@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-2AFX33YA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/indexing/index-snapshot.ts","../src/with-lookup/indexing/sorted-indexes.ts","../src/with-lookup/indexing/compound-indexes.ts","../src/with-lookup/indexing/eager-indexes.ts"],"sourcesContent":["/**\n * The on-disk shape of a persisted field index (#1359) — the format both\n * `SortedIndex` (#1344) and `CompoundIndex` (#1345) round-trip through, plus\n * the structural validator every load must pass.\n *\n * ⭐ **Nothing is flattened into a delimited string.** A compound entry keeps\n * its tuple as an ARRAY of per-component keys, each carrying its runtime KIND\n * alongside its value — which is the whole point of #1345's in-memory shape\n * and would be destroyed by a `join()`. Two properties depend on it:\n *\n *  - **Kind survives.** Entries rank by runtime kind FIRST (mirroring\n *    `predicate.ts`'s `isComparable`), so a `string` probe must not reach\n *    `number` entries. An encoding that wrote only the value would collapse\n *    `1` and `'1'` into one key space on the way back in.\n *  - **Per-component ordering survives.** A string component may contain any\n *    byte, including whatever a separator would have been.\n *\n * The validator is deliberately paranoid and its failure mode is a REBUILD,\n * never a partial load: a blob that is truncated, from a future format, or\n * internally out of order is rejected whole. See\n * {@link parseFieldIndexSnapshot}.\n */\n\n/** Bump on ANY incompatible change to the shapes below. An older stamp is rejected, not migrated. */\nexport const FIELD_INDEX_SNAPSHOT_VERSION = 1\n\n/** One `SortKey`, wire form: `[kind, key]`. `kind` IS the sort rank. */\nexport type WireKey = readonly [kind: number, key: number | string]\n\n/** One `SortedIndex` entry: `[kind, key, seq, id]`. */\nexport type WireSortedEntry = readonly [kind: number, key: number | string, seq: number, id: string]\n\n/** One `CompoundIndex` entry: `[tupleKeys, seq, id]` — the tuple stays an ARRAY. */\nexport type WireCompoundEntry = readonly [keys: readonly WireKey[], seq: number, id: string]\n\nexport interface SortedIndexSnapshot {\n  readonly v: number\n  readonly t: 'sorted'\n  readonly field: string\n  readonly nextSeq: number\n  readonly entries: readonly WireSortedEntry[]\n}\n\nexport interface CompoundIndexSnapshot {\n  readonly v: number\n  readonly t: 'compound'\n  readonly fields: readonly string[]\n  readonly nextSeq: number\n  readonly entries: readonly WireCompoundEntry[]\n}\n\nexport type FieldIndexSnapshot = SortedIndexSnapshot | CompoundIndexSnapshot\n\n/**\n * Sidecar key for a single-field sorted index. Field paths are\n * percent-encoded so no field name can collide with the `,` the compound\n * form joins on, nor with the `s:` / `c:` discriminator.\n */\nexport function sortedIndexKey(field: string): string {\n  return `s:${encodeURIComponent(field)}`\n}\n\n/** Sidecar key for a compound index over an ordered field tuple. */\nexport function compoundIndexKey(fields: readonly string[]): string {\n  return `c:${fields.map(encodeURIComponent).join(',')}`\n}\n\n/** A key is well-formed only if its declared kind matches its value's runtime type. */\nfunction isWireKey(x: unknown): x is WireKey {\n  if (!Array.isArray(x) || x.length !== 2) return false\n  const [kind, key] = x as [unknown, unknown]\n  // 0 = number, 1 = string, 2 = Date-as-epoch-millis. See `sorted-indexes.ts`.\n  if (kind === 0 || kind === 2) return typeof key === 'number' && Number.isFinite(key)\n  if (kind === 1) return typeof key === 'string'\n  return false\n}\n\nfunction isSeq(x: unknown): x is number {\n  return typeof x === 'number' && Number.isInteger(x) && x >= 0\n}\n\n/**\n * Decode + validate a persisted snapshot. Returns `null` — meaning \"rebuild\"\n * — for anything that is not exactly the current format: bad JSON (a torn\n * write), a version stamp from another release, a shape mismatch, a\n * malformed key, or entries out of the order the index's binary searches\n * require. A caller must never repair a snapshot; the source of truth is the\n * cache, and rebuilding from it is always available.\n */\nexport function parseFieldIndexSnapshot(json: string): FieldIndexSnapshot | null {\n  let raw: unknown\n  try {\n    raw = JSON.parse(json)\n  } catch {\n    return null\n  }\n  if (typeof raw !== 'object' || raw === null) return null\n  const o = raw as Record<string, unknown>\n  if (o['v'] !== FIELD_INDEX_SNAPSHOT_VERSION) return null\n  if (!isSeq(o['nextSeq']) || !Array.isArray(o['entries'])) return null\n  const nextSeq = o['nextSeq']\n  const entries = o['entries'] as unknown[]\n\n  if (o['t'] === 'sorted') {\n    if (typeof o['field'] !== 'string') return null\n    const out: WireSortedEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 4) return null\n      const [kind, key, seq, id] = e as [unknown, unknown, unknown, unknown]\n      if (!isWireKey([kind, key])) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([kind as number, key as number | string, seq, id])\n    }\n    if (!isAscending(out.map(e => [[e[0], e[1]] as WireKey]), out.map(e => e[2]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'sorted', field: o['field'], nextSeq, entries: out }\n  }\n\n  if (o['t'] === 'compound') {\n    const fields = o['fields']\n    if (!Array.isArray(fields) || fields.length === 0 || !fields.every(f => typeof f === 'string')) return null\n    const out: WireCompoundEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 3) return null\n      const [keys, seq, id] = e as [unknown, unknown, unknown]\n      if (!Array.isArray(keys) || keys.length !== fields.length || !keys.every(isWireKey)) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([keys as readonly WireKey[], seq, id])\n    }\n    if (!isAscending(out.map(e => e[0]), out.map(e => e[1]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'compound', fields, nextSeq, entries: out }\n  }\n\n  return null\n}\n\n/**\n * Every binary search in both index classes assumes `(keys…, seq)` ascending.\n * A blob that is not sorted would not merely be slow — it would answer\n * WRONGLY, so it is rejected rather than re-sorted (re-sorting would launder\n * a corrupt blob into a plausible-looking answer).\n */\nfunction isAscending(keys: ReadonlyArray<readonly WireKey[]>, seqs: readonly number[]): boolean {\n  for (let i = 1; i < keys.length; i++) {\n    const c = compareWireTuples(keys[i - 1]!, keys[i]!)\n    if (c > 0) return false\n    if (c === 0 && seqs[i - 1]! >= seqs[i]!) return false\n  }\n  return true\n}\n\nfunction compareWireTuples(a: readonly WireKey[], b: readonly WireKey[]): number {\n  for (let i = 0; i < a.length; i++) {\n    const x = a[i]!\n    const y = b[i]!\n    if (x[0] !== y[0]) return x[0] - y[0]\n    if (typeof x[1] === 'number' && typeof y[1] === 'number') {\n      if (x[1] !== y[1]) return x[1] - y[1]\n    } else if (x[1] !== y[1]) {\n      return x[1] < y[1] ? -1 : 1\n    }\n  }\n  return 0\n}\n","/**\n * Sorted (range) secondary indexes — the ordered sibling of the hash\n * index in `eager-indexes.ts` (#1344).\n *\n * A sorted index is an array of `{ kind, key, seq, id }` entries kept in\n * ascending `(kindRank, key, seq)` order. Binary search then answers\n * `<`, `<=`, `>`, `>=`, `between` and `startsWith` as a contiguous slice,\n * and `orderedIds()` walks the array for `orderBy(field).limit(n)`.\n *\n * Three properties are load-bearing, each mirroring the linear scan this\n * replaces (`kernel/query/predicate.ts`):\n *\n *  - **Kind-partitioned.** `evaluateFieldClause`'s `isComparable` refuses\n *    to order two values of different runtime types, so entries are ranked\n *    by kind FIRST. A `string` probe therefore cannot reach `number`\n *    entries, exactly as the scan cannot. Values with no order-defined\n *    type (booleans, objects, arrays) are not indexed at all.\n *  - **Nullish is not indexed**, same as the hash index.\n *  - **Ties keep insertion order** (`seq`), which after a `build()` is\n *    snapshot order — so an index-served `orderBy(...).limit(n)` returns\n *    the same rows the stable scan-and-sort would. An in-place UPDATE\n *    reinstates the rank it held rather than appending (#1369): the record\n *    cache does not move a re-`put` record, so neither may the index.\n *\n * Keys canonicalise through the SAME per-field closure the hash index\n * uses (`ViaPipeline.canonicalizeIndexKey`), so a Via-covered field's\n * entries live in one key space here too. Range DISPATCH for a\n * Via-covered clause is nevertheless declined by the query builder (a\n * money operand has no ordered stored-form probe) — see\n * `kernel/query/builder.ts`'s `candidateRecords`.\n *\n * PERSISTENCE (#1359) is OPT-IN, via `{ persist: true }` on the declaration.\n * {@link SortedIndex.toSnapshot} / {@link SortedIndex.loadSnapshot} are the\n * whole of this class's part in it — the encrypted sidecar, the freshness\n * stamp and the debounce live in `persisted-field-indexes.ts`. Without the\n * opt-in the index is in memory only and rebuilt on hydrate, as before.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type FieldIndexSnapshot,\n  type SortedIndexSnapshot,\n  type WireSortedEntry,\n} from './index-snapshot.js'\n\n/** Range operators a sorted index can answer. */\nexport type RangeOperator = '<' | '<=' | '>' | '>=' | 'between' | 'startsWith'\n\n// The ordered-key encoding itself moved to `kernel/query/sort-key.ts` (#1339):\n// #1339's declared joins key on it too, and the kernel spine may not\n// statically import a `with-*` service (`check-architecture.mjs`'s\n// port-layering ratchet). Re-exported here so every existing importer of this\n// module is unchanged, and so there is still exactly ONE definition of what\n// makes two stored values comparable.\nexport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\n\ninterface Entry extends SortKey {\n  readonly seq: number\n  readonly id: string\n}\n\n/** A single field's sorted index. */\nexport class SortedIndex {\n  private readonly entries: Entry[] = []\n  private nextSeq = 0\n\n  constructor(readonly field: string) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op when the value has no order-defined kind.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, value: unknown, canonicalKey: string | undefined, seq?: number): void {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return\n    const entry: Entry = { ...sk, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the value it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it (#1369):\n   * `sortRecords()` sorts a snapshot whose order does not change when a\n   * record is written in place, so a tie-breaking rank that drifted to the\n   * back on every `put` would make an index-served page disagree with the\n   * scan it must match. Same contract as `CompoundIndex.remove`.\n   */\n  remove(id: string, value: unknown, canonicalKey: string | undefined): number | undefined {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return undefined\n    // Every entry sharing this key is contiguous; walk that run for the id.\n    for (let i = this.lowerBound(sk); i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (compareKeys(e, sk) !== 0) break\n      if (e.id === id) {\n        this.entries.splice(i, 1)\n        return e.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids in ascending (or descending) key order. Ties keep INSERTION order\n   * in both directions — `sortRecords()` negates its comparator over a\n   * stable sort, which reverses the key order but not the order of equal\n   * keys. A plain `.reverse()` here would disagree on ties.\n   */\n  orderedIds(direction: 'asc' | 'desc'): string[] {\n    if (direction === 'asc') return this.entries.map(e => e.id)\n    const out: string[] = []\n    let end = this.entries.length\n    while (end > 0) {\n      let start = end - 1\n      while (start > 0 && compareKeys(this.entries[start - 1]!, this.entries[end - 1]!) === 0) start--\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  /**\n   * Ids matching a range clause. Returns an empty set when the probe has\n   * no comparable kind — which is what the linear scan would produce too.\n   */\n  lookup(op: RangeOperator, value: unknown): Set<string> {\n    if (op === 'startsWith') return this.prefix(value)\n    if (op === 'between') {\n      if (!Array.isArray(value) || value.length !== 2) return new Set()\n      const lo = toSortKey(value[0], undefined)\n      const hi = toSortKey(value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(this.lowerBound(lo), this.upperBound(hi))\n    }\n    const probe = toSortKey(value, undefined)\n    if (!probe) return new Set()\n    const lo = this.lowerBound(probe)\n    const hi = this.upperBound(probe)\n    // Kind-partitioned: `<`/`>` must stay inside the probe's own kind run.\n    const [kindStart, kindEnd] = this.kindBounds(probe.kind)\n    switch (op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  private prefix(value: unknown): Set<string> {\n    if (typeof value !== 'string') return new Set()\n    const out = new Set<string>()\n    const from = this.lowerBound({ kind: KIND_STRING, key: value })\n    for (let i = from; i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (e.kind !== KIND_STRING) break\n      if (!(e.key as string).startsWith(value)) break\n      out.add(e.id)\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the run of entries with the given kind — binary, not linear. */\n  private kindBounds(kind: KeyKind): [number, number] {\n    return [this.kindBoundary(k => k < kind), this.kindBoundary(k => k <= kind)]\n  }\n\n  private kindBoundary(before: (k: KeyKind) => boolean): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is >= `probe`. */\n  private lowerBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is > `probe`. */\n  private upperBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). `kind` travels with every\n   * key: entries rank by runtime kind first, so an encoding that dropped it\n   * would let a `string` probe reach `number` entries on the way back in.\n   */\n  toSnapshot(): SortedIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'sorted',\n      field: this.field,\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(e => [e.kind, e.key, e.seq, e.id] as WireSortedEntry),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Refusal (`false`) means the\n   * caller rebuilds — it NEVER means a partial index: the entries are staged\n   * and only swapped in once every one of them is accepted.\n   *\n   * `isLive` is the caller's liveness predicate over the record cache. An\n   * entry naming a record the cache does not hold means the blob and the\n   * collection have diverged (a crash between the two writes, say), so the\n   * whole blob is discarded. Crash residue must be a rebuild, never a wrong\n   * answer.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'sorted' || snap.field !== this.field) return false\n    const staged: Entry[] = []\n    for (const [kind, key, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ kind: kind as KeyKind, key, seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: Entry): number {\n    let i = this.upperBound(entry)\n    while (i > 0 && compareKeys(this.entries[i - 1]!, entry) === 0 && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildSortedIndex<T>(\n  idx: SortedIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    const value = readPath(record, idx.field)\n    if (value === null || value === undefined) continue\n    idx.add(id, value, canonicalize?.(idx.field, value))\n  }\n}\n\n","/**\n * Compound (multi-field) sorted indexes — the tuple-keyed sibling of\n * `sorted-indexes.ts` (#1345).\n *\n * A compound index is an array of `{ keys, seq, id }` entries kept in\n * ascending `(keys[0], keys[1], …, seq)` order, where each `keys[i]` is\n * the SAME `SortKey` the single-field sorted index builds — so the tuple\n * encoding is order-preserving per component BY CONSTRUCTION rather than\n * by a second, hand-rolled serialization. Nothing is flattened into a\n * delimited string: a string component can therefore contain any byte\n * without colliding with a separator, and a money field canonicalized to\n * a scaled-integer string (`ViaPipeline.canonicalizeIndexKey`) or a date\n * stored as ISO text sorts inside its own component exactly as it does in\n * the single-field index.\n *\n * The two load-bearing properties of #1344 hold PER COMPONENT:\n *\n *  - **Kind-partitioned.** `compareKeys` ranks by runtime kind first, so\n *    within any equality-prefix run a `string` probe on the next\n *    component cannot reach `number` entries — mirroring `predicate.ts`'s\n *    `isComparable`, exactly as the linear scan behaves.\n *  - **Ties keep insertion order** in both directions. `orderedIds()`\n *    walks equal-key runs forward even when emitting descending, because\n *    `sortRecords()` negates its comparator over a STABLE sort.\n *\n * **A record is indexed only when EVERY component has an order-defined\n * value.** One nullish or non-orderable component and the record is\n * absent — which is why the query builder compares {@link\n * CompoundIndex.size} against the snapshot size before dispatching, and\n * falls back to the scan when the index does not cover the collection.\n *\n * PERSISTENCE (#1359) is OPT-IN, same as its single-field sibling. The wire\n * form keeps the tuple as an ARRAY of per-component keys — see\n * `index-snapshot.ts`: flattening it to a delimited string would destroy\n * exactly the per-component ordering and kind partition this class is built\n * to preserve.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type RangeOperator, type SortKey } from './sorted-indexes.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type CompoundIndexSnapshot,\n  type FieldIndexSnapshot,\n  type WireCompoundEntry,\n  type WireKey,\n} from './index-snapshot.js'\n\n/** A range constraint on the component just past the equality prefix. */\nexport interface CompoundRangeProbe {\n  readonly op: RangeOperator\n  readonly value: unknown\n}\n\ninterface CompoundEntry {\n  readonly keys: readonly SortKey[]\n  readonly seq: number\n  readonly id: string\n}\n\n/** One collection's index over an ordered field tuple. */\nexport class CompoundIndex {\n  private readonly entries: CompoundEntry[] = []\n  private nextSeq = 0\n\n  constructor(readonly fields: readonly string[]) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op unless every component has an ordered key.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, keys: readonly SortKey[] | undefined, seq?: number): void {\n    if (!keys) return\n    const entry: CompoundEntry = { keys, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the tuple it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it: `sortRecords()`\n   * sorts a snapshot whose order does not change when a record is written in\n   * place, so a tie-breaking rank that drifted to the back on every `put`\n   * would make an index-served page disagree with the scan it must match.\n   */\n  remove(id: string, keys: readonly SortKey[] | undefined): number | undefined {\n    if (!keys) return undefined\n    const [from, to] = this.run(keys, keys.length)\n    for (let i = from; i < to; i++) {\n      if (this.entries[i]!.id === id) {\n        const [gone] = this.entries.splice(i, 1)\n        return gone!.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids matching an equality prefix, optionally narrowed by a range on\n   * the next component. An empty set is authoritative: the index covers\n   * these fields and nothing matches.\n   */\n  lookup(prefix: readonly SortKey[], range?: CompoundRangeProbe): Set<string> {\n    const [from, to] = this.run(prefix, prefix.length)\n    if (!range) return this.slice(from, to)\n    const k = prefix.length\n    if (k >= this.fields.length) return new Set()\n\n    if (range.op === 'startsWith') {\n      if (typeof range.value !== 'string') return new Set()\n      const out = new Set<string>()\n      const start = this.lowerBound([...prefix, { kind: KIND_STRING, key: range.value }], k + 1, from, to)\n      for (let i = start; i < to; i++) {\n        const key = this.entries[i]!.keys[k]!\n        if (key.kind !== KIND_STRING) break\n        if (!(key.key as string).startsWith(range.value)) break\n        out.add(this.entries[i]!.id)\n      }\n      return out\n    }\n\n    if (range.op === 'between') {\n      if (!Array.isArray(range.value) || range.value.length !== 2) return new Set()\n      const lo = toSortKey(range.value[0], undefined)\n      const hi = toSortKey(range.value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(\n        this.lowerBound([...prefix, lo], k + 1, from, to),\n        this.upperBound([...prefix, hi], k + 1, from, to),\n      )\n    }\n\n    const probe = toSortKey(range.value, undefined)\n    if (!probe) return new Set()\n    // Kind-partitioned per component: an open-ended bound stays inside the\n    // probe's own kind run, so `< '5'` never sweeps up numeric entries.\n    const [kindStart, kindEnd] = this.kindRun(from, to, k, probe.kind)\n    const lo = this.lowerBound([...prefix, probe], k + 1, from, to)\n    const hi = this.upperBound([...prefix, probe], k + 1, from, to)\n    switch (range.op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = range.op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  /**\n   * Ids matching an equality prefix, in the order of the remaining\n   * components. Ties keep INSERTION order in both directions — a plain\n   * `.reverse()` would disagree with `sortRecords()` on equal keys.\n   */\n  orderedIds(prefix: readonly SortKey[], direction: 'asc' | 'desc'): string[] {\n    const [from, to] = this.run(prefix, prefix.length)\n    const out: string[] = []\n    if (direction === 'asc') {\n      for (let i = from; i < to; i++) out.push(this.entries[i]!.id)\n      return out\n    }\n    let end = to\n    while (end > from) {\n      let start = end - 1\n      while (start > from && this.compare(this.entries[start - 1]!, this.entries[end - 1]!.keys, this.fields.length) === 0) {\n        start--\n      }\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the entries whose first `upto` components equal `probe`. */\n  private run(probe: readonly SortKey[], upto: number): [number, number] {\n    return [\n      this.lowerBound(probe, upto, 0, this.entries.length),\n      this.upperBound(probe, upto, 0, this.entries.length),\n    ]\n  }\n\n  /** [start, end) of the entries in [from,to) whose component `k` has this kind. */\n  private kindRun(from: number, to: number, k: number, kind: number): [number, number] {\n    return [\n      this.kindBoundary(from, to, k, x => x < kind),\n      this.kindBoundary(from, to, k, x => x <= kind),\n    ]\n  }\n\n  private kindBoundary(from: number, to: number, k: number, before: (kind: number) => boolean): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.keys[k]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are >= `probe`. */\n  private lowerBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are > `probe`. */\n  private upperBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). Each entry's tuple stays an\n   * ARRAY of `[kind, key]` pairs: nothing is joined into a string, so a\n   * string component may hold any byte and the per-component kind partition\n   * survives the round trip intact.\n   */\n  toSnapshot(): CompoundIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'compound',\n      fields: [...this.fields],\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(\n        e => [e.keys.map(k => [k.kind, k.key] as WireKey), e.seq, e.id] as WireCompoundEntry,\n      ),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Same contract as\n   * `SortedIndex.loadSnapshot`: all-or-nothing, and an entry naming a record\n   * the cache does not hold rejects the whole blob so crash residue becomes a\n   * rebuild rather than a wrong answer. A snapshot whose field tuple is not\n   * exactly this index's is refused — the declaration changed under it.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'compound') return false\n    if (snap.fields.length !== this.fields.length) return false\n    for (let i = 0; i < snap.fields.length; i++) if (snap.fields[i] !== this.fields[i]) return false\n    const staged: CompoundEntry[] = []\n    for (const [keys, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ keys: keys.map(k => ({ kind: k[0] as SortKey['kind'], key: k[1] })), seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: CompoundEntry): number {\n    const to = this.upperBound(entry.keys, this.fields.length, 0, this.entries.length)\n    let i = to\n    while (i > 0 && this.compare(this.entries[i - 1]!, entry.keys, this.fields.length) === 0\n      && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n\n  private compare(entry: CompoundEntry, probe: readonly SortKey[], upto: number): number {\n    for (let i = 0; i < upto; i++) {\n      const c = compareKeys(entry.keys[i]!, probe[i]!)\n      if (c !== 0) return c\n    }\n    return 0\n  }\n}\n\n/**\n * The tuple key for one record, or `undefined` when any component is\n * nullish or has no order-defined runtime type. Canonicalizes through the\n * same per-field closure the hash and sorted indexes use, so a Via-covered\n * component lives in one key space across all three.\n */\nexport function tupleKeyOf<T>(\n  fields: readonly string[],\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const field of fields) {\n    const value = readPath(record, field)\n    if (value === null || value === undefined) return undefined\n    const key = toSortKey(value, canonicalize?.(field, value))\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Probe keys for an equality prefix, or `undefined` if any operand is unorderable. */\nexport function probeKeysOf(values: readonly unknown[]): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const value of values) {\n    const key = toSortKey(value, undefined)\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildCompoundIndex<T>(\n  idx: CompoundIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    idx.add(id, tupleKeyOf(idx.fields, record, canonicalize))\n  }\n}\n\n/** Stable map key for a field tuple. `\\0` cannot appear in a field path. */\nexport function compoundKey(fields: readonly string[]): string {\n  return fields.join('\\u0000')\n}\n","/**\n * Secondary indexes for the query DSL.\n *\n * ships **in-memory hash indexes**:\n *   - Built during `Collection.ensureHydrated()` from the decrypted cache\n *   - Maintained incrementally on `put` and `delete`\n *   - Consulted by the query executor for `==` and `in` operators on\n *     indexed fields, falling back to a linear scan otherwise\n *   - Live entirely in memory — no adapter writes for the index itself\n *\n * Persistent encrypted index blobs (the spec's \"store as a separate\n * AES-256-GCM blob\" note) are deferred to a follow-up issue. The reasons\n * are documented in the PR body — short version: at the target\n * scale of 1K–50K records, building the index during hydrate is free,\n * so persistence buys nothing measurable.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { stringifyBucketKey, isProbeableBucketKey } from '../../kernel/query/distinct-key.js'\nimport { SortedIndex, buildSortedIndex, type RangeOperator } from './sorted-indexes.js'\nimport {\n  CompoundIndex,\n  buildCompoundIndex,\n  compoundKey,\n  probeKeysOf,\n  tupleKeyOf,\n  type CompoundRangeProbe,\n} from './compound-indexes.js'\nimport {\n  compoundIndexKey,\n  sortedIndexKey,\n  type FieldIndexSnapshot,\n} from './index-snapshot.js'\n\n/**\n * Index declaration accepted by `Collection`'s constructor.\n *\n * Accepts:\n *   - `string` — a single-field hash index (`'clientId'`)\n *   - `{ fields: [...] }` or `readonly string[]` — a composite index\n *     over an ordered field tuple. Only lazy-mode\n *     collections consume composite declarations today; eager mode\n *     silently treats a composite as equivalent to declaring each\n *     component field as its own single-field index.\n *\n * Additive variants (unique constraints, partial indexes) will land as\n * further union members without breaking existing declarations.\n */\nexport type IndexDef =\n  | string\n  | {\n      readonly fields: readonly string[]\n      /**\n       * Enforce that no two records share this field tuple. A MULTI-field\n       * tuple is a COMPOUND unique — uniqueness over the tuple, never over\n       * each component on its own (`['workerId','employerId']` allows one\n       * worker at many employers). Null-distinct: a record with `null` or\n       * `undefined` in any constrained field is exempt.\n       *\n       * ⚠️ **What \"unique\" means depends on the collection's mode (#1358),\n       * and one of the four cannot promise prevention at all:**\n       *\n       * - eager (default) — prevented, from the in-memory map.\n       * - lazy (`prefetch: false`) — prevented, by a point lookup through the\n       *   persisted `_idx/` mirror. Requires `withIndexing()`.\n       * - tiered (`tiers: [...]`) — prevented across every tier whose DEK the\n       *   writer holds. **A tier the writer cannot read is outside the\n       *   guarantee** — those records are unreadable, so no local check can\n       *   see them, and a duplicate against one is accepted.\n       * - CRDT (`crdt: '...'`) — **NOT prevented.** Uniqueness cannot be\n       *   enforced across concurrent replicas: two replicas that are offline\n       *   from each other can both accept the same value, and no local check\n       *   can prevent that. The write always succeeds and both records are\n       *   kept; the collision is reported on the `unique:violation` event as\n       *   a `UniqueConstraintError`, both when it happens and when a later\n       *   session first sees the two records together. What you get is\n       *   uniqueness within what this writer could see at write time, plus\n       *   detection when the replicas meet.\n       */\n      readonly unique?: boolean\n      readonly kind?: IndexKind\n      /**\n       * Persist this index as an encrypted sidecar so a restart reuses it\n       * instead of rebuilding (#1359). Only meaningful with `kind: 'sorted'`\n       * — the hash index is not persisted. OPT-IN until measured: at the\n       * 1K–50K target scale rebuild-on-open is free, and a sidecar is a\n       * write on every debounce window plus a blob at rest.\n       */\n      readonly persist?: boolean\n    }\n  | readonly string[]\n\n/**\n * The access structure an index declaration asks for (#1344).\n *\n * `'hash'` (the default, and what every pre-#1344 declaration means) is\n * the equality/`in` bucket map. `'sorted'` additionally maintains an\n * ordered array over the same canonicalized keys, which lights up\n * index-driven `<`, `<=`, `>`, `>=`, `between`, `startsWith` and\n * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash\n * index too — `==`/`in` stay O(1).\n */\nexport type IndexKind = 'hash' | 'sorted'\n\n/**\n * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`\n * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →\n * passthrough. Pure — used by `Collection`'s sensitive-field leak check\n * and by `getDeclaredIndexes()` (introspection).\n */\nexport function normalizeIndexDefs(\n  defs: readonly IndexDef[],\n): ReadonlyArray<{ readonly fields: readonly string[]; readonly unique?: boolean }> {\n  return defs.map((def) => {\n    if (typeof def === 'string') return { fields: [def] }\n    if (Array.isArray(def)) return { fields: def }\n    return def as { readonly fields: readonly string[]; readonly unique?: boolean }\n  })\n}\n\n/**\n * Internal representation of a built hash index.\n *\n * Maps stringified field values to the set of record ids whose value\n * for that field matches. Stringification keeps the index simple and\n * works uniformly for primitives (`'open'`, `'42'`, `'true'`).\n *\n * Records whose indexed field is `undefined` or `null` are NOT inserted\n * — `query().where('field', '==', undefined)` falls back to a linear\n * scan, which is the conservative behavior.\n */\nexport interface HashIndex {\n  readonly field: string\n  readonly buckets: Map<string, Set<string>>\n}\n\n/**\n * Container for all indexes on a single collection.\n *\n * Methods are pure with respect to the in-memory `buckets` Map — they\n * never touch the adapter or the keyring. The Collection class owns\n * lifecycle (build on hydrate, maintain on put/delete).\n */\nexport class CollectionIndexes {\n  private readonly indexes = new Map<string, HashIndex>()\n\n  /**\n   * Sorted (range) indexes, keyed by field — the #1344 half. Parallel to\n   * `indexes` above and maintained at the SAME mutation sites, through the\n   * SAME `canonicalize` closure, so the two can never disagree about which\n   * key space a field lives in.\n   */\n  private readonly sorted = new Map<string, SortedIndex>()\n\n  /**\n   * Compound (tuple-keyed) sorted indexes, keyed by the joined field\n   * tuple — the #1345 half. Third parallel map, maintained at the SAME\n   * mutation sites through the SAME `canonicalize` closure as the other\n   * two, so no field can end up in disagreeing key spaces.\n   */\n  private readonly compound = new Map<string, CompoundIndex>()\n\n  /**\n   * The indexes declared `persist: true` (#1359), keyed by their SIDECAR key\n   * (`s:<field>` / `c:<f1>,<f2>`). A separate map rather than a flag on the\n   * index classes: persistence is a property of the DECLARATION, and the\n   * index classes stay unaware of storage.\n   */\n  private readonly persistable = new Map<string, SortedIndex | CompoundIndex>()\n\n  /**\n   * Per-field bucket-key canonicalizer (#672 review C1), registered ONCE\n   * via {@link setCanonicalizer} when the collection wires indexing up\n   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by\n   * EVERY bucket-mutation site — `build`/`upsert`/`remove` — so bucket\n   * membership is symmetric by construction: a value can never be added\n   * under a canonical key and later removed under the raw one (or vice\n   * versa), which is what stranded ids on `put`/`delete` before this fix.\n   */\n  private canonicalize?: (field: string, value: unknown) => string | undefined\n\n  /**\n   * Register the bucket-key canonicalizer. Called once, where the\n   * collection constructs its indexing state — safe to call again (the\n   * closure is simply replaced) but there is normally only one caller.\n   */\n  setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void {\n    this.canonicalize = fn\n  }\n\n  /**\n   * Declare an index. Subsequent record additions are tracked under it.\n   * Calling this twice for the same field is a no-op (idempotent).\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { field, buckets: new Map() })\n  }\n\n  /**\n   * Declare a sorted (range) index on a field. Independent of\n   * {@link declare} — callers that want both `==` speed and range speed\n   * declare both (which is what `withIndexing()` does for a\n   * `kind: 'sorted'` declaration). Idempotent.\n   */\n  declareSorted(field: string, opts?: { readonly persist?: boolean }): void {\n    let idx = this.sorted.get(field)\n    if (!idx) {\n      idx = new SortedIndex(field)\n      this.sorted.set(field, idx)\n    }\n    if (opts?.persist) this.persistable.set(sortedIndexKey(field), idx)\n  }\n\n  /** True if the given field has a declared SORTED index. */\n  hasSorted(field: string): boolean {\n    return this.sorted.has(field)\n  }\n\n  /** All sorted-index field names, in declaration order. */\n  sortedFields(): string[] {\n    return [...this.sorted.keys()]\n  }\n\n  /** Number of entries in a field's sorted index (0 when undeclared). */\n  sortedSize(field: string): number {\n    return this.sorted.get(field)?.size ?? 0\n  }\n\n  /**\n   * Range lookup: ids whose `field` satisfies the operator. Returns\n   * `null` when no SORTED index covers the field — the caller falls back\n   * to a linear scan. An empty set means \"the index covers this field and\n   * nothing matches\", which is authoritative.\n   */\n  lookupRange(field: string, op: RangeOperator, value: unknown): ReadonlySet<string> | null {\n    return this.sorted.get(field)?.lookup(op, value) ?? null\n  }\n\n  /**\n   * Ids of every indexed record in `field` order. `null` when no sorted\n   * index covers the field. Records whose value is nullish or has no\n   * order-defined type are absent — compare against {@link sortedSize}\n   * before treating the result as the full collection.\n   */\n  orderedIds(field: string, direction: 'asc' | 'desc'): readonly string[] | null {\n    return this.sorted.get(field)?.orderedIds(direction) ?? null\n  }\n\n  /**\n   * Declare a compound (multi-field) sorted index over an ordered field\n   * tuple. A tuple shorter than two fields is a single-field sorted index\n   * and is ignored here. Idempotent.\n   */\n  declareCompound(fields: readonly string[], opts?: { readonly persist?: boolean }): void {\n    if (fields.length < 2) return\n    const key = compoundKey(fields)\n    let idx = this.compound.get(key)\n    if (!idx) {\n      idx = new CompoundIndex([...fields])\n      this.compound.set(key, idx)\n    }\n    if (opts?.persist) this.persistable.set(compoundIndexKey(fields), idx)\n  }\n\n  /** Every declared field tuple, in declaration order. */\n  compoundTuples(): ReadonlyArray<readonly string[]> {\n    return [...this.compound.values()].map(idx => idx.fields)\n  }\n\n  /**\n   * Number of records the tuple's index holds (0 when undeclared). A\n   * record with a nullish or non-orderable component is absent, so a\n   * caller that removes clauses from the plan MUST compare this against\n   * the snapshot size before trusting the result.\n   */\n  compoundSize(fields: readonly string[]): number {\n    return this.compound.get(compoundKey(fields))?.size ?? 0\n  }\n\n  /**\n   * Compound lookup: ids whose leading components equal `prefixValues`,\n   * optionally narrowed by a range on the component just past them.\n   * `null` when no compound index covers the tuple, or when an operand\n   * has no order-defined type — the caller falls back to a linear scan.\n   */\n  lookupCompound(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    range?: CompoundRangeProbe,\n  ): ReadonlySet<string> | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.lookup(prefix, range)\n  }\n\n  /**\n   * Ids matching an equality prefix, ordered by the remaining components.\n   * `null` when no compound index covers the tuple or an operand has no\n   * order-defined type. See {@link compoundSize} for the coverage caveat.\n   */\n  compoundOrderedIds(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    direction: 'asc' | 'desc',\n  ): readonly string[] | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.orderedIds(prefix, direction)\n  }\n\n  /** True if the given field has a declared index. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Build all declared indexes from a snapshot of records.\n   * Called once per hydration. O(N × indexes.size). Buckets through the\n   * registered {@link setCanonicalizer} closure, same as `upsert`/`remove`.\n   */\n  build<T>(records: ReadonlyArray<{ id: string; record: T }>, skip: ReadonlySet<string> = EMPTY_KEYS): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n      for (const { id, record } of records) {\n        addToIndex(idx, id, record, this.canonicalize)\n      }\n    }\n    // `skip` names the sidecar keys a persisted snapshot already restored\n    // (#1359) — rebuilding them would throw that work away AND renumber every\n    // `seq`, which is what the whole ordered fast path rests on.\n    for (const [field, idx] of this.sorted) {\n      if (skip.has(sortedIndexKey(field))) continue\n      buildSortedIndex(idx, records, this.canonicalize)\n    }\n    for (const idx of this.compound.values()) {\n      if (skip.has(compoundIndexKey(idx.fields))) continue\n      buildCompoundIndex(idx, records, this.canonicalize)\n    }\n  }\n\n  /** Sidecar keys of every index declared `persist: true`, in declaration order. */\n  persistableKeys(): readonly string[] {\n    return [...this.persistable.keys()]\n  }\n\n  /** The persistable snapshot behind one sidecar key, or `undefined` if it is not declared. */\n  snapshotIndex(key: string): FieldIndexSnapshot | undefined {\n    return this.persistable.get(key)?.toSnapshot()\n  }\n\n  /**\n   * Adopt a validated snapshot into the index behind `key`. `false` means the\n   * caller must rebuild that index from the cache — the index is left\n   * untouched, never half-loaded.\n   */\n  restoreIndex(key: string, snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    return this.persistable.get(key)?.loadSnapshot(snap, isLive) ?? false\n  }\n\n  /**\n   * Insert or update a single record across all indexes.\n   * Called by `Collection.put()` after the encrypted write succeeds.\n   *\n   * If `previousRecord` is provided, the record is removed from any old\n   * buckets first — this is the update path. Pass `null` for fresh adds.\n   */\n  upsert<T>(id: string, newRecord: T, previousRecord: T | null): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    // Detach the compound and sorted entries FIRST, holding the rank each one had. An\n    // in-place `put` does not move a record within `snapshot()`, so it must\n    // not move it within a tie run either — otherwise an index-served\n    // `orderBy(...).limit(n)` page disagrees with the stable scan-and-sort\n    // it is required to reproduce exactly (#1345, #1369). The `this.remove()`\n    // below re-runs both removals, which are then no-ops.\n    const ranks = new Map<string, number | undefined>()\n    const sortedRanks = new Map<string, number | undefined>()\n    if (previousRecord !== null) {\n      for (const [key, idx] of this.compound) {\n        ranks.set(key, idx.remove(id, tupleKeyOf(idx.fields, previousRecord, this.canonicalize)))\n      }\n      // Same for the single-field sorted indexes (#1369) — the defect and the\n      // remedy are identical, and the two implementations must agree.\n      for (const [key, idx] of this.sorted) {\n        const value = readPath(previousRecord, idx.field)\n        if (value === null || value === undefined) continue\n        sortedRanks.set(key, idx.remove(id, value, this.canonicalize?.(idx.field, value)))\n      }\n      this.remove(id, previousRecord)\n    }\n    for (const idx of this.indexes.values()) {\n      addToIndex(idx, id, newRecord, this.canonicalize)\n    }\n    for (const [key, idx] of this.sorted) {\n      const value = readPath(newRecord, idx.field)\n      if (value === null || value === undefined) continue\n      idx.add(id, value, this.canonicalize?.(idx.field, value), sortedRanks.get(key))\n    }\n    for (const [key, idx] of this.compound) {\n      idx.add(id, tupleKeyOf(idx.fields, newRecord, this.canonicalize), ranks.get(key))\n    }\n  }\n\n  /**\n   * Remove a record from all indexes. Called by `Collection.delete()`\n   * (and as the first half of `upsert` for the update path).\n   */\n  remove<T>(id: string, record: T): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    for (const idx of this.indexes.values()) {\n      removeFromIndex(idx, id, record, this.canonicalize)\n    }\n    for (const idx of this.sorted.values()) {\n      const value = readPath(record, idx.field)\n      if (value === null || value === undefined) continue\n      idx.remove(id, value, this.canonicalize?.(idx.field, value))\n    }\n    for (const idx of this.compound.values()) {\n      idx.remove(id, tupleKeyOf(idx.fields, record, this.canonicalize))\n    }\n  }\n\n  /** Drop all index data. Called when the collection is invalidated. */\n  clear(): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n    }\n    for (const idx of this.sorted.values()) {\n      idx.clear()\n    }\n    for (const idx of this.compound.values()) {\n      idx.clear()\n    }\n  }\n\n  /**\n   * Equality lookup: return the set of record ids whose `field` matches\n   * the given value. Returns `null` if no index covers the field — the\n   * caller should fall back to a linear scan.\n   *\n   * ⛔ ALSO `null` when the OPERAND has no bucket ADDRESS (#1402) — a\n   * nullish operand, or an object one, which every object-valued record in\n   * the collection shares. Answering those from the buckets returns rows\n   * the scan does not, silently, and only on the collections that happen to\n   * have an index. See `isProbeableBucketKey` for the two measurements.\n   *\n   * The returned Set is a reference to the index's internal storage —\n   * callers must NOT mutate it.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!isProbeableBucketKey(value)) return null\n    const key = stringifyKey(value)\n    return idx.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup: return the union of record ids whose `field` matches any\n   * of the given values. Returns `null` if no index covers the field.\n   *\n   * ⛔ ALSO `null` when ANY member of `values` has no bucket address\n   * (#1402) — one unaddressable member poisons the whole union, since the\n   * result is a union and there is no partial answer to hand back. Same\n   * measurement as {@link lookupEqual}.\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!values.every(isProbeableBucketKey)) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const key = stringifyKey(value)\n      const bucket = idx.buckets.get(key)\n      if (bucket) {\n        for (const id of bucket) out.add(id)\n      }\n    }\n    return out\n  }\n\n  /**\n   * One record id per NON-EMPTY bucket of `field`'s hash index, in bucket\n   * order — the index-backed spine of `Query.distinct()` (#1347). `null` when\n   * no hash index covers the field, so the caller scans instead.\n   *\n   * The bucket set IS the distinct key set, so this costs O(buckets) rather\n   * than O(records). It returns REPRESENTATIVE IDS rather than the keys\n   * themselves on purpose: a bucket key is a canonical string (money's\n   * BigInt-normalized scaled int, say), and `distinct()` owes its caller the\n   * field's real value, which only the record carries.\n   *\n   * Bucket insertion order is first-seen record order — `build()` walks the\n   * snapshot in order and `upsert()` appends — which is why an index-backed\n   * `distinct()` and a scanned one agree on ORDER too, not merely on the set.\n   * Empty buckets are skipped defensively; `removeFromIndex` already deletes\n   * them, so this is belt-and-braces against a future partial removal path.\n   */\n  bucketRepresentatives(field: string): readonly string[] | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    const out: string[] = []\n    for (const bucket of idx.buckets.values()) {\n      for (const id of bucket) {\n        out.push(id)\n        break\n      }\n    }\n    return out\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\nconst EMPTY_KEYS: ReadonlySet<string> = new Set()\n\n/**\n * Stringify a value into a stable bucket key.\n *\n * ⚠️ The DEFINITION moved to `kernel/query/distinct-key.ts` (#1347) and is\n * only aliased here. `distinct()` / `countDistinct()` recompute this key on\n * the scan path, and an index-backed `distinct()` reads the buckets it made —\n * one definition is what stops those two answers from drifting apart. Change\n * the shared function, not a copy.\n */\nconst stringifyKey = stringifyBucketKey\n\nfunction addToIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  let bucket = idx.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    idx.buckets.set(key, bucket)\n  }\n  bucket.add(id)\n}\n\nfunction removeFromIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  const bucket = idx.buckets.get(key)\n  if (!bucket) return\n  bucket.delete(id)\n  // Clean up empty buckets so the Map doesn't accumulate dead keys.\n  if (bucket.size === 0) idx.buckets.delete(key)\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBO,IAAM,+BAA+B;AAkCrC,SAAS,eAAe,OAAuB;AACpD,SAAO,KAAK,mBAAmB,KAAK,CAAC;AACvC;AAGO,SAAS,iBAAiB,QAAmC;AAClE,SAAO,KAAK,OAAO,IAAI,kBAAkB,EAAE,KAAK,GAAG,CAAC;AACtD;AAGA,SAAS,UAAU,GAA0B;AAC3C,MAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,QAAM,CAAC,MAAM,GAAG,IAAI;AAEpB,MAAI,SAAS,KAAK,SAAS,EAAG,QAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG;AACnF,MAAI,SAAS,EAAG,QAAO,OAAO,QAAQ;AACtC,SAAO;AACT;AAEA,SAAS,MAAM,GAAyB;AACtC,SAAO,OAAO,MAAM,YAAY,OAAO,UAAU,CAAC,KAAK,KAAK;AAC9D;AAUO,SAAS,wBAAwB,MAAyC;AAC/E,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,IAAI;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,GAAG,MAAM,6BAA8B,QAAO;AACpD,MAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAG,QAAO;AACjE,QAAM,UAAU,EAAE,SAAS;AAC3B,QAAM,UAAU,EAAE,SAAS;AAE3B,MAAI,EAAE,GAAG,MAAM,UAAU;AACvB,QAAI,OAAO,EAAE,OAAO,MAAM,SAAU,QAAO;AAC3C,UAAM,MAAyB,CAAC;AAChC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,KAAK,EAAE,IAAI;AAC7B,UAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAG,QAAO;AACpC,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAAgB,KAAwB,KAAK,EAAE,CAAC;AAAA,IAC5D;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAY,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACtF,WAAO,EAAE,GAAG,8BAA8B,GAAG,UAAU,OAAO,EAAE,OAAO,GAAG,SAAS,SAAS,IAAI;AAAA,EAClG;AAEA,MAAI,EAAE,GAAG,MAAM,YAAY;AACzB,UAAM,SAAS,EAAE,QAAQ;AACzB,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,CAAC,OAAO,MAAM,OAAK,OAAO,MAAM,QAAQ,EAAG,QAAO;AACvG,UAAM,MAA2B,CAAC;AAClC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,EAAE,IAAI;AACxB,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,OAAO,UAAU,CAAC,KAAK,MAAM,SAAS,EAAG,QAAO;AAC5F,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAA4B,KAAK,EAAE,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACjE,WAAO,EAAE,GAAG,8BAA8B,GAAG,YAAY,QAAQ,SAAS,SAAS,IAAI;AAAA,EACzF;AAEA,SAAO;AACT;AAQA,SAAS,YAAY,MAAyC,MAAkC;AAC9F,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,kBAAkB,KAAK,IAAI,CAAC,GAAI,KAAK,CAAC,CAAE;AAClD,QAAI,IAAI,EAAG,QAAO;AAClB,QAAI,MAAM,KAAK,KAAK,IAAI,CAAC,KAAM,KAAK,CAAC,EAAI,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAuB,GAA+B;AAC/E,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,IAAI,EAAE,CAAC;AACb,UAAM,IAAI,EAAE,CAAC;AACb,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACpC,QAAI,OAAO,EAAE,CAAC,MAAM,YAAY,OAAO,EAAE,CAAC,MAAM,UAAU;AACxD,UAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,IACtC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACxB,aAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;;;AClGO,IAAM,cAAN,MAAkB;AAAA,EAIvB,YAAqB,OAAe;AAAf;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAHJ,UAAmB,CAAC;AAAA,EAC7B,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,OAAgB,cAAkC,KAAoB;AACpF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI;AACT,UAAM,QAAe,EAAE,GAAG,IAAI,KAAK,OAAO,KAAK,WAAW,GAAG;AAC7D,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAO,IAAY,OAAgB,cAAsD;AACvF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI,QAAO;AAEhB,aAAS,IAAI,KAAK,WAAW,EAAE,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC9D,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,YAAY,GAAG,EAAE,MAAM,EAAG;AAC9B,UAAI,EAAE,OAAO,IAAI;AACf,aAAK,QAAQ,OAAO,GAAG,CAAC;AACxB,eAAO,EAAE;AAAA,MACX;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,WAAqC;AAC9C,QAAI,cAAc,MAAO,QAAO,KAAK,QAAQ,IAAI,OAAK,EAAE,EAAE;AAC1D,UAAM,MAAgB,CAAC;AACvB,QAAI,MAAM,KAAK,QAAQ;AACvB,WAAO,MAAM,GAAG;AACd,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,KAAK,YAAY,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,CAAE,MAAM,EAAG;AACzF,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,IAAmB,OAA6B;AACrD,QAAI,OAAO,aAAc,QAAO,KAAK,OAAO,KAAK;AACjD,QAAI,OAAO,WAAW;AACpB,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAChE,YAAMA,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,YAAMC,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK,MAAM,KAAK,WAAWD,GAAE,GAAG,KAAK,WAAWC,GAAE,CAAC;AAAA,IAC5D;AACA,UAAM,QAAQ,UAAU,OAAO,MAAS;AACxC,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,UAAM,KAAK,KAAK,WAAW,KAAK;AAChC,UAAM,KAAK,KAAK,WAAW,KAAK;AAEhC,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,WAAW,MAAM,IAAI;AACvD,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB;AAC3B,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,OAAO,OAA6B;AAC1C,QAAI,OAAO,UAAU,SAAU,QAAO,oBAAI,IAAI;AAC9C,UAAM,MAAM,oBAAI,IAAY;AAC5B,UAAM,OAAO,KAAK,WAAW,EAAE,MAAM,aAAa,KAAK,MAAM,CAAC;AAC9D,aAAS,IAAI,MAAM,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC/C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,EAAE,SAAS,YAAa;AAC5B,UAAI,CAAE,EAAE,IAAe,WAAW,KAAK,EAAG;AAC1C,UAAI,IAAI,EAAE,EAAE;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,MAAiC;AAClD,WAAO,CAAC,KAAK,aAAa,OAAK,IAAI,IAAI,GAAG,KAAK,aAAa,OAAK,KAAK,IAAI,CAAC;AAAA,EAC7E;AAAA,EAEQ,aAAa,QAAyC;AAC5D,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UAC3C,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,IAAI,EAAG,MAAK,MAAM;AAAA,UACtD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,KAAK,EAAG,MAAK,MAAM;AAAA,UACvD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAkC;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAoB;AAAA,IAChF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,YAAY,KAAK,UAAU,KAAK,MAAO,QAAO;AAC7D,UAAM,SAAkB,CAAC;AACzB,eAAW,CAAC,MAAM,KAAK,KAAK,EAAE,KAAK,KAAK,SAAS;AAC/C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAuB,KAAK,KAAK,GAAG,CAAC;AAAA,IACrD;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAAsB;AAC3C,QAAI,IAAI,KAAK,WAAW,KAAK;AAC7B,WAAO,IAAI,KAAK,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACtG;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,iBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,UAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,IAAI,IAAI,OAAO,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,EACrD;AACF;;;AC1OO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,YAAqB,QAA2B;AAA3B;AAAA,EAA4B;AAAA,EAA5B;AAAA,EAHJ,UAA2B,CAAC;AAAA,EACrC,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,MAAsC,KAAoB;AACxE,QAAI,CAAC,KAAM;AACX,UAAM,QAAuB,EAAE,MAAM,KAAK,OAAO,KAAK,WAAW,GAAG;AACpE,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,IAAY,MAA0D;AAC3E,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM;AAC7C,aAAS,IAAI,MAAM,IAAI,IAAI,KAAK;AAC9B,UAAI,KAAK,QAAQ,CAAC,EAAG,OAAO,IAAI;AAC9B,cAAM,CAAC,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AACvC,eAAO,KAAM;AAAA,MACf;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,QAA4B,OAAyC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,QAAI,CAAC,MAAO,QAAO,KAAK,MAAM,MAAM,EAAE;AACtC,UAAM,IAAI,OAAO;AACjB,QAAI,KAAK,KAAK,OAAO,OAAQ,QAAO,oBAAI,IAAI;AAE5C,QAAI,MAAM,OAAO,cAAc;AAC7B,UAAI,OAAO,MAAM,UAAU,SAAU,QAAO,oBAAI,IAAI;AACpD,YAAM,MAAM,oBAAI,IAAY;AAC5B,YAAM,QAAQ,KAAK,WAAW,CAAC,GAAG,QAAQ,EAAE,MAAM,aAAa,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE;AACnG,eAAS,IAAI,OAAO,IAAI,IAAI,KAAK;AAC/B,cAAM,MAAM,KAAK,QAAQ,CAAC,EAAG,KAAK,CAAC;AACnC,YAAI,IAAI,SAAS,YAAa;AAC9B,YAAI,CAAE,IAAI,IAAe,WAAW,MAAM,KAAK,EAAG;AAClD,YAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAAA,MAC7B;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,OAAO,WAAW;AAC1B,UAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5E,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK;AAAA,QACV,KAAK,WAAW,CAAC,GAAG,QAAQD,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,QAChD,KAAK,WAAW,CAAC,GAAG,QAAQC,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,MAClD;AAAA,IACF;AAEA,UAAM,QAAQ,UAAU,MAAM,OAAO,MAAS;AAC9C,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAG3B,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI;AACjE,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,YAAQ,MAAM,IAAI;AAAA,MAChB,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB,MAAM;AACjC,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAA4B,WAAqC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,UAAM,MAAgB,CAAC;AACvB,QAAI,cAAc,OAAO;AACvB,eAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC5D,aAAO;AAAA,IACT;AACA,QAAI,MAAM;AACV,WAAO,MAAM,MAAM;AACjB,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,QAAQ,KAAK,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,EAAG,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG;AACpH;AAAA,MACF;AACA,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,IAAI,OAA2B,MAAgC;AACrE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,MACnD,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,IACrD;AAAA,EACF;AAAA;AAAA,EAGQ,QAAQ,MAAc,IAAY,GAAW,MAAgC;AACnF,WAAO;AAAA,MACL,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,IAAI,IAAI;AAAA,MAC5C,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,KAAK,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,aAAa,MAAc,IAAY,GAAW,QAA2C;AACnG,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,KAAK,CAAC,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UACpD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,IAAI,EAAG,MAAK,MAAM;AAAA,UAC7D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,KAAK,EAAG,MAAK,MAAM;AAAA,UAC9D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAoC;AAClC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ;AAAA,QACpB,OAAK,CAAC,EAAE,KAAK,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAY,GAAG,EAAE,KAAK,EAAE,EAAE;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,WAAY,QAAO;AAClC,QAAI,KAAK,OAAO,WAAW,KAAK,OAAO,OAAQ,QAAO;AACtD,aAAS,IAAI,GAAG,IAAI,KAAK,OAAO,QAAQ,IAAK,KAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAG,QAAO;AAC3F,UAAM,SAA0B,CAAC;AACjC,eAAW,CAAC,MAAM,KAAK,EAAE,KAAK,KAAK,SAAS;AAC1C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAM,KAAK,IAAI,QAAM,EAAE,MAAM,EAAE,CAAC,GAAsB,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,CAAC;AAAA,IAC9F;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAA8B;AACnD,UAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,KAAK,QAAQ,MAAM;AACjF,QAAI,IAAI;AACR,WAAO,IAAI,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAI,MAAM,MAAM,KAAK,OAAO,MAAM,MAAM,KAClF,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACzC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,OAAsB,OAA2B,MAAsB;AACrF,aAAS,IAAI,GAAG,IAAI,MAAM,KAAK;AAC7B,YAAM,IAAI,YAAY,MAAM,KAAK,CAAC,GAAI,MAAM,CAAC,CAAE;AAC/C,UAAI,MAAM,EAAG,QAAO;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AACF;AAQO,SAAS,WACd,QACA,QACA,cACuB;AACvB,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,SAAS,QAAQ,KAAK;AACpC,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,UAAM,MAAM,UAAU,OAAO,eAAe,OAAO,KAAK,CAAC;AACzD,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,YAAY,QAAmD;AAC7E,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,UAAU,OAAO,MAAS;AACtC,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,mBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,QAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,QAAQ,YAAY,CAAC;AAAA,EAC1D;AACF;AAGO,SAAS,YAAY,QAAmC;AAC7D,SAAO,OAAO,KAAK,IAAQ;AAC7B;;;AC1PO,SAAS,mBACd,MACkF;AAClF,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,QAAQ,CAAC,GAAG,EAAE;AACpD,QAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,EAAE,QAAQ,IAAI;AAC7C,WAAO;AAAA,EACT,CAAC;AACH;AAyBO,IAAM,oBAAN,MAAwB;AAAA,EACZ,UAAU,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrC,SAAS,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQtC,WAAW,oBAAI,IAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1C,cAAc,oBAAI,IAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,iBAAiB,IAAiE;AAChF,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,OAAO,SAAS,oBAAI,IAAI,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,OAAe,MAA6C;AACxE,QAAI,MAAM,KAAK,OAAO,IAAI,KAAK;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,YAAY,KAAK;AAC3B,WAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,eAAe,KAAK,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA,EAGA,UAAU,OAAwB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,eAAyB;AACvB,WAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AAAA;AAAA,EAGA,WAAW,OAAuB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,QAAQ;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,OAAe,IAAmB,OAA4C;AACxF,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,KAAK;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,OAAe,WAAqD;AAC7E,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,WAAW,SAAS,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,QAA2B,MAA6C;AACtF,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,MAAM,YAAY,MAAM;AAC9B,QAAI,MAAM,KAAK,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,cAAc,CAAC,GAAG,MAAM,CAAC;AACnC,WAAK,SAAS,IAAI,KAAK,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,iBAAiB,MAAM,GAAG,GAAG;AAAA,EACvE;AAAA;AAAA,EAGA,iBAAmD;AACjD,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,SAAO,IAAI,MAAM;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAa,QAAmC;AAC9C,WAAO,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC,GAAG,QAAQ;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACE,QACA,cACA,OAC4B;AAC5B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,OAAO,QAAQ,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBACE,QACA,cACA,WAC0B;AAC1B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,WAAW,QAAQ,SAAS;AAAA,EACzC;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAS,SAAmD,OAA4B,YAAkB;AACxG,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAClB,iBAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,mBAAW,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,MAC/C;AAAA,IACF;AAIA,eAAW,CAAC,OAAO,GAAG,KAAK,KAAK,QAAQ;AACtC,UAAI,KAAK,IAAI,eAAe,KAAK,CAAC,EAAG;AACrC,uBAAiB,KAAK,SAAS,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,KAAK,IAAI,iBAAiB,IAAI,MAAM,CAAC,EAAG;AAC5C,yBAAmB,KAAK,SAAS,KAAK,YAAY;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,kBAAqC;AACnC,WAAO,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC;AAAA,EACpC;AAAA;AAAA,EAGA,cAAc,KAA6C;AACzD,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,KAAa,MAA0B,QAA0C;AAC5F,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,aAAa,MAAM,MAAM,KAAK;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAU,IAAY,WAAc,gBAAgC;AAClE,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AAOnF,UAAM,QAAQ,oBAAI,IAAgC;AAClD,UAAM,cAAc,oBAAI,IAAgC;AACxD,QAAI,mBAAmB,MAAM;AAC3B,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,cAAM,IAAI,KAAK,IAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,gBAAgB,KAAK,YAAY,CAAC,CAAC;AAAA,MAC1F;AAGA,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,cAAM,QAAQ,SAAS,gBAAgB,IAAI,KAAK;AAChD,YAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,oBAAY,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC,CAAC;AAAA,MACnF;AACA,WAAK,OAAO,IAAI,cAAc;AAAA,IAChC;AACA,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,iBAAW,KAAK,IAAI,WAAW,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,YAAM,QAAQ,SAAS,WAAW,IAAI,KAAK;AAC3C,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,IAAI,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,GAAG,YAAY,IAAI,GAAG,CAAC;AAAA,IAChF;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,UAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,WAAW,KAAK,YAAY,GAAG,MAAM,IAAI,GAAG,CAAC;AAAA,IAClF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAU,IAAY,QAAiB;AACrC,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AACnF,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,sBAAgB,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,IACpD;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,YAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,IAC7D;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,QAAQ,KAAK,YAAY,CAAC;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAGA,QAAc;AACZ,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAAA,IACpB;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,UAAI,MAAM;AAAA,IACZ;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,MAAM;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY,OAAe,OAA4C;AACrE,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO;AACzC,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,OAAe,QAAwD;AAC9E,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,OAAO,MAAM,oBAAoB,EAAG,QAAO;AAChD,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,UAAI,QAAQ;AACV,mBAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,sBAAsB,OAAyC;AAC7D,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAgB,CAAC;AACvB,eAAW,UAAU,IAAI,QAAQ,OAAO,GAAG;AACzC,iBAAW,MAAM,QAAQ;AACvB,YAAI,KAAK,EAAE;AACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAC/C,IAAM,aAAkC,oBAAI,IAAI;AAWhD,IAAM,eAAe;AAErB,SAAS,WACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,MAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,QAAI,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO,IAAI,EAAE;AACf;AAEA,SAAS,gBACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,QAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO,OAAO,EAAE;AAEhB,MAAI,OAAO,SAAS,EAAG,KAAI,QAAQ,OAAO,GAAG;AAC/C;","names":["lo","hi","lo","hi"]}

package/dist/{chunk-MVMXZYXT.js → chunk-2GHDLTPE.js}

@@ -1,6 +1,6 @@
 import {
   linkI18nVia
-} from "./chunk-TRGTKX5E.js";
+} from "./chunk-OKSTSITU.js";
 
 // src/via/i18n/dictionary.ts
 function dictKey(name, keysOrMap, opts) {
@@ -71,4 +71,4 @@ export {
   dictKey,
   staticDict
 };
-//# sourceMappingURL=chunk-MVMXZYXT.js.map
+//# sourceMappingURL=chunk-2GHDLTPE.js.map

package/dist/{chunk-GYGLAVCX.js → chunk-2MG3SW7Q.js}

@@ -1,6 +1,10 @@
+import {
+  hasSealedBody
+} from "./chunk-EZGV6F47.js";
+
 // src/with-shape/satellites/existence.ts
 function isEnvelopeLive(env) {
-  return env !== null && !(env._iv === "" && env._data === "");
+  return env !== null && (hasSealedBody(env) || (env._data ?? "") !== "");
 }
 async function isBaseLive(adapter, vault, base, id) {
   return isEnvelopeLive(await adapter.get(vault, base, id));
@@ -16,4 +20,4 @@ export {
   isBaseLive,
   liveBaseIdSet
 };
-//# sourceMappingURL=chunk-GYGLAVCX.js.map
+//# sourceMappingURL=chunk-2MG3SW7Q.js.map

package/dist/chunk-2MG3SW7Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/existence.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { hasSealedBody } from '../../capsule/index.js'\n\n/**\n * Existence authority (spec § Convergence & existence authority, rule 1): the\n * base row is the sole authority on record existence. `null` (absent) and the\n * tombstone shape (`_iv === '' && _data === ''`, per `buildTombstone()`) both\n * read as \"not live\" — undecrypted, envelope-level checks only.\n */\nfunction isEnvelopeLive(env: EncryptedEnvelope | null): boolean {\n  // #15: absence is the same statement as `''`, so both spellings of a\n  // bodyless envelope must read as NOT existing. `hasSealedBody` carries\n  // that equivalence; the raw `=== ''` comparison silently lost it for an\n  // omitted field — and, being a comparison rather than a read, it stayed\n  // perfectly well-typed while doing so.\n  return env !== null && (hasSealedBody(env) || (env._data ?? '') !== '')\n}\n\n/** One undecrypted adapter `get` on the base — the store-shape the spec pins (zero extra crypto). */\nexport async function isBaseLive(adapter: NoydbStore, vault: string, base: string, id: string): Promise<boolean> {\n  return isEnvelopeLive(await adapter.get(vault, base, id))\n}\n\n/** The set of base ids that are currently live — used to id-filter satellite `list()` results. */\nexport async function liveBaseIdSet(adapter: NoydbStore, vault: string, base: string): Promise<Set<string>> {\n  const ids = await adapter.list(vault, base)\n  const out = new Set<string>()\n  for (const id of ids) if (await isBaseLive(adapter, vault, base, id)) out.add(id)\n  return out\n}\n"],"mappings":";;;;;AASA,SAAS,eAAe,KAAwC;AAM9D,SAAO,QAAQ,SAAS,cAAc,GAAG,MAAM,IAAI,SAAS,QAAQ;AACtE;AAGA,eAAsB,WAAW,SAAqB,OAAe,MAAc,IAA8B;AAC/G,SAAO,eAAe,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE,CAAC;AAC1D;AAGA,eAAsB,cAAc,SAAqB,OAAe,MAAoC;AAC1G,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,MAAM,IAAK,KAAI,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,EAAG,KAAI,IAAI,EAAE;AAChF,SAAO;AACT;","names":[]}

package/dist/{chunk-XLMEZIAJ.js → chunk-2ODVB6LZ.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-XLMEZIAJ.js.map
+//# sourceMappingURL=chunk-2ODVB6LZ.js.map

package/dist/{chunk-HJUWN7JN.js → chunk-2PVXF5CS.js}

@@ -1,10 +1,13 @@
 import {
   validateProjectionLegs
-} from "./chunk-PPTHY5QO.js";
+} from "./chunk-JIBUPZHA.js";
+import {
+  describeGroupKey
+} from "./chunk-XBKH4FOC.js";
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -60,12 +63,12 @@ function withMaterializedView(spec) {
         `withMaterializedView "${spec.name}": UNION strategy with aggregate requires groupBy \u2014 use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`
       );
     }
-    if (spec.moneyFields && !spec.aggregate) {
+    if (spec.moneyFields && !spec.aggregate && !spec.window) {
       throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": moneyFields requires aggregate \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without an aggregate spec`
+        `withMaterializedView "${spec.name}": moneyFields requires aggregate or window \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without one`
       );
     }
-    if (spec.unionSources.some((s) => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {
+    if (spec.unionSources.some((s) => s.join?.some((leg) => !("on" in leg))) && (!spec.sources || spec.sources.length === 0)) {
       throw new MaterializedViewConfigError(
         `withMaterializedView "${spec.name}": a unionSources arm declares join(s) but no \`sources\` are listed \u2014 declare sources: [...] with the right-side (join-target) collection names so writes to them trigger MV refresh`
       );
@@ -76,6 +79,28 @@ function withMaterializedView(spec) {
       );
     }
   }
+  if (spec.window) {
+    if (spec.query) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": window is not supported on the query() form \u2014 the rows come from a Query, which has its own .window(...).select(...). window is for the unionSources / projection forms, whose rows are mapped`
+      );
+    }
+    if (typeof spec.window.select !== "object" || spec.window.select === null || Object.keys(spec.window.select).length === 0) {
+      throw new MaterializedViewConfigError(
+        `withMaterializedView "${spec.name}": window.select must declare at least one output \u2014 a window that selects nothing computes nothing, so declaring one is more likely a mistake than an intention`
+      );
+    }
+    const groupFields = new Set(
+      spec.groupBy === void 0 ? [] : (Array.isArray(spec.groupBy) ? spec.groupBy : [spec.groupBy]).map(describeGroupKey)
+    );
+    for (const key of Object.keys(spec.window.select)) {
+      if (groupFields.has(key)) {
+        throw new MaterializedViewConfigError(
+          `withMaterializedView "${spec.name}": window.select["${key}"] collides with a groupBy key \u2014 a group key is the row's identity and feeds rowKey, so a window output may not overwrite it. Pick another name for the window column`
+        );
+      }
+    }
+  }
   if (spec.projection) {
     const projection = spec.projection;
     if (typeof projection.source !== "string" || projection.source.length === 0) {
@@ -148,9 +173,9 @@ function withMaterializedView(spec) {
         `withMaterializedView "${spec.name}": projection strategy with aggregate requires groupBy \u2014 use groupBy to declare the bucketing keys, or remove aggregate for a row-per-primary-record MV`
       );
     }
-    if (spec.moneyFields && !spec.aggregate) {
+    if (spec.moneyFields && !spec.aggregate && !spec.window) {
       throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": moneyFields requires aggregate \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without an aggregate spec`
+        `withMaterializedView "${spec.name}": moneyFields requires aggregate or window \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without one`
       );
     }
     if (spec.predicates) {
@@ -183,4 +208,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-HJUWN7JN.js.map
+//# sourceMappingURL=chunk-2PVXF5CS.js.map

package/dist/chunk-2PVXF5CS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/with-materialized-view.ts"],"sourcesContent":["import { MaterializedViewConfigError, ValidationError } from '../../kernel/errors.js'\nimport type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js'\nimport { validateProjectionLegs } from './projection-legs.js' // #1140\nimport { describeGroupKey } from '../../kernel/query/reduce/date-trunc.js'\n\n/**\n * Register a materialized view: a declared query whose result is\n * persisted as a queryable collection and kept fresh as sources\n * change. Writes go through the standard `Collection.put` pipeline;\n * refresh-driven deletes route through `Collection._internalDelete` so\n * user `onDelete` guards on the output collection aren't tripped by\n * housekeeping.\n *\n * Three registration modes:\n *   - **single-source** — declare `query: (db) => Query<TRow>`; the\n *     dependency analyzer derives source collections from the plan.\n *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`\n *     plus optional `groupBy` + `aggregate`; the executor reads each\n *     arm, maps to the unified row shape, concatenates, then groups\n *     and aggregates.\n *   - **projection** (#810) — declare `projection: { source, joins,\n *     map }`; one output row per primary record, enriched with\n *     forward FK legs and reverse \"collect\" legs before `map` runs.\n *\n * The three modes are mutually exclusive — exactly one of `query` /\n * `unionSources` / `projection` must be set at registration time.\n *\n * See design-history/2026-05-20-dim14-mv-v2-design.md (single-source v2),\n * design-history/2026-05-21-dim14-mv-multikey-and-union.md (UNION),\n * and design-history/2026-07-25-join-projection-mv-design.md (projection).\n */\nexport function withMaterializedView<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n): MaterializedViewStrategy {\n  if (!spec.name || spec.name.length === 0) {\n    throw new ValidationError('withMaterializedView: name is required')\n  }\n  // Mutual exclusion: exactly one of the three forms must be declared.\n  const declaredForms = [spec.query, spec.unionSources, spec.projection]\n    .filter((f) => f !== undefined).length\n  if (declaredForms > 1) {\n    throw new MaterializedViewConfigError(\n      'query, unionSources, and projection are mutually exclusive — pick one',\n    )\n  }\n  if (declaredForms === 0) {\n    throw new MaterializedViewConfigError(\n      'strategy must declare exactly one of query, unionSources, or projection',\n    )\n  }\n  if (spec.query !== undefined && typeof spec.query !== 'function') {\n    throw new ValidationError('withMaterializedView: query must be a function returning a Query<T>')\n  }\n  // UNION-form invariants.\n  if (spec.unionSources) {\n    // A single arm is a deliberate shape: map→group→aggregate over\n    // ONE collection with a COMPUTED bucket key (e.g. month sliced from a\n    // date field) — something the query form's stored-field groupBy cannot\n    // express. The executor and dependency analyzer are arm-count-agnostic.\n    if (spec.unionSources.length < 1) {\n      throw new MaterializedViewConfigError(\n        'unionSources requires at least 1 source collection',\n      )\n    }\n    const seen = new Set<string>()\n    for (const s of spec.unionSources) {\n      if (typeof s?.collection !== 'string' || s.collection.length === 0) {\n        throw new MaterializedViewConfigError(\n          'each unionSources entry must declare a non-empty `collection` string',\n        )\n      }\n      if (typeof s.map !== 'function') {\n        throw new MaterializedViewConfigError(\n          `unionSources entry for \"${s.collection}\" is missing a \\`map\\` function`,\n        )\n      }\n      if (seen.has(s.collection)) {\n        throw new MaterializedViewConfigError(\n          `unionSources must reference distinct collections (duplicate: \"${s.collection}\")`,\n        )\n      }\n      seen.add(s.collection)\n    }\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": UNION strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`,\n      )\n    }\n    // `moneyFields` only has meaning when there's a reducer to money-rewrite —\n    // it keys reducer outputs, so declaring it with neither is a no-op config\n    // mistake.\n    //\n    // ⚠️ #1411 widened this: a WINDOW's reducer slots are money-rewritten by\n    // the same binding, so `moneyFields` is meaningful for a view that\n    // declares a window and no aggregate — which is exactly the pilot's\n    // per-row running total. Before the widening this guard refused that view\n    // with a message about aggregates it was not trying to use.\n    if (spec.moneyFields && !spec.aggregate && !spec.window) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate or window — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without one`,\n      )\n    }\n    // Per-arm joins resolve right-side collections that the union\n    // dependency set (built from arm `collection`s alone) does NOT\n    // include. The consumer must list those right-side collections in\n    // `sources` so writes to them trigger MV refresh.\n    // #1411 — declared (`on`) legs name their target literally and fold it in\n    // themselves; only ref legs need the consumer to list the right side.\n    if (spec.unionSources.some(s => s.join?.some(leg => !('on' in leg))) && (!spec.sources || spec.sources.length === 0)) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": a unionSources arm declares join(s) but `\n        + `no \\`sources\\` are listed — declare sources: [...] with the right-side `\n        + `(join-target) collection names so writes to them trigger MV refresh`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on UNION strategies — `\n        + `UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Use the query() form, or open an issue if per-arm predicates are needed`,\n      )\n    }\n  }\n  // #1411 — window-form invariants. Shared by UNION and projection, since the\n  // stage runs at both exits from the grouping tail.\n  if (spec.window) {\n    if (spec.query) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": window is not supported on the query() form — `\n        + `the rows come from a Query, which has its own .window(...).select(...). `\n        + `window is for the unionSources / projection forms, whose rows are mapped`,\n      )\n    }\n    if (typeof spec.window.select !== 'object' || spec.window.select === null\n        || Object.keys(spec.window.select).length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": window.select must declare at least one output — `\n        + `a window that selects nothing computes nothing, so declaring one is `\n        + `more likely a mistake than an intention`,\n      )\n    }\n    // Same rule `derive` has, and the same reason: a group key is the row's\n    // identity and feeds rowKey, so writing one from a later stage would\n    // silently re-home the row.\n    const groupFields = new Set<string>(\n      spec.groupBy === undefined\n        ? []\n        : (Array.isArray(spec.groupBy) ? spec.groupBy : [spec.groupBy]).map(describeGroupKey),\n    )\n    for (const key of Object.keys(spec.window.select)) {\n      if (groupFields.has(key)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": window.select[\"${key}\"] collides with a groupBy key — `\n          + `a group key is the row's identity and feeds rowKey, so a window output `\n          + `may not overwrite it. Pick another name for the window column`,\n        )\n      }\n    }\n  }\n\n  // Projection-form invariants (#810). Shape checks only — the\n  // semantic ref() check on collect legs (the `on` field must carry a\n  // ref() targeting the projection source) runs at first\n  // materialization, parity with join-time ref errors.\n  if (spec.projection) {\n    const projection = spec.projection\n    if (typeof projection.source !== 'string' || projection.source.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.source must be a non-empty collection name`,\n      )\n    }\n    if (typeof projection.map !== 'function') {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection is missing a \\`map\\` function`,\n      )\n    }\n    if (!Array.isArray(projection.joins) || projection.joins.length < 1) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.joins must declare at least 1 leg — `\n        + `a leg-less single-source MV is the query() form's job`,\n      )\n    }\n    const seenAs = new Set<string>()\n    for (const leg of projection.joins) {\n      const l = leg as { field?: unknown; collect?: unknown; on?: unknown; as?: unknown }\n      const isForward = l.field !== undefined\n      const isCollect = l.collect !== undefined\n      if (isForward && isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a projection leg cannot declare both \\`field\\` `\n          + `(forward) and \\`collect\\` (reverse) — split it into two legs`,\n        )\n      }\n      if (!isForward && !isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare either \\`field\\` `\n          + `(forward FK) or \\`collect\\` (reverse one-to-many)`,\n        )\n      }\n      if (isForward && (typeof l.field !== 'string' || l.field.length === 0)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a forward projection leg must declare a non-empty \\`field\\``,\n        )\n      }\n      if (isCollect) {\n        if (typeof l.collect !== 'string' || l.collect.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": a collect projection leg must declare a non-empty \\`collect\\` collection name`,\n          )\n        }\n        if (typeof l.on !== 'string' || l.on.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": collect leg for \"${l.collect}\" must declare a non-empty \\`on\\` FK field`,\n          )\n        }\n      }\n      if (typeof l.as !== 'string' || l.as.length === 0) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare a non-empty \\`as\\` alias`,\n        )\n      }\n      if (seenAs.has(l.as)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": projection legs must attach under distinct \\`as\\` aliases (duplicate: \"${l.as}\")`,\n        )\n      }\n      seenAs.add(l.as)\n    }\n    // #1140 — `from` wiring, checked here with the rest of the leg shape rather\n    // than at vault open: it is pure configuration, so the earliest failure is\n    // the best one. Owned by `projection-legs.ts` because the executor and the\n    // registry both walk the same graph.\n    validateProjectionLegs(spec.name, spec.projection)\n    // Post-map grouping invariants — same rules as UNION (the mapped\n    // stream feeds the same shared groupAndReduce tail).\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a row-per-primary-record MV`,\n      )\n    }\n    if (spec.moneyFields && !spec.aggregate && !spec.window) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate or window — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without one`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on projection strategies — `\n        + `projection mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Filter inside projection.map (return null to omit) instead`,\n      )\n    }\n  }\n  // i18nLocale + i18nFields drive compute-time i18n resolution of group-key\n  // i18nText fields before bucketing — UNION mode (resolved on the unified rows)\n  // AND query mode (resolved in GroupedReduction.run before groupAndReduce).\n  // i18nLocale without i18nFields cannot resolve anything, so reject it early.\n  if (spec.i18nLocale !== undefined && spec.i18nFields === undefined) {\n    throw new MaterializedViewConfigError(\n      `withMaterializedView \"${spec.name}\": i18nLocale requires i18nFields — `\n      + `declare the i18nText descriptors of the group-key fields so they can be `\n      + `resolved at the mv layer before bucketing.`,\n    )\n  }\n  if (typeof spec.rowKey !== 'function') {\n    // Two states, two messages. The original text said \"required\" for BOTH,\n    // so passing a field NAME — the shape every other option here takes —\n    // reported the key as ABSENT. That collapse cost this author three\n    // attempts and produced a probe that measured nothing.\n    throw new ValidationError(\n      spec.rowKey === undefined\n        ? 'withMaterializedView: rowKey is required (no default; see spec § Type surface)'\n        : `withMaterializedView: rowKey must be a FUNCTION (row) => string, not a ${typeof spec.rowKey}`\n          + ` — it computes each output row's id from the grouped row, so a field NAME is not enough.`\n          + ` Pass \\`rowKey: (r) => String(r.${typeof spec.rowKey === 'string' ? String(spec.rowKey) : 'someField'})\\`.`)\n  }\n  if (spec.refresh !== 'eager' && spec.refresh !== 'lazy' && spec.refresh !== 'manual') {\n    throw new ValidationError(\n      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got \"${String(spec.refresh)}\"`,\n    )\n  }\n  return {\n    __noydb_strategy: 'materialized-view',\n    spec,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA+BO,SAAS,qBACd,MAC0B;AAC1B,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AAEA,QAAM,gBAAgB,CAAC,KAAK,OAAO,KAAK,cAAc,KAAK,UAAU,EAClE,OAAO,CAAC,MAAM,MAAM,MAAS,EAAE;AAClC,MAAI,gBAAgB,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,UAAU,UAAa,OAAO,KAAK,UAAU,YAAY;AAChE,UAAM,IAAI,gBAAgB,qEAAqE;AAAA,EACjG;AAEA,MAAI,KAAK,cAAc;AAKrB,QAAI,KAAK,aAAa,SAAS,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,OAAO,GAAG,eAAe,YAAY,EAAE,WAAW,WAAW,GAAG;AAClE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,EAAE,UAAU;AAAA,QACzC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,EAAE,UAAU,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,iEAAiE,EAAE,UAAU;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,IAAI,EAAE,UAAU;AAAA,IACvB;AACA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AAUA,QAAI,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,QAAQ;AACvD,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAOA,QAAI,KAAK,aAAa,KAAK,OAAK,EAAE,MAAM,KAAK,SAAO,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI;AACpH,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAGA,MAAI,KAAK,QAAQ;AACf,QAAI,KAAK,OAAO;AACd,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,OAAO,KAAK,OAAO,WAAW,YAAY,KAAK,OAAO,WAAW,QAC9D,OAAO,KAAK,KAAK,OAAO,MAAM,EAAE,WAAW,GAAG;AACnD,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAIA,UAAM,cAAc,IAAI;AAAA,MACtB,KAAK,YAAY,SACb,CAAC,KACA,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,UAAU,CAAC,KAAK,OAAO,GAAG,IAAI,gBAAgB;AAAA,IACxF;AACA,eAAW,OAAO,OAAO,KAAK,KAAK,OAAO,MAAM,GAAG;AACjD,UAAI,YAAY,IAAI,GAAG,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI,qBAAqB,GAAG;AAAA,QAG5D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,KAAK,YAAY;AACnB,UAAM,aAAa,KAAK;AACxB,QAAI,OAAO,WAAW,WAAW,YAAY,WAAW,OAAO,WAAW,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAQ,YAAY;AACxC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,KAAK,WAAW,MAAM,SAAS,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,WAAW,OAAO;AAClC,YAAM,IAAI;AACV,YAAM,YAAY,EAAE,UAAU;AAC9B,YAAM,YAAY,EAAE,YAAY;AAChC,UAAI,aAAa,WAAW;AAC1B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,cAAc,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IAAI;AACtE,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,WAAW;AACb,YAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,WAAW,GAAG;AAC3D,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UACpC;AAAA,QACF;AACA,YAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI,uBAAuB,EAAE,OAAO;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,OAAO,IAAI,EAAE,EAAE,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI,6EAA6E,EAAE,EAAE;AAAA,QACrH;AAAA,MACF;AACA,aAAO,IAAI,EAAE,EAAE;AAAA,IACjB;AAKA,2BAAuB,KAAK,MAAM,KAAK,UAAU;AAGjD,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,QAAI,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,QAAQ;AACvD,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,IAAI;AAAA,IAGpC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,WAAW,YAAY;AAKrC,UAAM,IAAI;AAAA,MACR,KAAK,WAAW,SACZ,sFACA,0EAA0E,OAAO,KAAK,MAAM,gIAEvD,OAAO,KAAK,WAAW,WAAW,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,IAAM;AAAA,EACtH;AACA,MAAI,KAAK,YAAY,WAAW,KAAK,YAAY,UAAU,KAAK,YAAY,UAAU;AACpF,UAAM,IAAI;AAAA,MACR,2EAA2E,OAAO,KAAK,OAAO,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-YJRT5UQM.js → chunk-2RH777HH.js}

@@ -10,14 +10,21 @@ import {
   verifyPrompt,
   verifyRoster,
   verifyTypedEcho
-} from "./chunk-3V4KWFX7.js";
+} from "./chunk-XSPFDUDG.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decryptBytes,
+  encryptBytes,
+  generateEphemeralKey
+} from "./chunk-EZGV6F47.js";
 import {
   NoAccessError,
   NoydbError,
   ValidationError,
   WrongEchoError,
   WrongPromptError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/team/echo-ceremony.ts
 async function beginEchoUnlock(store, vault, opts) {
@@ -66,29 +73,23 @@ var MemoryDeviceSeal = class {
   keyPromise;
   constructor(opts) {
     this.id = opts.id;
-    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
-      "encrypt",
-      "decrypt"
-    ]);
+    this.keyPromise = generateEphemeralKey();
   }
   async seal(plain) {
-    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
-    const ct = new Uint8Array(
-      await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, await this.keyPromise, plain)
-    );
-    const out = new Uint8Array(12 + ct.length);
-    out.set(iv, 0);
-    out.set(ct, 12);
+    const { iv, data } = await encryptBytes(plain, await this.keyPromise);
+    const ivB = base64ToBuffer(iv);
+    const ct = base64ToBuffer(data);
+    const out = new Uint8Array(ivB.byteLength + ct.byteLength);
+    out.set(ivB, 0);
+    out.set(ct, ivB.byteLength);
     return out;
   }
   async unseal(sealed) {
     try {
-      return new Uint8Array(
-        await globalThis.crypto.subtle.decrypt(
-          { name: "AES-GCM", iv: sealed.slice(0, 12) },
-          await this.keyPromise,
-          sealed.slice(12)
-        )
+      return await decryptBytes(
+        bufferToBase64(sealed.slice(0, 12)),
+        bufferToBase64(sealed.slice(12)),
+        await this.keyPromise
       );
     } catch {
       throw new NoydbError("DEVICE_SEAL_UNSEAL_FAILED", "Device seal: unseal failed (tamper or wrong device).");
@@ -122,4 +123,4 @@ export {
   MemoryDeviceSeal,
   withTeam
 };
-//# sourceMappingURL=chunk-YJRT5UQM.js.map
+//# sourceMappingURL=chunk-2RH777HH.js.map

package/dist/{chunk-YJRT5UQM.js.map → chunk-2RH777HH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { NoydbDeviceSeal } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: NoydbDeviceSeal\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * design-history/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * design-history/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { NoydbDeviceSeal } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `NoydbSealer` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link NoydbDeviceSeal} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { NoydbDeviceSeal }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSeal implements NoydbDeviceSeal {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine, verifyRoster as verifyRosterEngine, quarantineKeyring as quarantineEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n    async verifyRoster(team, vault) {\n      return team.runVerifyRoster(verifyRosterEngine, vault)\n    },\n    async quarantineKeyring(team, vault, userId, factors) {\n      return team.runQuarantine(quarantineEngine, vault, userId, factors)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,mBAAN,MAAkD;AAAA,EAC9C;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,IACA,MAAM,aAAa,MAAM,OAAO;AAC9B,aAAO,KAAK,gBAAgB,cAAoB,KAAK;AAAA,IACvD;AAAA,IACA,MAAM,kBAAkB,MAAM,OAAO,QAAQ,SAAS;AACpD,aAAO,KAAK,cAAc,mBAAkB,OAAO,QAAQ,OAAO;AAAA,IACpE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { NoydbDeviceSeal } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: NoydbDeviceSeal\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * design-history/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * design-history/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport {\n  generateEphemeralKey, encryptBytes, decryptBytes, bufferToBase64, base64ToBuffer, type EnclaveKey,\n} from '../../capsule/index.js'\nimport type { NoydbDeviceSeal } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `NoydbSealer` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link NoydbDeviceSeal} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { NoydbDeviceSeal }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSeal implements NoydbDeviceSeal {\n  readonly id: string\n  private readonly keyPromise: Promise<EnclaveKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = generateEphemeralKey()\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const { iv, data } = await encryptBytes(plain, await this.keyPromise)\n    const ivB = base64ToBuffer(iv)\n    const ct = base64ToBuffer(data)\n    const out = new Uint8Array(ivB.byteLength + ct.byteLength)\n    out.set(ivB, 0)\n    out.set(ct, ivB.byteLength)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return await decryptBytes(\n        bufferToBase64(sealed.slice(0, 12)),\n        bufferToBase64(sealed.slice(12)),\n        await this.keyPromise,\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine, verifyRoster as verifyRosterEngine, quarantineKeyring as quarantineEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n    async verifyRoster(team, vault) {\n      return team.runVerifyRoster(verifyRosterEngine, vault)\n    },\n    async quarantineKeyring(team, vault, userId, factors) {\n      return team.runQuarantine(quarantineEngine, vault, userId, factors)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;AC9GO,IAAM,mBAAN,MAAkD;AAAA,EAC9C;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,qBAAqB;AAAA,EACzC;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,aAAa,OAAO,MAAM,KAAK,UAAU;AACpE,UAAM,MAAM,eAAe,EAAE;AAC7B,UAAM,KAAK,eAAe,IAAI;AAC9B,UAAM,MAAM,IAAI,WAAW,IAAI,aAAa,GAAG,UAAU;AACzD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,IAAI,IAAI,UAAU;AAC1B,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,MAAM;AAAA,QACX,eAAe,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,QAClC,eAAe,OAAO,MAAM,EAAE,CAAC;AAAA,QAC/B,MAAM,KAAK;AAAA,MACb;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACnCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,IACA,MAAM,aAAa,MAAM,OAAO;AAC9B,aAAO,KAAK,gBAAgB,cAAoB,KAAK;AAAA,IACvD;AAAA,IACA,MAAM,kBAAkB,MAAM,OAAO,QAAQ,SAAS;AACpD,aAAO,KAAK,cAAc,mBAAkB,OAAO,QAAQ,OAAO;AAAA,IACpE;AAAA,EACF;AACF;","names":[]}