,CAAC;AAAA,IAC5D;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAY,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACtF,WAAO,EAAE,GAAG,8BAA8B,GAAG,UAAU,OAAO,EAAE,OAAO,GAAG,SAAS,SAAS,IAAI;AAAA,EAClG;AAEA,MAAI,EAAE,GAAG,MAAM,YAAY;AACzB,UAAM,SAAS,EAAE,QAAQ;AACzB,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,CAAC,OAAO,MAAM,OAAK,OAAO,MAAM,QAAQ,EAAG,QAAO;AACvG,UAAM,MAA2B,CAAC;AAClC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,EAAE,IAAI;AACxB,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,OAAO,UAAU,CAAC,KAAK,MAAM,SAAS,EAAG,QAAO;AAC5F,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAA4B,KAAK,EAAE,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACjE,WAAO,EAAE,GAAG,8BAA8B,GAAG,YAAY,QAAQ,SAAS,SAAS,IAAI;AAAA,EACzF;AAEA,SAAO;AACT;AAQA,SAAS,YAAY,MAAyC,MAAkC;AAC9F,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,kBAAkB,KAAK,IAAI,CAAC,GAAI,KAAK,CAAC,CAAE;AAClD,QAAI,IAAI,EAAG,QAAO;AAClB,QAAI,MAAM,KAAK,KAAK,IAAI,CAAC,KAAM,KAAK,CAAC,EAAI,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAuB,GAA+B;AAC/E,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,IAAI,EAAE,CAAC;AACb,UAAM,IAAI,EAAE,CAAC;AACb,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACpC,QAAI,OAAO,EAAE,CAAC,MAAM,YAAY,OAAO,EAAE,CAAC,MAAM,UAAU;AACxD,UAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,IACtC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACxB,aAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;;;AClGO,IAAM,cAAN,MAAkB;AAAA,EAIvB,YAAqB,OAAe;AAAf;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAHJ,UAAmB,CAAC;AAAA,EAC7B,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,OAAgB,cAAkC,KAAoB;AACpF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI;AACT,UAAM,QAAe,EAAE,GAAG,IAAI,KAAK,OAAO,KAAK,WAAW,GAAG;AAC7D,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAO,IAAY,OAAgB,cAAsD;AACvF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI,QAAO;AAEhB,aAAS,IAAI,KAAK,WAAW,EAAE,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC9D,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,YAAY,GAAG,EAAE,MAAM,EAAG;AAC9B,UAAI,EAAE,OAAO,IAAI;AACf,aAAK,QAAQ,OAAO,GAAG,CAAC;AACxB,eAAO,EAAE;AAAA,MACX;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,WAAqC;AAC9C,QAAI,cAAc,MAAO,QAAO,KAAK,QAAQ,IAAI,OAAK,EAAE,EAAE;AAC1D,UAAM,MAAgB,CAAC;AACvB,QAAI,MAAM,KAAK,QAAQ;AACvB,WAAO,MAAM,GAAG;AACd,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,KAAK,YAAY,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,CAAE,MAAM,EAAG;AACzF,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,IAAmB,OAA6B;AACrD,QAAI,OAAO,aAAc,QAAO,KAAK,OAAO,KAAK;AACjD,QAAI,OAAO,WAAW;AACpB,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAChE,YAAMA,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,YAAMC,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK,MAAM,KAAK,WAAWD,GAAE,GAAG,KAAK,WAAWC,GAAE,CAAC;AAAA,IAC5D;AACA,UAAM,QAAQ,UAAU,OAAO,MAAS;AACxC,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,UAAM,KAAK,KAAK,WAAW,KAAK;AAChC,UAAM,KAAK,KAAK,WAAW,KAAK;AAEhC,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,WAAW,MAAM,IAAI;AACvD,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB;AAC3B,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,OAAO,OAA6B;AAC1C,QAAI,OAAO,UAAU,SAAU,QAAO,oBAAI,IAAI;AAC9C,UAAM,MAAM,oBAAI,IAAY;AAC5B,UAAM,OAAO,KAAK,WAAW,EAAE,MAAM,aAAa,KAAK,MAAM,CAAC;AAC9D,aAAS,IAAI,MAAM,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC/C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,EAAE,SAAS,YAAa;AAC5B,UAAI,CAAE,EAAE,IAAe,WAAW,KAAK,EAAG;AAC1C,UAAI,IAAI,EAAE,EAAE;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,MAAiC;AAClD,WAAO,CAAC,KAAK,aAAa,OAAK,IAAI,IAAI,GAAG,KAAK,aAAa,OAAK,KAAK,IAAI,CAAC;AAAA,EAC7E;AAAA,EAEQ,aAAa,QAAyC;AAC5D,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UAC3C,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,IAAI,EAAG,MAAK,MAAM;AAAA,UACtD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,KAAK,EAAG,MAAK,MAAM;AAAA,UACvD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAkC;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAoB;AAAA,IAChF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,YAAY,KAAK,UAAU,KAAK,MAAO,QAAO;AAC7D,UAAM,SAAkB,CAAC;AACzB,eAAW,CAAC,MAAM,KAAK,KAAK,EAAE,KAAK,KAAK,SAAS;AAC/C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAuB,KAAK,KAAK,GAAG,CAAC;AAAA,IACrD;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAAsB;AAC3C,QAAI,IAAI,KAAK,WAAW,KAAK;AAC7B,WAAO,IAAI,KAAK,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACtG;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,iBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,UAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,IAAI,IAAI,OAAO,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,EACrD;AACF;;;AC1OO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,YAAqB,QAA2B;AAA3B;AAAA,EAA4B;AAAA,EAA5B;AAAA,EAHJ,UAA2B,CAAC;AAAA,EACrC,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,MAAsC,KAAoB;AACxE,QAAI,CAAC,KAAM;AACX,UAAM,QAAuB,EAAE,MAAM,KAAK,OAAO,KAAK,WAAW,GAAG;AACpE,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,IAAY,MAA0D;AAC3E,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM;AAC7C,aAAS,IAAI,MAAM,IAAI,IAAI,KAAK;AAC9B,UAAI,KAAK,QAAQ,CAAC,EAAG,OAAO,IAAI;AAC9B,cAAM,CAAC,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AACvC,eAAO,KAAM;AAAA,MACf;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,QAA4B,OAAyC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,QAAI,CAAC,MAAO,QAAO,KAAK,MAAM,MAAM,EAAE;AACtC,UAAM,IAAI,OAAO;AACjB,QAAI,KAAK,KAAK,OAAO,OAAQ,QAAO,oBAAI,IAAI;AAE5C,QAAI,MAAM,OAAO,cAAc;AAC7B,UAAI,OAAO,MAAM,UAAU,SAAU,QAAO,oBAAI,IAAI;AACpD,YAAM,MAAM,oBAAI,IAAY;AAC5B,YAAM,QAAQ,KAAK,WAAW,CAAC,GAAG,QAAQ,EAAE,MAAM,aAAa,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE;AACnG,eAAS,IAAI,OAAO,IAAI,IAAI,KAAK;AAC/B,cAAM,MAAM,KAAK,QAAQ,CAAC,EAAG,KAAK,CAAC;AACnC,YAAI,IAAI,SAAS,YAAa;AAC9B,YAAI,CAAE,IAAI,IAAe,WAAW,MAAM,KAAK,EAAG;AAClD,YAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAAA,MAC7B;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,OAAO,WAAW;AAC1B,UAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5E,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK;AAAA,QACV,KAAK,WAAW,CAAC,GAAG,QAAQD,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,QAChD,KAAK,WAAW,CAAC,GAAG,QAAQC,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,MAClD;AAAA,IACF;AAEA,UAAM,QAAQ,UAAU,MAAM,OAAO,MAAS;AAC9C,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAG3B,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI;AACjE,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,YAAQ,MAAM,IAAI;AAAA,MAChB,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB,MAAM;AACjC,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAA4B,WAAqC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,UAAM,MAAgB,CAAC;AACvB,QAAI,cAAc,OAAO;AACvB,eAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC5D,aAAO;AAAA,IACT;AACA,QAAI,MAAM;AACV,WAAO,MAAM,MAAM;AACjB,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,QAAQ,KAAK,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,EAAG,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG;AACpH;AAAA,MACF;AACA,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,IAAI,OAA2B,MAAgC;AACrE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,MACnD,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,IACrD;AAAA,EACF;AAAA;AAAA,EAGQ,QAAQ,MAAc,IAAY,GAAW,MAAgC;AACnF,WAAO;AAAA,MACL,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,IAAI,IAAI;AAAA,MAC5C,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,KAAK,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,aAAa,MAAc,IAAY,GAAW,QAA2C;AACnG,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,KAAK,CAAC,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UACpD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,IAAI,EAAG,MAAK,MAAM;AAAA,UAC7D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,KAAK,EAAG,MAAK,MAAM;AAAA,UAC9D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAoC;AAClC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ;AAAA,QACpB,OAAK,CAAC,EAAE,KAAK,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAY,GAAG,EAAE,KAAK,EAAE,EAAE;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,WAAY,QAAO;AAClC,QAAI,KAAK,OAAO,WAAW,KAAK,OAAO,OAAQ,QAAO;AACtD,aAAS,IAAI,GAAG,IAAI,KAAK,OAAO,QAAQ,IAAK,KAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAG,QAAO;AAC3F,UAAM,SAA0B,CAAC;AACjC,eAAW,CAAC,MAAM,KAAK,EAAE,KAAK,KAAK,SAAS;AAC1C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAM,KAAK,IAAI,QAAM,EAAE,MAAM,EAAE,CAAC,GAAsB,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,CAAC;AAAA,IAC9F;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAA8B;AACnD,UAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,KAAK,QAAQ,MAAM;AACjF,QAAI,IAAI;AACR,WAAO,IAAI,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAI,MAAM,MAAM,KAAK,OAAO,MAAM,MAAM,KAClF,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACzC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,OAAsB,OAA2B,MAAsB;AACrF,aAAS,IAAI,GAAG,IAAI,MAAM,KAAK;AAC7B,YAAM,IAAI,YAAY,MAAM,KAAK,CAAC,GAAI,MAAM,CAAC,CAAE;AAC/C,UAAI,MAAM,EAAG,QAAO;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AACF;AAQO,SAAS,WACd,QACA,QACA,cACuB;AACvB,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,SAAS,QAAQ,KAAK;AACpC,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,UAAM,MAAM,UAAU,OAAO,eAAe,OAAO,KAAK,CAAC;AACzD,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,YAAY,QAAmD;AAC7E,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,UAAU,OAAO,MAAS;AACtC,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,mBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,QAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,QAAQ,YAAY,CAAC;AAAA,EAC1D;AACF;AAGO,SAAS,YAAY,QAAmC;AAC7D,SAAO,OAAO,KAAK,IAAQ;AAC7B;;;AC1PO,SAAS,mBACd,MACkF;AAClF,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,QAAQ,CAAC,GAAG,EAAE;AACpD,QAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,EAAE,QAAQ,IAAI;AAC7C,WAAO;AAAA,EACT,CAAC;AACH;AAyBO,IAAM,oBAAN,MAAwB;AAAA,EACZ,UAAU,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrC,SAAS,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQtC,WAAW,oBAAI,IAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1C,cAAc,oBAAI,IAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,iBAAiB,IAAiE;AAChF,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,OAAO,SAAS,oBAAI,IAAI,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,OAAe,MAA6C;AACxE,QAAI,MAAM,KAAK,OAAO,IAAI,KAAK;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,YAAY,KAAK;AAC3B,WAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,eAAe,KAAK,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA,EAGA,UAAU,OAAwB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,eAAyB;AACvB,WAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AAAA;AAAA,EAGA,WAAW,OAAuB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,QAAQ;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,OAAe,IAAmB,OAA4C;AACxF,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,KAAK;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,OAAe,WAAqD;AAC7E,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,WAAW,SAAS,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,QAA2B,MAA6C;AACtF,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,MAAM,YAAY,MAAM;AAC9B,QAAI,MAAM,KAAK,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,cAAc,CAAC,GAAG,MAAM,CAAC;AACnC,WAAK,SAAS,IAAI,KAAK,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,iBAAiB,MAAM,GAAG,GAAG;AAAA,EACvE;AAAA;AAAA,EAGA,iBAAmD;AACjD,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,SAAO,IAAI,MAAM;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAa,QAAmC;AAC9C,WAAO,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC,GAAG,QAAQ;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACE,QACA,cACA,OAC4B;AAC5B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,OAAO,QAAQ,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBACE,QACA,cACA,WAC0B;AAC1B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,WAAW,QAAQ,SAAS;AAAA,EACzC;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAS,SAAmD,OAA4B,YAAkB;AACxG,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAClB,iBAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,mBAAW,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,MAC/C;AAAA,IACF;AAIA,eAAW,CAAC,OAAO,GAAG,KAAK,KAAK,QAAQ;AACtC,UAAI,KAAK,IAAI,eAAe,KAAK,CAAC,EAAG;AACrC,uBAAiB,KAAK,SAAS,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,KAAK,IAAI,iBAAiB,IAAI,MAAM,CAAC,EAAG;AAC5C,yBAAmB,KAAK,SAAS,KAAK,YAAY;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,kBAAqC;AACnC,WAAO,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC;AAAA,EACpC;AAAA;AAAA,EAGA,cAAc,KAA6C;AACzD,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,KAAa,MAA0B,QAA0C;AAC5F,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,aAAa,MAAM,MAAM,KAAK;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAU,IAAY,WAAc,gBAAgC;AAClE,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AAOnF,UAAM,QAAQ,oBAAI,IAAgC;AAClD,UAAM,cAAc,oBAAI,IAAgC;AACxD,QAAI,mBAAmB,MAAM;AAC3B,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,cAAM,IAAI,KAAK,IAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,gBAAgB,KAAK,YAAY,CAAC,CAAC;AAAA,MAC1F;AAGA,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,cAAM,QAAQ,SAAS,gBAAgB,IAAI,KAAK;AAChD,YAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,oBAAY,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC,CAAC;AAAA,MACnF;AACA,WAAK,OAAO,IAAI,cAAc;AAAA,IAChC;AACA,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,iBAAW,KAAK,IAAI,WAAW,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,YAAM,QAAQ,SAAS,WAAW,IAAI,KAAK;AAC3C,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,IAAI,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,GAAG,YAAY,IAAI,GAAG,CAAC;AAAA,IAChF;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,UAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,WAAW,KAAK,YAAY,GAAG,MAAM,IAAI,GAAG,CAAC;AAAA,IAClF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAU,IAAY,QAAiB;AACrC,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AACnF,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,sBAAgB,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,IACpD;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,YAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,IAC7D;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,QAAQ,KAAK,YAAY,CAAC;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAGA,QAAc;AACZ,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAAA,IACpB;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,UAAI,MAAM;AAAA,IACZ;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,MAAM;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY,OAAe,OAA4C;AACrE,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO;AACzC,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,OAAe,QAAwD;AAC9E,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,OAAO,MAAM,oBAAoB,EAAG,QAAO;AAChD,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,UAAI,QAAQ;AACV,mBAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,sBAAsB,OAAyC;AAC7D,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAgB,CAAC;AACvB,eAAW,UAAU,IAAI,QAAQ,OAAO,GAAG;AACzC,iBAAW,MAAM,QAAQ;AACvB,YAAI,KAAK,EAAE;AACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAC/C,IAAM,aAAkC,oBAAI,IAAI;AAWhD,IAAM,eAAe;AAErB,SAAS,WACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,MAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,QAAI,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO,IAAI,EAAE;AACf;AAEA,SAAS,gBACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,QAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO,OAAO,EAAE;AAEhB,MAAI,OAAO,SAAS,EAAG,KAAI,QAAQ,OAAO,GAAG;AAC/C;","names":["lo","hi","lo","hi"]}

package/dist/{chunk-UXVWEX5L.js → chunk-Z5HTYMMQ.js}

@@ -1,8 +1,11 @@
 import {
   NoydbError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/kernel/via/index.ts
+function isViaPrefixProbe(x) {
+  return typeof x === "object" && x !== null && x.kind === "via-prefixes" && Array.isArray(x.prefixes);
+}
 var binders = /* @__PURE__ */ new Map();
 function installViaBinder(brand, binder) {
   if (!binders.has(brand)) binders.set(brand, binder);
@@ -22,8 +25,9 @@ function viaBinder(brand) {
 }
 
 export {
+  isViaPrefixProbe,
   installViaBinder,
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-UXVWEX5L.js.map
+//# sourceMappingURL=chunk-Z5HTYMMQ.js.map

package/dist/chunk-Z5HTYMMQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via/index.ts"],"sourcesContent":["// kernel/via/index.ts — the ONLY kernel-resident via surface.\nimport { NoydbError } from '../errors.js'\nimport type { EncryptedEnvelope } from '../types.js'\n\n/** Awaitable type for potentially async results. */\ntype Awaitable<T> = T | Promise<T>\n\n/** Declared security posture — a property the kernel enforces (enforcement activates in phases B/C). */\nexport interface ViaPosture {\n  readonly encryptedAtRest: 'envelope' | 'sealed'\n  readonly queryable: 'none' | 'det-exact' | 'ordered' | 'full'\n  readonly exportable: boolean\n  readonly forgettable: boolean\n}\n\n/** Opaque marker every feature descriptor extends; the kernel never sees concrete descriptor types. */\nexport interface ViaDescriptor { readonly _viaBrand: string }\n\n/** Per-call write context (A: minimal; B/C extend). */\nexport interface ViaWriteCtx {\n  readonly id: string\n  /** Owning vault name (event payload identity — e.g. i18n:script-violation). */\n  readonly vault: string\n  /** Prior stored record (decoded), lazily resolved. Null when creating. */\n  readonly prior: () => Promise<Record<string, unknown> | null>\n  /** Typed event emission (e.g. i18n:script-violation). */\n  readonly emit: (event: string, payload: unknown) => void\n}\n\n/** Per-call read context — mirrors LocaleReadOptions loosely; features narrow. */\nexport interface ViaReadCtx {\n  readonly locale?: unknown\n  readonly fallback?: unknown\n  readonly layer: string\n}\n\n/** One sealed slot's ciphertext — matches the existing `iv:data` sealed map entries (seam map §2 step 2). */\nexport interface SealedSlotRef { readonly iv: string; readonly data: string }\n\n/**\n * A scoped crypto capability handed to a `via` feature's `encodeAtRest`/\n * `decodeAtRest`/`erase` hooks — never the keyring, never the enclave.\n * `sealedSlots` is pre-bound to one `(collection, recordId)`; `reservedEnvelopes`\n * is a whole-envelope encrypt/decrypt door scoped to collection names under a\n * declared prefix (e.g. `_dict_`).\n */\nexport interface ViaCryptoCtx {\n  readonly sealedSlots: {\n    seal(field: string, plaintext: unknown): Promise<SealedSlotRef>\n    unseal(field: string, ref: SealedSlotRef): Promise<unknown>\n    delete(field: string): Promise<void>\n  }\n  reservedEnvelopes(prefix: string): {\n    /**\n     * `id` is the record id the envelope will be stored under. Required\n     * (#1051) because this function holds the DEK, so it is where record-identity\n     * AAD is applied — a caller that cannot name the id cannot be bound.\n     */\n    encrypt(\n      identity: { readonly collection: string; readonly id: string; readonly by?: string },\n      json: string,\n      v: number,\n    ): Promise<EncryptedEnvelope>\n    decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>\n  }\n}\n\n/** Per-call erase context — `forget()`'s per-ref participation door (phase C). */\nexport interface ViaEraseCtx { readonly id: string; readonly vault: string; readonly live: unknown /* EncryptedEnvelope */; readonly crypto: ViaCryptoCtx }\n/**\n * What an `erase` hook reports back to `forget()`'s summary ledger entry.\n * `retainedShared` is additive (#629 Task 10) — content NOT erased because\n * still referenced by another live record (blob's shared-chunk dual\n * accounting, `shredAllForRecord()`'s `retainedShared` count). Absent/0 for\n * bindings with no such concept (a sealed field is never \"shared\").\n */\nexport interface ViaEraseReport { readonly shredded: number; readonly residue: readonly unknown[]; readonly retainedShared?: number }\n\n/**\n * A feature bound to one collection's declared config. Record-grain hooks —\n * every hook receives the whole record (matches the real engine signatures,\n * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;\n * absent = passthrough. Query-participation hooks are SYNC (#553).\n */\nexport interface NoydbVia {\n  readonly brand: string\n  readonly posture: ViaPosture\n  /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future\n   *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,\n   *  reference declared fields) and graph-registers a derived edge for each covered\n   *  field at declare time, right after `compileVias` builds the bindings\n   *  (unknown source field throws `ValidationError`). See\n   *  `kernel/collection-config.ts`'s `resolveViaDepsEdges`. */\n  readonly deps?: readonly string[]\n  /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */\n  readonly reservedPrefixes?: readonly string[]\n  /**\n   * Does this binding own `field`? Backs `ViaPipeline.postureFor` (#629 Task\n   * 8's posture consumer) — a passive coverage check, independent of\n   * `buildClause`/`compareForOrder` (which some bindings, e.g. classified and\n   * blob, never define). SYNC, no side effects.\n   *\n   * Contract (documentation only — not enforced at runtime, future work):\n   * any binding declaring a non-default posture value — `queryable: 'none'`\n   * (#629 Task 8) or `exportable: false` (#629 Task 9's `redactForExport`)\n   * — MUST implement `covers()`. `postureFor`'s consumers only engage for\n   * fields a binding actively claims via `covers()`; a binding that omits\n   * it would silently fall through to the generic (unrefused/unredacted)\n   * path instead.\n   */\n  covers?(field: string): boolean\n  // NOTE: phase C adds a `derive` hook ADDITIVELY — do not stub it now.\n  // ── write pipeline ──\n  /** Refuse a write before crypto runs (classified step-3 slot: storage:'never' rejection + validators). Throws to refuse. */\n  enforceWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): void | Promise<void>\n  /** First pipeline stage (money canonicalizeIncomingMoney). SYNC. */\n  ingest?(record: Record<string, unknown>): Record<string, unknown>\n  /** Decode STORED form to canonical for internal boundaries (gates, derivations, patch bases). SYNC. */\n  canonicalizeStored?(record: Record<string, unknown>): Record<string, unknown>\n  /** Post-validation write encoding (money quantize; i18n translate→script→validate→densify). May be async. */\n  encodeWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): Awaitable<Record<string, unknown>>\n  /** Final write-pipeline stage: seal/encrypt declared fields via `crypto` before the envelope body is built (classified step-2 slot). */\n  encodeAtRest?(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }>\n  // ── read pipeline ──\n  /** First read-pipeline stage: unseal/decrypt declared fields via `crypto` before `present` runs (classified sealed-handle slot). */\n  decodeAtRest?(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: { asHandles: boolean }): Promise<Record<string, unknown>>\n  /** Read-time presentation (money decode+virtuals; i18n locale/labels/strip). May be async. */\n  present?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  /**\n   * Late read-time presentation (#669) — runs AFTER every binding's `present()` in the\n   * money+computed present-order segment (`ViaPipeline`'s `_presentOrder`, `kernel/via/\n   * pipeline.ts`), BEFORE the \"everything else\" segment (i18n/lookup dressing, taint\n   * redaction) runs. Exists for a binding that needs to react to a virtual computed\n   * field's fresh OWN-field output before anything dresses it (money's MAJOR-UNITS\n   * quantize-and-present for a field that is BOTH money AND `mode:'virtual'` computed) —\n   * `present()` alone can't express \"run after computed for THESE fields only, before\n   * computed for all others\", since it's a per-BINDING fold, not per-field. Folded over\n   * `bindings` in declaration order (mirrors every other per-binding fold), so lookup/\n   * i18n dressing and taint/redaction (both in the \"everything else\" segment) still see\n   * the already-dressed value.\n   */\n  presentLate?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  /**\n   * #1416 — declare that BOTH `present` and `presentLate` return synchronously,\n   * so `ViaPipeline.presentSync` may fold this binding.\n   *\n   * ⛔ DECLARED, NOT SNIFFED, and that is the whole point. A plain function\n   * returning a promise is indistinguishable at runtime from one that does not\n   * (`constructor.name === 'AsyncFunction'` catches `async () =>` and nothing\n   * else), so detecting it would silently mis-classify the one binding that\n   * matters. Calling an async hook and discarding its promise is worse still:\n   * side effects run and a rejection surfaces unhandled.\n   *\n   * Defaults to `false` — a binding that has not thought about it is skipped by\n   * the sync path and dressed only on the async one, which is today's\n   * behaviour. `money` and `computed` set it; `i18n` and `lookup` cannot.\n   */\n  readonly presentIsSync?: boolean\n  /**\n   * #1447 — the fields this binding covers, ENUMERATED.\n   *\n   * ⛔ `covers()` is a PREDICATE and cannot answer this. Iterating a\n   * collection's declared fields and asking \"do you cover this?\" misses every\n   * field that exists only in the binding's own config — a\n   * `computed({ mode: 'virtual' })` field is exactly that, and it is the case\n   * that motivated the report: a consumer's rulebook described three vault\n   * -computed fields as app-owned, and a predicate-based check would not have\n   * caught it because it never thinks to ask about them.\n   *\n   * Optional, and absence is honest rather than empty: a binding that has not\n   * declared its set is omitted from the report rather than reported as\n   * covering nothing.\n   */\n  readonly coveredFields?: readonly string[]\n  // ── query participation (ALL SYNC — #553) ──\n  /** Returns an opaque clause payload when this binding covers `field`, else undefined. */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  buildClause?(field: string, op: string, value: unknown): unknown | undefined\n  /** Evaluate a payload produced by buildClause against a raw stored value. */\n  evaluateClause?(actual: unknown, op: string, payload: unknown): boolean\n  /**\n   * Optional: the STORED-form operand for a direct secondary-index probe\n   * against a payload produced by `buildClause` (#625) — lets\n   * `candidateRecords()` (`query/builder.ts`) hit `CollectionIndexes.\n   * lookupEqual`/`lookupIn` for `==`/`in` clauses instead of falling back\n   * to a linear scan + per-record `evaluateClause`. Returning `undefined`\n   * means \"no sound probe for this op/payload\" (e.g. a comparison whose\n   * stored form isn't a single index-bucketable value, or an op the index\n   * can't serve) — the caller falls back to the scan. A binding that\n   * never implements this hook always falls back, unchanged from before\n   * this hook existed.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  indexProbe?(op: string, payload: unknown): unknown | undefined\n  /**\n   * Optional: canonicalize a raw STORED field value into the bucket key an\n   * eager index should use (#672) — lets `CollectionIndexes` group a\n   * pre-declaration / non-canonical stored value (e.g. a money field's\n   * leftover `'0100'` written before its `money()` declaration) under the\n   * SAME key a canonical write produces (`'100'`), so the index-probe fast\n   * path (`indexProbe` above) and the fallback scan (`evaluateClause`)\n   * agree on which records match. `undefined` means \"not mine / can't\n   * canonicalize this value\" — the caller buckets the raw stringified\n   * value, unchanged from before this hook existed. MUST agree with what\n   * this binding's own `evaluateClause`/`indexProbe` treat as equal, or\n   * the fast path and the scan will disagree.\n   */\n  canonicalizeIndexKey?(field: string, rawValue: unknown): string | undefined\n  /** Decode a raw stored record for query/scan results and callback views ('raw' — no virtuals). */\n  decodeResults?(record: unknown): unknown\n  /** Exact ordering for a covered field; undefined when the field is not covered. */\n  compareForOrder?(field: string, a: unknown, b: unknown): number | undefined\n  /**\n   * Per-key, PER-CALL-locale label resolution for `orderBy(field, dir,\n   * { by: 'label' })` (#650 Task 7) — the sibling `compareForOrder` above\n   * structurally cannot serve, since it carries no locale parameter.\n   * `locale` is the query's per-call locale (`undefined` for a locale-less\n   * query — a binding may fall back to its own descriptor-level default,\n   * mirroring `present`'s displayLocale hinge). `undefined` return = this\n   * binding doesn't resolve a label for `key` at `field` — caller falls\n   * back to the raw stored value, same graceful-degrade discipline every\n   * other via query hook uses. SYNC (#553 — query participation).\n   */\n  resolveOrderLabel?(field: string, key: string, locale: string | undefined): string | undefined\n  /** Rewrite an aggregate spec (money exact reducers). */\n  wrapReducers?(spec: unknown): unknown\n  // ── forget participation ──\n  /** `forget()`'s per-ref erasure door — shred/report this binding's residue for one record (classified/blob forget participation). */\n  erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>\n  // ── introspection ──\n  describeFragment?(): Record<string, unknown>\n}\n\n/**\n * An `indexProbe` result asking for a UNION of sorted-index PREFIX slices\n * (#1355), rather than the single equality operand `indexProbe` yielded\n * before it existed.\n *\n * ⛔ IT IS A SUPERSET, AND THAT IS THE CONTRACT. `candidateRecords()`\n * (`kernel/query/builder.ts`) narrows to the union of these prefixes and\n * then keeps the clause in `remainingClauses`, so the binding's own\n * `evaluateClause` still runs over every candidate. A binding returning\n * this promises only that no MATCHING record lies outside the union —\n * never that every record inside it matches. Return `undefined` instead\n * of a cover you cannot prove complete: an over-wide cover costs\n * predicate calls, a short one silently drops rows.\n *\n * Generic on purpose. Geo is today's only producer, but nothing here is\n * spatial — any binding whose stored key is an ordered string with a\n * meaningful prefix (a path, a bucketed timestamp) can use it.\n */\nexport interface ViaPrefixProbe {\n  readonly kind: 'via-prefixes'\n  readonly prefixes: readonly string[]\n}\n\n/** Runtime predicate for a {@link ViaPrefixProbe} handed back by `indexProbe`. */\nexport function isViaPrefixProbe(x: unknown): x is ViaPrefixProbe {\n  return (\n    typeof x === 'object' && x !== null &&\n    (x as { kind?: unknown }).kind === 'via-prefixes' &&\n    Array.isArray((x as { prefixes?: unknown }).prefixes)\n  )\n}\n\n/** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */\nexport type ViaBinder = (config: unknown) => NoydbVia\n\nconst binders = new Map<string, ViaBinder>()\n\n/** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */\nexport function installViaBinder(brand: string, binder: ViaBinder): void {\n  if (!binders.has(brand)) binders.set(brand, binder)\n}\n\n/** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */\nexport function isViaInstalled(brand: string): boolean {\n  return binders.has(brand)\n}\n\n/** @internal — resolve a binder; throws when the declaration factory never ran (hand-rolled descriptors). */\nexport function viaBinder(brand: string): ViaBinder {\n  const b = binders.get(brand)\n  if (!b) {\n    throw new NoydbError(\n      'VIA_NOT_LINKED',\n      `via feature \"${brand}\" requires descriptors created via its declaration factory from @noy-db/hub`,\n    )\n  }\n  return b\n}\n"],"mappings":";;;;;AAiQO,SAAS,iBAAiB,GAAiC;AAChE,SACE,OAAO,MAAM,YAAY,MAAM,QAC9B,EAAyB,SAAS,kBACnC,MAAM,QAAS,EAA6B,QAAQ;AAExD;AAKA,IAAM,UAAU,oBAAI,IAAuB;AAGpC,SAAS,iBAAiB,OAAe,QAAyB;AACvE,MAAI,CAAC,QAAQ,IAAI,KAAK,EAAG,SAAQ,IAAI,OAAO,MAAM;AACpD;AAGO,SAAS,eAAe,OAAwB;AACrD,SAAO,QAAQ,IAAI,KAAK;AAC1B;AAGO,SAAS,UAAU,OAA0B;AAClD,QAAM,IAAI,QAAQ,IAAI,KAAK;AAC3B,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-RRNRNANG.js → chunk-ZE4CHIED.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-2577DKXB.js";
+} from "./chunk-DC5QVPV7.js";
 import {
   assertRosterAuthenticated,
   assertRosterTagValid,
@@ -13,33 +13,40 @@ import {
   nextRosterEpoch,
   persistKeyring,
   readKeyringFile,
-  requireRosterKey
-} from "./chunk-G56KBWFY.js";
+  requireRosterKey,
+  rotateKeys
+} from "./chunk-M7NI3IWE.js";
 import {
   dekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-JCN44NCY.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   base64ToBuffer,
   bufferToBase64,
+  decryptBytes,
   deriveEchoKey,
   deriveKey,
   deriveSecretKey,
   encrypt,
+  encryptBytes,
+  exportDekSet,
+  generateRecoverySecret,
   generateSalt,
+  importDekSet,
   unwrapKey,
   wrapKey
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-7MG7SJT7.js";
+} from "./chunk-ODVPTDPK.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   DelegationTargetMissingError,
   InvalidKeyError,
   NoAccessError,
@@ -47,9 +54,10 @@ import {
   PrivilegeEscalationError,
   ROSTER_KEY_ID,
   RecoveryProfileNotImplementedError,
+  TamperedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -72,66 +80,30 @@ var NO_TEAM = {
 
 // src/with-party/team/wrapped-deks.ts
 var PBKDF2_ITERATIONS = 6e5;
-var SALT_BYTES = 32;
-var IV_BYTES = 12;
-var subtle = globalThis.crypto.subtle;
 async function mintWrappedDeksBlob(deks, credential) {
-  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const salt = generateSalt();
   const wrappingKey = await deriveWrappingKey(credential, salt);
-  const exported = {};
-  for (const [coll, dek] of deks) {
-    const raw = await subtle.exportKey("raw", dek);
-    exported[coll] = bytesToBase64(new Uint8Array(raw));
-  }
-  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: exported }));
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    wrappingKey,
-    plaintext
-  );
-  return {
-    salt: bytesToBase64(salt),
-    iv: bytesToBase64(iv),
-    wrappedDeks: bytesToBase64(new Uint8Array(ciphertext))
-  };
+  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: await exportDekSet(deks) }));
+  const { iv, data } = await encryptBytes(plaintext, wrappingKey);
+  return { salt: bufferToBase64(salt), iv, wrappedDeks: data };
 }
 async function unwrapDeksFromBlob(blob, credential) {
-  const wrappingKey = await deriveWrappingKey(credential, base64ToBytes(blob.salt));
-  const plaintext = await subtle.decrypt(
-    { name: "AES-GCM", iv: base64ToBytes(blob.iv) },
-    wrappingKey,
-    base64ToBytes(blob.wrappedDeks)
-  );
-  const parsed = JSON.parse(new TextDecoder().decode(plaintext));
-  const deks = /* @__PURE__ */ new Map();
-  for (const [coll, b64] of Object.entries(parsed.deks)) {
-    const raw = base64ToBytes(b64);
-    const key = await subtle.importKey(
-      "raw",
-      raw,
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(coll, key);
+  const wrappingKey = await deriveWrappingKey(credential, base64ToBuffer(blob.salt));
+  let plaintext;
+  try {
+    plaintext = await decryptBytes(blob.iv, blob.wrappedDeks, wrappingKey);
+  } catch (e) {
+    if (e instanceof TamperedError) {
+      throw new InvalidKeyError("Wrapped DEK set did not open \u2014 the credential does not match this blob, or the blob is corrupted");
+    }
+    throw e;
   }
-  return deks;
+  const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+  return importDekSet(parsed.deks);
 }
 async function deriveWrappingKey(credential, salt) {
   return deriveSecretKey(credential, salt, { iterations: PBKDF2_ITERATIONS, keyUsage: "aes-gcm" });
 }
-function bytesToBase64(b) {
-  let s = "";
-  for (const x of b) s += String.fromCharCode(x);
-  return btoa(s);
-}
-function base64ToBytes(b64) {
-  const s = atob(b64);
-  const out = new Uint8Array(s.length);
-  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-  return out;
-}
 
 // src/with-party/team/recovery.ts
 var PAPER_DOC_ID = "recovery-paper";
@@ -198,9 +170,9 @@ async function saveShamirRecoveryEntries(store, vault, entries) {
   await store.put(vault, "_meta", SHAMIR_DOC_ID, envelope);
 }
 async function mintShamirRecoveryEntry(provider, deks, entryId, k, n, label) {
-  const recoverySecret = crypto.getRandomValues(new Uint8Array(32));
+  const recoverySecret = generateRecoverySecret();
   try {
-    const credential = bytesToBase642(recoverySecret);
+    const credential = bufferToBase64(recoverySecret);
     const blob = await mintWrappedDeksBlob(deks, credential);
     const shareStrings = provider.splitToShares(recoverySecret, k, n);
     const entry = {
@@ -224,16 +196,11 @@ async function unwrapDeksFromShamirEntry(provider, entry, shareStrings) {
   }
   const secret = provider.combineShares(shareStrings);
   try {
-    return await unwrapDeksFromBlob(entry, bytesToBase642(secret));
+    return await unwrapDeksFromBlob(entry, bufferToBase64(secret));
   } finally {
     secret.fill(0);
   }
 }
-function bytesToBase642(b) {
-  let s = "";
-  for (const x of b) s += String.fromCharCode(x);
-  return btoa(s);
-}
 async function mintPaperRecoveryEntry(deks, code, codeId) {
   const blob = await mintWrappedDeksBlob(deks, code);
   return {
@@ -250,13 +217,13 @@ async function unwrapDeksFromPaperEntry(entry, code) {
 var MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 var MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
 async function deriveMagicLinkContentKey(serverSecret, token, vault) {
-  const subtle2 = globalThis.crypto.subtle;
+  const subtle = globalThis.crypto.subtle;
   const ikmBytes = serverSecret instanceof Uint8Array ? serverSecret : new TextEncoder().encode(serverSecret);
   const tokenBytes = new TextEncoder().encode(token);
-  const saltBuffer = await subtle2.digest("SHA-256", tokenBytes);
+  const saltBuffer = await subtle.digest("SHA-256", tokenBytes);
   const info = new TextEncoder().encode(MAGIC_LINK_CONTENT_INFO_PREFIX + vault);
-  const ikm = await subtle2.importKey("raw", ikmBytes, "HKDF", false, ["deriveKey"]);
-  return subtle2.deriveKey(
+  const ikm = await subtle.importKey("raw", ikmBytes, "HKDF", false, ["deriveKey"]);
+  return subtle.deriveKey(
     { name: "HKDF", hash: "SHA-256", salt: saltBuffer, info },
     ikm,
     { name: "AES-GCM", length: 256 },
@@ -471,7 +438,7 @@ async function recoverSecret(provider, store, vault, userId, input) {
   }
   throw new RecoveryProfileNotImplementedError(
     profile,
-    "https://github.com/vLannaAi/noy-db/issues/196"
+    "https://github.com/noy-db/core/issues/196"
   );
 }
 async function recoverViaPaperCode(store, vault, userId, input) {
@@ -860,6 +827,7 @@ function sanitizeId(s) {
 
 // src/with-party/team/authenticators.ts
 async function enrollAuthenticator(store, vault, keyring, options) {
+  assertSlotListVisible(keyring, "enrollAuthenticator", vault);
   const existing = keyring.authenticators.find((a) => a.id === options.id);
   if (existing) {
     throw new ValidationError(
@@ -892,6 +860,7 @@ async function updateAuthenticator(store, vault, keyring, slotId, options) {
       `updateAuthenticator: at least one of meta must be provided (slotId: "${slotId}").`
     );
   }
+  assertSlotListVisible(keyring, "updateAuthenticator", vault);
   const idx = keyring.authenticators.findIndex((a) => a.id === slotId);
   if (idx === -1) {
     throw new NoAccessError(
@@ -918,7 +887,14 @@ async function updateAuthenticator(store, vault, keyring, slotId, options) {
   await persistKeyring(store, vault, nextKeyring);
   return nextKeyring;
 }
+function assertSlotListVisible(keyring, op, vault) {
+  if (keyring.kek) return;
+  throw new ValidationError(
+    `${op}: keyring.kek is null, so the authenticator slot list for vault "${vault}" is not readable from this session and no slot decision can be made. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before enrolling, updating or removing a slot.`
+  );
+}
 async function removeAuthenticator(store, vault, keyring, slotId) {
+  assertSlotListVisible(keyring, "removeAuthenticator", vault);
   const filtered = keyring.authenticators.filter((a) => a.id !== slotId);
   if (filtered.length === keyring.authenticators.length) {
     return keyring;
@@ -939,6 +915,20 @@ function appendSlot(keyring, slot) {
     authenticators: [...keyring.authenticators, slot]
   };
 }
+async function revokeAuthenticator(store, vault, keyring, options) {
+  const next = await removeAuthenticator(store, vault, keyring, options.slotId);
+  const collections = new Set(next.deks.keys());
+  collections.delete(ROSTER_KEY_ID);
+  collections.delete(BLOB_ADDRESS_KEY_ID);
+  if (collections.size > 0) {
+    await rotateKeys(store, vault, next, { collections: [...collections] });
+  }
+  return rotateSecret(store, vault, next.userId, {
+    oldSecret: options.secret,
+    newSecret: options.secret,
+    ...options.slotCeremonies !== void 0 && { slotCeremonies: options.slotCeremonies }
+  });
+}
 
 export {
   NO_TEAM,
@@ -973,6 +963,7 @@ export {
   enrollAuthenticator,
   updateAuthenticator,
   removeAuthenticator,
-  findAuthenticator
+  findAuthenticator,
+  revokeAuthenticator
 };
-//# sourceMappingURL=chunk-RRNRNANG.js.map
+//# sourceMappingURL=chunk-ZE4CHIED.js.map