@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-5KC7QYEC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/enclave-aes/classify/compare.ts","../src/capsule/enclave-aes/crypto.ts","../src/capsule/enclave-aes/classify/vdig.ts","../src/capsule/enclave-aes/classify/write.ts","../src/capsule/enclave-aes/primitives.ts","../src/capsule/enclave-aes/bound.ts"],"sourcesContent":["/**\n * C2 — fixed-length-tag constant-time comparison (hub-portable; no\n * Node timingSafeEqual). Two mandatory rules (spec §3):\n *  1. Only fixed 32-byte tags are ever compared — ctEqualTags throws on\n *     anything else (tag length is structural, never secret-dependent).\n *  2. Every comparand is reduced to a 32-byte tag under a FRESH ephemeral\n *     HMAC-SHA256 key before comparison — keyed blinding makes compare\n *     timing uncorrelated with underlying values; rule 1 (not blinding)\n *     is what removes input-length timing. Length inequality folds into\n *     unequal tags — never an early return.\n * @module\n */\n\nimport { ctEqualTags } from '../../plumbing/ct-equal.js'\nconst subtle = globalThis.crypto.subtle\n\n\n/**\n * Blinded equality of arbitrary-length byte strings: fresh K_e per\n * comparison (never stored, never reused), HMAC both sides to 32-byte\n * tags, then ctEqualTags. On the digest path the inputs are already\n * 32-byte PBKDF2 outputs but still route through this reduction so\n * there is exactly ONE comparison construction (spec §3 rule 2).\n */\nexport async function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean> {\n  const ke = await subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  const tagA = new Uint8Array(await subtle.sign('HMAC', ke, a as BufferSource))\n  const tagB = new Uint8Array(await subtle.sign('HMAC', ke, b as BufferSource))\n  return ctEqualTags(tagA, tagB)\n}\n","/**\n * Cryptographic primitives — thin wrappers around the Web Crypto API.\n *\n * ## Design principle\n *\n * **Zero npm crypto dependencies.** Every operation uses `globalThis.crypto.subtle`,\n * which is available natively in Node.js ≥ 18, all modern browsers, and\n * Deno/Bun. This avoids supply-chain risk from third-party crypto packages and\n * ensures the library stays auditable.\n *\n * ## Algorithms\n *\n * | Use case | Algorithm | Parameters |\n * |----------|-----------|------------|\n * | Key derivation | PBKDF2-SHA256 | 600,000 iterations, 32-byte salt |\n * | Record encryption | AES-256-GCM | 12-byte random IV per operation |\n * | DEK wrapping | AES-KW (RFC 3394) | 256-bit KEK |\n * | Binary encrypt | AES-256-GCM | same as record encryption |\n * | Integrity | HMAC-SHA256 | for presence channels |\n * | Content hash | SHA-256 | for ledger and bundle integrity |\n *\n * ## Key lifecycle\n *\n * ```\n * secret + salt\n *   └─► deriveKey()       → KEK (CryptoKey, extractable: false)\n *         └─► wrapKey()   → wrapped DEK bytes  [stored in keyring]\n *         └─► unwrapKey() → DEK (CryptoKey)    [memory only during session]\n *               └─► encrypt() / decrypt()       → ciphertext / plaintext\n * ```\n *\n * IVs are generated fresh by {@link generateIV} on every encrypt call.\n * Reusing an IV with the same key would break GCM's authentication guarantee —\n * this function should be the only place IVs are produced.\n *\n * @module\n */\n\nimport { DecryptionError, InvalidKeyError, TamperedError, ValidationError } from '../../kernel/errors.js'\nimport {\n  KEY_BITS,\n  IV_BYTES,\n  bufferToBase64,\n  base64ToBuffer,\n  generateIV,\n  encodeEchoParts,\n  type EchoSecretParts,\n} from '../plumbing/digest.js'\n\n/**\n * **EnclaveKey** — the opaque key type at the enclave seam.\n *\n * In noy-db's reference enclave this is `CryptoKey` (the Web Crypto API's\n * key handle). A fork's enclave redefines this alias to its own key\n * representation (e.g. `type EnclaveKey = null` for a keyless HSM-backed\n * fork) — outside `capsule/enclave-aes/**`, every consumer must treat it as\n * opaque: never construct, inspect, or serialize it directly, only pass it\n * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).\n */\nexport type EnclaveKey = CryptoKey\n\n/** Opaque asymmetric pair at the enclave seam — `CryptoKeyPair` in the reference enclave. */\nexport type EnclaveKeyPair = CryptoKeyPair\n\nconst PBKDF2_ITERATIONS = 600_000\n\nconst subtle = globalThis.crypto.subtle\n\n// ─── Key Derivation ────────────────────────────────────────────────────\n\n/** Derive a KEK from a secret and salt using PBKDF2-SHA256. */\nexport async function deriveKey(\n  secret: string,\n  salt: Uint8Array,\n): Promise<CryptoKey> {\n  return deriveKekFromMaterial(new TextEncoder().encode(secret), salt)\n}\n\n/**\n * Shared PBKDF2 → AES-KW derivation core. `material` is the raw\n * pre-KDF input bytes (a UTF-8 phrase for standard mode, an\n * AG-1-encoded 3-part structure for echo mode).\n */\nasync function deriveKekFromMaterial(\n  material: Uint8Array,\n  salt: Uint8Array,\n): Promise<CryptoKey> {\n  const keyMaterial = await subtle.importKey('raw', material as BufferSource, 'PBKDF2', false, ['deriveKey'])\n  return subtle.deriveKey(\n    { name: 'PBKDF2', salt: salt as BufferSource, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },\n    keyMaterial,\n    { name: 'AES-KW', length: KEY_BITS },\n    false,\n    ['wrapKey', 'unwrapKey'],\n  )\n}\n\n/** One three-part echo secret: prompt (typed) → echo (revealed) → key (typed). */\n\n/**\n * Domain context for the AG-1 encoding. The leading `0xFF` is the load-bearing\n * byte: it is not a legal UTF-8 lead byte, so `TextEncoder` can never emit it —\n * no string's UTF-8 encoding can equal an AG-1 encoding, whatever the string.\n */\n\nexport async function deriveEchoKey(\n  parts: EchoSecretParts,\n  salt: Uint8Array,\n): Promise<CryptoKey> {\n  return deriveKekFromMaterial(encodeEchoParts(parts), salt)\n}\n\n/**\n * Which AES algorithm/usage a {@link deriveSecretKey} result is for:\n * `'aes-kw'` mints a key-wrapping key (`wrapKey`/`unwrapKey`, e.g. for\n * KEK derivation); `'aes-gcm'` mints a direct encrypt/decrypt key (e.g.\n * for the wrap-DEKs primitive in `with-party/team/wrapped-deks.ts`).\n */\nexport type SecretKeyUsage = 'aes-kw' | 'aes-gcm'\n\n/**\n * Derive a non-extractable AES key from a secret/credential and salt\n * via PBKDF2-SHA256, generalizing {@link deriveKey}'s AES-KW derivation to\n * also cover AES-GCM-usage keys. Callers pin their own `iterations` and\n * `keyUsage` so an existing call site's exact parameters (and thus its\n * derived-key bytes) are preserved verbatim when migrated onto this\n * shared primitive — this is call-site consolidation, not a KDF change.\n */\nexport async function deriveSecretKey(\n  secret: string,\n  salt: Uint8Array,\n  params: { iterations: number; keyUsage: SecretKeyUsage },\n): Promise<CryptoKey> {\n  const keyMaterial = await subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    'PBKDF2',\n    false,\n    ['deriveKey'],\n  )\n\n  return params.keyUsage === 'aes-gcm'\n    ? subtle.deriveKey(\n        {\n          name: 'PBKDF2',\n          salt: salt as BufferSource,\n          iterations: params.iterations,\n          hash: 'SHA-256',\n        },\n        keyMaterial,\n        { name: 'AES-GCM', length: KEY_BITS },\n        false,\n        ['encrypt', 'decrypt'],\n      )\n    : subtle.deriveKey(\n        {\n          name: 'PBKDF2',\n          salt: salt as BufferSource,\n          iterations: params.iterations,\n          hash: 'SHA-256',\n        },\n        keyMaterial,\n        { name: 'AES-KW', length: KEY_BITS },\n        false,\n        ['wrapKey', 'unwrapKey'],\n      )\n}\n\n// ─── DEK Generation ────────────────────────────────────────────────────\n\n/** Generate a random AES-256-GCM data encryption key. */\nexport async function generateDEK(): Promise<CryptoKey> {\n  return subtle.generateKey(\n    { name: 'AES-GCM', length: KEY_BITS },\n    true, // extractable — needed for AES-KW wrapping\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Generate a NON-extractable AES-256-GCM key for in-memory-only use — a\n * session key, a device seal. Unlike {@link generateDEK} it can never be\n * wrapped or exported: WebCrypto enforces that, and it is the tab-scope\n * invariant `with-party/session` and `device-seal` rely on.\n */\nexport async function generateEphemeralKey(): Promise<CryptoKey> {\n  return subtle.generateKey({ name: 'AES-GCM', length: KEY_BITS }, false, ['encrypt', 'decrypt'])\n}\n\n// ─── DEK-Set Codec ─────────────────────────────────────────────────────\n//\n// The portable form of a DEK set — `{ collection: base64(rawKey) }` — is the\n// plaintext body of every persisted WrappedDeksBlob (recovery-paper,\n// recovery-shamir, tier-2 password slots). It is an enclave door because it\n// is the one place a key's REPRESENTATION crosses into bytes: a fork with its\n// own EnclaveKey (hardware-backed, post-quantum, no encryption) decides here\n// what \"the bytes of a key\" means, and nothing outside capsule/enclave-aes has to\n// know. Byte-for-byte what wrapped-deks.ts did inline before #1317.\n\n/** Serialize a DEK set to `{ collection: base64(rawKey) }`. */\nexport async function exportDekSet(deks: Map<string, CryptoKey>): Promise<Record<string, string>> {\n  const out: Record<string, string> = {}\n  for (const [coll, dek] of deks) {\n    out[coll] = bufferToBase64(await subtle.exportKey('raw', dek))\n  }\n  return out\n}\n\n/**\n * Reverse of {@link exportDekSet}. Keys come back extractable AES-GCM\n * (`encrypt`/`decrypt`), matching what `generateDEK` mints.\n */\nexport async function importDekSet(exported: Record<string, string>): Promise<Map<string, CryptoKey>> {\n  const deks = new Map<string, CryptoKey>()\n  for (const [coll, b64] of Object.entries(exported)) {\n    const key = await subtle.importKey(\n      'raw',\n      base64ToBuffer(b64) as BufferSource,\n      { name: 'AES-GCM', length: KEY_BITS },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n    deks.set(coll, key)\n  }\n  return deks\n}\n\n// ─── Key Wrapping ──────────────────────────────────────────────────────\n\n/** Wrap (encrypt) a DEK with a KEK using AES-KW. Returns base64 string. */\nexport async function wrapKey(dek: CryptoKey, kek: CryptoKey): Promise<string> {\n  const wrapped = await subtle.wrapKey('raw', dek, kek, 'AES-KW')\n  return bufferToBase64(wrapped)\n}\n\n/** Unwrap (decrypt) a DEK from base64 string using a KEK. */\nexport async function unwrapKey(\n  wrappedBase64: string,\n  kek: CryptoKey,\n): Promise<CryptoKey> {\n  try {\n    return await subtle.unwrapKey(\n      'raw',\n      base64ToBuffer(wrappedBase64) as BufferSource,\n      kek,\n      'AES-KW',\n      { name: 'AES-GCM', length: KEY_BITS },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n  } catch {\n    throw new InvalidKeyError()\n  }\n}\n\n// ─── Canary ────────────────────────────────────────────────────────────\n//\n// \"Is this KEK the right one?\" is answered by wrapping a CONSTANT key under\n// it and seeing whether the wrap opens later. AES-KW is deterministic\n// (RFC 3394 fixed IV), so the same constant under the same KEK always yields\n// the same bytes — every write site can re-mint on persist. The keyring\n// canary (32 zero bytes) and the echo prompt/echo verifiers (32 × 0x5a) are\n// both this primitive with a different constant.\n\n/** Wrap the constant AES-GCM key built from `plaintext` under `kek`. */\nexport async function mintCanary(kek: CryptoKey, plaintext: Uint8Array): Promise<string> {\n  const constant = await subtle.importKey(\n    'raw', plaintext as BufferSource, { name: 'AES-GCM', length: KEY_BITS }, true, ['encrypt', 'decrypt'],\n  )\n  return wrapKey(constant, kek)\n}\n\n/** True iff `wrapped` unwraps under `kek` — the KEK is right AND the bytes are intact. */\nexport async function checkCanary(wrapped: string, kek: CryptoKey): Promise<boolean> {\n  try {\n    await unwrapKey(wrapped, kek)\n    return true\n  } catch {\n    return false\n  }\n}\n\n// ─── Per-record CEK wrapping ───────────────────────────────────────────\n\n/**\n * Derive a **dedicated** AES-KW wrapping key from a collection/tier DEK via\n * HKDF-SHA256, used to wrap/unwrap a per-record CEK.\n *\n * The collection/tier DEKs are AES-256-**GCM** keys (usages\n * `encrypt`/`decrypt`) and cannot themselves act as an AES-KW KEK. We do NOT\n * re-import the raw DEK bytes directly as an AES-KW key — that would reuse one\n * key across two primitives (AES-GCM for `_det`/presence, AES-KW for CEK\n * wrapping), violating key separation. Instead we HKDF-derive a domain-\n * separated KW key (salt `noydb-cek-wrap`), exactly as `derivePresenceKey`\n * derives a separate presence key. The derivation is deterministic, so\n * wrapping the same CEK under the same DEK always yields identical ciphertext\n * — which is what lets an update reuse a record's stable CEK and produce a\n * byte-identical `_cek`. The KW key is independent of the DEK's GCM key.\n *\n * The DEK must be extractable (it is — `generateDEK`/`unwrapKey` mint\n * extractable keys).\n */\nasync function asKwKey(dek: CryptoKey): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-cek-wrap')\n  const info = new TextEncoder().encode('v1')\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n  return subtle.importKey('raw', bits, 'AES-KW', false, ['wrapKey', 'unwrapKey'])\n}\n\n/**\n * AES-KW-wrap a per-record CEK under a collection/tier DEK. Returns base64.\n * Deterministic over `(cek, dek)`.\n */\nexport async function wrapCek(cek: CryptoKey, dek: CryptoKey): Promise<string> {\n  const kw = await asKwKey(dek)\n  const wrapped = await subtle.wrapKey('raw', cek, kw, 'AES-KW')\n  return bufferToBase64(wrapped)\n}\n\n/**\n * Unwrap a per-record CEK from base64 under a collection/tier DEK. Throws\n * `InvalidKeyError` if the wrapped bytes do not authenticate under the DEK.\n */\nexport async function unwrapCek(wrappedBase64: string, dek: CryptoKey): Promise<CryptoKey> {\n  const kw = await asKwKey(dek)\n  try {\n    return await subtle.unwrapKey(\n      'raw',\n      base64ToBuffer(wrappedBase64) as BufferSource,\n      kw,\n      'AES-KW',\n      { name: 'AES-GCM', length: KEY_BITS },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n  } catch {\n    throw new InvalidKeyError()\n  }\n}\n\n/**\n * Import a raw 32-byte AES-256-GCM record CEK (e.g. from a sealed-CEK\n * delivery binding). Non-extractable, decrypt-only — the imported key is\n * used solely to open the record's `_iv`/`_data` body under `decrypt()`.\n */\nexport async function importCek(rawKey: Uint8Array): Promise<CryptoKey> {\n  return subtle.importKey('raw', rawKey as BufferSource, { name: 'AES-GCM', length: KEY_BITS }, false, ['decrypt'])\n}\n\n/**\n * Import a raw 32-byte pre-shared key as a NON-extractable AES-256-GCM key\n * (encrypt + decrypt). The transfer seal (`with-cargo`) and the RSA-OAEP\n * TLV's per-blob CEK (`managed-secret`) both hand raw bytes to the enclave\n * here; the bytes never become a key anywhere else.\n */\nexport async function importTransferKey(raw: Uint8Array): Promise<CryptoKey> {\n  if (raw.byteLength !== 32) {\n    throw new ValidationError(`transfer key must be 32 bytes, got ${raw.byteLength}.`)\n  }\n  return subtle.importKey('raw', raw as BufferSource, { name: 'AES-GCM', length: KEY_BITS }, false, ['encrypt', 'decrypt'])\n}\n\n// ─── Encrypt / Decrypt ─────────────────────────────────────────────────\n\nexport interface EncryptResult {\n  iv: string   // base64\n  data: string // base64\n}\n\n/**\n * Encrypt plaintext JSON string with AES-256-GCM. Fresh IV per call.\n *\n * `aad` binds the record's identity into the auth tag (#1041) — see\n * `record-aad.ts` for what is bound and why `_v` is not. A body sealed with\n * AAD can only be opened by a reader supplying the identical bytes, which is\n * what stops an untrusted store from relocating or re-tiering an envelope.\n *\n * Optional **only while the call-site sweep is in progress**. It becomes\n * mandatory once every `encrypt`/`decrypt` pair supplies it, at which point\n * the format version bumps and the reader rejects anything unbound. Until\n * then an omitted `aad` reproduces the previous, unauthenticated behaviour.\n */\nexport async function encrypt(\n  plaintext: string,\n  dek: CryptoKey,\n  aad?: Uint8Array,\n): Promise<EncryptResult> {\n  const iv = generateIV()\n  const encoded = new TextEncoder().encode(plaintext)\n\n  const ciphertext = await subtle.encrypt(\n    {\n      name: 'AES-GCM',\n      iv: iv as BufferSource,\n      ...(aad !== undefined && { additionalData: aad as BufferSource }),\n    },\n    dek,\n    encoded,\n  )\n\n  return {\n    iv: bufferToBase64(iv),\n    data: bufferToBase64(ciphertext),\n  }\n}\n\n/**\n * Decrypt AES-256-GCM ciphertext. Throws on wrong key or tampered data.\n *\n * `aad` must be byte-identical to what {@link encrypt} was given, or the auth\n * tag fails and this throws `TamperedError` (#1041). Note the asymmetry that\n * makes this useful: a mismatched identity is indistinguishable from a\n * corrupted body, so relocation fails **closed** rather than returning a\n * plausible record in the wrong place.\n */\nexport async function decrypt(\n  ivBase64: string,\n  dataBase64: string,\n  dek: CryptoKey,\n  aad?: Uint8Array,\n): Promise<string> {\n  const iv = base64ToBuffer(ivBase64)\n  const ciphertext = base64ToBuffer(dataBase64)\n\n  try {\n    const plaintext = await subtle.decrypt(\n      {\n        name: 'AES-GCM',\n        iv: iv as BufferSource,\n        ...(aad !== undefined && { additionalData: aad as BufferSource }),\n      },\n      dek,\n      ciphertext as BufferSource,\n    )\n    return new TextDecoder().decode(plaintext)\n  } catch (err) {\n    if (err instanceof Error && err.name === 'OperationError') {\n      throw new TamperedError(...(await classifyTagFailure(iv, ciphertext, dek, aad)))\n    }\n    throw new DecryptionError(\n      err instanceof Error ? err.message : 'Decryption failed',\n    )\n  }\n}\n\n\n/**\n * Distinguish a FORMAT TRANSITION from an attack, when the enclave can (#1103).\n *\n * ## The problem\n *\n * Since #1041 switched identity AAD on, one `TamperedError` covers at least\n * four situations: legitimate pre-binding data, a store that reconstructs an\n * envelope and drops a bound field, a CEK/rotation mismatch, and actual\n * tampering. `SECURITY.md` and the subsystem docs teach the LAST reading — so a\n * user who upgrades, hits this on their own honest data, and consults the docs\n * is told their store has been compromised.\n *\n * That is a false positive on the product's central security claim, and the\n * cost is not merely a confusing message: **a tamper alarm that cries wolf is\n * one users learn to ignore.**\n *\n * ## Why the probe is sound, and why it is NOT a downgrade\n *\n * A body sealed before #1041 carries no AAD, so it opens under an empty one.\n * Retrying that way is **positive evidence** of the legacy format rather than a\n * guess: forging a body that decrypts under this DEK requires the DEK, and an\n * untrusted store does not hold one.\n *\n * ⚠️ **Classification ONLY — the plaintext is discarded and the caller still\n * throws.** That is the entire safety argument: the outcome is identical either\n * way, so this cannot become the lenient path #1041 exists to remove. A variant\n * that RETURNED the retry's plaintext would be exactly the accept-without-AAD\n * downgrade the binding was built to prevent. Do not \"optimise\" it into one.\n *\n * Note what the honest message concedes: pre-#1041 data had no authenticated\n * metadata, so a legacy record that was ALSO tampered with reads as legacy.\n * That is not a weakening — it is an accurate statement about data that\n * genuinely never carried a binding.\n */\nasync function classifyTagFailure(\n  iv: Uint8Array,\n  ciphertext: Uint8Array,\n  dek: CryptoKey,\n  aad: Uint8Array | undefined,\n): Promise<[] | [string, 'unbound-legacy-format']> {\n  // Only meaningful when AAD was supplied: with none there is no second\n  // interpretation to test, and the failure is a plain tag mismatch.\n  if (aad === undefined) return []\n  try {\n    await subtle.decrypt({ name: 'AES-GCM', iv: iv as BufferSource }, dek, ciphertext as BufferSource)\n  } catch {\n    return [] // no benign explanation — the security alert stands\n  }\n  return [\n    'This record was sealed BEFORE record-identity binding (#1041) and cannot be read by this ' +\n    'version. Its body decrypts correctly under the record key, so this is a data-format ' +\n    'transition, not tampering — but it also means the record predates authenticated metadata. ' +\n    'There is no migration path; see noy-db #1100.',\n    'unbound-legacy-format',\n  ]\n}\n\n// ─── Binary Encrypt / Decrypt ────────\n\n/**\n * Encrypt raw bytes with AES-256-GCM using a fresh random IV.\n * Used by the attachment store so binary blobs avoid double base64 encoding\n * (the existing `encrypt()` function calls `TextEncoder` on a string — here\n * we pass the `Uint8Array` directly to `subtle.encrypt`).\n */\nexport async function encryptBytes(\n  data: Uint8Array,\n  dek: CryptoKey,\n): Promise<EncryptResult> {\n  const iv = generateIV()\n  const ciphertext = await subtle.encrypt(\n    { name: 'AES-GCM', iv: iv as BufferSource },\n    dek,\n    data as unknown as BufferSource,\n  )\n  return {\n    iv: bufferToBase64(iv),\n    data: bufferToBase64(ciphertext),\n  }\n}\n\n/**\n * Decrypt AES-256-GCM ciphertext back to raw bytes.\n * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.\n */\nexport async function decryptBytes(\n  ivBase64: string,\n  dataBase64: string,\n  dek: CryptoKey,\n): Promise<Uint8Array> {\n  const iv = base64ToBuffer(ivBase64)\n  const ciphertext = base64ToBuffer(dataBase64)\n  try {\n    const plaintext = await subtle.decrypt(\n      { name: 'AES-GCM', iv: iv as BufferSource },\n      dek,\n      ciphertext as BufferSource,\n    )\n    return new Uint8Array(plaintext)\n  } catch (err) {\n    if (err instanceof Error && err.name === 'OperationError') {\n      throw new TamperedError()\n    }\n    throw new DecryptionError(\n      err instanceof Error ? err.message : 'Decryption failed',\n    )\n  }\n}\n\n\nexport async function encryptBytesWithAAD(\n  data: Uint8Array,\n  dek: CryptoKey,\n  aad: Uint8Array,\n): Promise<EncryptResult> {\n  const iv = generateIV()\n  const ciphertext = await subtle.encrypt(\n    {\n      name: 'AES-GCM',\n      iv: iv as BufferSource,\n      additionalData: aad as BufferSource,\n    },\n    dek,\n    data as unknown as BufferSource,\n  )\n  return {\n    iv: bufferToBase64(iv),\n    data: bufferToBase64(ciphertext),\n  }\n}\n\n/**\n * Decrypt AES-256-GCM ciphertext with AAD verification.\n *\n * If the AAD does not match the one used at encryption time (e.g. because\n * a chunk was reordered or substituted from another blob), the GCM auth\n * tag fails and this throws `TamperedError`.\n */\nexport async function decryptBytesWithAAD(\n  ivBase64: string,\n  dataBase64: string,\n  dek: CryptoKey,\n  aad: Uint8Array,\n): Promise<Uint8Array> {\n  const iv = base64ToBuffer(ivBase64)\n  const ciphertext = base64ToBuffer(dataBase64)\n  try {\n    const plaintext = await subtle.decrypt(\n      {\n        name: 'AES-GCM',\n        iv: iv as BufferSource,\n        additionalData: aad as BufferSource,\n      },\n      dek,\n      ciphertext as BufferSource,\n    )\n    return new Uint8Array(plaintext)\n  } catch (err) {\n    if (err instanceof Error && err.name === 'OperationError') {\n      throw new TamperedError()\n    }\n    throw new DecryptionError(\n      err instanceof Error ? err.message : 'Decryption failed',\n    )\n  }\n}\n\n// ─── Presence Key Derivation ──────────────────────────────\n\n\nexport async function deriveSealedFieldKey(\n  dek: CryptoKey,\n  collectionName: string,\n  field: string,\n): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-sealed')\n  // JSON-array encoding is injective: each element is separately quoted/\n  // escaped, so collection `a/sealed/b` + field `c` cannot collide with\n  // collection `a` + field `b/sealed/c`.\n  const info = new TextEncoder().encode(JSON.stringify(['noydb-sealed', collectionName, field]))\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Derive a per-record sealed-field key from the record's **per-record CEK**\n * rather than the collection DEK. Same HKDF construction as\n * {@link deriveSealedFieldKey} but with salt `'noydb-sealed-cek'` (distinct\n * from `'noydb-sealed'`), so a CEK-derived key can never collide with a\n * DEK-derived one for the same `{collection, field}`.\n *\n * The point: the sealed ciphertext's only key now flows from the record's CEK.\n * Dropping the record's wrapped `_cek` (crypto-shred / `forget`) makes the key\n * — and thus `_sealed[field]` — unrecoverable, giving sealed fields the same\n * erasure guarantee `_data` already has. The CEK must be extractable (it is —\n * `unwrapCek`/`generateDEK` mint extractable keys).\n *\n * @param cek            The record's AES-256-GCM CEK (extractable).\n * @param collectionName Part of the HKDF `info` for domain separation.\n * @param field          Sensitive field name — the rest of the `info`.\n * @returns A non-extractable AES-256-GCM key for that field's sealed slot.\n */\nexport async function deriveSealedFieldKeyFromCek(\n  cek: CryptoKey,\n  collectionName: string,\n  field: string,\n): Promise<CryptoKey> {\n  const rawCek = await subtle.exportKey('raw', cek)\n  const hkdfKey = await subtle.importKey('raw', rawCek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-sealed-cek')\n  const info = new TextEncoder().encode(JSON.stringify(['noydb-sealed-cek', collectionName, field]))\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n// ─── Deterministic Encryption ────────────────────────────\n\n/**\n * Derive the collection's **dedicated deterministic-index key** from its DEK\n * via HKDF-SHA256 (L-1, #554).\n *\n * `_det` slots previously encrypted under the raw collection DEK — the same\n * key `_data` uses with a *randomized*-IV regime while `_det` uses a\n * *deterministic*-IV regime. Two IV regimes on one key is avoidable hygiene\n * debt (~2^-96 theoretical collision), so the deterministic index now gets its\n * own HKDF-separated key: salt `'noydb-det'`, info\n * `JSON.stringify(['noydb-det'])` (the injective JSON-array domain tag, same\n * convention as {@link deriveSealedFieldKey}). Per-field separation still\n * comes from the `'<collection>/<field>'` context inside\n * {@link encryptDeterministic}, exactly as before.\n *\n * The derived key stays **DEK-derived (collection-level)** on purpose: `_det`\n * is carried verbatim through per-record CEK rotation (see\n * `record-keys/sealing.ts`), so its key must not depend on the CEK. It rotates\n * with the collection DEK, like the presence key.\n *\n * The key is minted **extractable** — {@link encryptDeterministic} derives its\n * per-value IV via HKDF over the raw key bytes (an `exportKey` under the\n * hood), which a non-extractable key would forbid. Same in-memory posture as\n * the DEK itself (`generateDEK` mints extractable keys).\n *\n * @param dek The collection's AES-256-GCM DEK (extractable).\n * @returns A dedicated AES-256-GCM key for the `_det` deterministic index.\n */\nexport async function deriveDeterministicKey(dek: CryptoKey): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-det')\n  const info = new TextEncoder().encode(JSON.stringify(['noydb-det']))\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    true,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Derive a deterministic 12-byte IV from `{ DEK, context, plaintext }`\n * via HKDF-SHA256. Given the same three inputs, the IV is identical, so\n * `encryptDeterministic` produces the same ciphertext on every call —\n * which is precisely what enables blind equality search on encrypted\n * fields.\n *\n * **The side channel this opens.** Two records whose field value is the\n * same produce the same ciphertext. An observer with store access can\n * therefore tell which records share a value — not *what* the value is,\n * but the equivalence class. This is the well-known trade-off of\n * deterministic encryption and is why the feature is strictly opt-in\n * per field, guarded by `acknowledgeDeterministicRisk: true` at\n * collection creation.\n *\n * The context string MUST include the collection name and field name,\n * so:\n *   - The same plaintext in two different fields encrypts differently\n *     (no cross-field equality leak).\n *   - The same plaintext in two different collections (different DEKs)\n *     encrypts differently by virtue of the key, even before HKDF\n *     domain separation kicks in.\n */\nasync function deriveDeterministicIV(\n  dek: CryptoKey,\n  context: string,\n  plaintext: string,\n): Promise<Uint8Array> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-deterministic-v1')\n  const info = new TextEncoder().encode(`${context}\\x00${plaintext}`)\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    IV_BYTES * 8,\n  )\n  return new Uint8Array(bits)\n}\n\n/**\n * Encrypt a plaintext string with AES-256-GCM and a deterministic,\n * HKDF-derived IV.\n *\n * The same `{ dek, context, plaintext }` triple always produces the\n * same `{ iv, data }` — call this twice and you can string-compare the\n * ciphertexts to check equality of the inputs without decrypting them.\n *\n * @param context  Domain-separation string — by convention\n *                 `'<collection>/<field>'`. Different contexts encrypt\n *                 the same plaintext to different ciphertexts, so\n *                 `email` in collection `users` does not collide with\n *                 `email` in collection `customers`.\n */\nexport async function encryptDeterministic(\n  plaintext: string,\n  dek: CryptoKey,\n  context: string,\n): Promise<EncryptResult> {\n  const iv = await deriveDeterministicIV(dek, context, plaintext)\n  const encoded = new TextEncoder().encode(plaintext)\n  const ciphertext = await subtle.encrypt(\n    { name: 'AES-GCM', iv: iv as BufferSource },\n    dek,\n    encoded,\n  )\n  return {\n    iv: bufferToBase64(iv),\n    data: bufferToBase64(ciphertext),\n  }\n}\n\n/**\n * Counterpart to {@link encryptDeterministic}. The IV is stored\n * alongside the ciphertext (exactly like the randomized path), so\n * decrypt uses the stored IV and verifies the GCM auth tag — a tampered\n * ciphertext throws `TamperedError` just like randomized AES-GCM.\n */\nexport async function decryptDeterministic(\n  ivBase64: string,\n  dataBase64: string,\n  dek: CryptoKey,\n): Promise<string> {\n  return decrypt(ivBase64, dataBase64, dek)\n}\n\n// ─── Random Generation ─────────────────────────────────────────────────\n\n\nexport async function generateRecipientKeyPair(): Promise<CryptoKeyPair> {\n  return subtle.generateKey(\n    { name: 'RSA-OAEP', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },\n    true,\n    ['encrypt', 'decrypt'],\n  )\n}\n\nexport async function exportRecipientPublicKeySpki(pair: CryptoKeyPair): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.exportKey('spki', pair.publicKey))\n}\n\nexport async function importRecipientPublicKeySpki(spki: Uint8Array): Promise<CryptoKey> {\n  return subtle.importKey('spki', spki as BufferSource, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, ['encrypt'])\n}\n\n/** RSA-OAEP-encrypt `bytes` (a 32-byte CEK) to the recipient's public key. */\nexport async function recipientWrap(pub: CryptoKey, bytes: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.encrypt({ name: 'RSA-OAEP' }, pub, bytes as BufferSource))\n}\n\n/**\n * RSA-OAEP-decrypt with the pair's private key. Propagates WebCrypto's own\n * error on failure — callers that need a typed error map it themselves.\n */\nexport async function recipientUnwrap(pair: CryptoKeyPair, wrapped: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.decrypt({ name: 'RSA-OAEP' }, pair.privateKey, wrapped as BufferSource))\n}\n\n// ─── Base64 Helpers ────────────────────────────────────────────────────\n\n\n","/**\n * The `_vdig` slot payload + crypto (stage 2, spec §2).\n *\n * A `_vdig[field]` blob is AES-256-GCM `\"iv:data\"` sealed under an\n * HKDF(CEK) slot key with AAD = ['noydb-classify-vdig', collection,\n * recordId, field] (C1 rollback-splice hardening). The AAD is NOT stored —\n * readers reconstruct it. It is deliberately `_v`-independent: C6's\n * carry-forward copies blob bytes verbatim across version bumps; the\n * same-record same-field TEMPORAL rollback residual is detected by the\n * ledger's conditional `_vdig` binding (envelope-body.ts).\n *\n * CEK-ONLY (I3): there is no DEK derivation and no\n * 'noydb-classify-vdig-dek' salt domain — every vdig slot dies with the\n * record's `_cek` (forget() shreds it totally; no vdig-dekResidue class).\n * @module\n */\nimport { encryptBytesWithAAD, decryptBytesWithAAD, type EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer } from '../../plumbing/digest.js'\nimport { TamperedError } from '../../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\nexport const VDIG_SALT_DOMAIN = 'noydb-classify-vdig'\n\nexport interface VdigDigestEntry {\n  readonly salt: string   // base64 32-byte per-write random salt\n  readonly hash: string   // base64 32-byte pbkdf2VerifyDigest output\n}\n\nexport interface VdigPayload {\n  readonly v: 1\n  readonly alg: 'PBKDF2-SHA256'\n  readonly iter: number\n  readonly cur: VdigDigestEntry & { readonly at: string }  // ISO write-time\n  /** Previous digests, oldest-first, length ≤ notLastN (cap 8). */\n  readonly ring?: readonly VdigDigestEntry[]\n}\n\n/** Injective JSON-array AAD — same collision argument as deriveSealedFieldKey. */\nexport function buildVdigAad(collection: string, recordId: string, field: string): Uint8Array {\n  return new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, recordId, field]))\n}\n\n/** HKDF(CEK) → non-extractable AES-256-GCM vdig slot key. CEK-only (I3). */\nexport async function deriveVdigSlotKey(\n  cek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<EnclaveKey> {\n  const raw = await subtle.exportKey('raw', cek)\n  const hkdf = await subtle.importKey('raw', raw, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(VDIG_SALT_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdf, 256)\n  return subtle.importKey('raw', bits, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt'])\n}\n\nexport async function sealVdigPayload(\n  payload: VdigPayload,\n  cek: EnclaveKey,\n  collection: string,\n  recordId: string,\n  field: string,\n): Promise<string> {\n  const key = await deriveVdigSlotKey(cek, collection, field)\n  const { iv, data } = await encryptBytesWithAAD(\n    new TextEncoder().encode(JSON.stringify(payload)),\n    key,\n    buildVdigAad(collection, recordId, field),\n  )\n  return `${iv}:${data}`\n}\n\n/** Throws TamperedError on any AAD / auth-tag mismatch (C1). */\nexport async function openVdigPayload(\n  blob: string,\n  cek: EnclaveKey,\n  collection: string,\n  recordId: string,\n  field: string,\n): Promise<VdigPayload> {\n  const sep = blob.indexOf(':')\n  if (sep === -1) throw new TamperedError()\n  const ivPart = blob.slice(0, sep)\n  const dataPart = blob.slice(sep + 1)\n  try {\n    base64ToBuffer(ivPart)\n    base64ToBuffer(dataPart)\n  } catch {\n    throw new TamperedError()\n  }\n  const key = await deriveVdigSlotKey(cek, collection, field)\n  const bytes = await decryptBytesWithAAD(\n    ivPart,\n    dataPart,\n    key,\n    buildVdigAad(collection, recordId, field),\n  )\n  return JSON.parse(new TextDecoder().decode(bytes)) as VdigPayload\n}\n","/**\n * Digest-only write engine (C6 rotate branch + notLastN ring, spec §2/§4).\n * Called ONLY by RecordCodec.encryptRecord — both live inside the enclave.\n * @module\n */\nimport { type EnclaveKey } from '../crypto.js'\nimport { generateSalt, bufferToBase64, base64ToBuffer } from '../../plumbing/digest.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify } from '../../plumbing/normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { sealVdigPayload, openVdigPayload, type VdigPayload, type VdigDigestEntry } from './vdig.js'\nimport { ClassifiedRotationError, TamperedError } from '../../../kernel/errors.js'\nimport type { VdigFieldPolicy } from '../../../kernel/types.js'\n\nexport async function mintVdigSlot(\n  rawValue: string,\n  policy: VdigFieldPolicy,\n  prevBlob: string | undefined,\n  cek: EnclaveKey,\n  collection: string,\n  recordId: string,\n  field: string,\n): Promise<string> {\n  const normalized = normalizeForVerify(policy.normalize, rawValue)\n\n  let prev: VdigPayload | null = null\n  if (prevBlob !== undefined) {\n    try {\n      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field)\n    } catch {\n      // Any failure opening a prior _vdig slot (auth-tag mismatch, malformed\n      // JSON, wrong AAD) is a tamper/false condition — normalize to\n      // TamperedError so the write path never sees a distinct error shape.\n      throw new TamperedError()\n    }\n    if (!Number.isInteger(prev.iter) || prev.iter < 1) {\n      // A corrupted/tampered iter count would silently weaken (or break)\n      // the reuse-check PBKDF2 pass — floor/validate before trusting it.\n      throw new TamperedError()\n    }\n  }\n\n  // notLastN reuse refusal: candidate vs cur + every ring entry, each a full\n  // PBKDF2 at the payload's own iteration count (n × 600K is the documented\n  // write-time cost ceiling, cap 8 — spec Q4).\n  if (prev !== null && policy.notLastN > 0) {\n    const history: readonly VdigDigestEntry[] = [prev.cur, ...(prev.ring ?? [])]\n    for (const entry of history) {\n      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter)\n      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {\n        throw new ClassifiedRotationError(collection, field, 'password was used recently')\n      }\n    }\n  }\n\n  const salt = generateSalt()\n  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS)\n  const ring = prev !== null && policy.notLastN > 0\n    ? [...(prev.ring ?? []), { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN)\n    : undefined\n\n  const payload: VdigPayload = {\n    v: 1,\n    alg: 'PBKDF2-SHA256',\n    iter: VDIG_ITERATIONS,\n    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: new Date().toISOString() },\n    ...(ring !== undefined && ring.length > 0 ? { ring } : {}),\n  }\n  return sealVdigPayload(payload, cek, collection, recordId, field)\n}\n","/**\n * `enclave-aes` as a {@link CapsulePrimitives} — the 13 functions the shared\n * plumbing binds to.\n *\n * ⭐ THE ASSIGNMENT BELOW IS A TEST, and it is the reason this file exists as\n * a file rather than an inline object at the `makeCapsule()` call. Declaring\n * the seam type and implementing it are two different acts; nothing checks a\n * hand-written interface against the module it claims to describe unless\n * something binds one to the other. This binding caught two errors in the\n * declaration within minutes of it being written:\n *\n *   - `deriveDeterministicKey` was declared `(dek, context)`. It takes ONE\n *     argument — the AES capsule derives the context into the IV, not the key.\n *   - `bufferToBase64` was declared `(bytes: Uint8Array)`. It also accepts an\n *     `ArrayBuffer`, which is what its callers actually pass.\n *\n * Both would have compiled here and failed at the far end of the refactor,\n * where the cause is no longer visible. (The same lesson as `#16`: a\n * structural declaration drifts silently from its implementation until an\n * assignment pins the two together.)\n *\n * ⚠️ Method shorthand in `CapsulePrimitives` is checked BIVARIANTLY, so this\n * assignment does NOT catch parameter-arity drift — that is exactly how the\n * `deriveDeterministicKey` mistake survived the type and was caught by a call\n * site instead. Keep the conformance kit's call-site coverage; this assignment\n * is necessary, not sufficient.\n */\nimport type { CapsulePrimitives } from '../contract.js'\nimport { encrypt, decrypt, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, generateDEK, wrapCek, unwrapCek } from './crypto.js'\nimport { bufferToBase64 } from '../plumbing/digest.js'\nimport { mintVdigSlot } from './classify/write.js'\nimport { mintBidxTag } from './classify/bidx.js'\nimport { openVdigPayload, sealVdigPayload } from './classify/vdig.js'\n\nexport const aesPrimitives: CapsulePrimitives = {\n  encrypt,\n  decrypt,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  encryptDeterministic,\n  deriveDeterministicKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  generateDEK,\n  wrapCek,\n  unwrapCek,\n  bufferToBase64,\n  mintVdigSlot,\n  mintBidxTag,\n  openVdigPayload,\n  sealVdigPayload,\n}\n","/**\n * The AES capsule, assembled: hub's shared plumbing bound to `aesPrimitives`.\n *\n * `classify/**` stays capsule-private (it is an optional group an exclave\n * refuses) but still needs `dualReadSealedSlot`, which is plumbing. Binding it\n * once here keeps `reveal.ts`/`verify.ts` from each building their own copy —\n * two bindings of the same primitives would work, but they would be two\n * objects, and `instanceof` across them is the class of bug the Stage B door\n * test caught by asserting identity rather than names.\n */\nimport { makeCapsule } from '../plumbing/index.js'\nimport { aesPrimitives } from './primitives.js'\n\nexport const aesCapsule = makeCapsule(aesPrimitives)\nexport const { dualReadSealedSlot } = aesCapsule\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,IAAM,SAAS,WAAW,OAAO;AAUjC,eAAsB,aAAa,GAAe,GAAiC;AACjF,QAAM,KAAK,MAAM,OAAO,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACtF,QAAM,OAAO,IAAI,WAAW,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAiB,CAAC;AAC5E,QAAM,OAAO,IAAI,WAAW,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAiB,CAAC;AAC5E,SAAO,YAAY,MAAM,IAAI;AAC/B;;;ACmCA,IAAM,oBAAoB;AAE1B,IAAMA,UAAS,WAAW,OAAO;AAKjC,eAAsB,UACpB,QACA,MACoB;AACpB,SAAO,sBAAsB,IAAI,YAAY,EAAE,OAAO,MAAM,GAAG,IAAI;AACrE;AAOA,eAAe,sBACb,UACA,MACoB;AACpB,QAAM,cAAc,MAAMA,QAAO,UAAU,OAAO,UAA0B,UAAU,OAAO,CAAC,WAAW,CAAC;AAC1G,SAAOA,QAAO;AAAA,IACZ,EAAE,MAAM,UAAU,MAA4B,YAAY,mBAAmB,MAAM,UAAU;AAAA,IAC7F;AAAA,IACA,EAAE,MAAM,UAAU,QAAQ,SAAS;AAAA,IACnC;AAAA,IACA,CAAC,WAAW,WAAW;AAAA,EACzB;AACF;AAUA,eAAsB,cACpB,OACA,MACoB;AACpB,SAAO,sBAAsB,gBAAgB,KAAK,GAAG,IAAI;AAC3D;AAkBA,eAAsB,gBACpB,QACA,MACA,QACoB;AACpB,QAAM,cAAc,MAAMA,QAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,CAAC,WAAW;AAAA,EACd;AAEA,SAAO,OAAO,aAAa,YACvBA,QAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,YAAY,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB,IACAA,QAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,YAAY,OAAO;AAAA,MACnB,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA,EAAE,MAAM,UAAU,QAAQ,SAAS;AAAA,IACnC;AAAA,IACA,CAAC,WAAW,WAAW;AAAA,EACzB;AACN;AAKA,eAAsB,cAAkC;AACtD,SAAOA,QAAO;AAAA,IACZ,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAQA,eAAsB,uBAA2C;AAC/D,SAAOA,QAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,SAAS,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;AAChG;AAaA,eAAsB,aAAa,MAA+D;AAChG,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,MAAM,GAAG,KAAK,MAAM;AAC9B,QAAI,IAAI,IAAI,eAAe,MAAMA,QAAO,UAAU,OAAO,GAAG,CAAC;AAAA,EAC/D;AACA,SAAO;AACT;AAMA,eAAsB,aAAa,UAAmE;AACpG,QAAM,OAAO,oBAAI,IAAuB;AACxC,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAClD,UAAM,MAAM,MAAMA,QAAO;AAAA,MACvB;AAAA,MACA,eAAe,GAAG;AAAA,MAClB,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,MACpC;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AACA,SAAK,IAAI,MAAM,GAAG;AAAA,EACpB;AACA,SAAO;AACT;AAKA,eAAsB,QAAQ,KAAgB,KAAiC;AAC7E,QAAM,UAAU,MAAMA,QAAO,QAAQ,OAAO,KAAK,KAAK,QAAQ;AAC9D,SAAO,eAAe,OAAO;AAC/B;AAGA,eAAsB,UACpB,eACA,KACoB;AACpB,MAAI;AACF,WAAO,MAAMA,QAAO;AAAA,MAClB;AAAA,MACA,eAAe,aAAa;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,MACpC;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACF;AAYA,eAAsB,WAAW,KAAgB,WAAwC;AACvF,QAAM,WAAW,MAAMA,QAAO;AAAA,IAC5B;AAAA,IAAO;AAAA,IAA2B,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IAAG;AAAA,IAAM,CAAC,WAAW,SAAS;AAAA,EACtG;AACA,SAAO,QAAQ,UAAU,GAAG;AAC9B;AAGA,eAAsB,YAAY,SAAiB,KAAkC;AACnF,MAAI;AACF,UAAM,UAAU,SAAS,GAAG;AAC5B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAsBA,eAAe,QAAQ,KAAoC;AACzD,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB;AACtD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC1C,QAAM,OAAO,MAAMA,QAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,SAAOA,QAAO,UAAU,OAAO,MAAM,UAAU,OAAO,CAAC,WAAW,WAAW,CAAC;AAChF;AAMA,eAAsB,QAAQ,KAAgB,KAAiC;AAC7E,QAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,QAAM,UAAU,MAAMA,QAAO,QAAQ,OAAO,KAAK,IAAI,QAAQ;AAC7D,SAAO,eAAe,OAAO;AAC/B;AAMA,eAAsB,UAAU,eAAuB,KAAoC;AACzF,QAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,MAAI;AACF,WAAO,MAAMA,QAAO;AAAA,MAClB;AAAA,MACA,eAAe,aAAa;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,MACpC;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACF;AAOA,eAAsB,UAAU,QAAwC;AACtE,SAAOA,QAAO,UAAU,OAAO,QAAwB,EAAE,MAAM,WAAW,QAAQ,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAClH;AAQA,eAAsB,kBAAkB,KAAqC;AAC3E,MAAI,IAAI,eAAe,IAAI;AACzB,UAAM,IAAI,gBAAgB,sCAAsC,IAAI,UAAU,GAAG;AAAA,EACnF;AACA,SAAOA,QAAO,UAAU,OAAO,KAAqB,EAAE,MAAM,WAAW,QAAQ,SAAS,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;AAC1H;AAsBA,eAAsB,QACpB,WACA,KACA,KACwB;AACxB,QAAM,KAAK,WAAW;AACtB,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS;AAElD,QAAM,aAAa,MAAMA,QAAO;AAAA,IAC9B;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,UAAa,EAAE,gBAAgB,IAAoB;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,eAAe,EAAE;AAAA,IACrB,MAAM,eAAe,UAAU;AAAA,EACjC;AACF;AAWA,eAAsB,QACpB,UACA,YACA,KACA,KACiB;AACjB,QAAM,KAAK,eAAe,QAAQ;AAClC,QAAM,aAAa,eAAe,UAAU;AAE5C,MAAI;AACF,UAAM,YAAY,MAAMA,QAAO;AAAA,MAC7B;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,GAAI,QAAQ,UAAa,EAAE,gBAAgB,IAAoB;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,SAAS,kBAAkB;AACzD,YAAM,IAAI,cAAc,GAAI,MAAM,mBAAmB,IAAI,YAAY,KAAK,GAAG,CAAE;AAAA,IACjF;AACA,UAAM,IAAI;AAAA,MACR,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AAAA,EACF;AACF;AAqCA,eAAe,mBACb,IACA,YACA,KACA,KACiD;AAGjD,MAAI,QAAQ,OAAW,QAAO,CAAC;AAC/B,MAAI;AACF,UAAMA,QAAO,QAAQ,EAAE,MAAM,WAAW,GAAuB,GAAG,KAAK,UAA0B;AAAA,EACnG,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,SAAO;AAAA,IACL;AAAA,IAIA;AAAA,EACF;AACF;AAUA,eAAsB,aACpB,MACA,KACwB;AACxB,QAAM,KAAK,WAAW;AACtB,QAAM,aAAa,MAAMA,QAAO;AAAA,IAC9B,EAAE,MAAM,WAAW,GAAuB;AAAA,IAC1C;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,eAAe,EAAE;AAAA,IACrB,MAAM,eAAe,UAAU;AAAA,EACjC;AACF;AAMA,eAAsB,aACpB,UACA,YACA,KACqB;AACrB,QAAM,KAAK,eAAe,QAAQ;AAClC,QAAM,aAAa,eAAe,UAAU;AAC5C,MAAI;AACF,UAAM,YAAY,MAAMA,QAAO;AAAA,MAC7B,EAAE,MAAM,WAAW,GAAuB;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AACA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,SAAS,kBAAkB;AACzD,YAAM,IAAI,cAAc;AAAA,IAC1B;AACA,UAAM,IAAI;AAAA,MACR,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AAAA,EACF;AACF;AAGA,eAAsB,oBACpB,MACA,KACA,KACwB;AACxB,QAAM,KAAK,WAAW;AACtB,QAAM,aAAa,MAAMA,QAAO;AAAA,IAC9B;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,eAAe,EAAE;AAAA,IACrB,MAAM,eAAe,UAAU;AAAA,EACjC;AACF;AASA,eAAsB,oBACpB,UACA,YACA,KACA,KACqB;AACrB,QAAM,KAAK,eAAe,QAAQ;AAClC,QAAM,aAAa,eAAe,UAAU;AAC5C,MAAI;AACF,UAAM,YAAY,MAAMA,QAAO;AAAA,MAC7B;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,SAAS,kBAAkB;AACzD,YAAM,IAAI,cAAc;AAAA,IAC1B;AACA,UAAM,IAAI;AAAA,MACR,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AAAA,EACF;AACF;AAKA,eAAsB,qBACpB,KACA,gBACA,OACoB;AACpB,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AAIpD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,gBAAgB,gBAAgB,KAAK,CAAC,CAAC;AAC7F,QAAM,OAAO,MAAMA,QAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,SAAOA,QAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAoBA,eAAsB,4BACpB,KACA,gBACA,OACoB;AACpB,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,kBAAkB;AACxD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,oBAAoB,gBAAgB,KAAK,CAAC,CAAC;AACjG,QAAM,OAAO,MAAMA,QAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,SAAOA,QAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AA+BA,eAAsB,uBAAuB,KAAoC;AAC/E,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,WAAW;AACjD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAC;AACnE,QAAM,OAAO,MAAMA,QAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,SAAOA,QAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAyBA,eAAe,sBACb,KACA,SACA,WACqB;AACrB,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,wBAAwB;AAC9D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,OAAO,KAAO,SAAS,EAAE;AAClE,QAAM,OAAO,MAAMA,QAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA,WAAW;AAAA,EACb;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAgBA,eAAsB,qBACpB,WACA,KACA,SACwB;AACxB,QAAM,KAAK,MAAM,sBAAsB,KAAK,SAAS,SAAS;AAC9D,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS;AAClD,QAAM,aAAa,MAAMA,QAAO;AAAA,IAC9B,EAAE,MAAM,WAAW,GAAuB;AAAA,IAC1C;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,eAAe,EAAE;AAAA,IACrB,MAAM,eAAe,UAAU;AAAA,EACjC;AACF;AAQA,eAAsB,qBACpB,UACA,YACA,KACiB;AACjB,SAAO,QAAQ,UAAU,YAAY,GAAG;AAC1C;AAKA,eAAsB,2BAAmD;AACvE,SAAOA,QAAO;AAAA,IACZ,EAAE,MAAM,YAAY,eAAe,MAAM,gBAAgB,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,MAAM,UAAU;AAAA,IACpG;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAEA,eAAsB,6BAA6B,MAA0C;AAC3F,SAAO,IAAI,WAAW,MAAMA,QAAO,UAAU,QAAQ,KAAK,SAAS,CAAC;AACtE;AAEA,eAAsB,6BAA6B,MAAsC;AACvF,SAAOA,QAAO,UAAU,QAAQ,MAAsB,EAAE,MAAM,YAAY,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;AACjH;AAGA,eAAsB,cAAc,KAAgB,OAAwC;AAC1F,SAAO,IAAI,WAAW,MAAMA,QAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,KAAK,KAAqB,CAAC;AAC9F;AAMA,eAAsB,gBAAgB,MAAqB,SAA0C;AACnG,SAAO,IAAI,WAAW,MAAMA,QAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,KAAK,YAAY,OAAuB,CAAC;AAC5G;;;ACj0BA,IAAMC,UAAS,WAAW,OAAO;AAE1B,IAAM,mBAAmB;AAiBzB,SAAS,aAAa,YAAoB,UAAkB,OAA2B;AAC5F,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,kBAAkB,YAAY,UAAU,KAAK,CAAC,CAAC;AACjG;AAGA,eAAsB,kBACpB,KACA,YACA,OACqB;AACrB,QAAM,MAAM,MAAMA,QAAO,UAAU,OAAO,GAAG;AAC7C,QAAM,OAAO,MAAMA,QAAO,UAAU,OAAO,KAAK,QAAQ,OAAO,CAAC,YAAY,CAAC;AAC7E,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB;AACtD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,kBAAkB,YAAY,KAAK,CAAC,CAAC;AAC3F,QAAM,OAAO,MAAMA,QAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,MAAM,GAAG;AAC7F,SAAOA,QAAO,UAAU,OAAO,MAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;AACtG;AAEA,eAAsB,gBACpB,SACA,KACA,YACA,UACA,OACiB;AACjB,QAAM,MAAM,MAAM,kBAAkB,KAAK,YAAY,KAAK;AAC1D,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAChD;AAAA,IACA,aAAa,YAAY,UAAU,KAAK;AAAA,EAC1C;AACA,SAAO,GAAG,EAAE,IAAI,IAAI;AACtB;AAGA,eAAsB,gBACpB,MACA,KACA,YACA,UACA,OACsB;AACtB,QAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,MAAI,QAAQ,GAAI,OAAM,IAAI,cAAc;AACxC,QAAM,SAAS,KAAK,MAAM,GAAG,GAAG;AAChC,QAAM,WAAW,KAAK,MAAM,MAAM,CAAC;AACnC,MAAI;AACF,mBAAe,MAAM;AACrB,mBAAe,QAAQ;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,cAAc;AAAA,EAC1B;AACA,QAAM,MAAM,MAAM,kBAAkB,KAAK,YAAY,KAAK;AAC1D,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,YAAY,UAAU,KAAK;AAAA,EAC1C;AACA,SAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACnD;;;ACrFA,eAAsB,aACpB,UACA,QACA,UACA,KACA,YACA,UACA,OACiB;AACjB,QAAM,aAAa,mBAAmB,OAAO,WAAW,QAAQ;AAEhE,MAAI,OAA2B;AAC/B,MAAI,aAAa,QAAW;AAC1B,QAAI;AACF,aAAO,MAAM,gBAAgB,UAAU,KAAK,YAAY,UAAU,KAAK;AAAA,IACzE,QAAQ;AAIN,YAAM,IAAI,cAAc;AAAA,IAC1B;AACA,QAAI,CAAC,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,GAAG;AAGjD,YAAM,IAAI,cAAc;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,SAAS,QAAQ,OAAO,WAAW,GAAG;AACxC,UAAM,UAAsC,CAAC,KAAK,KAAK,GAAI,KAAK,QAAQ,CAAC,CAAE;AAC3E,eAAW,SAAS,SAAS;AAC3B,YAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,MAAM,IAAI,GAAG,KAAK,IAAI;AACzF,UAAI,MAAM,aAAa,QAAQ,eAAe,MAAM,IAAI,CAAC,GAAG;AAC1D,cAAM,IAAI,wBAAwB,YAAY,OAAO,4BAA4B;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,aAAa;AAC1B,QAAM,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe;AACvE,QAAM,OAAO,SAAS,QAAQ,OAAO,WAAW,IAC5C,CAAC,GAAI,KAAK,QAAQ,CAAC,GAAI,EAAE,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,IAAI,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,QAAQ,IAC3F;AAEJ,QAAM,UAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK,EAAE,MAAM,eAAe,IAAI,GAAG,MAAM,eAAe,IAAI,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC5F,GAAI,SAAS,UAAa,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,SAAO,gBAAgB,SAAS,KAAK,YAAY,UAAU,KAAK;AAClE;;;ACnCO,IAAM,gBAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACtCO,IAAM,aAAa,YAAY,aAAa;AAC5C,IAAM,EAAE,mBAAmB,IAAI;","names":["subtle","subtle"]}

package/dist/{chunk-RSGLUIO6.js → chunk-5UMK7GRI.js}

@@ -1,25 +1,26 @@
+import {
+  ENCLAVE_SCHEME
+} from "./chunk-JWWYRR4Q.js";
 import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-G73UVHCA.js";
+} from "./chunk-DLD5LGDS.js";
+import {
+  signRevocationList
+} from "./chunk-GMKGGY7V.js";
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/attestation/revoke.ts
-import { signRevocationList } from "@noy-db/attestation";
 function requireOwner(ctx, op) {
   if (ctx.role !== "owner") {
     throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`);
@@ -72,7 +73,7 @@ async function publishRevocationListCore(ctx) {
   requireOwner(ctx, "publishRevocationList");
   const docIds = await getRevokedDocIdsCore(ctx);
   const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK());
-  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64);
+  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME);
 }
 
 export {
@@ -81,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-RSGLUIO6.js.map
+//# sourceMappingURL=chunk-5UMK7GRI.js.map

package/dist/chunk-5UMK7GRI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/revoke.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport { AttestationError, ConflictError } from '../../kernel/errors.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID } from './signer.js'\nimport { ENCLAVE_SCHEME } from './scheme.js'\nimport { signRevocationList } from '@noy-db/attestation'\nimport type { RevocationList } from './types.js'\n\n/** Everything the revoke core needs from the Vault, injected for testability. */\nexport interface RevokeContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK. */\n  getDEK(): Promise<EnclaveKey>\n}\n\ninterface RevokedSet {\n  docIds: string[]\n  updatedAt: string\n}\n\nfunction requireOwner(ctx: RevokeContext, op: string): void {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`)\n  }\n}\n\nasync function readSet(store: NoydbStore, vault: string, dek: EnclaveKey): Promise<{ docIds: Set<string>; version: number | undefined }> {\n  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID)\n  if (!env) return { docIds: new Set<string>(), version: undefined }\n  const set = JSON.parse(await openEnvelopeJson({ collection: ATTESTATIONS_COLLECTION, id: REVOKED_RECORD_ID }, env, dek)) as RevokedSet\n  return { docIds: new Set(set.docIds), version: env._v }\n}\n\n/** Read-modify-write the _revoked set with optimistic concurrency + one retry. */\nasync function mutateSet(ctx: RevokeContext, mutate: (ids: Set<string>) => void): Promise<void> {\n  const dek = await ctx.getDEK()\n  for (let attempt = 0; attempt < 2; attempt++) {\n    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek)\n    mutate(docIds)\n    const payload: RevokedSet = { docIds: [...docIds].sort(), updatedAt: new Date().toISOString() }\n    const expectedVersion = version ?? 0\n    const identity = { collection: ATTESTATIONS_COLLECTION, id: REVOKED_RECORD_ID, version: expectedVersion + 1 }\n    const { iv, data } = await encrypt(JSON.stringify(payload), dek, buildRecordAad(identity))\n    const env = buildRecordEnvelope(\n      identity,\n      { ts: payload.updatedAt, iv, data },\n    )\n    try {\n      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion)\n      return\n    } catch (e) {\n      if (e instanceof ConflictError && attempt === 0) continue\n      throw e\n    }\n  }\n}\n\nexport async function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'revokeAttestation')\n  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId)\n  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`)\n  await mutateSet(ctx, (ids) => ids.add(docId))\n}\n\nexport async function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'unrevokeAttestation')\n  await mutateSet(ctx, (ids) => ids.delete(docId))\n}\n\nexport async function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]> {\n  const dek = await ctx.getDEK()\n  const { docIds } = await readSet(ctx.store, ctx.vault, dek)\n  return [...docIds].sort()\n}\n\nexport async function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList> {\n  requireOwner(ctx, 'publishRevocationList')\n  const docIds = await getRevokedDocIdsCore(ctx)\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK())\n  return signRevocationList(docIds, new Date().toISOString(), signer.keyId, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,aAAa,KAAoB,IAAkB;AAC1D,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,GAAG,EAAE,0CAA0C,IAAI,IAAI,iDAAiD;AAAA,EACrI;AACF;AAEA,eAAe,QAAQ,OAAmB,OAAe,KAAgF;AACvI,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,yBAAyB,iBAAiB;AAC7E,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,SAAS,OAAU;AACjE,QAAM,MAAM,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,yBAAyB,IAAI,kBAAkB,GAAG,KAAK,GAAG,CAAC;AACvH,SAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,IAAI,GAAG;AACxD;AAGA,eAAe,UAAU,KAAoB,QAAmD;AAC9F,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AACnE,WAAO,MAAM;AACb,UAAM,UAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC9F,UAAM,kBAAkB,WAAW;AACnC,UAAM,WAAW,EAAE,YAAY,yBAAyB,IAAI,mBAAmB,SAAS,kBAAkB,EAAE;AAC5G,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,KAAK,eAAe,QAAQ,CAAC;AACzF,UAAM,MAAM;AAAA,MACV;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,IAAI,KAAK;AAAA,IACpC;AACA,QAAI;AACF,YAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,mBAAmB,KAAK,eAAe;AAC/F;AAAA,IACF,SAAS,GAAG;AACV,UAAI,aAAa,iBAAiB,YAAY,EAAG;AACjD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,KAAoB,OAA8B;AACpF,eAAa,KAAK,mBAAmB;AACrC,QAAM,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,KAAK;AAC5E,MAAI,CAAC,OAAQ,OAAM,IAAI,iBAAiB,mCAAmC,KAAK,6CAA6C;AAC7H,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;AAC9C;AAEA,eAAsB,gBAAgB,KAAoB,OAA8B;AACtF,eAAa,KAAK,qBAAqB;AACvC,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC;AACjD;AAEA,eAAsB,qBAAqB,KAAuC;AAChF,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AAC1D,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK;AAC1B;AAEA,eAAsB,0BAA0B,KAA6C;AAC3F,eAAa,KAAK,uBAAuB;AACzC,QAAM,SAAS,MAAM,qBAAqB,GAAG;AAC7C,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,IAAI,OAAO,CAAC;AAChF,SAAO,mBAAmB,SAAQ,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,oBAAoB,cAAc;AACrH;","names":[]}

package/dist/chunk-5WWDGFOS.js

@@ -0,0 +1,275 @@
+import {
+  UnsafePatternError
+} from "./chunk-37EPTBBR.js";
+
+// src/kernel/query/predicate.ts
+function readPath(record, path) {
+  if (record === null || record === void 0) return void 0;
+  if (!path.includes(".")) {
+    return record[path];
+  }
+  const segments = path.split(".");
+  let cursor = record;
+  for (const segment of segments) {
+    if (cursor === null || cursor === void 0) return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function evaluateFieldClause(record, clause) {
+  const actual = readPath(record, clause.field);
+  const { op, value } = clause;
+  if (clause.via) return clause.via.evaluate(actual, op);
+  return evaluateOperator(actual, op, value);
+}
+function evaluateOperator(actual, op, value) {
+  switch (op) {
+    case "==":
+      return actual === value;
+    case "!=":
+      return actual !== value;
+    case "<":
+      return isComparable(actual, value) && actual < value;
+    case "<=":
+      return isComparable(actual, value) && actual <= value;
+    case ">":
+      return isComparable(actual, value) && actual > value;
+    case ">=":
+      return isComparable(actual, value) && actual >= value;
+    case "in":
+      return Array.isArray(value) && value.includes(actual);
+    case "!in":
+      return !Array.isArray(value) || !value.includes(actual);
+    case "contains":
+      if (typeof actual === "string") return typeof value === "string" && actual.includes(value);
+      if (Array.isArray(actual)) return actual.includes(value);
+      return false;
+    case "startsWith":
+      return typeof actual === "string" && typeof value === "string" && actual.startsWith(value);
+    case "matches": {
+      if (typeof actual !== "string") return false;
+      const re = matchesRegExp(value);
+      return re !== null && re.test(actual);
+    }
+    case "between": {
+      if (!Array.isArray(value) || value.length !== 2) return false;
+      const [lo, hi] = value;
+      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false;
+      return actual >= lo && actual <= hi;
+    }
+    case "near":
+      return false;
+    default: {
+      const _exhaustive = op;
+      void _exhaustive;
+      return false;
+    }
+  }
+}
+function isIdOperandSource(value) {
+  return typeof value === "object" && value !== null && typeof value._asIdOperand === "function";
+}
+function normalizeSubqueryOperand(op, value) {
+  if (op !== "in" && op !== "!in") return { op, value };
+  if (!isIdOperandSource(value)) return { op, value };
+  const { ids, from } = value._asIdOperand();
+  return { op, value: [...ids], subquery: { from, ids: ids.length } };
+}
+var MATCHES_MAX_SOURCE = 200;
+var MATCHES_MAX_GROUP_DEPTH = 5;
+var MATCHES_MAX_QUANTIFIERS = 20;
+function isQuantifier(c) {
+  return c === "*" || c === "+" || c === "?" || c === "{";
+}
+function assertSafePattern(source, flags) {
+  if (source.length > MATCHES_MAX_SOURCE) {
+    throw new UnsafePatternError(
+      `where(..., 'matches', ...): pattern is ${source.length} characters, over the ${MATCHES_MAX_SOURCE}-character budget. Narrow the pattern, or use .filter(fn) and accept that it cannot use an index.`
+    );
+  }
+  for (const f of flags) {
+    if (f === "g" || f === "y") {
+      throw new UnsafePatternError(
+        `where(..., 'matches', ...): the '${f}' flag makes RegExp.test() stateful across records and would silently drop rows. Remove it from /${source}/${flags}.`
+      );
+    }
+  }
+  let quantifiers = 0;
+  let inClass = false;
+  let escaped = false;
+  const groupQuantified = [];
+  for (let i = 0; i < source.length; i++) {
+    const c = source[i];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (c === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]") inClass = false;
+      continue;
+    }
+    if (c === "[") {
+      inClass = true;
+      continue;
+    }
+    if (c === "(") {
+      groupQuantified.push(false);
+      if (groupQuantified.length > MATCHES_MAX_GROUP_DEPTH) {
+        throw new UnsafePatternError(
+          `where(..., 'matches', ...): group nesting exceeds the depth-${MATCHES_MAX_GROUP_DEPTH} budget in /${source}/. Flatten the pattern.`
+        );
+      }
+      if (source[i + 1] === "?") i++;
+      continue;
+    }
+    if (c === ")") {
+      const bodyQuantified = groupQuantified.pop() ?? false;
+      if (bodyQuantified && isQuantifier(source[i + 1])) {
+        throw new UnsafePatternError(
+          `where(..., 'matches', ...): nested quantifier at index ${i + 1} of /${source}/ \u2014 a quantified group whose body also quantifies backtracks exponentially. Rewrite it, or use .filter(fn).`
+        );
+      }
+      continue;
+    }
+    if (isQuantifier(c)) {
+      quantifiers++;
+      if (quantifiers > MATCHES_MAX_QUANTIFIERS) {
+        throw new UnsafePatternError(
+          `where(..., 'matches', ...): more than ${MATCHES_MAX_QUANTIFIERS} quantifiers in /${source}/. Narrow the pattern, or use .filter(fn).`
+        );
+      }
+      if (groupQuantified.length > 0) groupQuantified[groupQuantified.length - 1] = true;
+    }
+  }
+}
+function escapeRegExpChar(c) {
+  return /[.*+?^${}()|[\]\\/]/.test(c) ? `\\${c}` : c;
+}
+function likeToSource(like) {
+  let out = "^";
+  for (let i = 0; i < like.length; i++) {
+    const c = like[i];
+    if (c === "\\") {
+      const next = like[i + 1];
+      if (next === void 0) {
+        throw new UnsafePatternError(
+          `where(..., 'matches', ...): LIKE pattern "${like}" ends with a dangling escape.`
+        );
+      }
+      i++;
+      out += escapeRegExpChar(next);
+      continue;
+    }
+    if (c === "%") {
+      out += "[\\s\\S]*";
+      continue;
+    }
+    if (c === "_") {
+      out += "[\\s\\S]";
+      continue;
+    }
+    out += escapeRegExpChar(c);
+  }
+  return `${out}$`;
+}
+function literalPrefixAnchor(source, flags) {
+  if (flags !== "" || !source.startsWith("^")) return null;
+  const rest = source.slice(1);
+  return /^[^\\^$.|?*+()[\]{}]*$/.test(rest) ? rest : null;
+}
+function normalizeMatches(op, value) {
+  if (op !== "matches") return { op, value };
+  let source;
+  let flags;
+  if (typeof value === "string") {
+    if (/^[^%_\\]*%$/.test(value)) return { op: "startsWith", value: value.slice(0, -1) };
+    source = likeToSource(value);
+    flags = "";
+  } else if (value instanceof RegExp) {
+    source = value.source;
+    flags = value.flags;
+  } else {
+    throw new UnsafePatternError(
+      `where(..., 'matches', ...) needs a RegExp or a LIKE string; received ${typeof value}.`
+    );
+  }
+  assertSafePattern(source, flags);
+  const prefix = literalPrefixAnchor(source, flags);
+  if (prefix !== null) return { op: "startsWith", value: prefix };
+  return { op: "matches", value: { source, flags } };
+}
+var MATCHES_CACHE = /* @__PURE__ */ new Map();
+var MATCHES_CACHE_MAX = 256;
+function matchesRegExp(value) {
+  const spec = value instanceof RegExp ? { source: value.source, flags: value.flags } : value;
+  if (typeof spec !== "object" || spec === null) return null;
+  const { source, flags } = spec;
+  if (typeof source !== "string" || typeof flags !== "string") return null;
+  const safeFlags = flags.replace(/[gy]/g, "");
+  const key = `${safeFlags} ${source}`;
+  const cached = MATCHES_CACHE.get(key);
+  if (cached !== void 0) return cached;
+  let re;
+  try {
+    re = new RegExp(source, safeFlags);
+  } catch {
+    return null;
+  }
+  if (MATCHES_CACHE.size >= MATCHES_CACHE_MAX) MATCHES_CACHE.clear();
+  MATCHES_CACHE.set(key, re);
+  return re;
+}
+function isComparable(a, b) {
+  if (typeof a === "number" && typeof b === "number") return true;
+  if (typeof a === "string" && typeof b === "string") return true;
+  if (a instanceof Date && b instanceof Date) return true;
+  return false;
+}
+function evaluateClause(record, clause, fnRecord) {
+  switch (clause.type) {
+    case "field":
+      return evaluateFieldClause(record, clause);
+    case "filter":
+      return clause.fn(fnRecord !== void 0 ? fnRecord : record);
+    case "wherePredicate":
+      return clause.fn(fnRecord !== void 0 ? fnRecord : record, clause.ctx);
+    case "crossJoin":
+      throw new Error(
+        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not evaluated per-record. This is a query planner routing error \u2014 crossJoin clauses must be extracted from the clause list before calling evaluateClause or filterRecords.`
+      );
+    case "group":
+      if (clause.op === "and") {
+        for (const child of clause.clauses) {
+          if (!evaluateClause(record, child, fnRecord)) return false;
+        }
+        return true;
+      } else {
+        for (const child of clause.clauses) {
+          if (evaluateClause(record, child, fnRecord)) return true;
+        }
+        return false;
+      }
+  }
+}
+function hasFnClause(clauses) {
+  for (const c of clauses) {
+    if (c.type === "filter" || c.type === "wherePredicate") return true;
+    if (c.type === "group" && hasFnClause(c.clauses)) return true;
+  }
+  return false;
+}
+
+export {
+  readPath,
+  evaluateFieldClause,
+  evaluateOperator,
+  normalizeSubqueryOperand,
+  normalizeMatches,
+  evaluateClause,
+  hasFnClause
+};
+//# sourceMappingURL=chunk-5WWDGFOS.js.map

package/dist/chunk-5WWDGFOS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/predicate.ts"],"sourcesContent":["/**\n * Operator implementations for the query DSL.\n *\n * All predicates run client-side, AFTER decryption — they never see ciphertext.\n * Field clauses over a Via-covered field (e.g. money) carry their own\n * evaluator closure (see {@link FieldClause.via}), so this module has no\n * dependency on any Via feature's implementation — still tree-shakeable.\n */\n\nimport { UnsafePatternError } from '../errors.js'\n\n/** Comparison operators supported by the where() builder. */\nexport type Operator =\n  | '=='\n  | '!='\n  | '<'\n  | '<='\n  | '>'\n  | '>='\n  | 'in'\n  /**\n   * Set non-membership (#1351) — the anti-semi-join half of `in`.\n   *\n   * ⚠️ A NULLISH stored value MATCHES `!in`, deliberately: this module\n   * treats an absent field as \"not equal\" everywhere (`!=`, and money's\n   * `evaluateMoneyClause`), so `!in` follows. SQL's `NOT IN (…)` is\n   * three-valued and would EXCLUDE the row; noy-db has no NULL logic and\n   * inventing one here would make `!in` disagree with `!=` on the same\n   * record. Spell the SQL behaviour as `.where(f, '!=', undefined)` before\n   * the `!in`.\n   *\n   * ⛔ Never index-served. A hash bucket answers \"which ids hold this\n   * value\"; a negation needs the complement, which is the whole\n   * collection minus a bucket — so `!in` always falls to the scan, the\n   * same as `!=`.\n   */\n  | '!in'\n  | 'contains'\n  | 'startsWith'\n  | 'between'\n  /**\n   * Regex / SQL-LIKE pattern match (#1357). Operand: a `RegExp`, or a\n   * LIKE string. Normalized at `where()` time by {@link normalizeMatches}\n   * — an anchored literal prefix is LOWERED to `startsWith` (so it takes\n   * the sorted index), everything else is stored as `{ source, flags }`\n   * and evaluated per record.\n   */\n  | 'matches'\n  /**\n   * Proximity (#1355) — operand `{ lat, lng, radiusKm }`, matching a\n   * record whose stored point is within `radiusKm` great-circle\n   * kilometres of the centre.\n   *\n   * ⛔ MEANINGFUL ONLY OVER A `geo()`-DECLARED FIELD. Every other field\n   * has no point to measure, so the case below returns false rather than\n   * guessing at a `{lat,lng}`-shaped object — the geo binding owns both\n   * the comparison and the index cover, and an undeclared field has\n   * neither. `where()` is where a malformed operand throws; here a\n   * type mismatch is simply \"no match\", as it is for every operator.\n   */\n  | 'near'\n\n/**\n * A single field comparison clause inside a query plan.\n * Plans are JSON-serializable, so this type uses primitives only.\n */\nexport interface FieldClause {\n  readonly type: 'field'\n  readonly field: string\n  readonly op: Operator\n  readonly value: unknown\n  /**\n   * Present when `field` is covered by a Via feature binding (e.g. a\n   * declared money field): the opaque payload built by the binding's\n   * `buildClause` at query BUILD time, plus a closure that evaluates it\n   * per record via the binding's `evaluateClause`. Attached by\n   * `Query.where()` / `ScanBuilder.where()` when `source.via` covers the\n   * field. The closure keeps this module free of any dependency on a\n   * Via feature's implementation — clauses are in-memory only, never\n   * serialized, so carrying a function here is safe.\n   */\n  readonly via?: {\n    readonly brand: string\n    readonly payload: unknown\n    readonly evaluate: (actual: unknown, op: string) => boolean\n    /**\n     * The binding's `indexProbe` result for this clause's op/payload\n     * (#625) — the STORED-form operand `candidateRecords()` (`kernel/\n     * query/builder.ts`) can hand to `CollectionIndexes.lookupEqual`/\n     * `lookupIn` for a fast path. `undefined` (no `indexProbe` hook, or\n     * the binding declined to probe this op) means the field must fall\n     * back to a linear scan via `evaluate` above.\n     */\n    readonly indexValue?: unknown\n  }\n  /**\n   * Provenance of an `in`/`!in` operand that arrived as a SUBQUERY (#1351)\n   * rather than as a literal array. Set by {@link normalizeSubqueryOperand};\n   * `value` already holds the RESOLVED id array by the time this is present.\n   *\n   * Plain data on purpose — it is part of the plan JSON, so it folds into an\n   * MV's `queryHash` and discriminates two queries whose resolved id sets\n   * happen to coincide but whose inner sources differ.\n   */\n  readonly subquery?: {\n    /** The inner source's `identity` (`<vault>/<collection>`), or `'(unnamed)'`. */\n    readonly from: string\n    /** How many ids the inner query produced. */\n    readonly ids: number\n  }\n}\n\n/**\n * A user-supplied predicate function escape hatch. Not serializable.\n *\n * The predicate accepts `unknown` at the type level so the surrounding\n * Clause type can stay non-parametric — this keeps Collection<T> covariant\n * in T at the public API surface. Builder methods cast user predicates\n * (typed `(record: T) => boolean`) into this shape on the way in.\n */\nexport interface FilterClause {\n  readonly type: 'filter'\n  readonly fn: (record: unknown) => boolean\n}\n\n/**\n * A declared deterministic predicate reference. The query\n * builder produces this via `.wherePredicate(name, ctx?)` when a\n * Query has been augmented with a predicates map (typically by the\n * materialized-view registry).\n *\n * `predicateHash` is the consumer-supplied stable hash for the\n * function body; `ctxHash` is the canonical-JSON SHA-256 of `ctx`.\n * Both fold into the MV's `queryHash` so a function or ctx change\n * forces refresh on next visit.\n *\n * `fn` is resolved at builder time from the predicates map and\n * embedded directly — so `evaluateClause` can fire it without a\n * runtime lookup.\n */\nexport interface WherePredicateClause {\n  readonly type: 'wherePredicate'\n  readonly name: string\n  readonly ctx: unknown\n  readonly predicateHash: string\n  readonly ctxHash: string\n  readonly fn: (record: unknown, ctx?: unknown) => boolean\n}\n\n/** A logical group of clauses combined by AND or OR. */\nexport interface GroupClause {\n  readonly type: 'group'\n  readonly op: 'and' | 'or'\n  readonly clauses: readonly Clause[]\n}\n\n/**\n * Cartesian-product expansion clause. Appended to `QueryPlan.clauses`\n * by `Query.crossJoin()`. Processed in declaration order by\n * `executeClausePipeline` — NOT by `evaluateClause` (which is a\n * per-record predicate and throws on this type).\n */\nexport interface CrossJoinClause {\n  readonly type: 'crossJoin'\n  /** Target collection name to cross-join against. */\n  readonly target: string\n  /** Alias under which the right-side record is exposed on each result row. */\n  readonly as: string\n  /**\n   * Alias under which the LEFT row is exposed (#1289, `.crossJoinWith()`).\n   * `undefined` — every clause `.crossJoin()` builds — spreads the left row's\n   * own fields at the top level, which is the pre-#1289 shape.\n   *\n   * Set, the row becomes `{ [leftAs]: left, [as]: right }` and NO field sits\n   * at the top level. That is the whole point (a self-join needs both sides\n   * distinguishable) and also its whole cost: Via dressing keys by bare field\n   * name, so an aliased row is invisible to the top-level decode and must be\n   * dressed per alias instead. See `dressAliases` in `builder.ts`.\n   */\n  readonly leftAs?: string\n  /**\n   * Lateral filter callback. `undefined` → full cartesian product.\n   * Two call shapes:\n   *   - Subset:    `(left) => TTarget[]`            — returns the right rows for this left row\n   *   - Predicate: `(left) => (right) => boolean`   — executor materializes then filters\n   */\n  readonly on?: (left: unknown) => unknown[] | ((right: unknown) => boolean)\n  /** When `on:` was supplied as `{ predicate: name }`, the name is stored here for queryHash. */\n  readonly onPredicateName?: string\n  /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */\n  readonly maxRows?: number\n  /**\n   * Left-outer mode (#1130). When the `on:` subset for a left row is empty,\n   * emit that row once with `null` under `as` instead of dropping it.\n   *\n   * Applies to both call shapes. With `on:` the empty thing is that left\n   * row's subset; without it, an empty TARGET collection is what would\n   * otherwise drop every left row.\n   */\n  readonly outer?: boolean\n}\n\nexport type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause\n\n/**\n * Read a possibly nested field path like \"address.city\" from a record.\n * Returns undefined if any segment is missing.\n */\nexport function readPath(record: unknown, path: string): unknown {\n  if (record === null || record === undefined) return undefined\n  if (!path.includes('.')) {\n    return (record as Record<string, unknown>)[path]\n  }\n  const segments = path.split('.')\n  let cursor: unknown = record\n  for (const segment of segments) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * Evaluate a single field clause against a record.\n * Returns false on type mismatches rather than throwing — query results\n * exclude non-matching records by definition.\n */\nexport function evaluateFieldClause(record: unknown, clause: FieldClause): boolean {\n  const actual = readPath(record, clause.field)\n  const { op, value } = clause\n\n  // A Via-covered field (e.g. money) may store a transformed\n  // representation (money: BigInt-exact in scaled-integer space) that the\n  // generic paths below can't compare correctly — the operand was\n  // pre-built at query BUILD time and the binding's own evaluator knows\n  // how to compare it against the raw stored value.\n  if (clause.via) return clause.via.evaluate(actual, op)\n  return evaluateOperator(actual, op, value)\n}\n\n/**\n * The generic comparison, with no record and no Via involved.\n *\n * Split out of {@link evaluateFieldClause} (#1355) so a Via binding can\n * DELEGATE the operators it does not itself define. That matters more than\n * it sounds: a binding that claims a field for one operator and declines\n * the rest leaves the others with `clause.via` unset, and an unset `via` is\n * exactly what tells `candidateRecords()` a secondary index may serve the\n * clause. For a binding that also rewrites the index KEY\n * (`canonicalizeIndexKey`), that combination lets the index and the scan\n * answer the same clause differently. Claiming every operator and routing\n * the uninteresting ones back here keeps the two in step.\n */\nexport function evaluateOperator(actual: unknown, op: Operator, value: unknown): boolean {\n  switch (op) {\n    case '==':\n      return actual === value\n    case '!=':\n      return actual !== value\n    case '<':\n      return isComparable(actual, value) && (actual as number) < (value as number)\n    case '<=':\n      return isComparable(actual, value) && (actual as number) <= (value as number)\n    case '>':\n      return isComparable(actual, value) && (actual as number) > (value as number)\n    case '>=':\n      return isComparable(actual, value) && (actual as number) >= (value as number)\n    case 'in':\n      return Array.isArray(value) && value.includes(actual)\n    case '!in':\n      // An operand that is not an array matches nothing under 'in'; the\n      // negation of that is \"matches everything\", which is what a caller who\n      // wrote a malformed `!in` gets. Same posture as every other type\n      // mismatch here — no throw at evaluation time.\n      return !Array.isArray(value) || !value.includes(actual)\n    case 'contains':\n      if (typeof actual === 'string') return typeof value === 'string' && actual.includes(value)\n      if (Array.isArray(actual)) return actual.includes(value)\n      return false\n    case 'startsWith':\n      return typeof actual === 'string' && typeof value === 'string' && actual.startsWith(value)\n    case 'matches': {\n      if (typeof actual !== 'string') return false\n      const re = matchesRegExp(value)\n      return re !== null && re.test(actual)\n    }\n    case 'between': {\n      if (!Array.isArray(value) || value.length !== 2) return false\n      const [lo, hi] = value\n      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false\n      return (actual as number) >= (lo as number) && (actual as number) <= (hi as number)\n    }\n    case 'near':\n      // Reached only when NO via binding claimed the field (a `geo()`\n      // clause carries `clause.via` and returned above). Nothing else in\n      // the kernel knows what a point is.\n      return false\n    default: {\n      // Exhaustiveness — TS will error if a new operator is added without a case.\n      const _exhaustive: never = op\n      void _exhaustive\n      return false\n    }\n  }\n}\n\n// --- subquery operands (#1351) ----------------------------------------\n\n/**\n * What a `Query` looks like to this module. Duck-typed rather than imported:\n * `builder.ts` imports THIS file, so naming `Query` here would be a cycle.\n * `Query._asIdOperand()` is the only member of the contract.\n */\ninterface IdOperandSource {\n  _asIdOperand(): { readonly ids: readonly string[]; readonly from: string }\n}\n\nfunction isIdOperandSource(value: unknown): value is IdOperandSource {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as Partial<IdOperandSource>)._asIdOperand === 'function'\n  )\n}\n\n/**\n * Resolve a SUBQUERY operand of `in`/`!in` into the literal id array the rest\n * of the engine already knows how to handle (#1351).\n *\n * ⭐ THE INNER QUERY RUNS HERE — ONCE, at `where()` BUILD time — and never\n * again. That is the whole design, and it is what keeps an O(n) filter from\n * becoming O(n·m): by the time a record is evaluated the clause holds a plain\n * array, so `candidateRecords()` dispatches it through the hash index exactly\n * as it does a hand-written list. `__tests__/query-subquery-in.test.ts`\n * witnesses it with an evaluation counter, not by inspection.\n *\n * ⚠️ THE PRICE, stated once: the operand is a SNAPSHOT taken when `where()`\n * was called. A query object built now and executed later — `.live()` being\n * the case that matters — keeps the id set it was built with, so a change to\n * the INNER collection does not re-fire the outer live query and does not\n * change its answer. Rebuild the query to pick up a new inner result.\n *\n * Every other operator, and an operand that is not a Query, passes through\n * untouched — including a malformed one, which keeps this a resolution step\n * and not a new validation gate.\n */\nexport function normalizeSubqueryOperand(\n  op: Operator,\n  value: unknown,\n): { op: Operator; value: unknown; subquery?: FieldClause['subquery'] } {\n  if (op !== 'in' && op !== '!in') return { op, value }\n  if (!isIdOperandSource(value)) return { op, value }\n  const { ids, from } = value._asIdOperand()\n  return { op, value: [...ids], subquery: { from, ids: ids.length } }\n}\n\n// --- 'matches' (#1357) ------------------------------------------------\n\n/**\n * The serialized `matches` operand. Plans are JSON-serializable and an MV's\n * `queryHash` is taken over that JSON — a bare `RegExp` canonicalizes to\n * `{}`, so two different patterns would hash the SAME and a stale view would\n * never refresh. Source + flags is what makes the pattern part of the hash.\n */\ninterface MatchesOperand {\n  readonly source: string\n  readonly flags: string\n}\n\n/** ReDoS budget. A refusal, not a sanitiser — see {@link UnsafePatternError}. */\nconst MATCHES_MAX_SOURCE = 200\nconst MATCHES_MAX_GROUP_DEPTH = 5\nconst MATCHES_MAX_QUANTIFIERS = 20\n\nfunction isQuantifier(c: string | undefined): boolean {\n  return c === '*' || c === '+' || c === '?' || c === '{'\n}\n\n/**\n * Refuse a pattern that could backtrack catastrophically, by budget.\n *\n * Deliberately syntactic and conservative: an unescaped `{` counts as a\n * quantifier even when it is a literal brace, because over-counting only\n * ever costs a refusal the caller can see, while under-counting costs a\n * hang. The one structural rule is the real ReDoS shape — a quantified\n * group whose body itself quantifies, `(a+)+`.\n */\nfunction assertSafePattern(source: string, flags: string): void {\n  if (source.length > MATCHES_MAX_SOURCE) {\n    throw new UnsafePatternError(\n      `where(..., 'matches', ...): pattern is ${source.length} characters, over the ` +\n        `${MATCHES_MAX_SOURCE}-character budget. Narrow the pattern, or use .filter(fn) ` +\n        `and accept that it cannot use an index.`,\n    )\n  }\n  for (const f of flags) {\n    if (f === 'g' || f === 'y') {\n      throw new UnsafePatternError(\n        `where(..., 'matches', ...): the '${f}' flag makes RegExp.test() stateful across ` +\n          `records and would silently drop rows. Remove it from /${source}/${flags}.`,\n      )\n    }\n  }\n  let quantifiers = 0\n  let inClass = false\n  let escaped = false\n  const groupQuantified: boolean[] = []\n  for (let i = 0; i < source.length; i++) {\n    const c = source[i]!\n    if (escaped) { escaped = false; continue }\n    if (c === '\\\\') { escaped = true; continue }\n    if (inClass) { if (c === ']') inClass = false; continue }\n    if (c === '[') { inClass = true; continue }\n    if (c === '(') {\n      groupQuantified.push(false)\n      if (groupQuantified.length > MATCHES_MAX_GROUP_DEPTH) {\n        throw new UnsafePatternError(\n          `where(..., 'matches', ...): group nesting exceeds the depth-${MATCHES_MAX_GROUP_DEPTH} ` +\n            `budget in /${source}/. Flatten the pattern.`,\n        )\n      }\n      // `(?:` / `(?=` / `(?<name>` — that '?' is a group marker, not a quantifier.\n      if (source[i + 1] === '?') i++\n      continue\n    }\n    if (c === ')') {\n      const bodyQuantified = groupQuantified.pop() ?? false\n      if (bodyQuantified && isQuantifier(source[i + 1])) {\n        throw new UnsafePatternError(\n          `where(..., 'matches', ...): nested quantifier at index ${i + 1} of /${source}/ ` +\n            `— a quantified group whose body also quantifies backtracks exponentially. ` +\n            `Rewrite it, or use .filter(fn).`,\n        )\n      }\n      continue\n    }\n    if (isQuantifier(c)) {\n      quantifiers++\n      if (quantifiers > MATCHES_MAX_QUANTIFIERS) {\n        throw new UnsafePatternError(\n          `where(..., 'matches', ...): more than ${MATCHES_MAX_QUANTIFIERS} quantifiers in ` +\n            `/${source}/. Narrow the pattern, or use .filter(fn).`,\n        )\n      }\n      if (groupQuantified.length > 0) groupQuantified[groupQuantified.length - 1] = true\n    }\n  }\n}\n\n/** Escape one character for literal use inside a RegExp source. */\nfunction escapeRegExpChar(c: string): string {\n  return /[.*+?^${}()|[\\]\\\\/]/.test(c) ? `\\\\${c}` : c\n}\n\n/**\n * LIKE semantics, stated once: the pattern is ANCHORED at both ends (SQL\n * `LIKE`, not a substring find), `%` is any run of characters including\n * none, `_` is exactly one, and a BACKSLASH escapes the next character —\n * `\\%` and `\\_` are literal, `\\\\` is a literal backslash. Both wildcards\n * match newlines.\n */\nfunction likeToSource(like: string): string {\n  let out = '^'\n  for (let i = 0; i < like.length; i++) {\n    const c = like[i]!\n    if (c === '\\\\') {\n      const next = like[i + 1]\n      if (next === undefined) {\n        throw new UnsafePatternError(\n          `where(..., 'matches', ...): LIKE pattern \"${like}\" ends with a dangling escape.`,\n        )\n      }\n      i++\n      out += escapeRegExpChar(next)\n      continue\n    }\n    if (c === '%') { out += '[\\\\s\\\\S]*'; continue }\n    if (c === '_') { out += '[\\\\s\\\\S]'; continue }\n    out += escapeRegExpChar(c)\n  }\n  return `${out}$`\n}\n\n/**\n * The literal prefix a pattern is EXACTLY equivalent to, or `null`.\n *\n * Conservative by construction, because a wrong lowering returns wrong rows\n * silently while a missed one only costs a scan. It lowers only when the\n * source is `^` followed by characters that carry no regex meaning at all —\n * no escapes, no classes, no alternation, no quantifiers, no `$` — and the\n * flags are EMPTY. `i` in particular must never lower: the sorted index is\n * case-sensitive, so `/^client-b/i` would lose rows.\n */\nfunction literalPrefixAnchor(source: string, flags: string): string | null {\n  if (flags !== '' || !source.startsWith('^')) return null\n  const rest = source.slice(1)\n  return /^[^\\\\^$.|?*+()[\\]{}]*$/.test(rest) ? rest : null\n}\n\n/**\n * Normalize a `where(field, 'matches', operand)` at BUILD time: refuse an\n * unsafe pattern, lower an anchored literal prefix to `startsWith`, and\n * otherwise serialize to `{ source, flags }`. Every other operator passes\n * through untouched.\n *\n * Called by every `where()` (`Query`, `ScanBuilder`, `LazyQuery`) so all\n * three build the same clause for the same call.\n */\nexport function normalizeMatches(op: Operator, value: unknown): { op: Operator, value: unknown } {\n  if (op !== 'matches') return { op, value }\n  let source: string\n  let flags: string\n  if (typeof value === 'string') {\n    // `abc%` — a literal run then an open tail — IS startsWith('abc').\n    if (/^[^%_\\\\]*%$/.test(value)) return { op: 'startsWith', value: value.slice(0, -1) }\n    source = likeToSource(value)\n    flags = ''\n  } else if (value instanceof RegExp) {\n    source = value.source\n    flags = value.flags\n  } else {\n    throw new UnsafePatternError(\n      `where(..., 'matches', ...) needs a RegExp or a LIKE string; received ${typeof value}.`,\n    )\n  }\n  assertSafePattern(source, flags)\n  const prefix = literalPrefixAnchor(source, flags)\n  if (prefix !== null) return { op: 'startsWith', value: prefix }\n  return { op: 'matches', value: { source, flags } satisfies MatchesOperand }\n}\n\n/**\n * Compiled-pattern cache, keyed by flags + source. `evaluateFieldClause`\n * runs per record, so recompiling would dominate the scan. Cleared wholesale\n * at a small cap rather than evicting — a query's live patterns recompile\n * once and the map cannot grow without bound.\n */\nconst MATCHES_CACHE = new Map<string, RegExp>()\nconst MATCHES_CACHE_MAX = 256\n\n/**\n * The RegExp for a clause operand. Accepts the normalized\n * {@link MatchesOperand} and — for a hand-built plan that never went through\n * `where()` — a raw `RegExp`, whose `g`/`y` flags are stripped so `test()`\n * cannot carry `lastIndex` from one record to the next. Returns `null` for\n * anything else: a clause that cannot compile matches nothing, the same\n * posture as every other type mismatch in this module.\n */\nfunction matchesRegExp(value: unknown): RegExp | null {\n  const spec = value instanceof RegExp ? { source: value.source, flags: value.flags } : value\n  if (typeof spec !== 'object' || spec === null) return null\n  const { source, flags } = spec as Partial<MatchesOperand>\n  if (typeof source !== 'string' || typeof flags !== 'string') return null\n  const safeFlags = flags.replace(/[gy]/g, '')\n  const key = `${safeFlags} ${source}`\n  const cached = MATCHES_CACHE.get(key)\n  if (cached !== undefined) return cached\n  let re: RegExp\n  try {\n    re = new RegExp(source, safeFlags)\n  } catch {\n    return null\n  }\n  if (MATCHES_CACHE.size >= MATCHES_CACHE_MAX) MATCHES_CACHE.clear()\n  MATCHES_CACHE.set(key, re)\n  return re\n}\n\n/**\n * Two values are \"comparable\" if they share an order-defined runtime type.\n * Strings compare lexicographically; numbers and Dates numerically; otherwise false.\n */\nfunction isComparable(a: unknown, b: unknown): boolean {\n  if (typeof a === 'number' && typeof b === 'number') return true\n  if (typeof a === 'string' && typeof b === 'string') return true\n  if (a instanceof Date && b instanceof Date) return true\n  return false\n}\n\n/**\n * Evaluate any clause (field / filter / group) against a record.\n * The recursion depth is bounded by the user's query expression — no risk of\n * blowing the stack on a 50K-record collection.\n *\n * `fnRecord`, when provided, is the view handed to USER CALLBACK clauses\n * (`filter` / `wherePredicate`) instead of `record` — the executor passes\n * the money-decoded view there so user code never sees the stored\n * scaled-int form, while field clauses keep evaluating against the raw\n * record (their money operands are pre-quantized to that space).\n */\nexport function evaluateClause(record: unknown, clause: Clause, fnRecord?: unknown): boolean {\n  switch (clause.type) {\n    case 'field':\n      return evaluateFieldClause(record, clause)\n    case 'filter':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record)\n    case 'wherePredicate':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record, clause.ctx)\n    case 'crossJoin':\n      throw new Error(\n        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not ` +\n          `evaluated per-record. This is a query planner routing error — ` +\n          `crossJoin clauses must be extracted from the clause list before calling ` +\n          `evaluateClause or filterRecords.`,\n      )\n    case 'group':\n      if (clause.op === 'and') {\n        for (const child of clause.clauses) {\n          if (!evaluateClause(record, child, fnRecord)) return false\n        }\n        return true\n      } else {\n        for (const child of clause.clauses) {\n          if (evaluateClause(record, child, fnRecord)) return true\n        }\n        return false\n      }\n  }\n}\n\n/**\n * Does the clause list contain any user-callback clause (filter /\n * wherePredicate), at any group nesting depth? Used by executors to\n * decide whether the per-record decoded view needs materializing.\n */\nexport function hasFnClause(clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (c.type === 'filter' || c.type === 'wherePredicate') return true\n    if (c.type === 'group' && hasFnClause(c.clauses)) return true\n  }\n  return false\n}\n"],"mappings":";;;;;AAgNO,SAAS,SAAS,QAAiB,MAAuB;AAC/D,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,WAAQ,OAAmC,IAAI;AAAA,EACjD;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAkB;AACtB,aAAW,WAAW,UAAU;AAC9B,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,QAAiB,QAA8B;AACjF,QAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;AAC5C,QAAM,EAAE,IAAI,MAAM,IAAI;AAOtB,MAAI,OAAO,IAAK,QAAO,OAAO,IAAI,SAAS,QAAQ,EAAE;AACrD,SAAO,iBAAiB,QAAQ,IAAI,KAAK;AAC3C;AAeO,SAAS,iBAAiB,QAAiB,IAAc,OAAyB;AACvF,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,MAAM;AAAA,IACtD,KAAK;AAKH,aAAO,CAAC,MAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,SAAS,MAAM;AAAA,IACxD,KAAK;AACH,UAAI,OAAO,WAAW,SAAU,QAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACzF,UAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,SAAS,KAAK;AACvD,aAAO;AAAA,IACT,KAAK;AACH,aAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,WAAW,KAAK;AAAA,IAC3F,KAAK,WAAW;AACd,UAAI,OAAO,WAAW,SAAU,QAAO;AACvC,YAAM,KAAK,cAAc,KAAK;AAC9B,aAAO,OAAO,QAAQ,GAAG,KAAK,MAAM;AAAA,IACtC;AAAA,IACA,KAAK,WAAW;AACd,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,YAAM,CAAC,IAAI,EAAE,IAAI;AACjB,UAAI,CAAC,aAAa,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE,EAAG,QAAO;AACnE,aAAQ,UAAsB,MAAkB,UAAsB;AAAA,IACxE;AAAA,IACA,KAAK;AAIH,aAAO;AAAA,IACT,SAAS;AAEP,YAAM,cAAqB;AAC3B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAaA,SAAS,kBAAkB,OAA0C;AACnE,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAAmC,iBAAiB;AAEhE;AAuBO,SAAS,yBACd,IACA,OACsE;AACtE,MAAI,OAAO,QAAQ,OAAO,MAAO,QAAO,EAAE,IAAI,MAAM;AACpD,MAAI,CAAC,kBAAkB,KAAK,EAAG,QAAO,EAAE,IAAI,MAAM;AAClD,QAAM,EAAE,KAAK,KAAK,IAAI,MAAM,aAAa;AACzC,SAAO,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,UAAU,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE;AACpE;AAgBA,IAAM,qBAAqB;AAC3B,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAEhC,SAAS,aAAa,GAAgC;AACpD,SAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM;AACtD;AAWA,SAAS,kBAAkB,QAAgB,OAAqB;AAC9D,MAAI,OAAO,SAAS,oBAAoB;AACtC,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,MAAM,yBAClD,kBAAkB;AAAA,IAEzB;AAAA,EACF;AACA,aAAW,KAAK,OAAO;AACrB,QAAI,MAAM,OAAO,MAAM,KAAK;AAC1B,YAAM,IAAI;AAAA,QACR,oCAAoC,CAAC,oGACsB,MAAM,IAAI,KAAK;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAClB,MAAI,UAAU;AACd,MAAI,UAAU;AACd,QAAM,kBAA6B,CAAC;AACpC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,SAAS;AAAE,gBAAU;AAAO;AAAA,IAAS;AACzC,QAAI,MAAM,MAAM;AAAE,gBAAU;AAAM;AAAA,IAAS;AAC3C,QAAI,SAAS;AAAE,UAAI,MAAM,IAAK,WAAU;AAAO;AAAA,IAAS;AACxD,QAAI,MAAM,KAAK;AAAE,gBAAU;AAAM;AAAA,IAAS;AAC1C,QAAI,MAAM,KAAK;AACb,sBAAgB,KAAK,KAAK;AAC1B,UAAI,gBAAgB,SAAS,yBAAyB;AACpD,cAAM,IAAI;AAAA,UACR,+DAA+D,uBAAuB,eACtE,MAAM;AAAA,QACxB;AAAA,MACF;AAEA,UAAI,OAAO,IAAI,CAAC,MAAM,IAAK;AAC3B;AAAA,IACF;AACA,QAAI,MAAM,KAAK;AACb,YAAM,iBAAiB,gBAAgB,IAAI,KAAK;AAChD,UAAI,kBAAkB,aAAa,OAAO,IAAI,CAAC,CAAC,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,0DAA0D,IAAI,CAAC,QAAQ,MAAM;AAAA,QAG/E;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,aAAa,CAAC,GAAG;AACnB;AACA,UAAI,cAAc,yBAAyB;AACzC,cAAM,IAAI;AAAA,UACR,yCAAyC,uBAAuB,oBAC1D,MAAM;AAAA,QACd;AAAA,MACF;AACA,UAAI,gBAAgB,SAAS,EAAG,iBAAgB,gBAAgB,SAAS,CAAC,IAAI;AAAA,IAChF;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,GAAmB;AAC3C,SAAO,sBAAsB,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK;AACpD;AASA,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,MAAM;AACd,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,SAAS,QAAW;AACtB,cAAM,IAAI;AAAA,UACR,6CAA6C,IAAI;AAAA,QACnD;AAAA,MACF;AACA;AACA,aAAO,iBAAiB,IAAI;AAC5B;AAAA,IACF;AACA,QAAI,MAAM,KAAK;AAAE,aAAO;AAAa;AAAA,IAAS;AAC9C,QAAI,MAAM,KAAK;AAAE,aAAO;AAAY;AAAA,IAAS;AAC7C,WAAO,iBAAiB,CAAC;AAAA,EAC3B;AACA,SAAO,GAAG,GAAG;AACf;AAYA,SAAS,oBAAoB,QAAgB,OAA8B;AACzE,MAAI,UAAU,MAAM,CAAC,OAAO,WAAW,GAAG,EAAG,QAAO;AACpD,QAAM,OAAO,OAAO,MAAM,CAAC;AAC3B,SAAO,yBAAyB,KAAK,IAAI,IAAI,OAAO;AACtD;AAWO,SAAS,iBAAiB,IAAc,OAAkD;AAC/F,MAAI,OAAO,UAAW,QAAO,EAAE,IAAI,MAAM;AACzC,MAAI;AACJ,MAAI;AACJ,MAAI,OAAO,UAAU,UAAU;AAE7B,QAAI,cAAc,KAAK,KAAK,EAAG,QAAO,EAAE,IAAI,cAAc,OAAO,MAAM,MAAM,GAAG,EAAE,EAAE;AACpF,aAAS,aAAa,KAAK;AAC3B,YAAQ;AAAA,EACV,WAAW,iBAAiB,QAAQ;AAClC,aAAS,MAAM;AACf,YAAQ,MAAM;AAAA,EAChB,OAAO;AACL,UAAM,IAAI;AAAA,MACR,wEAAwE,OAAO,KAAK;AAAA,IACtF;AAAA,EACF;AACA,oBAAkB,QAAQ,KAAK;AAC/B,QAAM,SAAS,oBAAoB,QAAQ,KAAK;AAChD,MAAI,WAAW,KAAM,QAAO,EAAE,IAAI,cAAc,OAAO,OAAO;AAC9D,SAAO,EAAE,IAAI,WAAW,OAAO,EAAE,QAAQ,MAAM,EAA2B;AAC5E;AAQA,IAAM,gBAAgB,oBAAI,IAAoB;AAC9C,IAAM,oBAAoB;AAU1B,SAAS,cAAc,OAA+B;AACpD,QAAM,OAAO,iBAAiB,SAAS,EAAE,QAAQ,MAAM,QAAQ,OAAO,MAAM,MAAM,IAAI;AACtF,MAAI,OAAO,SAAS,YAAY,SAAS,KAAM,QAAO;AACtD,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,MAAI,OAAO,WAAW,YAAY,OAAO,UAAU,SAAU,QAAO;AACpE,QAAM,YAAY,MAAM,QAAQ,SAAS,EAAE;AAC3C,QAAM,MAAM,GAAG,SAAS,IAAI,MAAM;AAClC,QAAM,SAAS,cAAc,IAAI,GAAG;AACpC,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,SAAK,IAAI,OAAO,QAAQ,SAAS;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,cAAc,QAAQ,kBAAmB,eAAc,MAAM;AACjE,gBAAc,IAAI,KAAK,EAAE;AACzB,SAAO;AACT;AAMA,SAAS,aAAa,GAAY,GAAqB;AACrD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO;AACnD,SAAO;AACT;AAaO,SAAS,eAAe,QAAiB,QAAgB,UAA6B;AAC3F,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO,oBAAoB,QAAQ,MAAM;AAAA,IAC3C,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,QAAQ,OAAO,GAAG;AAAA,IACzE,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF,KAAK;AACH,UAAI,OAAO,OAAO,OAAO;AACvB,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,CAAC,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACvD;AACA,eAAO;AAAA,MACT,OAAO;AACL,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACtD;AACA,eAAO;AAAA,MACT;AAAA,EACJ;AACF;AAOO,SAAS,YAAY,SAAqC;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAkB,QAAO;AAC/D,QAAI,EAAE,SAAS,WAAW,YAAY,EAAE,OAAO,EAAG,QAAO;AAAA,EAC3D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-QPQUVOZ2.js → chunk-6QVKPHBF.js}

@@ -1,9 +1,7 @@
 import {
-  envelopeBodyForHash
-} from "./chunk-4ZS56W5S.js";
-import {
+  envelopeBodyForHash,
   sha256Hex
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -67,4 +65,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-QPQUVOZ2.js.map
+//# sourceMappingURL=chunk-6QVKPHBF.js.map

package/dist/chunk-6QVKPHBF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/ledger/entry.ts","../src/with-commit/history/ledger/hash.ts"],"sourcesContent":["/**\n * Ledger entry shape + canonical JSON + sha256 helpers.\n *\n * This file holds the PURE primitives used by the hash-chained ledger:\n * the entry type, the deterministic (sort-stable) JSON encoder, and\n * the sha256 hasher that produces `prevHash` and `ledger.head()`.\n *\n * Everything here is validator-free and side-effect free — the only\n * runtime dep is Web Crypto's `subtle.digest` for the sha256 call,\n * which we already use for every other hashing operation in the core.\n *\n * The hash chain property works like this:\n *\n *   hash(entry[i])       = sha256(canonicalJSON(entry[i]))\n *   entry[i+1].prevHash  = hash(entry[i])\n *\n * Any modification to `entry[i]` (field values, field order, whitespace)\n * produces a different `hash(entry[i])`, which means `entry[i+1]`'s\n * stored `prevHash` no longer matches the recomputed hash, which means\n * `verify()` returns `{ ok: false, divergedAt: i + 1 }`. The chain is\n * append-only and tamper-evident without external anchoring.\n */\n\n/**\n * A single ledger entry in its plaintext form — what gets serialized,\n * hashed, and then encrypted with the ledger DEK before being written\n * to the `_ledger/` adapter collection.\n *\n * ## Why hash the ciphertext, not the plaintext?\n *\n * `payloadHash` is the sha256 of the record's ENCRYPTED envelope bytes,\n * not its plaintext. This matters:\n *\n *   1. **Zero-knowledge preserved.** A user (or a third party) can\n *      verify the ledger against the stored envelopes without any\n *      decryption keys. The adapter layer already holds only\n *      ciphertext, so hashing the ciphertext keeps the ledger at the\n *      same privacy level as the adapter.\n *\n *   2. **Determinism.** Plaintext → ciphertext is randomized by the\n *      fresh per-write IV, so `hash(plaintext)` would need extra\n *      normalization. `hash(ciphertext)` is already deterministic and\n *      unique per write.\n *\n *   3. **Detection property.** If an attacker modifies even one byte of\n *      the stored ciphertext (trying to flip a record), the hash\n *      changes, the ledger's recorded `payloadHash` no longer matches,\n *      and a data-integrity check fails. We don't do that check in\n *      `verify()` today, but the\n *      hook is there for a future `verifyIntegrity()` follow-up.\n *\n * Fields marked `op`, `collection`, `id`, `version`, `ts`, `actor` are\n * plaintext METADATA about the operation — NOT the record itself. The\n * entry is still encrypted at rest via the ledger DEK, but adapters\n * could theoretically infer operation patterns from the sizes and\n * timestamps. This is an accepted trade-off for the tamper-evidence\n * property; full ORAM-level privacy is out of scope for noy-db.\n */\nimport { sha256Hex as sha256HexBytes } from '../../../capsule/index.js'\n\nexport interface LedgerEntry {\n  /**\n   * Zero-based sequential position of this entry in the chain. The\n   * canonical adapter key is this number zero-padded to 10 digits\n   * (`\"0000000001\"`) so lexicographic ordering matches numeric order.\n   */\n  readonly index: number\n\n  /**\n   * Hex-encoded sha256 of the canonical JSON of the PREVIOUS entry.\n   * The genesis entry (index 0) has `prevHash === ''` — the first\n   * entry in a fresh vault has nothing to point back to.\n   */\n  readonly prevHash: string\n\n  /**\n   * Which kind of mutation this entry records. only supports\n   * data operations (`put`, `delete`, `amendment`). Access-control\n   * operations (`grant`, `revoke`, `rotate`) will be added in a\n   * follow-up once the keyring write path is instrumented — that's\n   * tracked in the epic issue.\n   *\n   * `'amendment'` is the multi-record audit entry written by the\n   * guards service when an admin/owner uses `withTransactions(...)`\n   * to repair a constraint-violating state. See `amendment` field\n   * below for the structured payload.\n   *\n   * `'lifecycle'` records a non-data audit event (e.g. partition\n   * handover) — `collection`/`id` are empty and the event detail\n   * lives in `reason` (e.g. `'partition-handed-over:<sealId>'`). Like\n   * `amendment`, it carries no data envelope, so `verifyBackupIntegrity`\n   * skips it in the data cross-check (it still participates in the\n   * tamper-evident chain).\n   *\n   * `'forget'` is the single summary entry written by `vault.forget()`\n   * (GDPR crypto-shred). `collection`/`id` are empty and `version`\n   * is 0 — a forget is not scoped to one record. `payloadHash` carries\n   * `sha256Hex(subjectId)` so the ledger PROVES \"subject X existed and\n   * was erased on date D\" without retaining the subject id or any\n   * plaintext; `reason` holds a JSON summary of the shred counts. Like\n   * `amendment`/`lifecycle` it carries no data envelope and is skipped\n   * by the reconstruct walker (it still participates in the chain, so\n   * `verify()` passes after a shred).\n   */\n  readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration' | 'forget'\n\n  /** The collection the mutation targeted. */\n  readonly collection: string\n\n  /** The record id the mutation targeted. */\n  readonly id: string\n\n  /**\n   * The record version AFTER this mutation. For `put` this is the\n   * newly assigned version; for `delete` this is the version that\n   * was deleted (the last version visible to reads).\n   */\n  readonly version: number\n\n  /** ISO timestamp of the mutation. */\n  readonly ts: string\n\n  /** User id of the actor who performed the mutation. */\n  readonly actor: string\n\n  /**\n   * Hex-encoded sha256 over the encrypted envelope's `_data` field, plus its\n   * sealed-field ciphertext map (`_sealed`) when the record carries one —\n   * so the ledger attests to both the open body and every sealed\n   * value. A record with no `_sealed` hashes `_data` alone.\n   * For `put`, this is the hash of the new ciphertext. For `delete`,\n   * it's the hash of the last visible ciphertext at deletion time, or the empty\n   * string if nothing was there to delete. Hashing the ciphertext (not the\n   * plaintext) preserves zero-knowledge — see the file docstring. The exact\n   * recipe lives in `envelopePayloadHash` (`hash.ts`).\n   */\n  readonly payloadHash: string\n\n  /**\n   * Optional human-readable tag describing why this mutation happened.\n   * Threaded through `collection.put(_, _, { reason })`. Common\n   * values include `'import:csv'`, `'import:json'`, `'import:xlsx'` from\n   * `as-*` ImportPlan.apply(), but consumers can use any string for\n   * domain-specific audit filtering. Auto-strip via `canonicalJson` —\n   * absent on the wire, never serialized as `null`.\n   *\n   * Audit consumers filter: `entries.filter(e => e.reason?.startsWith('import:'))`.\n   */\n  readonly reason?: string\n\n  /**\n   * Optional hex-encoded sha256 of the encrypted JSON Patch delta\n   * blob stored alongside this entry in `_ledger_deltas/`. Present\n   * only for `put` operations that had a previous version — the\n   * genesis put of a new record, and every `delete`, leave this\n   * field undefined.\n   *\n   * The delta payload itself lives in a sibling internal collection\n   * (`_ledger_deltas/<paddedIndex>`) and is encrypted with the\n   * ledger DEK. Callers use `ledger.loadDelta(index)` to decrypt and\n   * deserialize it when reconstructing a historical version.\n   *\n   * Why optional instead of always-present: the first put of a\n   * record has no previous version to diff against, so storing an\n   * empty patch would be noise. For deletes there's no \"next\" state\n   * to describe with a delta. Both cases set this field to undefined.\n   *\n   * Note: the canonical-JSON hasher treats `undefined` as invalid\n   * (it's one of the guard rails), so on the wire this field is\n   * either `{ deltaHash: '<hex>' }` or absent from the JSON\n   * entirely — never `{ deltaHash: undefined }`.\n   */\n  readonly deltaHash?: string\n\n  /**\n   * Present only when `op === 'amendment'`. Records the human reason,\n   * the role of the actor, the (collection, id, vBefore, vAfter) tuple\n   * for every record touched, and which guard invariants passed.\n   *\n   * See design-history/2026-05-18-guards-design.md.\n   */\n  readonly amendment?: {\n    readonly reason: string\n    readonly role: 'admin' | 'owner'\n    readonly changes: ReadonlyArray<{\n      readonly collection: string\n      readonly id: string\n      readonly vBefore: number\n      readonly vAfter: number\n    }>\n    readonly invariantsPassed: ReadonlyArray<string>\n  }\n}\n\n/**\n * Canonical (sort-stable) JSON encoder.\n *\n * This function is the load-bearing primitive of the hash chain:\n * `sha256(canonicalJSON(entry))` must produce the same hex string\n * every time, on every machine, for the same logical entry — otherwise\n * `verify()` would return `{ ok: false }` on cross-platform reads.\n *\n * JavaScript's `JSON.stringify` is almost canonical, but NOT quite:\n * it preserves the insertion order of object keys, which means\n * `{a:1,b:2}` and `{b:2,a:1}` serialize differently. We fix this by\n * recursively walking objects and sorting their keys before\n * concatenation.\n *\n * Arrays keep their original order (reordering them would change\n * semantics). Numbers, strings, booleans, and `null` use the default\n * JSON encoding. `undefined` and functions are rejected — ledger\n * entries are plain data, and silently dropping `undefined` would\n * break the \"same input → same hash\" property if a caller forgot to\n * omit a field.\n *\n * Performance: one pass per nesting level; O(n log n) for key sorting\n * at each object. Entries are small (< 1 KB) so this is negligible\n * compared to the sha256 call.\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null) return 'null'\n  if (typeof value === 'boolean') return value ? 'true' : 'false'\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(\n        `canonicalJson: refusing to encode non-finite number ${String(value)}`,\n      )\n    }\n    return JSON.stringify(value)\n  }\n  if (typeof value === 'string') return JSON.stringify(value)\n  if (typeof value === 'bigint') {\n    throw new Error('canonicalJson: BigInt is not JSON-serializable')\n  }\n  if (typeof value === 'undefined' || typeof value === 'function') {\n    throw new Error(\n      `canonicalJson: refusing to encode ${typeof value} — include all fields explicitly`,\n    )\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map((v) => canonicalJson(v)).join(',') + ']'\n  }\n  if (typeof value === 'object') {\n    const obj = value as Record<string, unknown>\n    const keys = Object.keys(obj).sort()\n    const parts: string[] = []\n    for (const key of keys) {\n      parts.push(JSON.stringify(key) + ':' + canonicalJson(obj[key]))\n    }\n    return '{' + parts.join(',') + '}'\n  }\n  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`)\n}\n\n/**\n * Compute a hex-encoded sha256 of a string via Web Crypto's subtle API.\n *\n * We use hex (not base64) for hashes because hex is case-insensitive,\n * fixed-length (64 chars), and easier to compare visually in debug\n * output. Base64 would save a few bytes in storage but every encrypted\n * ledger entry is already much larger than the hash itself.\n */\nexport async function sha256Hex(input: string): Promise<string> {\n  return sha256HexBytes(new TextEncoder().encode(input))\n}\n\n/**\n * Compute the canonical hash of a ledger entry. Short wrapper around\n * `canonicalJson` + `sha256Hex`; callers use this instead of composing\n * the two functions every time, so any future change to the hashing\n * pipeline (e.g., adding a domain-separation prefix) lives in one place.\n */\nexport async function hashEntry(entry: LedgerEntry): Promise<string> {\n  return sha256Hex(canonicalJson(entry))\n}\n\n/**\n * Pad an index to the canonical 10-digit form used as the adapter key.\n * Ten digits is enough for ~10 billion ledger entries per vault\n * — far beyond any realistic use case, but cheap enough that the extra\n * digits don't hurt storage.\n */\nexport function paddedIndex(index: number): string {\n  return String(index).padStart(10, '0')\n}\n\n/** Parse a padded adapter key back into a number. Returns NaN on malformed input. */\nexport function parseIndex(key: string): number {\n  return Number.parseInt(key, 10)\n}\n","/**\n * Envelope payload hash — pinned in its own leaf module so consumers\n * (DictionaryHandle, the active history strategy) can import it\n * without dragging in the `LedgerStore` class.\n *\n * see `constants.ts` for the broader rationale.\n *\n * @internal\n */\n\nimport type { EncryptedEnvelope } from '../../../kernel/types.js'\nimport { sha256Hex } from './entry.js'\nimport { envelopeBodyForHash } from '../../../capsule/index.js'\n\n/**\n * Compute the `payloadHash` value for an encrypted envelope. Used by\n * `LedgerStore.append` for both put (hash the new envelope) and\n * delete (hash the previous envelope) paths, and by\n * `DictionaryHandle` so its ledger entries match the same contract.\n *\n * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext\n * map (`_sealed`) when a record carries one — so the ledger attests to\n * both the open body AND every sealed value … and the verify-digest\n * ciphertext map (`_vdig`), each bound only when present — the `_vdig`\n * binding is the temporal-rollback detector for the C1 splice class.\n * `rotateRecordCek` rewrites `_vdig` with no ledger entry, the same\n * pre-existing rotation property `_sealed`/`_cek` already have\n * (`verifyBackupIntegrity` flags rotated records until re-anchored).\n *\n * Returns the empty string when there is no envelope (delete of a\n * never-existed record). The empty string tolerated by the ledger\n * entry's `payloadHash` field as the canonical \"nothing here\" value.\n */\nexport async function envelopePayloadHash(\n  envelope: EncryptedEnvelope | null,\n): Promise<string> {\n  if (!envelope) return ''\n  // Back-compat: a record with NO sealed fields hashes as sha256 of\n  // `_data` alone — so every pre-existing ledger entry\n  // and every non-sealed backup verifies byte-identically. A record WITH\n  // `_sealed` widens the hash to also bind the sealed-field ciphertext, so the\n  // ledger attests to sealed-value tamper/erasure (a dropped or swapped\n  // `_sealed[field]` now diverges `verifyBackupIntegrity`'s data cross-check).\n  // `envelopeBodyForHash` (the enclave barrel's C1 protected-body access\n  // contract) derives this exact string — see its own doc for the\n  // canonicalization recipe (sorted keys, independent of `_sealed`'s\n  // field-insertion / store-serialization order).\n  //\n  // `_cek` is deliberately NOT bound: a tampered wrapped-CEK already self-\n  // detects (it fails to unwrap), and `rotateRecordCek` rewrites `_cek` with no\n  // ledger entry — binding it would make every legitimate rotation fail verify.\n  //\n  // RESIDUAL: a backup containing sealed records created BEFORE this change\n  // stored `payloadHash` over `_data` only, so it will fail the data cross-check\n  // and must be re-anchored (re-`put`/re-baseline). Sealed fields are new, so\n  // this is expected to affect ~no real vault.\n  //\n  // The two branches are NOT domain-separated — D1 pins the no-`_sealed` branch\n  // to exactly `sha256(_data)`, so it cannot carry a discriminator tag. An actor\n  // with raw-store write access could therefore set a non-sealed record's `_data`\n  // equal to the canonical-JSON string below and collide a sealed record's hash —\n  // but doing so overwrites `_data` itself, which then no longer GCM-decrypts, so\n  // it only suppresses the verify signal on an already-destroyed record; it cannot\n  // silently erase one sealed field while leaving the record readable.\n  return sha256Hex(envelopeBodyForHash(envelope))\n}\n"],"mappings":";;;;;;AA2NO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,uDAAuD,OAAO,KAAK,CAAC;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY;AAC/D,UAAM,IAAI;AAAA,MACR,qCAAqC,OAAO,KAAK;AAAA,IACnD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;AACnC,UAAM,QAAkB,CAAC;AACzB,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,UAAU,GAAG,IAAI,MAAM,cAAc,IAAI,GAAG,CAAC,CAAC;AAAA,IAChE;AACA,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,EAAE;AACzE;AAUA,eAAsBA,WAAU,OAAgC;AAC9D,SAAO,UAAe,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvD;AAQA,eAAsB,UAAU,OAAqC;AACnE,SAAOA,WAAU,cAAc,KAAK,CAAC;AACvC;AAQO,SAAS,YAAY,OAAuB;AACjD,SAAO,OAAO,KAAK,EAAE,SAAS,IAAI,GAAG;AACvC;AAGO,SAAS,WAAW,KAAqB;AAC9C,SAAO,OAAO,SAAS,KAAK,EAAE;AAChC;;;AChQA,eAAsB,oBACpB,UACiB;AACjB,MAAI,CAAC,SAAU,QAAO;AA4BtB,SAAOC,WAAU,oBAAoB,QAAQ,CAAC;AAChD;","names":["sha256Hex","sha256Hex"]}

package/dist/{chunk-ACAQ2DSG.js → chunk-747G6CT3.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-ACAQ2DSG.js.map
+//# sourceMappingURL=chunk-747G6CT3.js.map