@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/chunk-GF5BZ7D4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/via/blob/binding.ts","../src/port/with/blob-strategy.ts","../src/with-shape/blobs/export-blobs.ts","../src/with-shape/blobs/orphan-report.ts","../src/with-shape/blobs/legacy-sweep.ts","../src/with-shape/blobs/blob-compaction.ts"],"sourcesContent":["/**\n * The blob `NoydbVia` (#629 Task 7) — wires the `blobFields` declaration\n * into the kernel's generic Via port as a deliberately THIN binding:\n * declaration + posture + `describeFragment` + `erase` glue, and nothing\n * else. Blob content is fully out-of-band (`collection.blob(id)` →\n * `BlobSet` writing `_blob_*` side-collections; it never touches\n * `_putInternal` or the record codec), so this binding declares **no\n * write/read pipeline hooks** — in particular no `encodeAtRest`/\n * `decodeAtRest`: a blobFields collection must not flip the pipeline's\n * `hasAtRestHooks`, or the codec would abandon its inline seal path for a\n * feature that never seals record fields. The routing/compaction/TTL/\n * legal-hold/exportBlobs machinery stays service-side in\n * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery\n * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`\n * forbids under `via/*`).\n *\n * Like classified (see `port/with/classified-strategy.ts`), the link is\n * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module\n * load. `blobFields` policies are plain object literals (there is no\n * `blob.*()` declaration factory to hang a lazy link on), so the binder\n * must be installed before `compileVias` ever sees one.\n *\n * There is no `declare`-time validation: `blobFields` has never had a\n * construction-time refusal matrix (policies are consulted lazily by\n * `vault.compact()` and `BlobSet.put`), and inventing one here would\n * break the behavior lock.\n *\n * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline\n * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so\n * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture\n * `queryable: 'none'`); it does not participate in clause building or\n * evaluation.\n */\nimport type { NoydbVia, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\n\n/**\n * Config a blob collection's `blobFields` declaration resolves to — the\n * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL\n * vault/service-provided closure for the `erase` hook, mapping\n * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,\n * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/\n * `retainedShared` become counts, each residue eTag becomes a tagged\n * `{kind: 'blob-residue', eTag}` entry.\n *\n * DELIBERATELY left unwired by `compileVias` (#629 Task 10, resolved\n * within parity-first — see task-10-report.md \"blob purge\" section):\n * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is\n * gated SOLELY on the vault's `blobsStrategy` being configured, never on a\n * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,\n * and IS exercised by those tests, on collections with no `blobFields` at\n * all). Routing it exclusively through this binding would silently stop\n * blob crypto-shredding for every such collection; `vault.forget()` keeps\n * calling `collection.blob(id).shredAllForRecord()` directly for that\n * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a\n * future caller that wants it.\n */\nexport interface BlobViaConfig {\n  readonly fields: BlobFieldsConfig\n  readonly collectionName: string\n  /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */\n  readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>\n}\n\n/**\n * `forget()`'s per-ref blob-purge participation: delegate to the wired\n * closure, or report a clean zero-shredded, zero-residue no-op — the\n * default in production too (#629 Task 10 deliberately leaves this unwired;\n * see `BlobViaConfig`'s doc comment).\n */\nasync function eraseBlobs(ctx: ViaEraseCtx, cfg: BlobViaConfig): Promise<ViaEraseReport> {\n  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id)\n  return { shredded: 0, residue: [] }\n}\n\n/**\n * One field's blob knobs as they appear on `describeFragment()`'s payload\n * (#657 — the second real `NoydbVia.describeFragment` consumer after\n * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).\n * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;\n * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the\n * decrypted record) as presence flags, since a predicate has no serializable\n * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.\n */\nexport interface BlobDescribeFragmentEntry {\n  readonly retainDays?: number\n  readonly evictWhen?: true\n  readonly legalHold?: true\n  readonly retainUntil?: true\n  readonly external?: true\n  readonly public?: true\n  readonly backlink?: string\n}\n\n/** The `'blob'` binding's `describeFragment()` payload shape. */\nexport interface BlobDescribeFragment {\n  readonly blobFields: Record<string, BlobDescribeFragmentEntry>\n}\n\n/**\n * `{ blobFields: { <field>: <knobs> } }` — declarative scalars\n * (`retainDays`/`external`/`public`/`backlink`) verbatim; predicate knobs\n * (`evictWhen`/`legalHold`/`retainUntil` — functions over the decrypted\n * record) as presence flags, since a predicate has no serializable form.\n */\nfunction buildBlobDescribeFragment(fields: BlobFieldsConfig): Record<string, unknown> {\n  return {\n    blobFields: Object.fromEntries(\n      Object.entries(fields).map(([field, p]) => [field, {\n        ...(p.retainDays !== undefined ? { retainDays: p.retainDays } : {}),\n        ...(p.evictWhen !== undefined ? { evictWhen: true } : {}),\n        ...(p.legalHold !== undefined ? { legalHold: true } : {}),\n        ...(p.retainUntil !== undefined ? { retainUntil: true } : {}),\n        ...(p.external === true ? { external: true } : {}),\n        ...(p.public === true ? { public: true } : {}),\n        ...(p.backlink !== undefined ? { backlink: p.backlink } : {}),\n      }]),\n    ),\n  }\n}\n\nexport function blobVia(cfg: BlobViaConfig): NoydbVia {\n  return {\n    brand: 'blob',\n    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes\n    // in `_blob_chunks` (service-side), not sealed record fields; queryable:\n    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()\n    // is a first-class door; forgettable — shredAllForRecord participates in\n    // vault.forget().\n    posture: { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: true },\n    covers: (field) => field in cfg.fields,\n    coveredFields: Object.keys(cfg.fields), // #1447\n    erase: (ctx) => eraseBlobs(ctx, cfg),\n    describeFragment: () => buildBlobDescribeFragment(cfg.fields),\n  }\n}\n\nexport function linkBlobVia(): void {\n  installViaBinder('blob', (c) => blobVia(c as BlobViaConfig))\n}\n","/**\n * Strategy seam between core Collection and the optional blob service\n * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:\n * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the\n * `/with` port (the one seam the kernel spine may import statically) so\n * `Collection`/`Vault` can hold the `NO_BLOBS` default without a\n * spine→service static import.\n *\n * Core imports `BlobsStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a\n * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /\n * MIME machinery — those only arrive when the consumer explicitly\n * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →\n * `withBlobs()` factory).\n *\n * This file is intentionally tiny so the bundler keeps it in the graph\n * without dragging everything else in.\n *\n * @internal\n */\n\nimport type { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { ObjectProjection } from '../../with-shape/blobs/object-projection.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { BlobCacheStats } from '../../with-shape/blobs/blob-pinning.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { linkBlobVia } from '../../via/blob/binding.js'\n\n// Install the blob Via binder EAGERLY (#629 Task 7) — `blobFields` policies\n// are plain object literals (there is no `blob.*()` declaration factory to\n// hang a lazy money/i18n-style link on), so the binder must be installed\n// before `compileVias` ever compiles one. This port module is\n// already unconditionally imported by the kernel spine (for the `NO_BLOBS`\n// strategy default below), so linking here guarantees it — same rationale\n// as `port/with/classified-strategy.ts`'s eager `linkClassifiedVia()`. The\n// binding module is hook-free glue (declare/describe/erase) and imports no\n// machinery, so the eager cost is a few hundred bytes, not `BlobSet`.\nlinkBlobVia()\n\n/**\n * Args forwarded by `Collection.blob(id)` to the active strategy's\n * `openSlot`. The strategy is responsible for returning a live\n * `BlobSet` bound to the given record.\n *\n * @internal\n */\nexport interface BlobsStrategyOpenArgs {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collection: string\n  readonly recordId: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly encrypted: boolean\n  readonly userId: string\n  /**\n   * Collection opts into per-record keys (`perRecordKeys`), so its blobs are\n   * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at\n   * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob\n   * CEK design spec.\n   */\n  readonly erasableBlobs?: boolean\n  /**\n   * #1452 — refuse a content-changing blob verb (`put`/`delete`/`publish`/\n   * `deleteVersion`/`adoptExternal`) when the OWNING RECORD is not writable:\n   * the collection runs its `beforePut` gate bus (closed periods, record\n   * guards) with `incoming = existing`, so an attachment change is gated\n   * exactly as an update of the record would be. Absent → ungated (direct\n   * `BlobSet` construction in tests).\n   */\n  readonly assertOwnerWritable?: () => Promise<void>\n  /**\n   * Collection has `tiers` active (#724 I1 completion). Combined with\n   * `erasableBlobs` false, a content write is refused —\n   * `UnsupportedTierCompositionError` — since a legacy blob has no\n   * per-blob `_cek` and can never be tier-isolated on elevate/demote.\n   */\n  readonly tiersActive?: boolean\n  /**\n   * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).\n   * Blobs are then written as a single un-gzipped object (one base64 chunk) so\n   * the stored object is directly recoverable with native tools (`base64 -d`),\n   * matching the directly-inspectable record layout. Dev-only — see the\n   * plaintext/debug-store-mode design.\n   */\n  readonly debugPlaintext?: boolean\n  /**\n   * Object projection for `external` blob fields (`createNoydb({ objectStore })`).\n   * When present, fields declared `external` in `blobFields` route their raw\n   * bytes here instead of the encrypted-chunk path.\n   */\n  readonly objectStore?: ObjectProjection\n  /** Per-collection blob field policies — used to resolve `external` / `public`. */\n  readonly blobFields?: BlobFieldsConfig\n  /**\n   * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`\n   * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/\n   * `demote` run before any tier `getDEK` call — rather than relying on a bare\n   * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it\n   * is not itself a gate). Omitted only by a construction path that never calls\n   * `atTier()`.\n   */\n  readonly keyring?: UnlockedKeyring\n}\n\n/**\n * The seam interface. `@internal` — do not build public APIs on this\n * shape; it can evolve freely until blobs are extracted into their\n * own package, at which point it will be promoted to public.\n *\n * @internal\n */\nexport interface BlobsStrategy {\n  openSlot(args: BlobsStrategyOpenArgs): BlobSet\n  /**\n   * Snapshot of this device's blob-cache KPI counters: local-read hits,\n   * network misses, and total bytes downloaded from the object store (#808).\n   *\n   * Lives on the seam rather than on the `withBlobs()` return type so the\n   * service has exactly one name (#844b) — `NO_BLOBS` answers with zeros,\n   * which is the truthful reading of \"blobs were never enabled\".\n   */\n  cacheStats(): BlobCacheStats\n}\n\n/**\n * Default strategy for collections that did not opt into blob storage.\n * Every operation surfaces an actionable error that points the caller\n * at the opt-in path.\n *\n * @internal\n */\nexport const NO_BLOBS: BlobsStrategy = {\n  openSlot() {\n    throw new Error(\n      'Blob storage is not enabled on this Noydb instance. ' +\n      'Import `{ withBlobs }` from \"@noy-db/hub/blobs\" and pass `withBlobs()` to `createNoydb({ blobsStrategy: withBlobs() })`.',\n    )\n  },\n  cacheStats() {\n    return { hits: 0, misses: 0, bytesDownloaded: 0 }\n  },\n}\n","/**\n * `vault.exportBlobs()` — bulk blob extraction primitive.\n *\n * Async-iterable handle over every blob attached to records in a\n * vault, optionally filtered by collection allowlist and per-record\n * predicate. Emits tuples of `{ blobId, recordRef, bytes, meta }` so\n * the consumer can pipe into any sink (zip stream, S3 multipart, USB\n * copy, cold-storage tape) without pulling the whole export into\n * memory.\n *\n * ## Auth + audit\n *\n * - Capability check runs **once** at handle creation via\n *   `Vault.assertCanExport('plaintext', 'blob')`. An operator whose\n *   keyring lacks that bit fails before a single byte of ciphertext\n *   is decrypted.\n * - Audit entry lands in `_export_audit` at handle creation: the\n *   actor, start timestamp, target collections, predicate presence,\n *   and batch mechanism. **No content hashes** — per the spec\n *   non-correlation invariant.\n *\n * ## Abort + resume\n *\n * - `handle.abort()` flips the internal signal; the next iteration\n *   boundary throws `AbortError`. Consumers already in `for await`\n *   can catch and exit cleanly.\n * - Restart after a partial failure with `{ afterBlobId }` — the\n *   iterator skips tuples up to (and including) that blob id before\n *   yielding again. Combined with a blob-count ceiling it supports\n *   idempotent batch re-runs.\n *\n * @module\n */\n\nimport type { Collection } from '../../kernel/collection.js'\nimport type { SlotInfo } from '../../kernel/types.js'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface ExportBlobsOptions {\n  /**\n   * Collection allowlist. Omit to export blobs from every collection\n   * the caller has read access to.\n   */\n  readonly collections?: readonly string[]\n  /**\n   * Per-record predicate. Called on the decrypted record BEFORE any\n   * blob bytes are read for that record — returning false skips the\n   * record and all its slots without touching their chunks.\n   */\n  readonly where?: (record: unknown, context: { collection: string; id: string }) => boolean\n  /**\n   * Resume after a specific blob id. The iterator skips tuples up to\n   * and including this id, then yields. Format of the id is the same\n   * as `ExportedBlob.blobId` (the HMAC-keyed eTag).\n   */\n  readonly afterBlobId?: string\n  /**\n   * External abort signal. When fired, the next iterator tick throws\n   * `ExportBlobsAbortedError`. Honored alongside `handle.abort()`.\n   */\n  readonly signal?: AbortSignal\n}\n\nexport interface ExportedBlob {\n  /** Opaque blob identifier — HMAC-keyed eTag, stable across vaults. */\n  readonly blobId: string\n  /** Where this blob came from in the vault. */\n  readonly recordRef: {\n    readonly collection: string\n    readonly id: string\n    readonly slot: string\n  }\n  /** Decrypted plaintext bytes. */\n  readonly bytes: Uint8Array\n  /** Best-effort metadata (from the blob slot record). */\n  readonly meta: {\n    readonly size: number\n    /**\n     * User-visible filename stored on the slot. Often equal to the\n     * slot name; differs when the caller supplied an explicit\n     * `filename` to `BlobSet.put()`.\n     */\n    readonly filename: string\n    readonly mimeType?: string\n    readonly createdAt?: string\n  }\n}\n\nexport interface ExportBlobsHandle extends AsyncIterable<ExportedBlob> {\n  /** Abort the export. Safe to call multiple times. */\n  abort(): void\n  /** True once `abort()` has fired or the external signal aborted. */\n  readonly aborted: boolean\n}\n\nexport class ExportBlobsAbortedError extends Error {\n  constructor(reason: string) {\n    super(`exportBlobs aborted: ${reason}`)\n    this.name = 'ExportBlobsAbortedError'\n  }\n}\n\n// ─── Audit ──────────────────────────────────────────────────────────────\n\nexport const EXPORT_AUDIT_COLLECTION = '_export_audit'\n\nexport interface ExportBlobsAuditEntry {\n  readonly id: string\n  readonly mechanism: 'exportBlobs'\n  readonly actor: string\n  readonly startedAt: string\n  readonly collections: readonly string[] | null\n  readonly predicate: boolean\n  readonly afterBlobId: string | null\n}\n\n// ─── Implementation ─────────────────────────────────────────────────────\n\n/**\n * Build the handle. Factored out of `Vault.exportBlobs` so the\n * implementation can be unit-tested without going through the\n * compartment lifecycle.\n */\nexport function createExportBlobsHandle(\n  actor: string,\n  listAccessibleCollections: () => Promise<string[]>,\n  getCollection: <T>(name: string) => Collection<T>,\n  writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>,\n  options: ExportBlobsOptions,\n): ExportBlobsHandle {\n  let aborted = false\n\n  const abort = (): void => {\n    aborted = true\n  }\n\n  if (options.signal) {\n    if (options.signal.aborted) aborted = true\n    options.signal.addEventListener('abort', () => { aborted = true })\n  }\n\n  function assertLive(): void {\n    if (aborted) throw new ExportBlobsAbortedError('aborted by caller')\n  }\n\n  const allowlist = options.collections ? new Set(options.collections) : null\n\n  // Write the audit entry BEFORE the first yield so a blocked\n  // iteration still leaves an audit trail that the export started.\n  let auditPromise: Promise<void> | null = null\n  function writeAuditOnce(): Promise<void> {\n    if (!auditPromise) {\n      auditPromise = writeAudit({\n        id: generateBatchId(),\n        mechanism: 'exportBlobs',\n        actor,\n        startedAt: new Date().toISOString(),\n        collections: options.collections ?? null,\n        predicate: Boolean(options.where),\n        afterBlobId: options.afterBlobId ?? null,\n      })\n    }\n    return auditPromise\n  }\n\n  async function* generate(): AsyncGenerator<ExportedBlob> {\n    await writeAuditOnce()\n    assertLive()\n\n    // Resolve target collections lazily — also keeps the call async.\n    const allCollections = await listAccessibleCollections()\n    const targets = allCollections.filter(name => {\n      if (name.startsWith('_')) return false\n      if (allowlist && !allowlist.has(name)) return false\n      return true\n    })\n\n    let resumeCursorHit = options.afterBlobId === undefined\n\n    for (const collectionName of targets) {\n      if (aborted) return\n\n      const coll = getCollection<Record<string, unknown>>(collectionName)\n      const records = await coll.list().catch(() => [])\n      for (const record of records) {\n        if (aborted) return\n        assertLive()\n\n        const idField = (record as { id?: unknown }).id\n        if (typeof idField !== 'string') continue\n\n        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue\n\n        const blobSet = coll.blob(idField)\n        const slots = await blobSet.list().catch(() => [] as SlotInfo[])\n        for (const slot of slots) {\n          if (aborted) return\n\n          if (!resumeCursorHit) {\n            if (slot.eTag === options.afterBlobId) {\n              resumeCursorHit = true\n            }\n            continue\n          }\n\n          const bytes = await blobSet.get(slot.name)\n          if (!bytes) continue\n\n          const item: ExportedBlob = {\n            blobId: slot.eTag,\n            recordRef: { collection: collectionName, id: idField, slot: slot.name },\n            bytes,\n            meta: {\n              size: slot.size,\n              filename: slot.filename,\n              ...(slot.mimeType !== undefined && { mimeType: slot.mimeType }),\n              ...(slot.uploadedAt !== undefined && { createdAt: slot.uploadedAt }),\n            },\n          }\n          yield item\n        }\n      }\n    }\n  }\n\n  const handle: ExportBlobsHandle = {\n    abort,\n    get aborted() { return aborted },\n    [Symbol.asyncIterator]: () => generate(),\n  }\n  return handle\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction generateBatchId(): string {\n  // 16 bytes of crypto randomness, URL-safe base64, no padding.\n  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  let s = ''\n  for (const b of raw) s += b.toString(16).padStart(2, '0')\n  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`\n}\n","/**\n * Orphan blob-chunk REPORT (#1133) — the read-only half of the residue #1127\n * stopped producing.\n *\n * Before #1127, `releaseRef` deleted a blob's index row BEFORE its chunks, so a\n * crash in between stranded chunk bodies nothing can ever reach: `loadBlobObject`\n * returns null so no reader addresses them, and `rekeyBlobSet` derives its chunk\n * ids from each index entry's `chunkCount` so a rotation never visits them. For a\n * LEGACY blob (bytes under the shared `_blob` DEK rather than a per-blob content\n * CEK) those bodies then stay openable under the retired DEK indefinitely.\n *\n * #1127 reversed the order, which removes the class at the source. It does\n * nothing for orphans created before the fix, and this module does not delete\n * them either. It counts them.\n *\n * ## Why this REPORTS and does not RECLAIM\n *\n * Deciding \"orphaned\" requires `store.list(_blob_index)`, and the store is\n * untrusted — that is the premise of the product, not a caveat on it. A store\n * that withholds a single index row makes a LIVE blob's chunks look orphaned. A\n * reclaim pass acting on that would convert **withholding**, which is reversible\n * the moment the store stops lying, into **permanent destruction** — handing an\n * untrusted store a data-loss primitive it does not currently have, in order to\n * tidy up residue.\n *\n * Reporting inverts the risk to something harmless: a lying store can only\n * inflate this count. Nothing is deleted on its word, so the worst outcome is an\n * operator investigating residue that turns out not to exist.\n *\n * Re-keying is not an alternative either: the chunk AAD is\n * `{eTag}:{chunkIndex}:{chunkCount}`, and `chunkCount` lives only in the index\n * row that is already gone — an orphan's AAD is unreconstructable, so it cannot\n * be decrypted-and-re-encrypted at all.\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION } from './blob-set.js'\n\n/** How many distinct orphaned eTags to name in the report. */\nconst SAMPLE_LIMIT = 10\n\nexport interface OrphanChunkReport {\n  /** Chunk rows whose eTag has no `_blob_index` entry. */\n  readonly chunks: number\n  /** Distinct eTags those chunks belong to. */\n  readonly eTags: number\n  /**\n   * Up to {@link SAMPLE_LIMIT} of those eTags, so an operator can inspect a real\n   * one rather than only a count. Deterministic (store list order), not random.\n   */\n  readonly sampleETags: readonly string[]\n  /**\n   * Chunk ids that do not match the `{eTag}_{index}` grammar at all. Counted\n   * rather than skipped: an id this module cannot parse is a thing it cannot\n   * classify either way, and reporting zero orphans while silently dropping\n   * such ids would be the reassuring-but-wrong answer.\n   */\n  readonly unparseable: number\n}\n\n/**\n * Split a chunk id into `{eTag, index}`, or `null` if it does not fit the\n * grammar `BlobSet` writes (`${eTag}_${i}`).\n *\n * Splits on the LAST underscore and requires a digits-only suffix. eTags are\n * HMAC-SHA-256 hex today and contain no underscore, so a simpler split would\n * work — but it would break silently if that ever changed, and this rule holds\n * either way.\n */\nfunction parseChunkId(id: string): { eTag: string; index: number } | null {\n  const cut = id.lastIndexOf('_')\n  if (cut <= 0 || cut === id.length - 1) return null\n  const suffix = id.slice(cut + 1)\n  if (!/^\\d+$/.test(suffix)) return null\n  return { eTag: id.slice(0, cut), index: Number(suffix) }\n}\n\n/**\n * Count chunk rows with no surviving index row. Read-only: two `list` calls and\n * no `get`, no `delete`, and no decryption — an orphan cannot be opened anyway.\n *\n * A store that cannot list either collection yields an empty report rather than\n * throwing: this is a diagnostic riding along with a maintenance pass, and it\n * must not be able to fail one.\n */\nexport async function reportOrphanBlobChunks(\n  adapter: NoydbStore,\n  vault: string,\n): Promise<OrphanChunkReport> {\n  const empty: OrphanChunkReport = { chunks: 0, eTags: 0, sampleETags: [], unparseable: 0 }\n  let liveETags: Set<string>\n  let chunkIds: string[]\n  try {\n    liveETags = new Set(await adapter.list(vault, BLOB_INDEX_COLLECTION))\n    chunkIds = await adapter.list(vault, BLOB_CHUNKS_COLLECTION)\n  } catch {\n    return empty\n  }\n\n  let chunks = 0\n  let unparseable = 0\n  const orphanETags = new Set<string>()\n  for (const id of chunkIds) {\n    const parsed = parseChunkId(id)\n    if (parsed === null) { unparseable += 1; continue }\n    if (liveETags.has(parsed.eTag)) continue\n    chunks += 1\n    orphanETags.add(parsed.eTag)\n  }\n\n  return {\n    chunks,\n    eTags: orphanETags.size,\n    sampleETags: [...orphanETags].slice(0, SAMPLE_LIMIT),\n    unparseable,\n  }\n}\n","/**\n * #1453 — count, and optionally reclaim, legacy blobs nothing references.\n *\n * A legacy blob (no per-blob `_cek`) is left at refCount 0 \"for deferred GC\"\n * by `releaseRef`; before this the deferred GC had no verb outside\n * `forget()` (which needs `withForget`), and `orphanBlobChunks` could not see\n * these rows because they keep their index entry — so `vault.compact()`\n * reported clean over a vault whose blob storage grew on every overwrite.\n *\n * Reclaiming here is SAFE where reclaiming orphans is not (see\n * `orphan-report.ts`): the decision reads `refCount` off an AAD-bound index\n * row the hub decrypted itself, never the store's `list()`. A withholding\n * store cannot make a live blob look unreferenced; it can only hide a row from\n * this sweep, which then does nothing to it.\n *\n * Rows sealed at an elevated tier do not open under the flat `_blob` DEK and\n * are skipped, not counted: this is a tier-0 pass.\n */\nimport type { NoydbStore, BlobObject } from '../../kernel/types.js'\nimport { openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { TamperedError } from '../../kernel/errors.js'\nimport { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION } from './blob-set.js'\n\n/** What `vault.compact()` reports (and, on request, reclaims) about legacy blobs. */\nexport interface UnreferencedLegacyBlobReport {\n  /** `_blob_index` rows with no `_cek` (legacy) and `refCount <= 0`. */\n  readonly blobs: number\n  /** Chunk rows those blobs still hold. */\n  readonly chunks: number\n  /** How many of those blobs this run deleted (chunks first, then the index row). */\n  readonly reclaimed: number\n}\n\nexport async function sweepUnreferencedLegacyBlobs(\n  ctx: { adapter: NoydbStore; vault: string; getDEK: (name: string) => Promise<EnclaveKey>; encrypted: boolean },\n  reclaim: boolean,\n): Promise<UnreferencedLegacyBlobReport> {\n  let blobs = 0, chunks = 0, reclaimed = 0\n  const eTags = await ctx.adapter.list(ctx.vault, BLOB_INDEX_COLLECTION)\n  const dek = ctx.encrypted ? await ctx.getDEK(BLOB_COLLECTION) : null\n  for (const eTag of eTags) {\n    const env = await ctx.adapter.get(ctx.vault, BLOB_INDEX_COLLECTION, eTag)\n    if (!env) continue\n    let blob: BlobObject\n    try {\n      // `encrypt: false` stores the body as plaintext JSON; read it as the\n      // opaque string it is (no enclave field is interpreted here).\n      const json = dek ? await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, env, dek) : env['_data']\n      blob = JSON.parse(json) as BlobObject\n    } catch (err) {\n      if (err instanceof TamperedError) continue // elevated-tier row: not this pass's\n      throw err\n    }\n    // A BlobObject with a wrapped content key is erasable and shreds eagerly at\n    // refCount 0; only the key-less legacy shape ever lingers.\n    if (Object.hasOwn(blob, '_cek') || blob.refCount > 0) continue\n    blobs += 1\n    chunks += blob.chunkCount\n    if (!reclaim) continue\n    // CHUNKS BEFORE INDEX — same ordering rule as `deleteChunksThenIndex` (#1127).\n    for (let i = 0; i < blob.chunkCount; i++) {\n      await ctx.adapter.delete(ctx.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`)\n    }\n    await ctx.adapter.delete(ctx.vault, BLOB_INDEX_COLLECTION, eTag)\n    reclaimed += 1\n  }\n  return { blobs, chunks, reclaimed }\n}\n","/**\n * Blob retention + compaction.\n *\n * Declarative per-collection / per-slot eviction policy. Two\n * triggers:\n *\n *   - **`retainDays`** — age-based TTL. A slot uploaded more than N\n *     days ago is evicted.\n *   - **`evictWhen(record)`** — predicate over the **decrypted**\n *     record. Lets consumers express \"the image is safe to drop once\n *     the structured invoice has been reviewed and confirmed.\"\n *\n * Either trigger (or both) causes the slot to evict. Eviction removes\n * the slot entry from `_blob_slots_{collection}`, decrements the\n * blob's refCount (so unreferenced chunks can be GC'd by the next\n * sweep), and writes one entry to the `_blob_eviction_audit`\n * collection for tamper-evident record-keeping.\n *\n * The audit entry carries the eTag of the evicted blob (opaque HMAC\n * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,\n * per the SPEC non-correlation invariant. Consumers reconstructing\n * \"what used to be attached\" can look up the audit entry by record\n * id.\n *\n * Compaction is **consumer-scheduled** — noy-db never runs a\n * background daemon. Call `vault.compact()` whenever your workflow\n * allows (cron, manual \"tidy\" button, cold-storage export prep, …).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope, SlotInfo } from '../../kernel/types.js'\nimport { ValidationError } from '../../kernel/errors.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { reportOrphanBlobChunks, type OrphanChunkReport } from './orphan-report.js'\nimport { sweepUnreferencedLegacyBlobs, type UnreferencedLegacyBlobReport } from './legacy-sweep.js'\n\n// ─── Config types ───────────────────────────────────────────────────────\n\nexport interface BlobFieldPolicy<T = unknown> {\n  /**\n   * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's\n   * opaque `ViaDescriptor` (#629 Task 7). Optional (the\n   * `ClassifiedFieldSpec._viaBrand` precedent): `blobFields` policies are\n   * plain object literals with no declaration factory to stamp it, so a\n   * mandatory field would break every existing declaration.\n   */\n  readonly _viaBrand?: 'blob'\n  /**\n   * Age-based TTL in days. A slot whose `uploadedAt` is older than\n   * `now - retainDays × 86400s` evicts on the next `vault.compact()`.\n   * Omit to disable age-based eviction.\n   */\n  readonly retainDays?: number\n  /**\n   * Predicate evaluated against the decrypted record. When it returns\n   * `true`, every matching slot on that record evicts. Omit to\n   * disable predicate-based eviction.\n   */\n  readonly evictWhen?: (record: T) => boolean\n  /**\n   * **Legal hold.** When this predicate returns `true`, the slot is\n   * never evicted — `retainDays`/`evictWhen` are overridden. Use for a\n   * litigation / audit hold on a fiscal document: the blob stays until\n   * the predicate returns `false` (the hold is released). Fail-closed:\n   * if the predicate throws, the slot is treated as held.\n   */\n  readonly legalHold?: (record: T) => boolean\n  /**\n   * **Period-bound retention.** Returns the date (Date / ISO string /\n   * epoch ms) until which the slot must be retained — typically derived\n   * from the record's fiscal period (e.g. period end + 10 years). While\n   * `now < retainUntil`, the slot is never evicted, regardless of\n   * `retainDays`. Return `null`/`undefined` to impose no floor.\n   * Fail-closed: a throwing function holds the slot.\n   */\n  readonly retainUntil?: (record: T) => Date | string | number | null | undefined\n  /**\n   * **External projection.** When `true`, this field's bytes are stored in the\n   * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,\n   * **unencrypted** object — servable directly from S3/CDN and processable by\n   * native tooling — instead of the encrypted-chunk path. The encrypted slot\n   * record remains the catalog (anchoring invariant). Requires an `objectStore`;\n   * **outside the zero-knowledge guarantee** — use only for assets meant to\n   * leave the vault. See the as-aws-s3 design spec.\n   */\n  readonly external?: boolean\n  /**\n   * For an `external` field: make the object world-readable (CDN origin) rather\n   * than presigned-only. Default `false` (presigned). Ignored unless `external`.\n   */\n  readonly public?: boolean\n  /**\n   * For an `external` field: how to stamp a **backlink** (this record's\n   * vault/collection/id/field) onto the object's metadata — the self-describing\n   * \"secondary store\" that powers reconcile / DR / import re-pairing.\n   * - `'opaque-token'` (default): a random id; preserves the opaque-bucket\n   *   property (no names leak); the token is also recorded on the slot.\n   * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;\n   *   falls back to `'opaque-token'` on a plaintext vault).\n   * - `'plain'`: the reference in cleartext metadata — **leaks structure** to\n   *   bucket readers; only for non-sensitive deployments.\n   * - `'none'`: no backlink.\n   */\n  readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none'\n}\n\nexport type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>\n\n// ─── Audit collection ──────────────────────────────────────────────────\n\nexport const BLOB_EVICTION_AUDIT_COLLECTION = '_blob_eviction_audit'\n\nexport interface BlobEvictionEntry {\n  readonly id: string\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly blobHash: string\n  /** `'budget'` — evicted by the #808 cache-budget LRU pass, not a policy. */\n  readonly reason: 'ttl' | 'predicate' | 'both' | 'budget'\n  readonly evictedAt: string\n  readonly actor: string\n}\n\n// ─── Compaction result ──────────────────────────────────────────────────\n\nexport interface CompactionResult {\n  /** Number of blob slots evicted by the policy pass across all collections. */\n  readonly evicted: number\n  /** Number of records touched (iterated + policy checked). */\n  readonly records: number\n  /** Number of collections with `blobFields` configured. */\n  readonly collections: number\n  /**\n   * Number of audit entries written — one per policy eviction plus one per\n   * budget SLOT eviction (dropping a device-local cache copy writes none).\n   */\n  readonly auditEntries: number\n  /**\n   * Number of slots that would have evicted (TTL/predicate triggered)\n   * but were retained by a `legalHold` or `retainUntil` floor.\n   */\n  readonly held: number\n  /**\n   * #808: number of slots whose due policy eviction was skipped because they\n   * are pinned for offline on THIS device (pin state is device-local).\n   */\n  readonly pinned: number\n  /**\n   * #808: number of evictions performed by the `cacheBudget` LRU pass —\n   * internal slots evicted through the standard eviction writer plus\n   * device-local external cache copies dropped. 0 when no budget was given.\n   */\n  readonly budgetEvicted: number\n  /** #808: plaintext bytes freed by the `cacheBudget` LRU pass. */\n  readonly budgetBytesFreed: number\n  /** Per-collection breakdown for diagnostics. */\n  readonly byCollection: Record<string, { records: number; evicted: number }>\n  /**\n   * #1133 — chunk rows in `_blob_chunks` with no surviving `_blob_index` entry.\n   * Pre-#1127 residue: unreachable by every reader AND by rotation, so for a\n   * legacy blob the bytes stay openable under a retired `_blob` DEK.\n   *\n   * REPORTED, never reclaimed — deciding \"orphaned\" means trusting the store's\n   * `list`, and a store that withholds one index row would have us destroy a\n   * LIVE blob's chunks. See `orphan-report.ts` for the full argument. A vault\n   * that has run `migrate()` has no legacy chunks to strand, and `chunks: 0`\n   * is the expected reading everywhere else.\n   */\n  readonly orphanBlobChunks: OrphanChunkReport\n  /**\n   * #1453 — legacy (no `_cek`) blobs at `refCount <= 0`: released by every\n   * reference-drop path but never reclaimed, because a legacy chunk has no\n   * eager shred. Counted on every run; deleted only with\n   * `reclaimLegacyBlobs: true`. Not an orphan in the `orphanBlobChunks`\n   * sense — these rows keep their index entry, which is exactly why that\n   * report could not see them.\n   */\n  readonly unreferencedLegacyBlobs: UnreferencedLegacyBlobReport\n}\n\n// ─── Core ──────────────────────────────────────────────────────────────\n\nexport interface CompactRunOptions {\n  /** Override \"now\" for deterministic testing. */\n  readonly now?: Date\n  /**\n   * Stop after this many evictions. Useful for capped batches / cron\n   * jobs that need to fit in a time window. `undefined` = unbounded.\n   */\n  readonly maxEvictions?: number\n  /**\n   * Dry-run — evaluate policies and return the counts, but do NOT\n   * delete slots or write audit entries. Lets a consumer preview\n   * what would happen.\n   */\n  readonly dryRun?: boolean\n  /**\n   * #808 mobile cache budget: cap the locally-cached UNPINNED blob bytes.\n   * After the policy pass, a dedicated LRU pass walks every collection's\n   * slots (pinned slots and `legalHold`/`retainUntil`-held slots are exempt\n   * and uncounted) and evicts oldest-access-first — internal slots through\n   * the standard eviction writer (`deleteSlot` + a `'budget'` audit entry),\n   * external slots by dropping their device-local encrypted cache copy only\n   * (the object-store copy is authoritative and untouched) — until the\n   * remaining unpinned bytes fit `maxBytes`. Internal slots count their\n   * uncompressed `size`; external slots count `cachedBytes` (0 = nothing\n   * local, nothing to evict). LRU order comes from the device-local\n   * `lastAccessAt` stamp, falling back to `uploadedAt`.\n   */\n  readonly cacheBudget?: { readonly maxBytes: number }\n  /**\n   * #1453 — reclaim unreferenced legacy blobs (chunks first, then the index\n   * row). Off by default: reclaiming is irreversible and the default posture\n   * for a maintenance pass is to report. Ignored under `dryRun`.\n   */\n  readonly reclaimLegacyBlobs?: boolean\n}\n\nexport interface CompactionContext {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly actor: string\n  readonly encrypted: boolean\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n  /**\n   * Resolve a collection's declared `blobFields` config. Returns an\n   * empty map for collections without the config — the walk skips\n   * those.\n   */\n  readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null\n  /** List collection names in the vault. */\n  readonly listCollections: () => Promise<string[]>\n  /** List record ids in a collection. */\n  readonly listRecords: (collection: string) => Promise<string[]>\n  /** Decrypt and return the record. Null when absent. */\n  readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>\n  /** Return the BlobSet-like handle for a record's slots. */\n  readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>\n  /** Delete a slot and decrement its blob's refCount. */\n  readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>\n  /**\n   * #808: drop a slot's DEVICE-LOCAL cached copy (the encrypted external\n   * side-cache) without touching the slot or the object store. Returns the\n   * plaintext bytes freed. Optional — absent (or a 0 return) means external\n   * cache entries simply cannot be budget-evicted through this context.\n   */\n  readonly dropLocalCache?: (collection: string, id: string, slotName: string) => Promise<number>\n}\n\nexport async function runCompaction(\n  ctx: CompactionContext,\n  options: CompactRunOptions = {},\n): Promise<CompactionResult> {\n  // #1133 — two `list` calls, no decryption, nothing written. Always on rather\n  // than opt-in: residue an operator has to know to ask about is residue nobody\n  // finds. The cost is negligible beside this pass's own per-record `getRecord`.\n  const orphanBlobChunks = await reportOrphanBlobChunks(ctx.adapter, ctx.vault)\n  const now = options.now ?? new Date()\n  const maxEvictions = options.maxEvictions ?? Infinity\n  const dryRun = options.dryRun === true\n  // #1453 — always counted, reclaimed only on request and never under dryRun.\n  const unreferencedLegacyBlobs = await sweepUnreferencedLegacyBlobs(ctx, options.reclaimLegacyBlobs === true && !dryRun)\n  if (options.cacheBudget !== undefined\n    && (!Number.isFinite(options.cacheBudget.maxBytes) || options.cacheBudget.maxBytes < 0)) {\n    throw new ValidationError('compact(): cacheBudget.maxBytes must be a non-negative finite number (#808)')\n  }\n\n  const allCollections = await ctx.listCollections()\n  const byCollection: Record<string, { records: number; evicted: number }> = {}\n  let evicted = 0\n  let records = 0\n  let auditEntries = 0\n  let held = 0\n  let pinned = 0\n  let collectionsWithPolicy = 0\n\n  outer: for (const collectionName of allCollections) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    if (!config) continue\n    const configuredSlots = Object.keys(config)\n    if (configuredSlots.length === 0) continue\n    collectionsWithPolicy += 1\n    byCollection[collectionName] = { records: 0, evicted: 0 }\n\n    const ids = await ctx.listRecords(collectionName)\n    for (const recordId of ids) {\n      if (evicted >= maxEvictions) break outer\n\n      const record = await ctx.getRecord(collectionName, recordId).catch(() => null)\n      if (record === null) continue\n      records += 1\n      byCollection[collectionName].records += 1\n\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      for (const slot of slots) {\n        if (evicted >= maxEvictions) break outer\n        const policy = config[slot.name]\n        if (!policy) continue\n\n        const reason = evaluatePolicy(policy, record, slot, now)\n        if (!reason) continue\n\n        // #808: device-local offline pin — an exemption inside this existing\n        // pass, exactly like a hold: counted, never evicted. `slot.pinned` is\n        // the device-local annotation `BlobSet.list()` stamps from the\n        // withBlobs() pin registry (never synced state).\n        if (slot.pinned === true) {\n          pinned += 1\n          continue\n        }\n\n        // Retention floor: a legal hold or period-bound retainUntil\n        // blocks an otherwise-due eviction. Counted, never evicted.\n        if (isHeld(policy, record, now)) {\n          held += 1\n          continue\n        }\n\n        if (!dryRun) {\n          await ctx.deleteSlot(collectionName, recordId, slot.name)\n          await writeAuditEntry(ctx, {\n            id: generateEvictionId(collectionName, recordId, slot.name),\n            collection: collectionName,\n            recordId,\n            slotName: slot.name,\n            blobHash: slot.eTag,\n            reason,\n            evictedAt: now.toISOString(),\n            actor: ctx.actor,\n          })\n          auditEntries += 1\n        }\n        evicted += 1\n        byCollection[collectionName].evicted += 1\n      }\n    }\n  }\n\n  // #808: cache-budget LRU pass — runs AFTER the policy pass so a slot that\n  // just evicted no longer counts toward the budget. Reuses this module's own\n  // eviction writer (deleteSlot + audit), never a parallel one.\n  let budgetEvicted = 0\n  let budgetBytesFreed = 0\n  if (options.cacheBudget !== undefined) {\n    const pass = await runBudgetPass(ctx, options.cacheBudget.maxBytes, {\n      now, dryRun, remainingEvictions: maxEvictions - evicted,\n    })\n    budgetEvicted = pass.evicted\n    budgetBytesFreed = pass.bytesFreed\n    auditEntries += pass.auditEntries\n  }\n\n  return {\n    evicted,\n    records,\n    collections: collectionsWithPolicy,\n    auditEntries,\n    held,\n    pinned,\n    budgetEvicted,\n    budgetBytesFreed,\n    byCollection,\n    orphanBlobChunks,\n    unreferencedLegacyBlobs,\n  }\n}\n\n// ─── #808: cache-budget LRU pass ───────────────────────────────────────\n\ninterface BudgetCandidate {\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly eTag: string\n  readonly bytes: number\n  /** `'slot'` — internal blob, evicted via `deleteSlot`; `'cache'` — external device-local copy, dropped via `dropLocalCache`. */\n  readonly kind: 'slot' | 'cache'\n  readonly lastAccessMs: number\n}\n\n/**\n * Enforce `cacheBudget.maxBytes` over the locally-cached UNPINNED blob bytes\n * (see {@link CompactRunOptions.cacheBudget} for the full contract). Walks\n * EVERY collection — unlike the policy pass, the budget is not gated on a\n * declared `blobFields` config — but still honors a declared policy's\n * `legalHold`/`retainUntil` floor where one exists.\n */\nasync function runBudgetPass(\n  ctx: CompactionContext,\n  maxBytes: number,\n  opts: { now: Date; dryRun: boolean; remainingEvictions: number },\n): Promise<{ evicted: number; bytesFreed: number; auditEntries: number }> {\n  const candidates: BudgetCandidate[] = []\n  let total = 0\n\n  for (const collectionName of await ctx.listCollections()) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    for (const recordId of await ctx.listRecords(collectionName)) {\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      if (slots.length === 0) continue\n      // The record is only needed to evaluate a declared policy's retention\n      // floor — skip the decrypt entirely for policy-less collections.\n      const record = config\n        ? await ctx.getRecord<unknown>(collectionName, recordId).catch(() => null)\n        : null\n      for (const slot of slots) {\n        if (slot.pinned === true) continue // pinned: exempt AND uncounted (#808)\n        const policy = config?.[slot.name]\n        if (policy && record !== null && isHeld(policy, record, opts.now)) continue // floor blocks budget too\n        const lastAccessMs = Date.parse(slot.lastAccessAt ?? slot.uploadedAt) || 0\n        const isExternal = slot.external !== undefined\n        const bytes = isExternal ? slot.cachedBytes ?? 0 : slot.size\n        if (bytes <= 0) continue // external with no local copy: nothing cached to evict\n        total += bytes\n        candidates.push({\n          collection: collectionName, recordId, slotName: slot.name, eTag: slot.eTag,\n          bytes, kind: isExternal ? 'cache' : 'slot', lastAccessMs,\n        })\n      }\n    }\n  }\n\n  // Oldest access first; deterministic tiebreak so equal timestamps (common\n  // within one ms) never make the eviction order flap between runs.\n  candidates.sort((a, b) =>\n    a.lastAccessMs - b.lastAccessMs\n    || a.collection.localeCompare(b.collection)\n    || a.recordId.localeCompare(b.recordId)\n    || a.slotName.localeCompare(b.slotName))\n\n  let evicted = 0\n  let bytesFreed = 0\n  let auditEntries = 0\n  for (const c of candidates) {\n    if (total <= maxBytes || evicted >= opts.remainingEvictions) break\n    if (!opts.dryRun) {\n      if (c.kind === 'slot') {\n        await ctx.deleteSlot(c.collection, c.recordId, c.slotName)\n        await writeAuditEntry(ctx, {\n          id: generateEvictionId(c.collection, c.recordId, c.slotName),\n          collection: c.collection,\n          recordId: c.recordId,\n          slotName: c.slotName,\n          blobHash: c.eTag,\n          reason: 'budget',\n          evictedAt: opts.now.toISOString(),\n          actor: ctx.actor,\n        })\n        auditEntries += 1\n      } else {\n        // Device-local cache drop only — the slot (catalog) and the\n        // object-store copy are untouched, so no eviction audit entry.\n        await ctx.dropLocalCache?.(c.collection, c.recordId, c.slotName)\n      }\n    }\n    evicted += 1\n    bytesFreed += c.bytes\n    total -= c.bytes\n  }\n\n  return { evicted, bytesFreed, auditEntries }\n}\n\n/**\n * Whether a retention floor (legal hold or period-bound `retainUntil`)\n * currently blocks eviction of this record's slots. Fail-closed: a\n * throwing predicate holds the slot.\n */\nfunction isHeld<T>(policy: BlobFieldPolicy<T>, record: T, now: Date): boolean {\n  if (policy.legalHold) {\n    try {\n      if (policy.legalHold(record)) return true\n    } catch {\n      return true\n    }\n  }\n  if (policy.retainUntil) {\n    try {\n      const until = policy.retainUntil(record)\n      if (until !== null && until !== undefined) {\n        const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(String(until))\n        if (!Number.isFinite(t)) return true   // fail-closed: unparseable retainUntil holds the slot\n        if (t > now.getTime()) return true\n      }\n    } catch {\n      return true\n    }\n  }\n  return false\n}\n\nfunction evaluatePolicy<T>(\n  policy: BlobFieldPolicy<T>,\n  record: T,\n  slot: SlotInfo,\n  now: Date,\n): 'ttl' | 'predicate' | 'both' | null {\n  let ttlTriggered = false\n  let predicateTriggered = false\n\n  if (policy.retainDays !== undefined && policy.retainDays > 0) {\n    const uploadedAt = Date.parse(slot.uploadedAt)\n    if (Number.isFinite(uploadedAt)) {\n      const ageMs = now.getTime() - uploadedAt\n      const limitMs = policy.retainDays * 86_400_000\n      if (ageMs > limitMs) ttlTriggered = true\n    }\n  }\n\n  if (policy.evictWhen) {\n    try {\n      if (policy.evictWhen(record)) predicateTriggered = true\n    } catch {\n      // Predicate error → do NOT evict. Fail closed.\n    }\n  }\n\n  if (ttlTriggered && predicateTriggered) return 'both'\n  if (ttlTriggered) return 'ttl'\n  if (predicateTriggered) return 'predicate'\n  return null\n}\n\nfunction generateEvictionId(collection: string, recordId: string, slotName: string): string {\n  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8))\n  let suffix = ''\n  for (const b of rand) suffix += b.toString(16).padStart(2, '0')\n  return `${collection}__${recordId}__${slotName}__${suffix}`\n}\n\nasync function writeAuditEntry(ctx: CompactionContext, entry: BlobEvictionEntry): Promise<void> {\n  const json = JSON.stringify(entry)\n  const identity = { collection: BLOB_EVICTION_AUDIT_COLLECTION, id: entry.id, by: entry.actor, version: 1 }\n  const body = { ts: entry.evictedAt }\n  let envelope: EncryptedEnvelope\n  if (ctx.encrypted) {\n    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION)\n    const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { ...body, iv, data })\n  } else {\n    envelope = buildRecordEnvelope(identity, { ...body, iv: '', data: json })\n  }\n  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuEA,eAAe,WAAW,KAAkB,KAA6C;AACvF,MAAI,IAAI,oBAAqB,QAAO,IAAI,oBAAoB,IAAI,EAAE;AAClE,SAAO,EAAE,UAAU,GAAG,SAAS,CAAC,EAAE;AACpC;AAgCA,SAAS,0BAA0B,QAAmD;AACpF,SAAO;AAAA,IACL,YAAY,OAAO;AAAA,MACjB,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;AAAA,QACjD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACjE,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAC3D,GAAI,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC5C,GAAI,EAAE,aAAa,SAAY,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,KAA8B;AACpD,SAAO;AAAA,IACL,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA,IAC/F,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,eAAe,OAAO,KAAK,IAAI,MAAM;AAAA;AAAA,IACrC,OAAO,CAAC,QAAQ,WAAW,KAAK,GAAG;AAAA,IACnC,kBAAkB,MAAM,0BAA0B,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,QAAQ,CAAkB,CAAC;AAC7D;;;ACtGA,YAAY;AA8FL,IAAM,WAA0B;AAAA,EACrC,WAAW;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAAA,EACA,aAAa;AACX,WAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,EAAE;AAAA,EAClD;AACF;;;AC9CO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,wBAAwB,MAAM,EAAE;AACtC,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,0BAA0B;AAmBhC,SAAS,wBACd,OACA,2BACA,eACA,YACA,SACmB;AACnB,MAAI,UAAU;AAEd,QAAM,QAAQ,MAAY;AACxB,cAAU;AAAA,EACZ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,QAAQ,OAAO,QAAS,WAAU;AACtC,YAAQ,OAAO,iBAAiB,SAAS,MAAM;AAAE,gBAAU;AAAA,IAAK,CAAC;AAAA,EACnE;AAEA,WAAS,aAAmB;AAC1B,QAAI,QAAS,OAAM,IAAI,wBAAwB,mBAAmB;AAAA,EACpE;AAEA,QAAM,YAAY,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AAIvE,MAAI,eAAqC;AACzC,WAAS,iBAAgC;AACvC,QAAI,CAAC,cAAc;AACjB,qBAAe,WAAW;AAAA,QACxB,IAAI,gBAAgB;AAAA,QACpB,WAAW;AAAA,QACX;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,QAAQ,KAAK;AAAA,QAChC,aAAa,QAAQ,eAAe;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,WAAyC;AACvD,UAAM,eAAe;AACrB,eAAW;AAGX,UAAM,iBAAiB,MAAM,0BAA0B;AACvD,UAAM,UAAU,eAAe,OAAO,UAAQ;AAC5C,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,UAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAG,QAAO;AAC9C,aAAO;AAAA,IACT,CAAC;AAED,QAAI,kBAAkB,QAAQ,gBAAgB;AAE9C,eAAW,kBAAkB,SAAS;AACpC,UAAI,QAAS;AAEb,YAAM,OAAO,cAAuC,cAAc;AAClE,YAAM,UAAU,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAChD,iBAAW,UAAU,SAAS;AAC5B,YAAI,QAAS;AACb,mBAAW;AAEX,cAAM,UAAW,OAA4B;AAC7C,YAAI,OAAO,YAAY,SAAU;AAEjC,YAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,QAAQ,CAAC,EAAG;AAE1F,cAAM,UAAU,KAAK,KAAK,OAAO;AACjC,cAAM,QAAQ,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAe;AAC/D,mBAAW,QAAQ,OAAO;AACxB,cAAI,QAAS;AAEb,cAAI,CAAC,iBAAiB;AACpB,gBAAI,KAAK,SAAS,QAAQ,aAAa;AACrC,gCAAkB;AAAA,YACpB;AACA;AAAA,UACF;AAEA,gBAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AACzC,cAAI,CAAC,MAAO;AAEZ,gBAAM,OAAqB;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,WAAW,EAAE,YAAY,gBAAgB,IAAI,SAAS,MAAM,KAAK,KAAK;AAAA,YACtE;AAAA,YACA,MAAM;AAAA,cACJ,MAAM,KAAK;AAAA,cACX,UAAU,KAAK;AAAA,cACf,GAAI,KAAK,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS;AAAA,cAC7D,GAAI,KAAK,eAAe,UAAa,EAAE,WAAW,KAAK,WAAW;AAAA,YACpE;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA4B;AAAA,IAChC;AAAA,IACA,IAAI,UAAU;AAAE,aAAO;AAAA,IAAQ;AAAA,IAC/B,CAAC,OAAO,aAAa,GAAG,MAAM,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,kBAA0B;AAEjC,QAAM,MAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI,IAAI;AACR,aAAW,KAAK,IAAK,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3D;;;AC3MA,IAAM,eAAe;AA8BrB,SAAS,aAAa,IAAoD;AACxE,QAAM,MAAM,GAAG,YAAY,GAAG;AAC9B,MAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,EAAG,QAAO;AAC9C,QAAM,SAAS,GAAG,MAAM,MAAM,CAAC;AAC/B,MAAI,CAAC,QAAQ,KAAK,MAAM,EAAG,QAAO;AAClC,SAAO,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,OAAO,MAAM,EAAE;AACzD;AAUA,eAAsB,uBACpB,SACA,OAC4B;AAC5B,QAAM,QAA2B,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG,aAAa,EAAE;AACxF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,MAAM,QAAQ,KAAK,OAAO,qBAAqB,CAAC;AACpE,eAAW,MAAM,QAAQ,KAAK,OAAO,sBAAsB;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,SAAS;AACb,MAAI,cAAc;AAClB,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,MAAM,UAAU;AACzB,UAAM,SAAS,aAAa,EAAE;AAC9B,QAAI,WAAW,MAAM;AAAE,qBAAe;AAAG;AAAA,IAAS;AAClD,QAAI,UAAU,IAAI,OAAO,IAAI,EAAG;AAChC,cAAU;AACV,gBAAY,IAAI,OAAO,IAAI;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AAAA,IACnB,aAAa,CAAC,GAAG,WAAW,EAAE,MAAM,GAAG,YAAY;AAAA,IACnD;AAAA,EACF;AACF;;;ACnFA,eAAsB,6BACpB,KACA,SACuC;AACvC,MAAI,QAAQ,GAAG,SAAS,GAAG,YAAY;AACvC,QAAM,QAAQ,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,qBAAqB;AACrE,QAAM,MAAM,IAAI,YAAY,MAAM,IAAI,OAAO,eAAe,IAAI;AAChE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,uBAAuB,IAAI;AACxE,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AAGF,YAAM,OAAO,MAAM,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,IAAI,OAAO;AAClH,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI,eAAe,cAAe;AAClC,YAAM;AAAA,IACR;AAGA,QAAI,OAAO,OAAO,MAAM,MAAM,KAAK,KAAK,WAAW,EAAG;AACtD,aAAS;AACT,cAAU,KAAK;AACf,QAAI,CAAC,QAAS;AAEd,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,wBAAwB,GAAG,IAAI,IAAI,CAAC,EAAE;AAAA,IAC5E;AACA,UAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,uBAAuB,IAAI;AAC/D,iBAAa;AAAA,EACf;AACA,SAAO,EAAE,OAAO,QAAQ,UAAU;AACpC;;;AC4CO,IAAM,iCAAiC;AA4I9C,eAAsB,cACpB,KACA,UAA6B,CAAC,GACH;AAI3B,QAAM,mBAAmB,MAAM,uBAAuB,IAAI,SAAS,IAAI,KAAK;AAC5E,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAElC,QAAM,0BAA0B,MAAM,6BAA6B,KAAK,QAAQ,uBAAuB,QAAQ,CAAC,MAAM;AACtH,MAAI,QAAQ,gBAAgB,WACtB,CAAC,OAAO,SAAS,QAAQ,YAAY,QAAQ,KAAK,QAAQ,YAAY,WAAW,IAAI;AACzF,UAAM,IAAI,gBAAgB,6EAA6E;AAAA,EACzG;AAEA,QAAM,iBAAiB,MAAM,IAAI,gBAAgB;AACjD,QAAM,eAAqE,CAAC;AAC5E,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,wBAAwB;AAE5B,QAAO,YAAW,kBAAkB,gBAAgB;AAClD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB,OAAO,KAAK,MAAM;AAC1C,QAAI,gBAAgB,WAAW,EAAG;AAClC,6BAAyB;AACzB,iBAAa,cAAc,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE;AAExD,UAAM,MAAM,MAAM,IAAI,YAAY,cAAc;AAChD,eAAW,YAAY,KAAK;AAC1B,UAAI,WAAW,aAAc,OAAM;AAEnC,YAAM,SAAS,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC7E,UAAI,WAAW,KAAM;AACrB,iBAAW;AACX,mBAAa,cAAc,EAAE,WAAW;AAExC,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,iBAAW,QAAQ,OAAO;AACxB,YAAI,WAAW,aAAc,OAAM;AACnC,cAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,YAAI,CAAC,OAAQ;AAEb,cAAM,SAAS,eAAe,QAAQ,QAAQ,MAAM,GAAG;AACvD,YAAI,CAAC,OAAQ;AAMb,YAAI,KAAK,WAAW,MAAM;AACxB,oBAAU;AACV;AAAA,QACF;AAIA,YAAI,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAC/B,kBAAQ;AACR;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI,WAAW,gBAAgB,UAAU,KAAK,IAAI;AACxD,gBAAM,gBAAgB,KAAK;AAAA,YACzB,IAAI,mBAAmB,gBAAgB,UAAU,KAAK,IAAI;AAAA,YAC1D,YAAY;AAAA,YACZ;AAAA,YACA,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,WAAW,IAAI,YAAY;AAAA,YAC3B,OAAO,IAAI;AAAA,UACb,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,mBAAW;AACX,qBAAa,cAAc,EAAE,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAKA,MAAI,gBAAgB;AACpB,MAAI,mBAAmB;AACvB,MAAI,QAAQ,gBAAgB,QAAW;AACrC,UAAM,OAAO,MAAM,cAAc,KAAK,QAAQ,YAAY,UAAU;AAAA,MAClE;AAAA,MAAK;AAAA,MAAQ,oBAAoB,eAAe;AAAA,IAClD,CAAC;AACD,oBAAgB,KAAK;AACrB,uBAAmB,KAAK;AACxB,oBAAgB,KAAK;AAAA,EACvB;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBA,eAAe,cACb,KACA,UACA,MACwE;AACxE,QAAM,aAAgC,CAAC;AACvC,MAAI,QAAQ;AAEZ,aAAW,kBAAkB,MAAM,IAAI,gBAAgB,GAAG;AACxD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,eAAW,YAAY,MAAM,IAAI,YAAY,cAAc,GAAG;AAC5D,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,UAAI,MAAM,WAAW,EAAG;AAGxB,YAAM,SAAS,SACX,MAAM,IAAI,UAAmB,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI,IACvE;AACJ,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,WAAW,KAAM;AAC1B,cAAM,SAAS,SAAS,KAAK,IAAI;AACjC,YAAI,UAAU,WAAW,QAAQ,OAAO,QAAQ,QAAQ,KAAK,GAAG,EAAG;AACnE,cAAM,eAAe,KAAK,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK;AACzE,cAAM,aAAa,KAAK,aAAa;AACrC,cAAM,QAAQ,aAAa,KAAK,eAAe,IAAI,KAAK;AACxD,YAAI,SAAS,EAAG;AAChB,iBAAS;AACT,mBAAW,KAAK;AAAA,UACd,YAAY;AAAA,UAAgB;AAAA,UAAU,UAAU,KAAK;AAAA,UAAM,MAAM,KAAK;AAAA,UACtE;AAAA,UAAO,MAAM,aAAa,UAAU;AAAA,UAAQ;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,aAAW,KAAK,CAAC,GAAG,MAClB,EAAE,eAAe,EAAE,gBAChB,EAAE,WAAW,cAAc,EAAE,UAAU,KACvC,EAAE,SAAS,cAAc,EAAE,QAAQ,KACnC,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAEzC,MAAI,UAAU;AACd,MAAI,aAAa;AACjB,MAAI,eAAe;AACnB,aAAW,KAAK,YAAY;AAC1B,QAAI,SAAS,YAAY,WAAW,KAAK,mBAAoB;AAC7D,QAAI,CAAC,KAAK,QAAQ;AAChB,UAAI,EAAE,SAAS,QAAQ;AACrB,cAAM,IAAI,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AACzD,cAAM,gBAAgB,KAAK;AAAA,UACzB,IAAI,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,UAC3D,YAAY,EAAE;AAAA,UACd,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI,YAAY;AAAA,UAChC,OAAO,IAAI;AAAA,QACb,CAAC;AACD,wBAAgB;AAAA,MAClB,OAAO;AAGL,cAAM,IAAI,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,eAAW;AACX,kBAAc,EAAE;AAChB,aAAS,EAAE;AAAA,EACb;AAEA,SAAO,EAAE,SAAS,YAAY,aAAa;AAC7C;AAOA,SAAS,OAAU,QAA4B,QAAW,KAAoB;AAC5E,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,QAAO;AAAA,IACvC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AACtB,QAAI;AACF,YAAM,QAAQ,OAAO,YAAY,MAAM;AACvC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,cAAM,IAAI,iBAAiB,OAAO,MAAM,QAAQ,IAAI,OAAO,UAAU,WAAW,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC;AAChH,YAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,YAAI,IAAI,IAAI,QAAQ,EAAG,QAAO;AAAA,MAChC;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QACA,MACA,KACqC;AACrC,MAAI,eAAe;AACnB,MAAI,qBAAqB;AAEzB,MAAI,OAAO,eAAe,UAAa,OAAO,aAAa,GAAG;AAC5D,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU;AAC7C,QAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,YAAM,UAAU,OAAO,aAAa;AACpC,UAAI,QAAQ,QAAS,gBAAe;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,sBAAqB;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,gBAAgB,mBAAoB,QAAO;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,mBAAoB,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,UAAkB,UAA0B;AAC1F,QAAM,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChE,MAAI,SAAS;AACb,aAAW,KAAK,KAAM,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC9D,SAAO,GAAG,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,eAAe,gBAAgB,KAAwB,OAAyC;AAC9F,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAM,WAAW,EAAE,YAAY,gCAAgC,IAAI,MAAM,IAAI,IAAI,MAAM,OAAO,SAAS,EAAE;AACzG,QAAM,OAAO,EAAE,IAAI,MAAM,UAAU;AACnC,MAAI;AACJ,MAAI,IAAI,WAAW;AACjB,UAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC;AAAA,EAChE,OAAO;AACL,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EAC1E;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,gCAAgC,MAAM,IAAI,QAAQ;AACrF;","names":[]}

package/dist/chunk-GHLTDZRS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/port/with/i18n-strategy.ts","../src/kernel/paths.ts","../src/via/i18n/policy.ts","../src/via/i18n/script.ts","../src/via/i18n/binding.ts","../src/via/i18n/core.ts"],"sourcesContent":["/**\n * i18n strategy seam (#623 Task 7 — moved out of `via/i18n/strategy.ts`\n * and `via/i18n/dictionary.ts`, precedent: `port/with/lazy-strategy.ts`).\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`Vault` can hold the `NO_I18N` default and the\n * two reserved-name/brand predicates without a spine→service static import.\n *\n * Core imports `I18nStrategy` type-only + `NO_I18N` stub; real\n * `applyI18nLocale` / `validateI18nTextValue` / `DictionaryHandle` are only\n * reachable via `withI18n()` in `via/i18n/active.ts`.\n *\n * Solo apps that don't use `i18nText()` fields, don't declare `dictKey()`\n * fields, and don't open a `vault.dictionary(...)` handle ship none of the\n * ~854 LOC behind this seam.\n *\n * Behavior under NO_I18N:\n *\n * - **applyI18nLocale** — returns the record unchanged. Apps without\n *   any i18n descriptors never observe a difference; apps that\n *   *did* declare i18nText/dictKey fields without opting into the\n *   strategy still get raw values back (locale resolution silently\n *   skipped). The validators below ensure the misconfiguration is\n *   caught at write time instead.\n * - **validateI18nTextValue** — throws when called. Only fires when\n *   a collection declared `i18nFields`; if you declared the field,\n *   you must opt in.\n * - **buildDictionaryHandle** — throws when called. Only fires when\n *   user code calls `vault.dictionary(...)`.\n *\n * #650 Task 1 (via-lookup extraction, phase D): the real\n * `buildDictionaryHandle` (in `via/i18n/active.ts`) now delegates to\n * `withLookup().buildLookupHandle` (`via/lookup/active.ts`) — same\n * handle (`LookupHandle`, aliased as `DictionaryHandle`), new home. This\n * interface's shape is unchanged.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport type { I18nTextDescriptor } from '../../via/i18n/core.js'\nimport type { Layer } from '../../via/i18n/policy.js'\nimport type { ScriptWarning } from '../../via/i18n/script.js'\nimport type { DictKeyDescriptor, DictionaryHandle, DictionaryOptions, StaticDictDescriptor } from '../../via/i18n/dictionary.js'\nimport type { ViaCryptoCtx } from '../../kernel/via/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\n\n/**\n * Options accepted by `I18nStrategy.buildDictionaryHandle`. Mirrors\n * the `DictionaryHandle` constructor verbatim — kept here so core\n * code never imports the dictionary module at runtime.\n *\n * @internal\n */\nexport interface BuildDictionaryHandleOptions<Keys extends string = string> {\n  adapter: NoydbStore\n  compartmentName: string\n  dictionaryName: string\n  keyring: UnlockedKeyring\n  /**\n   * The `reservedEnvelopes('_dict_')` capability (#629 Task 4) — DictionaryHandle's\n   * sanctioned crypto door onto its `_dict_<name>` collection. Bound by the\n   * Vault to its own `getDEK`, the same per-collection-name DEK resolver\n   * every other collection uses.\n   */\n  reservedEnvelopes: ReturnType<ViaCryptoCtx['reservedEnvelopes']>\n  encrypted: boolean\n  ledger: LedgerStore | undefined\n  options: DictionaryOptions\n  findAndUpdateReferences:\n    | ((\n        dictionaryName: string,\n        oldKey: string,\n        newKey: string,\n      ) => Promise<void>)\n    | undefined\n  emitter: NoydbEventEmitter\n  /**\n   * Used by the active strategy to satisfy the generic-key parameter\n   * on the returned handle. The NO_I18N stub never reads it.\n   */\n  // marker generic — runtime sees no value\n  _keyMarker?: Keys\n  /** #650 Task 4 (#647) — choke-point participation hooks, passed through to `buildLookupHandle`. */\n  onDirty?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined\n  onRecordMutated?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined\n  /**\n   * #647 fix wave 1 — mints a version-ordered delete-marker envelope, passed through to\n   * `buildLookupHandle`. See `port/with/lookup-strategy.ts`'s `BuildLookupHandleOptions` doc\n   * comment for why this is injected rather than imported by the handle itself.\n   */\n  buildDeleteMarker: (identity: { collection: string; id: string }, version: number, actor: string) => EncryptedEnvelope\n  /** #650 Task 5 (#648) — the real reference check, passed through to `buildLookupHandle`. */\n  checkReferencesOnDelete?: ((key: string) => Promise<unknown>) | undefined\n}\n\n/**\n * @internal\n */\nexport interface I18nStrategy {\n  /**\n   * Resolve `i18nText` fields on a record to the requested locale and\n   * return a new object. Returns the input unchanged under\n   * `NO_I18N`.\n   */\n  applyI18nLocale(\n    record: Record<string, unknown>,\n    fields: Record<string, I18nTextDescriptor>,\n    locale: string,\n    fallback?: string | readonly string[],\n    layer?: Layer,\n  ): Record<string, unknown>\n\n  /**\n   * Validate that an i18nText field's value satisfies its descriptor\n   * (required locales present, etc.). Throws under `NO_I18N` —\n   * declaring i18nFields without opting in is a misconfiguration.\n   */\n  validateI18nTextValue(\n    value: unknown,\n    field: string,\n    descriptor: I18nTextDescriptor,\n  ): void\n\n  /**\n   * Enforce per-locale script constraints over an i18nText value map\n   * (write-time). Returns the (possibly filtered) value plus any\n   * non-fatal warnings. Returns the value unchanged when the field has\n   * no `script` option, or under `NO_I18N`.\n   */\n  enforceScript(\n    value: Record<string, unknown>,\n    field: string,\n    descriptor: I18nTextDescriptor,\n    exempt?: ReadonlySet<string>,\n  ): { value: Record<string, unknown>; warnings: ScriptWarning[] }\n\n  /**\n   * Per-field locales that are unchanged round-tripped densify fills (exempt\n   * from write-time script enforcement). Empty under NO_I18N.\n   */\n  computeExemptFills(\n    prior: Record<string, unknown> | undefined,\n    incoming: Record<string, unknown>,\n    fields: Record<string, I18nTextDescriptor>,\n  ): Map<string, Set<string>>\n\n  /**\n   * Eager-fill empty i18n slots from each field's substitute chain and record\n   * provenance in `record['_i18nFilled']`. Mutates `record`. No-op under\n   * NO_I18N.\n   */\n  densify(\n    record: Record<string, unknown>,\n    prior: Record<string, unknown> | undefined,\n    fields: Record<string, I18nTextDescriptor>,\n  ): void\n\n  /**\n   * Construct a typed `DictionaryHandle` for the named dictionary.\n   * Throws under `NO_I18N`.\n   */\n  buildDictionaryHandle<Keys extends string = string>(\n    opts: BuildDictionaryHandleOptions<Keys>,\n  ): DictionaryHandle<Keys>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the i18n strategy. Import ` +\n    '`{ withI18n }` from \"@noy-db/hub/i18n\" and pass it to ' +\n    '`createNoydb({ i18nStrategy: withI18n() })`.',\n  )\n}\n\n/**\n * No-i18n stub. Locale resolution is the identity; validation and\n * dictionary construction throw with an actionable pointer.\n *\n * @internal\n */\nexport const NO_I18N: I18nStrategy = {\n  applyI18nLocale(record) { return record },\n  validateI18nTextValue() { throw notEnabled('i18nText field validation') },\n  enforceScript(value) { return { value, warnings: [] } },\n  computeExemptFills() { return new Map<string, Set<string>>() },\n  densify() {},\n  buildDictionaryHandle() { throw notEnabled('vault.dictionary()') },\n}\n\n/**\n * Return true when a collection name is a reserved dictionary collection\n * (the `_dict_*` prefix). Mirrors `DICT_COLLECTION_PREFIX` — now on\n * `via/lookup/handle.ts` (#650 Task 1), re-exported from\n * `via/i18n/dictionary.ts` for compat — duplicated here (not\n * imported) so this port has no VALUE dependency back on the feature; keep\n * the two in sync if the prefix ever changes.\n */\nexport function isDictCollectionName(name: string): boolean {\n  return name.startsWith('_dict_')\n}\n\n/** Runtime predicate for detecting a StaticDictDescriptor. */\nexport function isStaticDictDescriptor(x: unknown): x is StaticDictDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbStaticDict?: unknown })._noydbStaticDict === true\n  )\n}\n\n/**\n * Runtime predicate for detecting an I18nTextDescriptor. Pure tag check —\n * moved here (#623 Task 11) alongside `isStaticDictDescriptor` so\n * `kernel/via/compose.ts` (`mergeViaFields`'s descriptor-shape classification)\n * can reach it through the port instead of importing `via/i18n/core.js`\n * directly. Re-exported from that module for compat with existing importers.\n */\nexport function isI18nTextDescriptor(x: unknown): x is I18nTextDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbI18nText?: unknown })._noydbI18nText === true\n  )\n}\n\n/**\n * Runtime predicate for detecting a DictKeyDescriptor. Pure tag check —\n * moved here (#623 Task 11) for the same reason as `isI18nTextDescriptor`\n * above. Re-exported from `via/i18n/dictionary.js` for compat with\n * existing importers.\n */\nexport function isDictKeyDescriptor(x: unknown): x is DictKeyDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbDictKey?: unknown })._noydbDictKey === true\n  )\n}\n\n/**\n * Type-only re-exports (#623 Task 8) — the kernel spine (collection.ts,\n * collection-config.ts, vault.ts, types.ts) imports these descriptor/handle\n * types through the port instead of reaching into `via/i18n/*`\n * directly, so `src/kernel/**` carries no via-i18n specifier at all.\n * `isolatedModules: true` erases these at build time — no runtime coupling.\n */\nexport type { I18nTextDescriptor } from '../../via/i18n/core.js'\nexport type { DictKeyDescriptor, DictionaryHandle, DictionaryOptions, StaticDictDescriptor } from '../../via/i18n/dictionary.js'\nexport type { Layer } from '../../via/i18n/policy.js'\nexport type { ScriptWarning } from '../../via/i18n/script.js'\n","/**\n * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:\n * these carry zero i18n logic — they were extracted out of\n * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time\n * validation, densify) can import them without a spine→service edge.\n *\n * @internal\n */\n\n/**\n * Return all leaf values at `path`, expanding `[].` array wildcards.\n *\n * - `'name'`              → `[obj.name]`\n * - `'address.lineOne'`   → `[obj.address.lineOne]`\n * - `'contacts[].title'`  → `[obj.contacts[0].title, obj.contacts[1].title, …]`\n *\n * Returns an empty array when the path does not resolve (missing key,\n * wrong type, etc.). Used by `enforceI18nOnPut` to validate nested fields.\n */\nexport function getAtPath(obj: Record<string, unknown>, path: string): unknown[] {\n  const arrayIdx = path.indexOf('[].')\n  if (arrayIdx !== -1) {\n    const arrayKey = path.slice(0, arrayIdx)\n    const restPath = path.slice(arrayIdx + 3)\n    const arr = obj[arrayKey]\n    if (!Array.isArray(arr)) return []\n    return arr.flatMap(item => {\n      if (!item || typeof item !== 'object' || Array.isArray(item)) return []\n      return getAtPath(item as Record<string, unknown>, restPath)\n    })\n  }\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return []\n    return getAtPath(nested as Record<string, unknown>, rest)\n  }\n  const val = obj[path]\n  return val !== undefined ? [val] : []\n}\n\n/**\n * Mutate `obj` in-place, setting `value` at the nested `path`.\n * Supports dot notation (`'address.lineOne'`) but not array wildcards —\n * auto-translate on `contacts[].title` style paths is not supported.\n */\nexport function setAtPathInPlace(\n  obj: Record<string, unknown>,\n  path: string,\n  value: unknown,\n): void {\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return\n    setAtPathInPlace(nested as Record<string, unknown>, rest, value)\n    return\n  }\n  obj[path] = value\n}\n","/**\n * Per-layer i18n resolution policy.\n *\n * `onMissing` governs what happens when a multilingual field is resolved\n * to a target locale that is absent. It may be a single scalar policy or\n * a per-layer map, so a field can be lenient at the app read boundary but\n * strict inside a materialized view.\n *\n * Effective policy for layer `λ`:\n *\n * ```\n * explicit(λ) = typeof onMissing === 'object' ? onMissing[λ] : undefined\n * scalar      = typeof onMissing === 'string' ? onMissing : undefined\n * policy(λ)   = explicit(λ) ?? layerDefault(λ) ?? scalar ?? 'throw'\n * ```\n *\n * - `layerDefault('guard') = 'substitute'` — guards are lenient unless\n *   EXPLICITLY overridden; they never inherit a scalar policy (a guard\n *   reading a display value must not hard-fail on a missing locale).\n * - every other layer has no default, so it inherits the scalar, else\n *   falls back to `'throw'` (today's behavior — zero breaking change).\n *\n * @public\n */\nexport type OnMissing = 'substitute' | 'null' | 'throw'\n\n/**\n * The contexts in which a multilingual field is resolved. Each can carry\n * its own `onMissing` policy.\n *\n * - `read`       — ordinary app reads (`get`/`list`/query projection).\n * - `guard`      — a guard callback reading a value.\n * - `join`       — a joined record expanded onto a row.\n * - `mv`         — materialized-view input.\n * - `derivation` — derivation input.\n * - `export`     — bundle/cover export.\n */\nexport type Layer = 'read' | 'guard' | 'join' | 'mv' | 'derivation' | 'export'\n\n/** Field-level policy: a single scalar, or a per-layer map. */\nexport type OnMissingPolicy = OnMissing | Partial<Record<Layer, OnMissing>>\n\n/**\n * Resolve the effective `OnMissing` for a layer from a field's declared\n * policy. See module docs for the resolution rule.\n */\nexport function resolvePolicy(\n  onMissing: OnMissingPolicy | undefined,\n  layer: Layer,\n): OnMissing {\n  const explicit =\n    onMissing && typeof onMissing === 'object' ? onMissing[layer] : undefined\n  const scalar = typeof onMissing === 'string' ? onMissing : undefined\n  const layerDefault: OnMissing | undefined =\n    layer === 'guard' ? 'substitute' : undefined\n  return explicit ?? layerDefault ?? scalar ?? 'throw'\n}\n","/**\n * Per-locale script enforcement for `i18nText` fields (write-time).\n *\n * Each locale slot's string is validated against an allowed set of\n * Unicode scripts. `'auto'` infers the set from the locale code with\n * **asymmetric Latin tolerance**: every non-Latin-script locale\n * also allows `Latin`, because proper names and addresses in those\n * locales routinely embed Latin brand/building/technical names — while\n * Latin-script locales do NOT allow other scripts, so the common error\n * (e.g. Thai text dumped into an `en` slot) is still caught.\n *\n * The always-on baseline is `Common` (digits, punctuation), `Inherited`\n * and `Mark` (combining diacritics, joiners, harakat, tone marks), and\n * whitespace — so Latin digits and in-script combining marks never\n * false-reject.\n *\n * @public\n */\nimport { ScriptViolationError } from '../../kernel/errors.js'\nimport type { I18nTextDescriptor } from './core.js'\n\n/** Locales whose base language is written in the Latin script. */\nconst LATIN_BASE = new Set([\n  'en', 'fr', 'de', 'es', 'it', 'pt', 'nl', 'sv', 'no', 'da', 'fi', 'is',\n  'pl', 'cs', 'sk', 'hu', 'ro', 'hr', 'sl', 'et', 'lv', 'lt', 'tr', 'vi',\n  'id', 'ms', 'tl', 'sw', 'af', 'ca', 'gl', 'eu', 'cy', 'ga',\n])\n\n/** Base-language → primary (non-Latin) scripts. Latin is appended by inferScripts. */\nconst SCRIPT_TABLE: Record<string, readonly string[]> = {\n  th: ['Thai'],\n  ko: ['Hangul', 'Han'],\n  ja: ['Han', 'Hiragana', 'Katakana'],\n  zh: ['Han'],\n  ar: ['Arabic'],\n  fa: ['Arabic'],\n  ur: ['Arabic'],\n  ru: ['Cyrillic'],\n  uk: ['Cyrillic'],\n  bg: ['Cyrillic'],\n  sr: ['Cyrillic'],\n  he: ['Hebrew'],\n  el: ['Greek'],\n  hi: ['Devanagari'],\n  ta: ['Tamil'],\n  km: ['Khmer'],\n  lo: ['Lao'],\n  my: ['Myanmar'],\n}\n\n/** Map a BCP-47 script subtag (e.g. `Latn`, `Cyrl`) to allowed scripts. */\nconst SUBTAG_SCRIPTS: Record<string, readonly string[]> = {\n  Latn: ['Latin'],\n  Cyrl: ['Cyrillic', 'Latin'],\n  Hans: ['Han', 'Latin'],\n  Hant: ['Han', 'Latin'],\n  Thai: ['Thai', 'Latin'],\n  Arab: ['Arabic', 'Latin'],\n}\n\n/**\n * Infer the allowed Unicode scripts for a BCP-47 locale, with asymmetric\n * Latin tolerance. A script subtag (`th-Latn`) wins over the base\n * language. Unknown locales default to `['Latin']`.\n */\nexport function inferScripts(locale: string): readonly string[] {\n  const parts = locale.split('-')\n  const subtag = parts.find((t) => /^[A-Z][a-z]{3}$/.test(t))\n  if (subtag && SUBTAG_SCRIPTS[subtag]) return SUBTAG_SCRIPTS[subtag]\n\n  const base = (parts[0] ?? '').toLowerCase()\n  if (LATIN_BASE.has(base)) return ['Latin']\n  const primary = SCRIPT_TABLE[base]\n  if (primary) return [...primary, 'Latin'] // asymmetric Latin tolerance\n  return ['Latin']\n}\n\n/** Resolve the allowed scripts for a field's locale slot. */\nfunction allowedFor(descriptor: I18nTextDescriptor, locale: string): readonly string[] {\n  const script = descriptor.options.script\n  if (script && script !== 'auto') {\n    const explicit = script[locale]\n    if (explicit) return explicit\n  }\n  return inferScripts(locale)\n}\n\n/** Always-allowed baseline character classes (besides the named scripts). */\nconst BASELINE = String.raw`\\p{White_Space}\\p{Script=Common}\\p{Script=Inherited}\\p{Mark}`\n\n/** Build a whole-string matcher for the allowed scripts. */\nfunction fullMatcher(scripts: readonly string[]): RegExp {\n  const cls = scripts.map((s) => `\\\\p{Script=${s}}`).join('')\n  return new RegExp(`^[${BASELINE}${cls}]*$`, 'u')\n}\n\n/** Build a single-character matcher (for sampling / stripping). */\nfunction charMatcher(scripts: readonly string[]): RegExp {\n  const cls = scripts.map((s) => `\\\\p{Script=${s}}`).join('')\n  return new RegExp(`[${BASELINE}${cls}]`, 'u')\n}\n\n/** Collect a short sample of characters that violate the allowed scripts. */\nfunction offendingSample(str: string, scripts: readonly string[]): string {\n  const ok = charMatcher(scripts)\n  const bad: string[] = []\n  for (const ch of str) {\n    if (!ok.test(ch)) bad.push(ch)\n    if (bad.length >= 8) break\n  }\n  return bad.join('')\n}\n\n/** Remove characters that violate the allowed scripts. */\nfunction stripDisallowed(str: string, scripts: readonly string[]): string {\n  const ok = charMatcher(scripts)\n  let out = ''\n  for (const ch of str) if (ok.test(ch)) out += ch\n  return out\n}\n\n/** A non-fatal script violation recorded under `'filter'`/`'warn'` modes. */\nexport interface ScriptWarning {\n  readonly field: string\n  readonly locale: string\n  readonly expected: readonly string[]\n  readonly sample: string\n}\n\n/**\n * Enforce a field's script constraint over an i18nText value map.\n *\n * - No `script` option ⇒ returns the value unchanged.\n * - `onScriptViolation: 'reject'` (default) ⇒ throws {@link ScriptViolationError}.\n * - `'filter'` ⇒ returns a copy with disallowed characters stripped + warnings.\n * - `'warn'` ⇒ returns the value unchanged + warnings.\n */\nexport function enforceScript(\n  value: Record<string, unknown>,\n  field: string,\n  descriptor: I18nTextDescriptor,\n  exempt?: ReadonlySet<string>,\n): { value: Record<string, unknown>; warnings: ScriptWarning[] } {\n  const opt = descriptor.options\n  if (!opt.script) return { value, warnings: [] }\n\n  const mode = opt.onScriptViolation ?? 'reject'\n  const warnings: ScriptWarning[] = []\n  let out = value\n\n  for (const [locale, raw] of Object.entries(value)) {\n    if (exempt?.has(locale)) continue\n    if (typeof raw !== 'string') continue\n    const allowed = allowedFor(descriptor, locale)\n    if (fullMatcher(allowed).test(raw)) continue\n\n    const sample = offendingSample(raw, allowed)\n    if (mode === 'reject') {\n      throw new ScriptViolationError(field, locale, allowed, sample)\n    }\n    warnings.push({ field, locale, expected: allowed, sample })\n    if (mode === 'filter') {\n      if (out === value) out = { ...value }\n      out[locale] = stripDisallowed(raw, allowed)\n    }\n  }\n\n  return { value: out, warnings }\n}\n","/**\n * The i18n `NoydbVia` — wires the i18n engine (auto-translate/script\n * enforcement/validation/densify on write; locale + dict-label presentation\n * on read) into the kernel's generic Via port. Mirrors\n * `via/money/binding.ts`'s #553 static-link pattern.\n *\n * LIVE (#623 Task 8 wired the cutover): `i18nVia()`/`linkI18nVia()` are\n * the real put/read path for every i18n-declaring collection —\n * `collection.ts`'s `_putInternal`/`applyLocaleToRecord` (the call sites\n * this file's bodies were moved/adapted from) now delegate their i18n\n * stages to `this.via.encodeWrite`/`this.via.present` instead of running\n * the hand-wired i18n logic inline.\n *\n * `i18nText()`, `dictKey()`, `staticDict()` each call {@link linkI18nVia}\n * first — the same #553 pattern `money()` uses.\n */\nimport type { NoydbVia, ViaWriteCtx, ViaReadCtx } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { I18nTextDescriptor } from './core.js'\nimport { stripI18nFilled } from './core.js'\nimport type { DictKeyDescriptor, StaticDictDescriptor } from './dictionary.js'\nimport type { I18nStrategy } from '../../port/with/i18n-strategy.js'\nimport { isStaticDictDescriptor } from '../../port/with/i18n-strategy.js'\nimport { resolvePolicy, type Layer } from './policy.js'\nimport { getAtPath, setAtPathInPlace } from '../../kernel/paths.js'\nimport { TranslatorNotConfiguredError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\n\n/**\n * Config a collection's i18n declarations resolve to — the binding's\n * construction input. Fields are loosely typed (`unknown`) at this seam\n * because the kernel's `ViaBinder` contract is opaque-config-in; the\n * concrete i18n types are applied inside the binding's own functions.\n */\nexport interface I18nViaConfig {\n  i18nFields?: Record<string, unknown>          // I18nTextDescriptor map\n  dictKeyFields?: Record<string, unknown>       // DictKeyDescriptor | StaticDictDescriptor map\n  i18nDensifyFields?: Record<string, unknown>   // I18nTextDescriptor subset (densifyOnWrite: true)\n  strategy: unknown                              // I18nStrategy (real or NO_I18N)\n  defaultLocale?: string\n  autoTranslateHook?: (...args: unknown[]) => Promise<string>\n  dictLabelResolver?: (...args: unknown[]) => Promise<string | undefined>\n  i18nPutValidator?: (record: unknown) => void   // the vault-built closure (unchanged wiring)\n  collectionName: string\n}\n\n// ─── write pipeline ─────────────────────────────────────────────────────\n\n/**\n * Auto-translate missing i18nText translations. Runs BEFORE i18n\n * validation so translated values satisfy the required-locale constraint.\n * Throws `TranslatorNotConfiguredError` when a field has\n * `autoTranslate: true` but no hook was configured. Mutates `record`\n * in place (mirrors `collection.ts:1830-1874`).\n */\nasync function runI18nAutoTranslate(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  cfg: I18nViaConfig,\n): Promise<void> {\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    if (!descriptor.options.autoTranslate) continue\n    // getAtPath returns [] for array-wildcard paths — auto-translate on\n    // 'contacts[].field' style paths is not supported; skip silently.\n    const leafValues = getAtPath(record, field)\n    if (leafValues.length !== 1) continue\n    const value = leafValues[0]\n    if (!value || typeof value !== 'object' || Array.isArray(value)) continue\n    const map = value as Record<string, string>\n    // Determine which locales need translation. For 'all', translate all\n    // declared languages that are missing. For 'any', only translate if\n    // none are present. For string[], translate the listed required ones.\n    const { languages, required } = descriptor.options\n    const missing: string[] = languages.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length === 0) continue\n    // Find a source locale (first present non-empty value)\n    const sourceLocale = languages.find((l) => l in map && map[l] !== '')\n    if (!sourceLocale) continue\n    if (!cfg.autoTranslateHook) {\n      throw new TranslatorNotConfiguredError(field, cfg.collectionName)\n    }\n    // Only translate locales that are actually needed\n    const toTranslate =\n      required === 'any'\n        ? [] // 'any' is already satisfied since sourceLocale exists\n        : required === 'all'\n          ? missing\n          : missing.filter((l) => required.includes(l))\n    const translated = { ...map }\n    for (const targetLocale of toTranslate) {\n      translated[targetLocale] = await cfg.autoTranslateHook(\n        map[sourceLocale]!,\n        sourceLocale,\n        targetLocale,\n        field,\n        cfg.collectionName,\n      )\n    }\n    setAtPathInPlace(record, field, translated)\n  }\n}\n\n/**\n * i18nText script enforcement — runs AFTER auto-translate (so generated\n * values are checked too). Throws `ScriptViolationError` (from inside\n * `strategy.enforceScript`) under the default 'reject'; 'filter' strips\n * disallowed chars in place; 'warn' leaves the value unchanged. Mirrors\n * `collection.ts:1896-1927`.\n */\nfunction runI18nScriptEnforcement(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  strategy: I18nStrategy,\n  exemptFills: Map<string, Set<string>> | undefined,\n  ctx: ViaWriteCtx,\n  cfg: I18nViaConfig,\n): void {\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    if (!descriptor.options.script) continue\n    for (const leaf of getAtPath(record, field)) {\n      if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) continue\n      const leafMap = leaf as Record<string, unknown>\n      const { value: cleaned, warnings } = strategy.enforceScript(\n        leafMap,\n        field,\n        descriptor,\n        exemptFills?.get(field),\n      )\n      if (cleaned !== leafMap) Object.assign(leafMap, cleaned)\n      // enforceScript only returns warnings under 'warn'/'filter' ('reject'\n      // throws first), so this guard never fires — it makes that invariant\n      // explicit and keeps `mode` off the optional-undefined type.\n      const mode = descriptor.options.onScriptViolation\n      if (mode === 'warn' || mode === 'filter') {\n        for (const w of warnings) {\n          // Exact original payload shape (collection.ts:1916-1922 pre-cutover).\n          ctx.emit('i18n:script-violation', {\n            vault: ctx.vault,\n            collection: cfg.collectionName,\n            id: ctx.id,\n            mode,\n            warning: w,\n          })\n        }\n      }\n    }\n  }\n}\n\n/**\n * `encodeWrite` — translate → script → validate → densify, in the EXACT\n * order `_putInternal` runs them today (seam-map Part 2, stages 7-11).\n */\nasync function runI18nWriteStages(\n  record: Record<string, unknown>,\n  ctx: ViaWriteCtx,\n  cfg: I18nViaConfig,\n): Promise<Record<string, unknown>> {\n  const i18nFields = cfg.i18nFields as Record<string, I18nTextDescriptor> | undefined\n  const i18nDensifyFields = cfg.i18nDensifyFields as Record<string, I18nTextDescriptor> | undefined\n  const strategy = cfg.strategy as I18nStrategy\n\n  // 1. Auto-translate.\n  if (i18nFields) {\n    await runI18nAutoTranslate(record, i18nFields, cfg)\n  }\n\n  // 2. densifyOnWrite: read prior fills so a round-tripped derived copy is\n  // exempt from script enforcement and can be refreshed. Read once here,\n  // reused by densify() below. `ctx.prior()` resolves the real prior\n  // record (collection.ts wires it to `resolveDensifyPrior`, #623 Task 8).\n  let densifyPrior: Record<string, unknown> | undefined\n  let exemptFills: Map<string, Set<string>> | undefined\n  if (i18nDensifyFields) {\n    densifyPrior = (await ctx.prior()) ?? undefined\n    exemptFills = strategy.computeExemptFills(densifyPrior, record, i18nDensifyFields)\n  }\n\n  // 3. Script enforcement.\n  if (i18nFields) {\n    runI18nScriptEnforcement(record, i18nFields, strategy, exemptFills, ctx, cfg)\n  }\n\n  // 4. i18nText validation — AFTER auto-translate + script so the record is\n  // trustworthy. Throws MissingTranslationError when required translations\n  // are absent. The vault-built closure (unchanged wiring).\n  cfg.i18nPutValidator?.(record)\n\n  // 5. Eager-fill empty slots + record provenance. Runs AFTER the authored\n  // gates (required + script) so only authored slots are validated.\n  if (i18nDensifyFields) {\n    strategy.densify(record, densifyPrior, i18nDensifyFields)\n  }\n\n  return record\n}\n\n// ─── read pipeline ──────────────────────────────────────────────────────\n\n/**\n * `present` — i18nText locale resolution + dictKey/staticDict label\n * resolution + `_i18nFilled` stripping. Adapted from\n * `applyLocaleToRecord`'s i18n+dict+strip portions (`collection.ts:4184-\n * 4301`) — the money-decode portion of that method is a separate binding\n * (`via/money`) and is NOT this function's concern.\n */\nasync function runI18nPresent(\n  record: Record<string, unknown>,\n  ctx: ViaReadCtx,\n  cfg: I18nViaConfig,\n): Promise<Record<string, unknown>> {\n  const i18nFields = cfg.i18nFields as Record<string, I18nTextDescriptor> | undefined\n  const dictKeyFields = cfg.dictKeyFields as Record<string, DictKeyDescriptor | StaticDictDescriptor> | undefined\n  const strategy = cfg.strategy as I18nStrategy\n  const hasI18n = i18nFields !== undefined && Object.keys(i18nFields).length > 0\n  const hasDict = dictKeyFields !== undefined && Object.keys(dictKeyFields).length > 0\n  if (!hasI18n && !hasDict) return record\n\n  const locale = typeof ctx.locale === 'string' ? ctx.locale : undefined\n  const fallback = ctx.fallback as string | readonly string[] | undefined\n  const layer = ctx.layer as Layer\n\n  let result = record\n\n  // i18nText / dictKey resolution require an active locale — EXCEPT a\n  // static dict declaring a `displayLocale`, which resolves its\n  // `<field>Label` even under a locale-less read (the hybrid hinge). Only\n  // this second gate relaxes, and ONLY for static-display fields — folding\n  // `hasI18n` in here would let an i18nText-only collection fall through to\n  // applyI18nLocale(…, undefined) on a locale-less read, breaking the\n  // raw-{th,en}-map invariant.\n  const hasStaticDisplay =\n    hasDict &&\n    dictKeyFields !== undefined &&\n    Object.values(dictKeyFields).some(\n      (d) => isStaticDictDescriptor(d) && d.displayLocale !== undefined,\n    )\n\n  // Strip the internal densify marker even when no locale is active\n  // (applyI18nLocale, which normally strips it, is skipped on this path).\n  // Non-mutating: never touches the cached/stored record object.\n  if (!locale && !hasStaticDisplay) return stripI18nFilled(result)\n\n  // 1. i18nText resolution — guarded on `locale`, because the relaxed gate\n  // above can now be entered with `locale === undefined` (static-display).\n  // The layer selects the field's per-layer `onMissing` policy inside\n  // applyI18nLocale.\n  if (locale && hasI18n && i18nFields) {\n    result = strategy.applyI18nLocale(result, i18nFields, locale, fallback, layer)\n  }\n\n  // 2. dictKey / staticDict label resolution\n  if (hasDict && dictKeyFields && cfg.dictLabelResolver && locale !== 'raw') {\n    const withLabels = { ...result }\n    const resolver = cfg.dictLabelResolver\n    for (const [field, desc] of Object.entries(dictKeyFields)) {\n      // dictKey default policy is 'null' (omit/null on miss) — today's\n      // behavior — unless the field declares onMissing. 'substitute'\n      // walks the declared substitute chain (passed as the resolver's\n      // fallback); 'throw' raises LocaleNotSpecifiedError.\n      const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : 'null'\n      const fieldFallback =\n        policy === 'substitute'\n          ? (fallback ?? desc.substitute)\n          : fallback\n      // Per-field effective locale: a static dict falls back to its\n      // `displayLocale` when no locale is active (the hybrid hinge); a\n      // plain dictKey with no displayLocale gets `undefined` → its\n      // <field>Label is omitted on a locale-less read (today's behavior).\n      const effLocale =\n        locale ??\n        (isStaticDictDescriptor(desc) ? desc.displayLocale : undefined)\n      // Resolve one key → label | null, honoring the policy. With no\n      // effective locale there is nothing to resolve against.\n      const resolveKey = async (key: string): Promise<string | null> => {\n        if (!effLocale) {\n          if (policy === 'throw') {\n            throw new LocaleNotSpecifiedError(\n              field,\n              `dictKey \"${field}\": no locale active to resolve key \"${key}\".`,\n            )\n          }\n          return null\n        }\n        const label = await resolver(desc.name, key, effLocale, fieldFallback)\n        if (label === undefined) {\n          if (policy === 'throw') {\n            throw new LocaleNotSpecifiedError(\n              field,\n              `dictKey \"${field}\": no label for key \"${key}\" in locale \"${effLocale}\".`,\n            )\n          }\n          return null\n        }\n        return label\n      }\n\n      if (field.includes('[].')) {\n        // Wildcard path `arrayKey[].leaf`: add a per-element sibling\n        // `<leaf>Label`. Single level + simple leaf.\n        const parts = field.split('[].')\n        const arrayKey = parts[0]!\n        const leaf = parts[1]\n        if (!leaf || leaf.includes('.')) continue\n        const arr = (withLabels as Record<string, unknown>)[arrayKey]\n        if (!Array.isArray(arr)) continue\n        const labelKey = `${leaf}Label`\n        ;(withLabels as Record<string, unknown>)[arrayKey] = await Promise.all(\n          arr.map(async (el) => {\n            if (!el || typeof el !== 'object' || Array.isArray(el)) return el\n            const k = (el as Record<string, unknown>)[leaf]\n            if (typeof k !== 'string') return el\n            return { ...(el as Record<string, unknown>), [labelKey]: await resolveKey(k) }\n          }),\n        )\n        continue\n      }\n\n      const val = result[field]\n      if (Array.isArray(val)) {\n        // Array-of-keys → [{ key, label }] pair objects (key preserved).\n        withLabels[`${field}Label`] = await Promise.all(\n          val.map(async (k) => ({\n            key: k,\n            label: typeof k === 'string' ? await resolveKey(k) : null,\n          })),\n        )\n      } else if (typeof val === 'string') {\n        const label = await resolveKey(val)\n        // Scalar under 'null'/default omits the label key (today's\n        // behavior); 'substitute' returns a value; 'throw' threw above.\n        if (label !== null) withLabels[`${field}Label`] = label\n      }\n    }\n    result = withLabels\n  }\n\n  // Final guard: the locale-less static-display path skips\n  // applyI18nLocale's strip, so ensure the densify marker never leaks here\n  // either. Non-mutating (no-op when absent or already stripped above).\n  return stripI18nFilled(result)\n}\n\n// ─── introspection ──────────────────────────────────────────────────────\n\nfunction buildI18nDescribeFragment(cfg: I18nViaConfig): Record<string, unknown> {\n  return {\n    i18nFields: cfg.i18nFields ? Object.keys(cfg.i18nFields) : [],\n    dictKeyFields: cfg.dictKeyFields ? Object.keys(cfg.dictKeyFields) : [],\n    ...(cfg.defaultLocale !== undefined ? { defaultLocale: cfg.defaultLocale } : {}),\n  }\n}\n\n// ─── binding ────────────────────────────────────────────────────────────\n\nexport function i18nVia(cfg: I18nViaConfig): NoydbVia {\n  return {\n    brand: 'i18n',\n    posture: { encryptedAtRest: 'envelope', queryable: 'full', exportable: true, forgettable: true },\n    // DictionaryHandle's `_dict_*` reserved collections (#629 Task 4) — the\n    // codec boundary's `reservedEnvelopes` door may address any collection\n    // name under this prefix.\n    reservedPrefixes: ['_dict_'],\n    covers: (field) =>\n      (cfg.i18nFields !== undefined && field in cfg.i18nFields)\n      || (cfg.dictKeyFields !== undefined && field in cfg.dictKeyFields),\n    // #1447 — both config maps, since either makes the field vault-resolved.\n    coveredFields: [...Object.keys(cfg.i18nFields ?? {}), ...Object.keys(cfg.dictKeyFields ?? {})],\n    encodeWrite: async (record, ctx) => runI18nWriteStages(record, ctx, cfg),\n    present: async (record, ctx) => runI18nPresent(record, ctx, cfg),\n    describeFragment: () => buildI18nDescribeFragment(cfg),\n  }\n}\n\nexport function linkI18nVia(): void {\n  installViaBinder('i18n', (c) => i18nVia(c as I18nViaConfig))\n}\n","/**\n * i18nText schema type —\n *\n * `i18nText({ languages, required })` creates a descriptor for a\n * multi-language content field whose value is stored as a\n * `{ [locale]: string }` map (e.g. `{ en: 'Consulting', th: 'ที่ปรึกษา' }`).\n *\n * On put, the descriptor validates that required languages are present.\n * On read (when a `locale` option is passed), the map is collapsed to the\n * caller's locale string via the fallback chain.\n *\n * Design decisions\n * ────────────────\n *\n * **Descriptor pattern (not a Zod type).**\n * `i18nText()` returns a plain descriptor object used in the collection's\n * `i18nFields` option — same pattern as `ref()` / `dictKey()`. This keeps\n * `@noy-db/core` at zero runtime dependencies and avoids Zod v3 field-type\n * constraints. TypeScript inference is handled via the descriptor's type.\n *\n * **Enforcement at the collection boundary.**\n * The `required` option is checked by `Collection.put()` via the compartment's\n * registered `i18nFields`. Failed validation throws `MissingTranslationError`\n * — a distinct class from `SchemaValidationError` so callers can tell\n * \"wrong shape\" from \"missing translations\".\n *\n * **Resolution is post-decryption.**\n * Locale resolution happens AFTER `decryptRecord()`, as a pure in-memory\n * transform. No additional crypto work is needed. The resolved record is\n * returned in place of the stored one, with i18nText fields replaced by\n * their locale-resolved strings.\n *\n * **`locale: 'raw'`.**\n * Passing `{ locale: 'raw' }` skips resolution and returns the full\n * `{ [locale]: string }` map — useful for bilingual exports, admin UIs,\n * and any context where all translations must be visible at once.\n *\n * **Out of scope.**\n * Pluralization, RTL rendering, date/number formatting, per-locale CRDT\n * merging.\n */\n\nimport { MissingTranslationError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\nimport type { OnMissing, OnMissingPolicy, Layer } from './policy.js'\nimport { resolvePolicy } from './policy.js'\nimport { inferScripts } from './script.js'\nimport { linkI18nVia } from './binding.js'\n\n// ─── I18nMap type helper ───────────────────────────────────────────────\n\n/** Flatten an intersection into a single object literal for nicer hovers. */\ntype Prettify<T> = { [K in keyof T]: T[K] } & {}\n\n/**\n * The stored shape of a multilingual field, inferred from its `required`\n * mode — so the compiler forces you to handle an absent optional locale\n * (`string | undefined`) instead of silently yielding `undefined`.\n *\n * Mirrors `i18nText({ languages, required })`:\n * - `'all'` (default) — every locale required: `{ th: string; en: string }`\n * - `'any'`           — every locale optional: `{ th?: string; en?: string }`\n *   (the \"at least one present\" guarantee is runtime-only — not expressible\n *   in TypeScript — so each key is optional)\n * - `readonly L[]`    — listed locales required, the rest optional:\n *   `I18nMap<'th'|'en', ['th']>` → `{ th: string; en?: string }`\n *\n * @example\n * ```ts\n * type Lang = 'th' | 'en'\n * interface Contact {\n *   name: I18nMap<Lang, 'any'>      // { th?: string; en?: string }\n *   legalName: I18nMap<Lang, ['th']> // { th: string; en?: string }\n *   slug: I18nMap<Lang>             // { th: string; en: string }\n * }\n * ```\n *\n * @public\n */\nexport type I18nMap<\n  Langs extends string,\n  Required extends 'all' | 'any' | readonly Langs[] = 'all',\n> = Required extends 'all'\n  ? Record<Langs, string>\n  : Required extends 'any'\n    ? Partial<Record<Langs, string>>\n    : Required extends readonly (infer R extends Langs)[]\n      ? Prettify<Record<R, string> & Partial<Record<Exclude<Langs, R>, string>>>\n      : never\n\n// ─── i18nText descriptor ───────────────────────────────────────────────\n\n/**\n * Options for `i18nText()`.\n *\n * `languages` declares the full set of supported locales. `required`\n * controls which must be present on every `put()`.\n *\n * `autoTranslate` is the per-field opt-in for the `plaintextTranslator`\n * hook. When `true` and a `plaintextTranslator` is configured\n * on `createNoydb()`, missing translations are generated before `put()`.\n * Default: `false`.\n */\nexport interface I18nTextOptions {\n  /** All supported locale codes (BCP 47). */\n  readonly languages: readonly string[]\n  /**\n   * Which locales must be present on every `put()`.\n   *\n   * - `'all'`       — every declared language must be present.\n   * - `'any'`       — at least one declared language must be present.\n   * - `string[]`    — listed locales are required; others are optional.\n   */\n  readonly required: 'all' | 'any' | readonly string[]\n  /**\n   * Per-field opt-in for the `plaintextTranslator` hook.\n   * When `true`, missing required translations are auto-generated\n   * before `put()` if a translator is configured. Default: `false`.\n   */\n  readonly autoTranslate?: boolean\n  /**\n   * What to do when this field is resolved to a locale that is absent.\n   * A single policy, or a per-layer map (read/guard/join/mv/derivation/\n   * export). Default `'throw'` — today's behavior, zero breaking change.\n   * See {@link OnMissingPolicy}.\n   *\n   * NOTE (current wiring): ALL layers are enforced — `read` (`get`/`list`),\n   * `guard`, `derivation`, `mv`, `join`, `export`. Guard / derivation\n   * `ctx.vault` reads resolve under their own layer policy (`guard` defaults to\n   * the lenient `'substitute'`). The `mv` layer fires for materialized views\n   * that declare `{ i18nLocale, i18nFields }` — UNION (group-key i18n fields\n   * resolve before the unified-row bucketing) and query-form (resolved in\n   * `GroupedReduction.run` before `groupAndReduce`); grouping a raw i18n field\n   * without a locale throws. The `join` layer resolves a joined right-side i18n\n   * field to the query locale (`toArray({ locale })` or the vault default; raw\n   * when locale-less). The `export` layer fires for\n   * `exportStream`/`exportJSON({ resolveLabels })` — records collapse to the\n   * export locale.\n   */\n  readonly onMissing?: OnMissingPolicy\n  /**\n   * Ordered preferred-substitute locales used when `onMissing` resolves\n   * to `'substitute'` and the target locale is absent. `'any'` as an\n   * element means \"first non-empty value\". A caller-supplied `fallback`\n   * at read time takes precedence over this declared list.\n   */\n  readonly substitute?: readonly string[]\n  /**\n   * Smart-substitute. When `true`, a missing-locale `substitute` walk that\n   * misses the explicit chain prefers the available locale whose script is\n   * nearest the target (same script, then Latin) rather than an arbitrary value\n   * — e.g. a missing Thai label prefers another Thai (or Latin) translation over\n   * an unreadable script. Default `false` (legacy first-non-empty behavior).\n   */\n  readonly smartSubstitute?: boolean\n  /**\n   * Per-locale script enforcement (write-time). `'auto'` infers the\n   * allowed Unicode scripts per locale (asymmetric Latin tolerance); an\n   * object overrides per slot. Absent ⇒ no check. See `./script.ts`.\n   */\n  readonly script?: 'auto' | Partial<Record<string, readonly string[]>>\n  /**\n   * What to do when a slot's value contains characters outside its\n   * allowed script set. Default `'reject'`.\n   */\n  readonly onScriptViolation?: 'reject' | 'filter' | 'warn'\n  /**\n   * Eager-fill empty locale slots from the substitute chain at\n   * write time, recording provenance in the internal `_i18nFilled` marker.\n   * Mutually exclusive with an EXPLICIT `'throw'` onMissing policy (densify\n   * fills every hole, so a throw would be unreachable). Without an explicit\n   * `substitute`, fills from `'any'` (first non-empty). Default absent.\n   */\n  readonly densifyOnWrite?: boolean\n}\n\n/**\n * Descriptor returned by `i18nText()`. Attach to the collection's\n * `i18nFields` option:\n *\n * ```ts\n * const lineItems = company.collection<LineItem>('line-items', {\n *   i18nFields: {\n *     description: i18nText({ languages: ['en', 'th'], required: 'all' }),\n *   },\n * })\n * ```\n */\nexport interface I18nTextDescriptor {\n  readonly _noydbI18nText: true\n  /** Via port brand marker — lets an `I18nTextDescriptor` satisfy the kernel's opaque `ViaDescriptor` (#623 Task 9). */\n  readonly _viaBrand: 'i18n'\n  readonly options: I18nTextOptions\n}\n\n/**\n * Create an `I18nTextDescriptor` for a multi-language content field.\n *\n * @param options  Language list + enforcement mode.\n *\n * @example\n * ```ts\n * i18nText({ languages: ['en', 'th'], required: 'all' })\n * i18nText({ languages: ['en', 'th'], required: ['th'], autoTranslate: true })\n * ```\n */\nexport function i18nText(options: I18nTextOptions): I18nTextDescriptor {\n  // The declaration is the Via binding's opt-in unit (#553): constructing\n  // a descriptor statically links the i18n binding into the kernel's Via\n  // port, so every later kernel consultation finds it already installed.\n  linkI18nVia()\n  if (options.densifyOnWrite === true && hasThrowPolicy(options.onMissing)) {\n    throw new Error(\n      `i18nText: densifyOnWrite cannot be combined with an explicit onMissing 'throw' ` +\n        `policy — densify fills every empty slot, so a 'throw' would be unreachable. ` +\n        `Remove the 'throw' policy or disable densifyOnWrite.`,\n    )\n  }\n  return { _noydbI18nText: true, _viaBrand: 'i18n', options }\n}\n\n/** True when `onMissing` declares `'throw'` for any layer (scalar or per-layer). */\nfunction hasThrowPolicy(onMissing: OnMissingPolicy | undefined): boolean {\n  if (onMissing === undefined) return false\n  if (typeof onMissing === 'string') return onMissing === 'throw'\n  return Object.values(onMissing).includes('throw')\n}\n\n// `isI18nTextDescriptor` now lives on the kernel port (#623 Task 11,\n// port/with/i18n-strategy.ts, alongside `isStaticDictDescriptor`) —\n// re-exported here for compat with existing importers of this module.\nexport { isI18nTextDescriptor } from '../../port/with/i18n-strategy.js'\n\n// ─── Validation helpers ────────────────────────────────────────────────\n\n/**\n * Validate that a value is a valid `{ [locale]: string }` map and that\n * all required locales are present. Throws `MissingTranslationError`\n * when the required constraint is violated.\n *\n * Called by `Collection.put()` for each registered `i18nField`.\n *\n * @param value       The raw field value from the record being put.\n * @param field       The field name (used in the thrown error message).\n * @param descriptor  The `i18nText()` descriptor for this field.\n */\nexport function validateI18nTextValue(\n  value: unknown,\n  field: string,\n  descriptor: I18nTextDescriptor,\n): void {\n  const { options } = descriptor\n\n  // Must be a non-null object\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new MissingTranslationError(\n      field,\n      options.languages,\n      `Field \"${field}\" must be a { [locale]: string } map, got ${typeof value}.`,\n    )\n  }\n\n  const map = value as Record<string, unknown>\n\n  // All values must be strings\n  for (const [locale, v] of Object.entries(map)) {\n    if (typeof v !== 'string') {\n      throw new MissingTranslationError(\n        field,\n        [locale],\n        `Field \"${field}\": locale \"${locale}\" must be a string, got ${typeof v}.`,\n      )\n    }\n  }\n\n  // Check required constraint\n  const { required } = options\n  if (required === 'all') {\n    const missing = options.languages.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length > 0) {\n      throw new MissingTranslationError(\n        field,\n        missing,\n        `Field \"${field}\" requires all declared languages. Missing: ${missing.join(', ')}.`,\n      )\n    }\n  } else if (required === 'any') {\n    const present = options.languages.some(\n      (lang) => lang in map && map[lang] !== '',\n    )\n    if (!present) {\n      throw new MissingTranslationError(\n        field,\n        options.languages,\n        `Field \"${field}\" requires at least one declared language. None present.`,\n      )\n    }\n  } else {\n    // string[] — named required locales; TypeScript narrows required to readonly string[]\n    const requiredList = required\n    const missing = requiredList.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length > 0) {\n      throw new MissingTranslationError(\n        field,\n        missing,\n        `Field \"${field}\" requires: ${requiredList.join(', ')}. Missing: ${missing.join(', ')}.`,\n      )\n    }\n  }\n}\n\n// ─── Locale resolution ─────────────────────────────────────────────────\n\n/**\n * Resolve an i18nText value (`{ [locale]: string }` map) to a string\n * for the given locale.\n *\n * @param value    The stored locale map.\n * @param locale   The requested locale code, or `'raw'` to return the map.\n * @param fallback Single locale or ordered list; use `'any'` as the last\n *                 element to fall back to any available translation.\n * @param field    Field name used in `LocaleNotSpecifiedError` messages.\n * @returns The resolved string, OR the original map when `locale === 'raw'`.\n */\n/** Options for the policy-aware form of {@link resolveI18nText}. */\nexport interface ResolveI18nOptions {\n  /** Effective policy for the resolution layer. Default `'throw'`. */\n  readonly policy?: OnMissing\n  /** Declared substitute chain; applied only under policy `'substitute'`. */\n  readonly substitute?: readonly string[]\n  /**\n   * Smart-substitute. When `true` and policy is `'substitute'`, after the\n   * explicit chain misses, pick the available locale whose script is nearest the\n   * target (same script first, then Latin's broad readability) instead of an\n   * arbitrary value. Default `false`.\n   */\n  readonly smartSubstitute?: boolean\n}\n\n/** Normalize a single-or-list fallback into an array. */\nfunction toChain(fallback: string | readonly string[] | undefined): readonly string[] {\n  return Array.isArray(fallback) ? fallback : fallback ? [fallback as string] : []\n}\n\n/** Walk a chain, returning the first non-empty value (or `'any'` match). */\nfunction pickFromChain(\n  value: Record<string, string>,\n  chain: readonly string[],\n): string | undefined {\n  for (const fb of chain) {\n    if (fb === 'any') {\n      const any = Object.values(value).find((v) => v !== '')\n      if (any !== undefined) return any\n    } else if (value[fb] !== undefined && value[fb] !== '') {\n      return value[fb]\n    }\n  }\n  return undefined\n}\n\n// Legacy 4-arg form: can only throw or return — never null. Keeps every\n// existing call site's type unchanged (default policy is 'throw').\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback?: string | readonly string[],\n  field?: string,\n): string | Record<string, string>\n// Policy-aware form: may return null under 'null'/'substitute' policies.\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback: string | readonly string[] | undefined,\n  field: string | undefined,\n  opts: ResolveI18nOptions,\n): string | Record<string, string> | null\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback?: string | readonly string[],\n  field?: string,\n  opts?: ResolveI18nOptions,\n): string | Record<string, string> | null {\n  if (locale === 'raw') {\n    return value\n  }\n\n  if (!locale) {\n    throw new LocaleNotSpecifiedError(field ?? '<unknown>')\n  }\n\n  // Primary locale\n  if (value[locale] !== undefined && value[locale] !== '') {\n    return value[locale]\n  }\n\n  const policy: OnMissing = opts?.policy ?? 'throw'\n\n  // Caller-supplied fallback ALWAYS applies first (backward compat +\n  // explicit read-time override), regardless of policy.\n  const callerChain = toChain(fallback)\n  const callerHit = pickFromChain(value, callerChain)\n  if (callerHit !== undefined) return callerHit\n\n  // Declared substitute applies ONLY under policy 'substitute'.\n  if (policy === 'substitute') {\n    const subHit = pickFromChain(value, toChain(opts?.substitute))\n    if (subHit !== undefined) return subHit\n    // Smart-substitute: after the explicit chain, prefer the script-nearest\n    // available locale over an arbitrary first-non-empty value.\n    if (opts?.smartSubstitute) {\n      const smartHit = pickNearestScript(value, locale)\n      if (smartHit !== undefined) return smartHit\n    }\n  }\n\n  // Exhausted.\n  if (policy === 'throw') {\n    throw new LocaleNotSpecifiedError(\n      field ?? '<unknown>',\n      `No translation available for locale \"${locale}\"` +\n        (callerChain.length > 0 ? ` or fallback chain [${callerChain.join(', ')}]` : '') +\n        '.',\n    )\n  }\n  return null\n}\n\n/**\n * Smart-substitute: among the non-empty locales in `value`, pick the one\n * whose primary script is nearest the target `locale` — same script first, then\n * Latin (broadly readable), then any other — so a missing Thai label falls back\n * to another Thai (or Latin) value rather than, say, an Arabic one. First-seen\n * wins on ties. Returns the value string, or `undefined` when `value` has no\n * non-empty entry.\n */\nfunction pickNearestScript(value: Record<string, string>, target: string): string | undefined {\n  const targetScript = inferScripts(target)[0] ?? 'Latin'\n  let best: { score: number; v: string } | undefined\n  for (const [loc, v] of Object.entries(value)) {\n    if (typeof v !== 'string' || v === '') continue\n    const s = inferScripts(loc)[0] ?? 'Latin'\n    const score = s === targetScript ? 0 : s === 'Latin' ? 1 : 2\n    if (best === undefined || score < best.score) best = { score, v }\n    if (score === 0) break // nothing beats a same-script match\n  }\n  return best?.v\n}\n\n// ─── Path helpers (nested i18nFields like 'address.lineOne') ──────────\n\n// `getAtPath`/`setAtPathInPlace` are generic dotted-path/[]-wildcard record\n// helpers, not i18n logic — moved to `kernel/paths.ts` (Task 7, #623).\n// `getAtPath` re-exported here for compat with existing importers of this\n// module (embeddings/descriptor.ts, search/build-docs.ts); `setAtPathInPlace`\n// is not re-exported — its only consumer (via-i18n/binding.ts) imports it\n// directly from kernel/paths.ts.\nexport { getAtPath } from '../../kernel/paths.js'\n\n/** Recursively resolve i18nText at a single path within a record copy. */\nfunction applyAtPath(\n  obj: Record<string, unknown>,\n  path: string,\n  locale: string,\n  fallback: string | readonly string[] | undefined,\n  opts: ResolveI18nOptions,\n): Record<string, unknown> {\n  const arrayIdx = path.indexOf('[].')\n  if (arrayIdx !== -1) {\n    const arrayKey = path.slice(0, arrayIdx)\n    const restPath = path.slice(arrayIdx + 3)\n    const arr = obj[arrayKey]\n    if (!Array.isArray(arr)) return obj\n    return {\n      ...obj,\n      [arrayKey]: arr.map(item => {\n        if (!item || typeof item !== 'object' || Array.isArray(item)) return item\n        return applyAtPath(item as Record<string, unknown>, restPath, locale, fallback, opts)\n      }),\n    }\n  }\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return obj\n    return {\n      ...obj,\n      [head]: applyAtPath(nested as Record<string, unknown>, rest, locale, fallback, opts),\n    }\n  }\n  const raw = obj[path]\n  if (raw === undefined || raw === null) return obj\n  if (typeof raw !== 'object' || Array.isArray(raw)) return obj\n  return {\n    ...obj,\n    [path]: resolveI18nText(raw as Record<string, string>, locale, fallback, path, opts),\n  }\n}\n\n/**\n * Apply locale resolution to a single record, returning a new copy.\n *\n * For each field registered as an `i18nText` descriptor:\n * - If `locale === 'raw'`, the field value is left as the stored map.\n * - Otherwise, the field value is replaced with the resolved string.\n *\n * Field paths support dot notation (`'address.lineOne'`) and array\n * wildcards (`'contacts[].title'`). Top-level fields work as before.\n *\n * @param record      The decrypted record.\n * @param i18nFields  Map of field path → `I18nTextDescriptor`.\n * @param locale      The requested locale (or `'raw'`).\n * @param fallback    Fallback chain (optional).\n * @param layer       Resolution layer (default `'read'`). Each field's\n *                    `onMissing` policy is resolved for this layer, so the\n *                    same record resolves leniently on a get but strictly\n *                    inside an mv/derivation.\n */\nexport function applyI18nLocale(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  locale: string,\n  fallback?: string | readonly string[],\n  layer: Layer = 'read',\n): Record<string, unknown> {\n  const fieldNames = Object.keys(i18nFields)\n  if (fieldNames.length === 0) return record\n\n  let result = record\n\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    const { onMissing, substitute, smartSubstitute } = descriptor.options\n    const opts: ResolveI18nOptions = {\n      policy: resolvePolicy(onMissing, layer),\n      ...(substitute !== undefined ? { substitute } : {}),\n      ...(smartSubstitute ? { smartSubstitute } : {}),\n    }\n    result = applyAtPath(result, field, locale, fallback, opts)\n  }\n\n  // The internal densify provenance marker never leaves the store.\n  result = stripI18nFilled(result)\n\n  return result\n}\n\n/**\n * Sync i18n-text-only present-for-join dressing — the exact `join`-layer\n * partial application `kernel/query/relate/join.ts` used to import and call\n * directly before #626's retirement (#650 Task 6): fixes `fallback`\n * `undefined` and `layer` `'join'`. `via/lookup/snapshot.ts`'s\n * `buildPresentForJoin` composes this with the lookup-label half to build\n * the `JoinableSource.presentForJoin` hook the join executor now calls\n * instead of reaching into this module.\n */\nexport function presentI18nForJoin(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  locale: string,\n): Record<string, unknown> {\n  return applyI18nLocale(record, i18nFields, locale, undefined, 'join')\n}\n\n/**\n * Remove the internal densify provenance marker (`_i18nFilled`) from a\n * read-facing record. NON-mutating: returns the same object when the\n * marker is absent, otherwise a shallow copy without the marker.\n *\n * MUST be applied on every user-facing read return — even locale-less ones,\n * which bypass {@link applyI18nLocale}. MUST NOT be applied on the internal\n * prior-read path (decryptRecord / resolveDensifyPrior), where densify needs\n * the marker.\n */\nexport function stripI18nFilled<T extends Record<string, unknown>>(record: T): T {\n  if (!Object.prototype.hasOwnProperty.call(record, '_i18nFilled')) return record\n  const rest: T = { ...record }\n  delete (rest as Record<string, unknown>)._i18nFilled\n  return rest\n}\n"],"mappings":";;;;;;;;;;;AAyKA,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAGP;AACF;AAQO,IAAM,UAAwB;AAAA,EACnC,gBAAgB,QAAQ;AAAE,WAAO;AAAA,EAAO;AAAA,EACxC,wBAAwB;AAAE,UAAM,WAAW,2BAA2B;AAAA,EAAE;AAAA,EACxE,cAAc,OAAO;AAAE,WAAO,EAAE,OAAO,UAAU,CAAC,EAAE;AAAA,EAAE;AAAA,EACtD,qBAAqB;AAAE,WAAO,oBAAI,IAAyB;AAAA,EAAE;AAAA,EAC7D,UAAU;AAAA,EAAC;AAAA,EACX,wBAAwB;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AACnE;AAUO,SAAS,qBAAqB,MAAuB;AAC1D,SAAO,KAAK,WAAW,QAAQ;AACjC;AAGO,SAAS,uBAAuB,GAAuC;AAC5E,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAqC,qBAAqB;AAE/D;AASO,SAAS,qBAAqB,GAAqC;AACxE,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAmC,mBAAmB;AAE3D;AAQO,SAAS,oBAAoB,GAAoC;AACtE,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAkC,kBAAkB;AAEzD;;;AC7NO,SAAS,UAAU,KAA8B,MAAyB;AAC/E,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,aAAa,IAAI;AACnB,UAAM,WAAW,KAAK,MAAM,GAAG,QAAQ;AACvC,UAAM,WAAW,KAAK,MAAM,WAAW,CAAC;AACxC,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,WAAO,IAAI,QAAQ,UAAQ;AACzB,UAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO,CAAC;AACtE,aAAO,UAAU,MAAiC,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AACA,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAC5E,WAAO,UAAU,QAAmC,IAAI;AAAA,EAC1D;AACA,QAAM,MAAM,IAAI,IAAI;AACpB,SAAO,QAAQ,SAAY,CAAC,GAAG,IAAI,CAAC;AACtC;AAOO,SAAS,iBACd,KACA,MACA,OACM;AACN,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG;AACpE,qBAAiB,QAAmC,MAAM,KAAK;AAC/D;AAAA,EACF;AACA,MAAI,IAAI,IAAI;AACd;;;ACjBO,SAAS,cACd,WACA,OACW;AACX,QAAM,WACJ,aAAa,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AAClE,QAAM,SAAS,OAAO,cAAc,WAAW,YAAY;AAC3D,QAAM,eACJ,UAAU,UAAU,eAAe;AACrC,SAAO,YAAY,gBAAgB,UAAU;AAC/C;;;AClCA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AACxD,CAAC;AAGD,IAAM,eAAkD;AAAA,EACtD,IAAI,CAAC,MAAM;AAAA,EACX,IAAI,CAAC,UAAU,KAAK;AAAA,EACpB,IAAI,CAAC,OAAO,YAAY,UAAU;AAAA,EAClC,IAAI,CAAC,KAAK;AAAA,EACV,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,YAAY;AAAA,EACjB,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,KAAK;AAAA,EACV,IAAI,CAAC,SAAS;AAChB;AAGA,IAAM,iBAAoD;AAAA,EACxD,MAAM,CAAC,OAAO;AAAA,EACd,MAAM,CAAC,YAAY,OAAO;AAAA,EAC1B,MAAM,CAAC,OAAO,OAAO;AAAA,EACrB,MAAM,CAAC,OAAO,OAAO;AAAA,EACrB,MAAM,CAAC,QAAQ,OAAO;AAAA,EACtB,MAAM,CAAC,UAAU,OAAO;AAC1B;AAOO,SAAS,aAAa,QAAmC;AAC9D,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,QAAM,SAAS,MAAM,KAAK,CAAC,MAAM,kBAAkB,KAAK,CAAC,CAAC;AAC1D,MAAI,UAAU,eAAe,MAAM,EAAG,QAAO,eAAe,MAAM;AAElE,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,YAAY;AAC1C,MAAI,WAAW,IAAI,IAAI,EAAG,QAAO,CAAC,OAAO;AACzC,QAAM,UAAU,aAAa,IAAI;AACjC,MAAI,QAAS,QAAO,CAAC,GAAG,SAAS,OAAO;AACxC,SAAO,CAAC,OAAO;AACjB;AAGA,SAAS,WAAW,YAAgC,QAAmC;AACrF,QAAM,SAAS,WAAW,QAAQ;AAClC,MAAI,UAAU,WAAW,QAAQ;AAC/B,UAAM,WAAW,OAAO,MAAM;AAC9B,QAAI,SAAU,QAAO;AAAA,EACvB;AACA,SAAO,aAAa,MAAM;AAC5B;AAGA,IAAM,WAAW,OAAO;AAGxB,SAAS,YAAY,SAAoC;AACvD,QAAM,MAAM,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1D,SAAO,IAAI,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,GAAG;AACjD;AAGA,SAAS,YAAY,SAAoC;AACvD,QAAM,MAAM,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1D,SAAO,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,KAAK,GAAG;AAC9C;AAGA,SAAS,gBAAgB,KAAa,SAAoC;AACxE,QAAM,KAAK,YAAY,OAAO;AAC9B,QAAM,MAAgB,CAAC;AACvB,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,KAAK,EAAE,EAAG,KAAI,KAAK,EAAE;AAC7B,QAAI,IAAI,UAAU,EAAG;AAAA,EACvB;AACA,SAAO,IAAI,KAAK,EAAE;AACpB;AAGA,SAAS,gBAAgB,KAAa,SAAoC;AACxE,QAAM,KAAK,YAAY,OAAO;AAC9B,MAAI,MAAM;AACV,aAAW,MAAM,IAAK,KAAI,GAAG,KAAK,EAAE,EAAG,QAAO;AAC9C,SAAO;AACT;AAkBO,SAAS,cACd,OACA,OACA,YACA,QAC+D;AAC/D,QAAM,MAAM,WAAW;AACvB,MAAI,CAAC,IAAI,OAAQ,QAAO,EAAE,OAAO,UAAU,CAAC,EAAE;AAE9C,QAAM,OAAO,IAAI,qBAAqB;AACtC,QAAM,WAA4B,CAAC;AACnC,MAAI,MAAM;AAEV,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,QAAI,QAAQ,IAAI,MAAM,EAAG;AACzB,QAAI,OAAO,QAAQ,SAAU;AAC7B,UAAM,UAAU,WAAW,YAAY,MAAM;AAC7C,QAAI,YAAY,OAAO,EAAE,KAAK,GAAG,EAAG;AAEpC,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,QAAI,SAAS,UAAU;AACrB,YAAM,IAAI,qBAAqB,OAAO,QAAQ,SAAS,MAAM;AAAA,IAC/D;AACA,aAAS,KAAK,EAAE,OAAO,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1D,QAAI,SAAS,UAAU;AACrB,UAAI,QAAQ,MAAO,OAAM,EAAE,GAAG,MAAM;AACpC,UAAI,MAAM,IAAI,gBAAgB,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,KAAK,SAAS;AAChC;;;AClHA,eAAe,qBACb,QACA,YACA,KACe;AACf,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,QAAI,CAAC,WAAW,QAAQ,cAAe;AAGvC,UAAM,aAAa,UAAU,QAAQ,KAAK;AAC1C,QAAI,WAAW,WAAW,EAAG;AAC7B,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG;AACjE,UAAM,MAAM;AAIZ,UAAM,EAAE,WAAW,SAAS,IAAI,WAAW;AAC3C,UAAM,UAAoB,UAAU;AAAA,MAClC,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,WAAW,EAAG;AAE1B,UAAM,eAAe,UAAU,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE;AACpE,QAAI,CAAC,aAAc;AACnB,QAAI,CAAC,IAAI,mBAAmB;AAC1B,YAAM,IAAI,6BAA6B,OAAO,IAAI,cAAc;AAAA,IAClE;AAEA,UAAM,cACJ,aAAa,QACT,CAAC,IACD,aAAa,QACX,UACA,QAAQ,OAAO,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AAClD,UAAM,aAAa,EAAE,GAAG,IAAI;AAC5B,eAAW,gBAAgB,aAAa;AACtC,iBAAW,YAAY,IAAI,MAAM,IAAI;AAAA,QACnC,IAAI,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA,IAAI;AAAA,MACN;AAAA,IACF;AACA,qBAAiB,QAAQ,OAAO,UAAU;AAAA,EAC5C;AACF;AASA,SAAS,yBACP,QACA,YACA,UACA,aACA,KACA,KACM;AACN,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,QAAI,CAAC,WAAW,QAAQ,OAAQ;AAChC,eAAW,QAAQ,UAAU,QAAQ,KAAK,GAAG;AAC3C,UAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG;AAC9D,YAAM,UAAU;AAChB,YAAM,EAAE,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,QAC5C;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,IAAI,KAAK;AAAA,MACxB;AACA,UAAI,YAAY,QAAS,QAAO,OAAO,SAAS,OAAO;AAIvD,YAAM,OAAO,WAAW,QAAQ;AAChC,UAAI,SAAS,UAAU,SAAS,UAAU;AACxC,mBAAW,KAAK,UAAU;AAExB,cAAI,KAAK,yBAAyB;AAAA,YAChC,OAAO,IAAI;AAAA,YACX,YAAY,IAAI;AAAA,YAChB,IAAI,IAAI;AAAA,YACR;AAAA,YACA,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,mBACb,QACA,KACA,KACkC;AAClC,QAAM,aAAa,IAAI;AACvB,QAAM,oBAAoB,IAAI;AAC9B,QAAM,WAAW,IAAI;AAGrB,MAAI,YAAY;AACd,UAAM,qBAAqB,QAAQ,YAAY,GAAG;AAAA,EACpD;AAMA,MAAI;AACJ,MAAI;AACJ,MAAI,mBAAmB;AACrB,mBAAgB,MAAM,IAAI,MAAM,KAAM;AACtC,kBAAc,SAAS,mBAAmB,cAAc,QAAQ,iBAAiB;AAAA,EACnF;AAGA,MAAI,YAAY;AACd,6BAAyB,QAAQ,YAAY,UAAU,aAAa,KAAK,GAAG;AAAA,EAC9E;AAKA,MAAI,mBAAmB,MAAM;AAI7B,MAAI,mBAAmB;AACrB,aAAS,QAAQ,QAAQ,cAAc,iBAAiB;AAAA,EAC1D;AAEA,SAAO;AACT;AAWA,eAAe,eACb,QACA,KACA,KACkC;AAClC,QAAM,aAAa,IAAI;AACvB,QAAM,gBAAgB,IAAI;AAC1B,QAAM,WAAW,IAAI;AACrB,QAAM,UAAU,eAAe,UAAa,OAAO,KAAK,UAAU,EAAE,SAAS;AAC7E,QAAM,UAAU,kBAAkB,UAAa,OAAO,KAAK,aAAa,EAAE,SAAS;AACnF,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AAEjC,QAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAC7D,QAAM,WAAW,IAAI;AACrB,QAAM,QAAQ,IAAI;AAElB,MAAI,SAAS;AASb,QAAM,mBACJ,WACA,kBAAkB,UAClB,OAAO,OAAO,aAAa,EAAE;AAAA,IAC3B,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,kBAAkB;AAAA,EAC1D;AAKF,MAAI,CAAC,UAAU,CAAC,iBAAkB,QAAO,gBAAgB,MAAM;AAM/D,MAAI,UAAU,WAAW,YAAY;AACnC,aAAS,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,UAAU,KAAK;AAAA,EAC/E;AAGA,MAAI,WAAW,iBAAiB,IAAI,qBAAqB,WAAW,OAAO;AACzE,UAAM,aAAa,EAAE,GAAG,OAAO;AAC/B,UAAM,WAAW,IAAI;AACrB,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,aAAa,GAAG;AAKzD,YAAM,SAAS,KAAK,YAAY,cAAc,KAAK,WAAW,KAAK,IAAI;AACvE,YAAM,gBACJ,WAAW,eACN,YAAY,KAAK,aAClB;AAKN,YAAM,YACJ,WACC,uBAAuB,IAAI,IAAI,KAAK,gBAAgB;AAGvD,YAAM,aAAa,OAAO,QAAwC;AAChE,YAAI,CAAC,WAAW;AACd,cAAI,WAAW,SAAS;AACtB,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,YAAY,KAAK,uCAAuC,GAAG;AAAA,YAC7D;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,KAAK,WAAW,aAAa;AACrE,YAAI,UAAU,QAAW;AACvB,cAAI,WAAW,SAAS;AACtB,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,YAAY,KAAK,wBAAwB,GAAG,gBAAgB,SAAS;AAAA,YACvE;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,UAAI,MAAM,SAAS,KAAK,GAAG;AAGzB,cAAM,QAAQ,MAAM,MAAM,KAAK;AAC/B,cAAM,WAAW,MAAM,CAAC;AACxB,cAAM,OAAO,MAAM,CAAC;AACpB,YAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,cAAM,MAAO,WAAuC,QAAQ;AAC5D,YAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,cAAM,WAAW,GAAG,IAAI;AACvB,QAAC,WAAuC,QAAQ,IAAI,MAAM,QAAQ;AAAA,UACjE,IAAI,IAAI,OAAO,OAAO;AACpB,gBAAI,CAAC,MAAM,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,EAAG,QAAO;AAC/D,kBAAM,IAAK,GAA+B,IAAI;AAC9C,gBAAI,OAAO,MAAM,SAAU,QAAO;AAClC,mBAAO,EAAE,GAAI,IAAgC,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE;AAAA,UAC/E,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,YAAM,MAAM,OAAO,KAAK;AACxB,UAAI,MAAM,QAAQ,GAAG,GAAG;AAEtB,mBAAW,GAAG,KAAK,OAAO,IAAI,MAAM,QAAQ;AAAA,UAC1C,IAAI,IAAI,OAAO,OAAO;AAAA,YACpB,KAAK;AAAA,YACL,OAAO,OAAO,MAAM,WAAW,MAAM,WAAW,CAAC,IAAI;AAAA,UACvD,EAAE;AAAA,QACJ;AAAA,MACF,WAAW,OAAO,QAAQ,UAAU;AAClC,cAAM,QAAQ,MAAM,WAAW,GAAG;AAGlC,YAAI,UAAU,KAAM,YAAW,GAAG,KAAK,OAAO,IAAI;AAAA,MACpD;AAAA,IACF;AACA,aAAS;AAAA,EACX;AAKA,SAAO,gBAAgB,MAAM;AAC/B;AAIA,SAAS,0BAA0B,KAA6C;AAC9E,SAAO;AAAA,IACL,YAAY,IAAI,aAAa,OAAO,KAAK,IAAI,UAAU,IAAI,CAAC;AAAA,IAC5D,eAAe,IAAI,gBAAgB,OAAO,KAAK,IAAI,aAAa,IAAI,CAAC;AAAA,IACrE,GAAI,IAAI,kBAAkB,SAAY,EAAE,eAAe,IAAI,cAAc,IAAI,CAAC;AAAA,EAChF;AACF;AAIO,SAAS,QAAQ,KAA8B;AACpD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA;AAAA;AAAA;AAAA,IAI/F,kBAAkB,CAAC,QAAQ;AAAA,IAC3B,QAAQ,CAAC,UACN,IAAI,eAAe,UAAa,SAAS,IAAI,cAC1C,IAAI,kBAAkB,UAAa,SAAS,IAAI;AAAA;AAAA,IAEtD,eAAe,CAAC,GAAG,OAAO,KAAK,IAAI,cAAc,CAAC,CAAC,GAAG,GAAG,OAAO,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC;AAAA,IAC7F,aAAa,OAAO,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK,GAAG;AAAA,IACvE,SAAS,OAAO,QAAQ,QAAQ,eAAe,QAAQ,KAAK,GAAG;AAAA,IAC/D,kBAAkB,MAAM,0BAA0B,GAAG;AAAA,EACvD;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,QAAQ,CAAkB,CAAC;AAC7D;;;AC5KO,SAAS,SAAS,SAA8C;AAIrE,cAAY;AACZ,MAAI,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,SAAS,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,SAAO,EAAE,gBAAgB,MAAM,WAAW,QAAQ,QAAQ;AAC5D;AAGA,SAAS,eAAe,WAAiD;AACvE,MAAI,cAAc,OAAW,QAAO;AACpC,MAAI,OAAO,cAAc,SAAU,QAAO,cAAc;AACxD,SAAO,OAAO,OAAO,SAAS,EAAE,SAAS,OAAO;AAClD;AAoBO,SAAS,sBACd,OACA,OACA,YACM;AACN,QAAM,EAAE,QAAQ,IAAI;AAGpB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,KAAK,6CAA6C,OAAO,KAAK;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,MAAM;AAGZ,aAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC7C,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,CAAC,MAAM;AAAA,QACP,UAAU,KAAK,cAAc,MAAM,2BAA2B,OAAO,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAGA,QAAM,EAAE,SAAS,IAAI;AACrB,MAAI,aAAa,OAAO;AACtB,UAAM,UAAU,QAAQ,UAAU;AAAA,MAChC,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,KAAK,+CAA+C,QAAQ,KAAK,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,EACF,WAAW,aAAa,OAAO;AAC7B,UAAM,UAAU,QAAQ,UAAU;AAAA,MAChC,CAAC,SAAS,QAAQ,OAAO,IAAI,IAAI,MAAM;AAAA,IACzC;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,UAAU,KAAK;AAAA,MACjB;AAAA,IACF;AAAA,EACF,OAAO;AAEL,UAAM,eAAe;AACrB,UAAM,UAAU,aAAa;AAAA,MAC3B,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,KAAK,eAAe,aAAa,KAAK,IAAI,CAAC,cAAc,QAAQ,KAAK,IAAI,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;AA+BA,SAAS,QAAQ,UAAqE;AACpF,SAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,WAAW,CAAC,QAAkB,IAAI,CAAC;AACjF;AAGA,SAAS,cACP,OACA,OACoB;AACpB,aAAW,MAAM,OAAO;AACtB,QAAI,OAAO,OAAO;AAChB,YAAM,MAAM,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC,MAAM,MAAM,EAAE;AACrD,UAAI,QAAQ,OAAW,QAAO;AAAA,IAChC,WAAW,MAAM,EAAE,MAAM,UAAa,MAAM,EAAE,MAAM,IAAI;AACtD,aAAO,MAAM,EAAE;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAkBO,SAAS,gBACd,OACA,QACA,UACA,OACA,MACwC;AACxC,MAAI,WAAW,OAAO;AACpB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,wBAAwB,SAAS,WAAW;AAAA,EACxD;AAGA,MAAI,MAAM,MAAM,MAAM,UAAa,MAAM,MAAM,MAAM,IAAI;AACvD,WAAO,MAAM,MAAM;AAAA,EACrB;AAEA,QAAM,SAAoB,MAAM,UAAU;AAI1C,QAAM,cAAc,QAAQ,QAAQ;AACpC,QAAM,YAAY,cAAc,OAAO,WAAW;AAClD,MAAI,cAAc,OAAW,QAAO;AAGpC,MAAI,WAAW,cAAc;AAC3B,UAAM,SAAS,cAAc,OAAO,QAAQ,MAAM,UAAU,CAAC;AAC7D,QAAI,WAAW,OAAW,QAAO;AAGjC,QAAI,MAAM,iBAAiB;AACzB,YAAM,WAAW,kBAAkB,OAAO,MAAM;AAChD,UAAI,aAAa,OAAW,QAAO;AAAA,IACrC;AAAA,EACF;AAGA,MAAI,WAAW,SAAS;AACtB,UAAM,IAAI;AAAA,MACR,SAAS;AAAA,MACT,wCAAwC,MAAM,OAC3C,YAAY,SAAS,IAAI,uBAAuB,YAAY,KAAK,IAAI,CAAC,MAAM,MAC7E;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAUA,SAAS,kBAAkB,OAA+B,QAAoC;AAC5F,QAAM,eAAe,aAAa,MAAM,EAAE,CAAC,KAAK;AAChD,MAAI;AACJ,aAAW,CAAC,KAAK,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC5C,QAAI,OAAO,MAAM,YAAY,MAAM,GAAI;AACvC,UAAM,IAAI,aAAa,GAAG,EAAE,CAAC,KAAK;AAClC,UAAM,QAAQ,MAAM,eAAe,IAAI,MAAM,UAAU,IAAI;AAC3D,QAAI,SAAS,UAAa,QAAQ,KAAK,MAAO,QAAO,EAAE,OAAO,EAAE;AAChE,QAAI,UAAU,EAAG;AAAA,EACnB;AACA,SAAO,MAAM;AACf;AAaA,SAAS,YACP,KACA,MACA,QACA,UACA,MACyB;AACzB,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,aAAa,IAAI;AACnB,UAAM,WAAW,KAAK,MAAM,GAAG,QAAQ;AACvC,UAAM,WAAW,KAAK,MAAM,WAAW,CAAC;AACxC,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,CAAC,QAAQ,GAAG,IAAI,IAAI,UAAQ;AAC1B,YAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,eAAO,YAAY,MAAiC,UAAU,QAAQ,UAAU,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,WAAO;AAAA,MACL,GAAG;AAAA,MACH,CAAC,IAAI,GAAG,YAAY,QAAmC,MAAM,QAAQ,UAAU,IAAI;AAAA,IACrF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,IAAI;AACpB,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC1D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,IAAI,GAAG,gBAAgB,KAA+B,QAAQ,UAAU,MAAM,IAAI;AAAA,EACrF;AACF;AAqBO,SAAS,gBACd,QACA,YACA,QACA,UACA,QAAe,QACU;AACzB,QAAM,aAAa,OAAO,KAAK,UAAU;AACzC,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,MAAI,SAAS;AAEb,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,UAAM,EAAE,WAAW,YAAY,gBAAgB,IAAI,WAAW;AAC9D,UAAM,OAA2B;AAAA,MAC/B,QAAQ,cAAc,WAAW,KAAK;AAAA,MACtC,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,MACjD,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,IAC/C;AACA,aAAS,YAAY,QAAQ,OAAO,QAAQ,UAAU,IAAI;AAAA,EAC5D;AAGA,WAAS,gBAAgB,MAAM;AAE/B,SAAO;AACT;AAWO,SAAS,mBACd,QACA,YACA,QACyB;AACzB,SAAO,gBAAgB,QAAQ,YAAY,QAAQ,QAAW,MAAM;AACtE;AAYO,SAAS,gBAAmD,QAAc;AAC/E,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,aAAa,EAAG,QAAO;AACzE,QAAM,OAAU,EAAE,GAAG,OAAO;AAC5B,SAAQ,KAAiC;AACzC,SAAO;AACT;","names":[]}

package/dist/chunk-GYGLAVCX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/satellites/existence.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\n\n/**\n * Existence authority (spec § Convergence & existence authority, rule 1): the\n * base row is the sole authority on record existence. `null` (absent) and the\n * tombstone shape (`_iv === '' && _data === ''`, per `buildTombstone()`) both\n * read as \"not live\" — undecrypted, envelope-level checks only.\n */\nfunction isEnvelopeLive(env: EncryptedEnvelope | null): boolean {\n  return env !== null && !(env._iv === '' && env._data === '')\n}\n\n/** One undecrypted adapter `get` on the base — the store-shape the spec pins (zero extra crypto). */\nexport async function isBaseLive(adapter: NoydbStore, vault: string, base: string, id: string): Promise<boolean> {\n  return isEnvelopeLive(await adapter.get(vault, base, id))\n}\n\n/** The set of base ids that are currently live — used to id-filter satellite `list()` results. */\nexport async function liveBaseIdSet(adapter: NoydbStore, vault: string, base: string): Promise<Set<string>> {\n  const ids = await adapter.list(vault, base)\n  const out = new Set<string>()\n  for (const id of ids) if (await isBaseLive(adapter, vault, base, id)) out.add(id)\n  return out\n}\n"],"mappings":";AAQA,SAAS,eAAe,KAAwC;AAC9D,SAAO,QAAQ,QAAQ,EAAE,IAAI,QAAQ,MAAM,IAAI,UAAU;AAC3D;AAGA,eAAsB,WAAW,SAAqB,OAAe,MAAc,IAA8B;AAC/G,SAAO,eAAe,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE,CAAC;AAC1D;AAGA,eAAsB,cAAc,SAAqB,OAAe,MAAoC;AAC1G,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,MAAM,IAAK,KAAI,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,EAAG,KAAI,IAAI,EAAE;AAChF,SAAO;AACT;","names":[]}