@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/sequence/index.js

@@ -5,18 +5,17 @@ import {
   compileSequenceFormat,
   resolveSequenceKey,
   withSequence
-} from "../chunk-GPNTB4Y7.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-VFHCKG5M.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SequenceNotEnabledError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,

package/dist/session/index.js

@@ -12,24 +12,23 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-A2HKRLPV.js";
+} from "../chunk-MXKI4ABF.js";
 import {
   NO_SESSION
 } from "../chunk-VKQCVU2Z.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-party/session/active.ts
 function withSession() {

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/session/active.ts"],"sourcesContent":["/**\n * Active session strategy — `withSession()` returns the real\n * implementation that wires `SessionPolicy` validation, the\n * `PolicyEnforcer`, and the global session-token registry into the\n * Noydb lifecycle.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSession } from '@noy-db/hub/session'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   sessionPolicy: { idleTimeoutMs: 15 * 60_000 },\n *   sessionStrategy: withSession(),\n * })\n * ```\n *\n * The factory delegates to the existing `session-policy.ts` and\n * `session.ts` modules. Splitting the import chain through this file\n * is what lets tsup tree-shake the ~495 LOC of policy + token code\n * out of the default bundle when no `withSession()` import is\n * present.\n *\n * Note: dev-unlock (`devUnlock`, `cancelDevUnlock`) is a separate\n * named import from `@noy-db/hub` and tree-shakes independently —\n * apps that don't import it never include it.\n *\n * @public\n */\n\nimport type { SessionStrategy } from './strategy.js'\nimport { createEnforcer, validateSessionPolicy } from './session-policy.js'\nimport { revokeAllSessions } from './session.js'\n\nexport function withSession(): SessionStrategy {\n  return {\n    validateSessionPolicy,\n    createEnforcer,\n    revokeAllSessions,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/shadow/index.js

@@ -1,11 +1,11 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-XLMEZIAJ.js";
+} from "../chunk-2ODVB6LZ.js";
 import {
   NO_SHADOW
 } from "../chunk-SMY5X46Z.js";
-import "../chunk-7O3Y4PPD.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-fork/shadow/active.ts
 function withShadow() {

package/dist/signer-MHGW3OIL.js

@@ -0,0 +1,23 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-DLD5LGDS.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-MHGW3OIL.js.map

package/dist/snapshots/index.js

@@ -4,19 +4,19 @@ import {
 import {
   readPod,
   writePod
-} from "../chunk-BVN6KXL2.js";
-import "../chunk-EQEYOJBM.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-KZXDLBY6.js";
+import "../chunk-5A4345TG.js";
+import "../chunk-GMKGGY7V.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/with-fork/snapshots/engine.ts
 var SnapshotEngine = class {

package/dist/stale-6GCFMOOR.js

@@ -0,0 +1,28 @@
+import {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+} from "./chunk-VKI2EB3N.js";
+import "./chunk-5D2ALSM5.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+};
+//# sourceMappingURL=stale-6GCFMOOR.js.map

package/dist/storage-BYN5LO6Z.js

@@ -0,0 +1,21 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-3L2NBKDR.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-BYN5LO6Z.js.map

package/dist/storage-BYN5LO6Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/store/index.js

@@ -7,7 +7,7 @@ import {
   withMetrics,
   withRetry,
   wrapStore
-} from "../chunk-EIPVYUEP.js";
+} from "../chunk-GQ4MF3CM.js";
 export {
   routeStore,
   withCache,

package/dist/{store-coordination-provider-4WZAIRHC.js → store-coordination-provider-C4BPT5XF.js}

@@ -1,18 +1,17 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-453F654R.js";
-import "./chunk-4ZS56W5S.js";
+} from "./chunk-VAORSCSU.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 
 // src/with-shape/schema-update/client-registry.ts
 var META_COLLECTION = "_meta";
@@ -33,7 +32,7 @@ async function listClientDocs(store, vault) {
     const env = await store.get(vault, META_COLLECTION, id);
     if (!env) continue;
     try {
-      const parsed = JSON.parse(env._data);
+      const parsed = JSON.parse(env._data ?? "");
       if (isClientDoc(parsed)) out.push(parsed);
     } catch {
     }
@@ -145,4 +144,4 @@ function unref(timer) {
 export {
   StoreMesh
 };
-//# sourceMappingURL=store-coordination-provider-4WZAIRHC.js.map
+//# sourceMappingURL=store-coordination-provider-C4BPT5XF.js.map

package/dist/store-coordination-provider-C4BPT5XF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/client-registry.ts","../src/with-shape/schema-update/store-coordination-provider.ts"],"sourcesContent":["/**\n * Schema-cutover client registry. Each client keeps a\n * heartbeat doc at `_meta/schema-fence:client:<clientId>` carrying its\n * liveness (`lastSeen`) and the fence generation it has quiesced for\n * (`quiescedAtVersion`). Plaintext envelope, like the fence doc.\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\n\nconst META_COLLECTION = '_meta'\nconst CLIENT_PREFIX = 'schema-fence:client:'\n\nexport interface ClientDoc {\n  readonly clientId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n  /**\n   * Session that owns this writer (one user's writers across vaults). Additive\n   * and optional so legacy client docs (written without it) keep parsing;\n   * readers default it.\n   */\n  readonly sessionId?: string\n}\n\nexport async function writeClientDoc(\n  store: NoydbStore,\n  vault: string,\n  clientId: string,\n  doc: { lastSeen: number; quiescedAtVersion: number | null; sessionId?: string },\n): Promise<void> {\n  const recordId = `${CLIENT_PREFIX}${clientId}`\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: recordId, version: 1 },\n    { iv: '', data: JSON.stringify({ clientId, ...doc }) },\n  )\n  await store.put(vault, META_COLLECTION, recordId, envelope)\n}\n\nexport async function listClientDocs(store: NoydbStore, vault: string): Promise<ClientDoc[]> {\n  const ids = await store.list(vault, META_COLLECTION)\n  const out: ClientDoc[] = []\n  for (const id of ids) {\n    if (!id.startsWith(CLIENT_PREFIX)) continue\n    const env = await store.get(vault, META_COLLECTION, id)\n    if (!env) continue\n    try {\n      const parsed = JSON.parse(env._data ?? '') as unknown\n      if (isClientDoc(parsed)) out.push(parsed)\n    } catch { /* skip corrupt */ }\n  }\n  return out\n}\n\n/**\n * True when every *active* client (lastSeen within staleMs of now) has\n * `quiescedAtVersion === generation`. Stale clients are ignored. An empty\n * active set is vacuously quiesced.\n */\nexport async function activeQuiesced(\n  store: NoydbStore,\n  vault: string,\n  opts: { generation: number; now: number; staleMs: number; excludeClientId?: string },\n): Promise<boolean> {\n  const docs = await listClientDocs(store, vault)\n  const active = docs.filter(\n    d => d.lastSeen >= opts.now - opts.staleMs && d.clientId !== opts.excludeClientId,\n  )\n  return active.every(d => d.quiescedAtVersion === opts.generation)\n}\n\nfunction isClientDoc(x: unknown): x is ClientDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  return typeof o['clientId'] === 'string'\n    && typeof o['lastSeen'] === 'number'\n    && (o['quiescedAtVersion'] === null || typeof o['quiescedAtVersion'] === 'number')\n    && (o['sessionId'] === undefined || typeof o['sessionId'] === 'string')\n}\n","/**\n * Store-backed default {@link NoydbMesh}.\n *\n * Maps the five coordination-port methods onto today's `_meta/schema-fence`\n * store ops so that, with no `by-*` provider injected, the fence service\n * reproduces its current store-polling behavior byte-for-byte. The `observe*`\n * methods are poll-emit (the legacy {@link FenceWatcher} model); `by-tabs` /\n * `by-peer` override them with real-time push.\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { Unsubscribe } from '../../port/with/write-hooks.js'\nimport { loadFence, saveFence, type FenceDoc } from './fence.js'\nimport { writeClientDoc, listClientDocs, type ClientDoc } from './client-registry.js'\nimport type { NoydbMesh, WriterPresence } from '../../port/by/types.js'\n\n/**\n * Default poll cadence for the `observe*` fallbacks (ms). Matches the\n * store-poll granularity the fence-controller uses while waiting for quorum\n * (`delay(50)`); the same value the migration cutover falls back to when no\n * real-time provider is injected.\n */\nconst DEFAULT_POLL_INTERVAL_MS = 50\n\n/** Map a stored {@link ClientDoc} to the port's {@link WriterPresence}. */\nfunction toPresence(doc: ClientDoc): WriterPresence {\n  return {\n    writerId: doc.clientId,\n    // Legacy docs written without a sessionId (and explicit empty) have no\n    // session — fall back to the writerId so every presence is session-addressable.\n    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,\n    lastSeen: doc.lastSeen,\n    quiescedAtVersion: doc.quiescedAtVersion,\n  }\n}\n\nfunction fenceEqual(a: FenceDoc, b: FenceDoc): boolean {\n  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState\n}\n\nfunction presenceListEqual(a: readonly WriterPresence[], b: readonly WriterPresence[]): boolean {\n  if (a.length !== b.length) return false\n  const key = (w: WriterPresence) => `${w.writerId}\\u0000${w.sessionId}\\u0000${w.lastSeen}\\u0000${String(w.quiescedAtVersion)}`\n  const bk = new Set(b.map(key))\n  return a.every((w) => bk.has(key(w)))\n}\n\nexport class StoreMesh implements NoydbMesh {\n  readonly #store: NoydbStore\n  readonly #pollIntervalMs: number\n\n  constructor(store: NoydbStore, opts?: { pollIntervalMs?: number }) {\n    this.#store = store\n    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS\n  }\n\n  async setFence(vault: string, fence: FenceDoc): Promise<void> {\n    // RE-READ AND SPREAD, never write the caller's doc whole (#1197).\n    //\n    // `saveFence` serialises what it is given and does a full `store.put` — no\n    // merge. Callers legitimately construct a PARTIAL doc: `FenceController`\n    // builds `{ currentSchemaVersion, fenceState }`, which is a valid `FenceDoc`\n    // because `schemaHash` is optional. Writing that whole silently erased the\n    // hash #946 added, so \"which schema is generation N is answerable from\n    // schemaFenceState() alone\" held only until the first drain.\n    //\n    // The type cannot see the loss: for an optional field, \"absent\" and\n    // \"deliberately cleared\" are the same value.\n    //\n    // Mirrors `persisted-schemas/register.ts:136`, which re-reads for the same\n    // reason and documents it — a stale snapshot would roll back a concurrent\n    // cutover's version. Re-reading NARROWS that window rather than closing it;\n    // fence transitions are orchestrator-driven and serialised, so the residual\n    // is the same one that path already accepts.\n    const current = await loadFence(this.#store, vault)\n    await saveFence(this.#store, vault, { ...current, ...fence })\n  }\n\n  async readFence(vault: string): Promise<FenceDoc> {\n    return loadFence(this.#store, vault)\n  }\n\n  observeFence(vault: string, onChange: (f: FenceDoc) => void): Unsubscribe {\n    let last: FenceDoc | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const fence = await loadFence(this.#store, vault)\n        if (last === null || !fenceEqual(last, fence)) {\n          last = fence\n          onChange(fence)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current state once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reportPresence(vault: string, p: WriterPresence): Promise<void> {\n    await writeClientDoc(this.#store, vault, p.writerId, {\n      lastSeen: p.lastSeen,\n      quiescedAtVersion: p.quiescedAtVersion,\n      sessionId: p.sessionId,\n    })\n  }\n\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe {\n    let last: readonly WriterPresence[] | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const docs = await listClientDocs(this.#store, vault)\n        const writers = docs.map(toPresence)\n        if (last === null || !presenceListEqual(last, writers)) {\n          last = writers\n          onChange(writers)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current set once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]> {\n    const docs = await listClientDocs(this.#store, vault)\n    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs)\n  }\n}\n\n/** Best-effort `unref` so a poll timer never holds the process open (Node only). */\nfunction unref(timer: ReturnType<typeof setInterval>): void {\n  const t = timer as unknown as { unref?: () => void }\n  if (typeof t.unref === 'function') t.unref()\n}\n"],"mappings":";;;;;;;;;;;;;;;;AASA,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AActB,eAAsB,eACpB,OACA,OACA,UACA,KACe;AACf,QAAM,WAAW,GAAG,aAAa,GAAG,QAAQ;AAC5C,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,UAAU,SAAS,EAAE;AAAA,IACxD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC,EAAE;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,UAAU,QAAQ;AAC5D;AAEA,eAAsB,eAAe,OAAmB,OAAqC;AAC3F,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AACnD,QAAM,MAAmB,CAAC;AAC1B,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,WAAW,aAAa,EAAG;AACnC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,iBAAiB,EAAE;AACtD,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI,SAAS,EAAE;AACzC,UAAI,YAAY,MAAM,EAAG,KAAI,KAAK,MAAM;AAAA,IAC1C,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AACA,SAAO;AACT;AAmBA,SAAS,YAAY,GAA4B;AAC/C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,UAAU,MAAM,YAC3B,OAAO,EAAE,UAAU,MAAM,aACxB,EAAE,mBAAmB,MAAM,QAAQ,OAAO,EAAE,mBAAmB,MAAM,cACrE,EAAE,WAAW,MAAM,UAAa,OAAO,EAAE,WAAW,MAAM;AAClE;;;ACrDA,IAAM,2BAA2B;AAGjC,SAAS,WAAW,KAAgC;AAClD,SAAO;AAAA,IACL,UAAU,IAAI;AAAA;AAAA;AAAA,IAGd,WAAW,IAAI,aAAa,IAAI,UAAU,SAAS,IAAI,IAAI,YAAY,IAAI;AAAA,IAC3E,UAAU,IAAI;AAAA,IACd,mBAAmB,IAAI;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,GAAa,GAAsB;AACrD,SAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,eAAe,EAAE;AACjF;AAEA,SAAS,kBAAkB,GAA8B,GAAuC;AAC9F,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,MAAM,CAAC,MAAsB,GAAG,EAAE,QAAQ,KAAS,EAAE,SAAS,KAAS,EAAE,QAAQ,KAAS,OAAO,EAAE,iBAAiB,CAAC;AAC3H,QAAM,KAAK,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;AAC7B,SAAO,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACtC;AAEO,IAAM,YAAN,MAAqC;AAAA,EACjC;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,MAAoC;AACjE,SAAK,SAAS;AACd,SAAK,kBAAkB,MAAM,kBAAkB;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,OAAe,OAAgC;AAkB5D,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ,KAAK;AAClD,UAAM,UAAU,KAAK,QAAQ,OAAO,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,UAAU,OAAkC;AAChD,WAAO,UAAU,KAAK,QAAQ,KAAK;AAAA,EACrC;AAAA,EAEA,aAAa,OAAe,UAA8C;AACxE,QAAI,OAAwB;AAC5B,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,QAAQ,KAAK;AAChD,YAAI,SAAS,QAAQ,CAAC,WAAW,MAAM,KAAK,GAAG;AAC7C,iBAAO;AACP,mBAAS,KAAK;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,eAAe,OAAe,GAAkC;AACpE,UAAM,eAAe,KAAK,QAAQ,OAAO,EAAE,UAAU;AAAA,MACnD,UAAU,EAAE;AAAA,MACZ,mBAAmB,EAAE;AAAA,MACrB,WAAW,EAAE;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,OAAe,UAAqE;AAClG,QAAI,OAAyC;AAC7C,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,cAAM,UAAU,KAAK,IAAI,UAAU;AACnC,YAAI,SAAS,QAAQ,CAAC,kBAAkB,MAAM,OAAO,GAAG;AACtD,iBAAO;AACP,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,iBAAiB,OAAe,GAAyE;AAC7G,UAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,WAAO,KAAK,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;AAAA,EAC3E;AACF;AAGA,SAAS,MAAM,OAA6C;AAC1D,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAC7C;","names":[]}

package/dist/sync/index.js

@@ -2,20 +2,19 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-K23VKTN4.js";
+} from "../chunk-H23XHRTT.js";
 import {
   NO_SYNC
 } from "../chunk-T7IR4N2S.js";
-import "../chunk-FAHMLERK.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+import "../chunk-QBLT6POL.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-sync/active.ts
 function withSync() {

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-sync/active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../kernel/vault.js'\nimport { SyncEngine } from './engine.js'\nimport { SyncTransaction } from './transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSeal,
   beginEchoUnlock,
   withTeam
-} from "../chunk-YJRT5UQM.js";
+} from "../chunk-2RH777HH.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -23,6 +23,7 @@ import {
   recoverSecret,
   recoverUser,
   removeAuthenticator,
+  revokeAuthenticator,
   revokeMagicLinkGrant,
   rotateSecret,
   savePaperRecoveryEntries,
@@ -31,8 +32,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-WQBG4SZS.js";
-import "../chunk-2577DKXB.js";
+} from "../chunk-DQESF6RP.js";
+import "../chunk-VHBKYN2J.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,21 +54,20 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-3V4KWFX7.js";
-import "../chunk-XKWGNJ26.js";
-import "../chunk-UGTBXF5U.js";
-import "../chunk-JMGDHKQF.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-XSPFDUDG.js";
+import "../chunk-LIOVX5TJ.js";
+import "../chunk-7XMHMVTS.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   TeamNotEnabledError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   MemoryDeviceSeal,
   NO_TEAM,
@@ -107,6 +107,7 @@ export {
   removeAuthenticator,
   resolveEchoReveal,
   revoke,
+  revokeAuthenticator,
   revokeMagicLinkGrant,
   rotateSecret,
   savePaperRecoveryEntries,

package/dist/tiers/index.js

@@ -3,6 +3,7 @@ import {
   assertDeclaredTier,
   assertTierComposition,
   assertTiersEnabled,
+  checkUniqueAcrossTiers,
   classifySealedShred,
   demote,
   elevate,
@@ -11,26 +12,26 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-M4YPHYEH.js";
-import "../chunk-UGTBXF5U.js";
-import "../chunk-JMGDHKQF.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-DHHGL42E.js";
+import "../chunk-7XMHMVTS.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   TiersNotEnabledError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,
   assertDeclaredTier,
   assertTierComposition,
   assertTiersEnabled,
+  checkUniqueAcrossTiers,
   classifySealedShred,
   demote,
   elevate,

package/dist/to/index.js

@@ -1,6 +1,6 @@
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-7MG7SJT7.js";
+} from "../chunk-SV2PM2OY.js";
 import {
   ConflictError,
   DuplicateStoreKindError,
@@ -9,7 +9,7 @@ import {
   StoreCapabilityError,
   UnknownStoreKindError,
   isConflictError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/port/to/locator.ts
 function isPodStore(store) {

package/dist/transactions/index.js

@@ -3,15 +3,15 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-BLN54W3L.js";
+} from "../chunk-UA372JHH.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-7O3Y4PPD.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-AQVXV5GZ.js"));
+var loadGuardExecutor = lazy(() => import("../executor-LBBBRTN5.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";

package/dist/vault-head/index.js

@@ -2,23 +2,20 @@ import {
   DEFAULT_HEAD_BUCKETS,
   NO_VAULT_HEAD,
   VAULT_HEAD_COLLECTION
-} from "../chunk-HK67PX4J.js";
+} from "../chunk-HW7CMKUG.js";
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "../chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import {
-  encrypt
-} from "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+} from "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-commit/vault-head/head.ts
 function bucketIndex(collection, id, buckets) {

package/dist/vault-head/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../capsule/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}