@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/{chunk-TKVUE4JF.js → chunk-2ZFD2UJC.js}

@@ -7,15 +7,15 @@ import {
   joinsDropLeftRows,
   orderReferencesJoinAlias,
   splitAroundJoins
-} from "./chunk-NCO25JZO.js";
+} from "./chunk-PT2YCQVK.js";
 import {
   describeJoinOn,
   joinOnDispatch,
   normalizeJoinOn
-} from "./chunk-4V3Q35WG.js";
+} from "./chunk-5UUJE4FP.js";
 import {
   ScanBuilder
-} from "./chunk-JQYKPKG6.js";
+} from "./chunk-QGFEBNHO.js";
 import {
   installMethods
 } from "./chunk-F6NCB7KT.js";
@@ -27,22 +27,22 @@ import {
   pickCompound,
   pickCompoundOrder,
   viaOrdersField
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-ZVSKSUGI.js";
 import {
   gateTerminal
-} from "./chunk-FOEDQATO.js";
+} from "./chunk-DHU2AQ6T.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-BUE7R3B5.js";
 import {
   isViaPrefixProbe
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-PTJY5R3O.js";
 import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   RefNotDeclaredError,
   TraversalCycleError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/query/relate/explain.ts
 var WARN_FRACTION = 0.8;
@@ -1286,4 +1286,4 @@ export {
   runTraversal,
   installRelate
 };
-//# sourceMappingURL=chunk-TKVUE4JF.js.map
+//# sourceMappingURL=chunk-2ZFD2UJC.js.map

package/dist/{chunk-2AFX33YA.js → chunk-3V6LZHUO.js}

@@ -6,10 +6,10 @@ import {
   KIND_STRING,
   compareKeys,
   toSortKey
-} from "./chunk-LGNDFRYC.js";
+} from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-BUE7R3B5.js";
 
 // src/with-lookup/indexing/index-snapshot.ts
 var FIELD_INDEX_SNAPSHOT_VERSION = 1;
@@ -933,4 +933,4 @@ export {
   normalizeIndexDefs,
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-2AFX33YA.js.map
+//# sourceMappingURL=chunk-3V6LZHUO.js.map

package/dist/chunk-3V6LZHUO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/indexing/index-snapshot.ts","../src/with-lookup/indexing/sorted-indexes.ts","../src/with-lookup/indexing/compound-indexes.ts","../src/with-lookup/indexing/eager-indexes.ts"],"sourcesContent":["/**\n * The on-disk shape of a persisted field index (#1359) — the format both\n * `SortedIndex` (#1344) and `CompoundIndex` (#1345) round-trip through, plus\n * the structural validator every load must pass.\n *\n * ⭐ **Nothing is flattened into a delimited string.** A compound entry keeps\n * its tuple as an ARRAY of per-component keys, each carrying its runtime KIND\n * alongside its value — which is the whole point of #1345's in-memory shape\n * and would be destroyed by a `join()`. Two properties depend on it:\n *\n *  - **Kind survives.** Entries rank by runtime kind FIRST (mirroring\n *    `predicate.ts`'s `isComparable`), so a `string` probe must not reach\n *    `number` entries. An encoding that wrote only the value would collapse\n *    `1` and `'1'` into one key space on the way back in.\n *  - **Per-component ordering survives.** A string component may contain any\n *    byte, including whatever a separator would have been.\n *\n * The validator is deliberately paranoid and its failure mode is a REBUILD,\n * never a partial load: a blob that is truncated, from a future format, or\n * internally out of order is rejected whole. See\n * {@link parseFieldIndexSnapshot}.\n */\n\n/** Bump on ANY incompatible change to the shapes below. An older stamp is rejected, not migrated. */\nexport const FIELD_INDEX_SNAPSHOT_VERSION = 1\n\n/** One `SortKey`, wire form: `[kind, key]`. `kind` IS the sort rank. */\nexport type WireKey = readonly [kind: number, key: number | string]\n\n/** One `SortedIndex` entry: `[kind, key, seq, id]`. */\nexport type WireSortedEntry = readonly [kind: number, key: number | string, seq: number, id: string]\n\n/** One `CompoundIndex` entry: `[tupleKeys, seq, id]` — the tuple stays an ARRAY. */\nexport type WireCompoundEntry = readonly [keys: readonly WireKey[], seq: number, id: string]\n\nexport interface SortedIndexSnapshot {\n  readonly v: number\n  readonly t: 'sorted'\n  readonly field: string\n  readonly nextSeq: number\n  readonly entries: readonly WireSortedEntry[]\n}\n\nexport interface CompoundIndexSnapshot {\n  readonly v: number\n  readonly t: 'compound'\n  readonly fields: readonly string[]\n  readonly nextSeq: number\n  readonly entries: readonly WireCompoundEntry[]\n}\n\nexport type FieldIndexSnapshot = SortedIndexSnapshot | CompoundIndexSnapshot\n\n/**\n * Sidecar key for a single-field sorted index. Field paths are\n * percent-encoded so no field name can collide with the `,` the compound\n * form joins on, nor with the `s:` / `c:` discriminator.\n */\nexport function sortedIndexKey(field: string): string {\n  return `s:${encodeURIComponent(field)}`\n}\n\n/** Sidecar key for a compound index over an ordered field tuple. */\nexport function compoundIndexKey(fields: readonly string[]): string {\n  return `c:${fields.map(encodeURIComponent).join(',')}`\n}\n\n/** A key is well-formed only if its declared kind matches its value's runtime type. */\nfunction isWireKey(x: unknown): x is WireKey {\n  if (!Array.isArray(x) || x.length !== 2) return false\n  const [kind, key] = x as [unknown, unknown]\n  // 0 = number, 1 = string, 2 = Date-as-epoch-millis. See `sorted-indexes.ts`.\n  if (kind === 0 || kind === 2) return typeof key === 'number' && Number.isFinite(key)\n  if (kind === 1) return typeof key === 'string'\n  return false\n}\n\nfunction isSeq(x: unknown): x is number {\n  return typeof x === 'number' && Number.isInteger(x) && x >= 0\n}\n\n/**\n * Decode + validate a persisted snapshot. Returns `null` — meaning \"rebuild\"\n * — for anything that is not exactly the current format: bad JSON (a torn\n * write), a version stamp from another release, a shape mismatch, a\n * malformed key, or entries out of the order the index's binary searches\n * require. A caller must never repair a snapshot; the source of truth is the\n * cache, and rebuilding from it is always available.\n */\nexport function parseFieldIndexSnapshot(json: string): FieldIndexSnapshot | null {\n  let raw: unknown\n  try {\n    raw = JSON.parse(json)\n  } catch {\n    return null\n  }\n  if (typeof raw !== 'object' || raw === null) return null\n  const o = raw as Record<string, unknown>\n  if (o['v'] !== FIELD_INDEX_SNAPSHOT_VERSION) return null\n  if (!isSeq(o['nextSeq']) || !Array.isArray(o['entries'])) return null\n  const nextSeq = o['nextSeq']\n  const entries = o['entries'] as unknown[]\n\n  if (o['t'] === 'sorted') {\n    if (typeof o['field'] !== 'string') return null\n    const out: WireSortedEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 4) return null\n      const [kind, key, seq, id] = e as [unknown, unknown, unknown, unknown]\n      if (!isWireKey([kind, key])) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([kind as number, key as number | string, seq, id])\n    }\n    if (!isAscending(out.map(e => [[e[0], e[1]] as WireKey]), out.map(e => e[2]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'sorted', field: o['field'], nextSeq, entries: out }\n  }\n\n  if (o['t'] === 'compound') {\n    const fields = o['fields']\n    if (!Array.isArray(fields) || fields.length === 0 || !fields.every(f => typeof f === 'string')) return null\n    const out: WireCompoundEntry[] = []\n    for (const e of entries) {\n      if (!Array.isArray(e) || e.length !== 3) return null\n      const [keys, seq, id] = e as [unknown, unknown, unknown]\n      if (!Array.isArray(keys) || keys.length !== fields.length || !keys.every(isWireKey)) return null\n      if (!isSeq(seq) || seq >= nextSeq || typeof id !== 'string') return null\n      out.push([keys as readonly WireKey[], seq, id])\n    }\n    if (!isAscending(out.map(e => e[0]), out.map(e => e[1]))) return null\n    return { v: FIELD_INDEX_SNAPSHOT_VERSION, t: 'compound', fields, nextSeq, entries: out }\n  }\n\n  return null\n}\n\n/**\n * Every binary search in both index classes assumes `(keys…, seq)` ascending.\n * A blob that is not sorted would not merely be slow — it would answer\n * WRONGLY, so it is rejected rather than re-sorted (re-sorting would launder\n * a corrupt blob into a plausible-looking answer).\n */\nfunction isAscending(keys: ReadonlyArray<readonly WireKey[]>, seqs: readonly number[]): boolean {\n  for (let i = 1; i < keys.length; i++) {\n    const c = compareWireTuples(keys[i - 1]!, keys[i]!)\n    if (c > 0) return false\n    if (c === 0 && seqs[i - 1]! >= seqs[i]!) return false\n  }\n  return true\n}\n\nfunction compareWireTuples(a: readonly WireKey[], b: readonly WireKey[]): number {\n  for (let i = 0; i < a.length; i++) {\n    const x = a[i]!\n    const y = b[i]!\n    if (x[0] !== y[0]) return x[0] - y[0]\n    if (typeof x[1] === 'number' && typeof y[1] === 'number') {\n      if (x[1] !== y[1]) return x[1] - y[1]\n    } else if (x[1] !== y[1]) {\n      return x[1] < y[1] ? -1 : 1\n    }\n  }\n  return 0\n}\n","/**\n * Sorted (range) secondary indexes — the ordered sibling of the hash\n * index in `eager-indexes.ts` (#1344).\n *\n * A sorted index is an array of `{ kind, key, seq, id }` entries kept in\n * ascending `(kindRank, key, seq)` order. Binary search then answers\n * `<`, `<=`, `>`, `>=`, `between` and `startsWith` as a contiguous slice,\n * and `orderedIds()` walks the array for `orderBy(field).limit(n)`.\n *\n * Three properties are load-bearing, each mirroring the linear scan this\n * replaces (`kernel/query/predicate.ts`):\n *\n *  - **Kind-partitioned.** `evaluateFieldClause`'s `isComparable` refuses\n *    to order two values of different runtime types, so entries are ranked\n *    by kind FIRST. A `string` probe therefore cannot reach `number`\n *    entries, exactly as the scan cannot. Values with no order-defined\n *    type (booleans, objects, arrays) are not indexed at all.\n *  - **Nullish is not indexed**, same as the hash index.\n *  - **Ties keep insertion order** (`seq`), which after a `build()` is\n *    snapshot order — so an index-served `orderBy(...).limit(n)` returns\n *    the same rows the stable scan-and-sort would. An in-place UPDATE\n *    reinstates the rank it held rather than appending (#1369): the record\n *    cache does not move a re-`put` record, so neither may the index.\n *\n * Keys canonicalise through the SAME per-field closure the hash index\n * uses (`ViaPipeline.canonicalizeIndexKey`), so a Via-covered field's\n * entries live in one key space here too. Range DISPATCH for a\n * Via-covered clause is nevertheless declined by the query builder (a\n * money operand has no ordered stored-form probe) — see\n * `kernel/query/builder.ts`'s `candidateRecords`.\n *\n * PERSISTENCE (#1359) is OPT-IN, via `{ persist: true }` on the declaration.\n * {@link SortedIndex.toSnapshot} / {@link SortedIndex.loadSnapshot} are the\n * whole of this class's part in it — the encrypted sidecar, the freshness\n * stamp and the debounce live in `persisted-field-indexes.ts`. Without the\n * opt-in the index is in memory only and rebuilt on hydrate, as before.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type FieldIndexSnapshot,\n  type SortedIndexSnapshot,\n  type WireSortedEntry,\n} from './index-snapshot.js'\n\n/** Range operators a sorted index can answer. */\nexport type RangeOperator = '<' | '<=' | '>' | '>=' | 'between' | 'startsWith'\n\n// The ordered-key encoding itself moved to `kernel/query/sort-key.ts` (#1339):\n// #1339's declared joins key on it too, and the kernel spine may not\n// statically import a `with-*` service (`check-architecture.mjs`'s\n// port-layering ratchet). Re-exported here so every existing importer of this\n// module is unchanged, and so there is still exactly ONE definition of what\n// makes two stored values comparable.\nexport { KIND_STRING, compareKeys, toSortKey, type KeyKind, type SortKey } from '../../kernel/query/sort-key.js'\n\ninterface Entry extends SortKey {\n  readonly seq: number\n  readonly id: string\n}\n\n/** A single field's sorted index. */\nexport class SortedIndex {\n  private readonly entries: Entry[] = []\n  private nextSeq = 0\n\n  constructor(readonly field: string) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op when the value has no order-defined kind.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, value: unknown, canonicalKey: string | undefined, seq?: number): void {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return\n    const entry: Entry = { ...sk, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the value it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it (#1369):\n   * `sortRecords()` sorts a snapshot whose order does not change when a\n   * record is written in place, so a tie-breaking rank that drifted to the\n   * back on every `put` would make an index-served page disagree with the\n   * scan it must match. Same contract as `CompoundIndex.remove`.\n   */\n  remove(id: string, value: unknown, canonicalKey: string | undefined): number | undefined {\n    const sk = toSortKey(value, canonicalKey)\n    if (!sk) return undefined\n    // Every entry sharing this key is contiguous; walk that run for the id.\n    for (let i = this.lowerBound(sk); i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (compareKeys(e, sk) !== 0) break\n      if (e.id === id) {\n        this.entries.splice(i, 1)\n        return e.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids in ascending (or descending) key order. Ties keep INSERTION order\n   * in both directions — `sortRecords()` negates its comparator over a\n   * stable sort, which reverses the key order but not the order of equal\n   * keys. A plain `.reverse()` here would disagree on ties.\n   */\n  orderedIds(direction: 'asc' | 'desc'): string[] {\n    if (direction === 'asc') return this.entries.map(e => e.id)\n    const out: string[] = []\n    let end = this.entries.length\n    while (end > 0) {\n      let start = end - 1\n      while (start > 0 && compareKeys(this.entries[start - 1]!, this.entries[end - 1]!) === 0) start--\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  /**\n   * Ids matching a range clause. Returns an empty set when the probe has\n   * no comparable kind — which is what the linear scan would produce too.\n   */\n  lookup(op: RangeOperator, value: unknown): Set<string> {\n    if (op === 'startsWith') return this.prefix(value)\n    if (op === 'between') {\n      if (!Array.isArray(value) || value.length !== 2) return new Set()\n      const lo = toSortKey(value[0], undefined)\n      const hi = toSortKey(value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(this.lowerBound(lo), this.upperBound(hi))\n    }\n    const probe = toSortKey(value, undefined)\n    if (!probe) return new Set()\n    const lo = this.lowerBound(probe)\n    const hi = this.upperBound(probe)\n    // Kind-partitioned: `<`/`>` must stay inside the probe's own kind run.\n    const [kindStart, kindEnd] = this.kindBounds(probe.kind)\n    switch (op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  private prefix(value: unknown): Set<string> {\n    if (typeof value !== 'string') return new Set()\n    const out = new Set<string>()\n    const from = this.lowerBound({ kind: KIND_STRING, key: value })\n    for (let i = from; i < this.entries.length; i++) {\n      const e = this.entries[i]!\n      if (e.kind !== KIND_STRING) break\n      if (!(e.key as string).startsWith(value)) break\n      out.add(e.id)\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the run of entries with the given kind — binary, not linear. */\n  private kindBounds(kind: KeyKind): [number, number] {\n    return [this.kindBoundary(k => k < kind), this.kindBoundary(k => k <= kind)]\n  }\n\n  private kindBoundary(before: (k: KeyKind) => boolean): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is >= `probe`. */\n  private lowerBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index whose key is > `probe`. */\n  private upperBound(probe: SortKey): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (compareKeys(this.entries[mid]!, probe) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). `kind` travels with every\n   * key: entries rank by runtime kind first, so an encoding that dropped it\n   * would let a `string` probe reach `number` entries on the way back in.\n   */\n  toSnapshot(): SortedIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'sorted',\n      field: this.field,\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(e => [e.kind, e.key, e.seq, e.id] as WireSortedEntry),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Refusal (`false`) means the\n   * caller rebuilds — it NEVER means a partial index: the entries are staged\n   * and only swapped in once every one of them is accepted.\n   *\n   * `isLive` is the caller's liveness predicate over the record cache. An\n   * entry naming a record the cache does not hold means the blob and the\n   * collection have diverged (a crash between the two writes, say), so the\n   * whole blob is discarded. Crash residue must be a rebuild, never a wrong\n   * answer.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'sorted' || snap.field !== this.field) return false\n    const staged: Entry[] = []\n    for (const [kind, key, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ kind: kind as KeyKind, key, seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: Entry): number {\n    let i = this.upperBound(entry)\n    while (i > 0 && compareKeys(this.entries[i - 1]!, entry) === 0 && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildSortedIndex<T>(\n  idx: SortedIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    const value = readPath(record, idx.field)\n    if (value === null || value === undefined) continue\n    idx.add(id, value, canonicalize?.(idx.field, value))\n  }\n}\n\n","/**\n * Compound (multi-field) sorted indexes — the tuple-keyed sibling of\n * `sorted-indexes.ts` (#1345).\n *\n * A compound index is an array of `{ keys, seq, id }` entries kept in\n * ascending `(keys[0], keys[1], …, seq)` order, where each `keys[i]` is\n * the SAME `SortKey` the single-field sorted index builds — so the tuple\n * encoding is order-preserving per component BY CONSTRUCTION rather than\n * by a second, hand-rolled serialization. Nothing is flattened into a\n * delimited string: a string component can therefore contain any byte\n * without colliding with a separator, and a money field canonicalized to\n * a scaled-integer string (`ViaPipeline.canonicalizeIndexKey`) or a date\n * stored as ISO text sorts inside its own component exactly as it does in\n * the single-field index.\n *\n * The two load-bearing properties of #1344 hold PER COMPONENT:\n *\n *  - **Kind-partitioned.** `compareKeys` ranks by runtime kind first, so\n *    within any equality-prefix run a `string` probe on the next\n *    component cannot reach `number` entries — mirroring `predicate.ts`'s\n *    `isComparable`, exactly as the linear scan behaves.\n *  - **Ties keep insertion order** in both directions. `orderedIds()`\n *    walks equal-key runs forward even when emitting descending, because\n *    `sortRecords()` negates its comparator over a STABLE sort.\n *\n * **A record is indexed only when EVERY component has an order-defined\n * value.** One nullish or non-orderable component and the record is\n * absent — which is why the query builder compares {@link\n * CompoundIndex.size} against the snapshot size before dispatching, and\n * falls back to the scan when the index does not cover the collection.\n *\n * PERSISTENCE (#1359) is OPT-IN, same as its single-field sibling. The wire\n * form keeps the tuple as an ARRAY of per-component keys — see\n * `index-snapshot.ts`: flattening it to a delimited string would destroy\n * exactly the per-component ordering and kind partition this class is built\n * to preserve.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { KIND_STRING, compareKeys, toSortKey, type RangeOperator, type SortKey } from './sorted-indexes.js'\nimport {\n  FIELD_INDEX_SNAPSHOT_VERSION,\n  type CompoundIndexSnapshot,\n  type FieldIndexSnapshot,\n  type WireCompoundEntry,\n  type WireKey,\n} from './index-snapshot.js'\n\n/** A range constraint on the component just past the equality prefix. */\nexport interface CompoundRangeProbe {\n  readonly op: RangeOperator\n  readonly value: unknown\n}\n\ninterface CompoundEntry {\n  readonly keys: readonly SortKey[]\n  readonly seq: number\n  readonly id: string\n}\n\n/** One collection's index over an ordered field tuple. */\nexport class CompoundIndex {\n  private readonly entries: CompoundEntry[] = []\n  private nextSeq = 0\n\n  constructor(readonly fields: readonly string[]) {}\n\n  get size(): number {\n    return this.entries.length\n  }\n\n  clear(): void {\n    this.entries.length = 0\n    this.nextSeq = 0\n  }\n\n  /**\n   * Insert one record. No-op unless every component has an ordered key.\n   *\n   * `seq` REINSTATES a rank a previous entry for this id held — see\n   * {@link remove}'s return value and `CollectionIndexes.upsert`. Omit it\n   * for a fresh insert, which appends after every existing tie.\n   */\n  add(id: string, keys: readonly SortKey[] | undefined, seq?: number): void {\n    if (!keys) return\n    const entry: CompoundEntry = { keys, seq: seq ?? this.nextSeq++, id }\n    this.entries.splice(this.insertionPoint(entry), 0, entry)\n  }\n\n  /**\n   * Remove one record, addressed by the tuple it was indexed under.\n   * Returns the rank it held, so an UPDATE can reinstate it: `sortRecords()`\n   * sorts a snapshot whose order does not change when a record is written in\n   * place, so a tie-breaking rank that drifted to the back on every `put`\n   * would make an index-served page disagree with the scan it must match.\n   */\n  remove(id: string, keys: readonly SortKey[] | undefined): number | undefined {\n    if (!keys) return undefined\n    const [from, to] = this.run(keys, keys.length)\n    for (let i = from; i < to; i++) {\n      if (this.entries[i]!.id === id) {\n        const [gone] = this.entries.splice(i, 1)\n        return gone!.seq\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Ids matching an equality prefix, optionally narrowed by a range on\n   * the next component. An empty set is authoritative: the index covers\n   * these fields and nothing matches.\n   */\n  lookup(prefix: readonly SortKey[], range?: CompoundRangeProbe): Set<string> {\n    const [from, to] = this.run(prefix, prefix.length)\n    if (!range) return this.slice(from, to)\n    const k = prefix.length\n    if (k >= this.fields.length) return new Set()\n\n    if (range.op === 'startsWith') {\n      if (typeof range.value !== 'string') return new Set()\n      const out = new Set<string>()\n      const start = this.lowerBound([...prefix, { kind: KIND_STRING, key: range.value }], k + 1, from, to)\n      for (let i = start; i < to; i++) {\n        const key = this.entries[i]!.keys[k]!\n        if (key.kind !== KIND_STRING) break\n        if (!(key.key as string).startsWith(range.value)) break\n        out.add(this.entries[i]!.id)\n      }\n      return out\n    }\n\n    if (range.op === 'between') {\n      if (!Array.isArray(range.value) || range.value.length !== 2) return new Set()\n      const lo = toSortKey(range.value[0], undefined)\n      const hi = toSortKey(range.value[1], undefined)\n      if (!lo || !hi || lo.kind !== hi.kind) return new Set()\n      return this.slice(\n        this.lowerBound([...prefix, lo], k + 1, from, to),\n        this.upperBound([...prefix, hi], k + 1, from, to),\n      )\n    }\n\n    const probe = toSortKey(range.value, undefined)\n    if (!probe) return new Set()\n    // Kind-partitioned per component: an open-ended bound stays inside the\n    // probe's own kind run, so `< '5'` never sweeps up numeric entries.\n    const [kindStart, kindEnd] = this.kindRun(from, to, k, probe.kind)\n    const lo = this.lowerBound([...prefix, probe], k + 1, from, to)\n    const hi = this.upperBound([...prefix, probe], k + 1, from, to)\n    switch (range.op) {\n      case '<':\n        return this.slice(kindStart, lo)\n      case '<=':\n        return this.slice(kindStart, hi)\n      case '>':\n        return this.slice(hi, kindEnd)\n      case '>=':\n        return this.slice(lo, kindEnd)\n      default: {\n        const _exhaustive: never = range.op\n        void _exhaustive\n        return new Set()\n      }\n    }\n  }\n\n  /**\n   * Ids matching an equality prefix, in the order of the remaining\n   * components. Ties keep INSERTION order in both directions — a plain\n   * `.reverse()` would disagree with `sortRecords()` on equal keys.\n   */\n  orderedIds(prefix: readonly SortKey[], direction: 'asc' | 'desc'): string[] {\n    const [from, to] = this.run(prefix, prefix.length)\n    const out: string[] = []\n    if (direction === 'asc') {\n      for (let i = from; i < to; i++) out.push(this.entries[i]!.id)\n      return out\n    }\n    let end = to\n    while (end > from) {\n      let start = end - 1\n      while (start > from && this.compare(this.entries[start - 1]!, this.entries[end - 1]!.keys, this.fields.length) === 0) {\n        start--\n      }\n      for (let i = start; i < end; i++) out.push(this.entries[i]!.id)\n      end = start\n    }\n    return out\n  }\n\n  private slice(from: number, to: number): Set<string> {\n    const out = new Set<string>()\n    for (let i = from; i < to; i++) out.add(this.entries[i]!.id)\n    return out\n  }\n\n  /** [start, end) of the entries whose first `upto` components equal `probe`. */\n  private run(probe: readonly SortKey[], upto: number): [number, number] {\n    return [\n      this.lowerBound(probe, upto, 0, this.entries.length),\n      this.upperBound(probe, upto, 0, this.entries.length),\n    ]\n  }\n\n  /** [start, end) of the entries in [from,to) whose component `k` has this kind. */\n  private kindRun(from: number, to: number, k: number, kind: number): [number, number] {\n    return [\n      this.kindBoundary(from, to, k, x => x < kind),\n      this.kindBoundary(from, to, k, x => x <= kind),\n    ]\n  }\n\n  private kindBoundary(from: number, to: number, k: number, before: (kind: number) => boolean): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (before(this.entries[mid]!.keys[k]!.kind)) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are >= `probe`. */\n  private lowerBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /** First index in [from,to) whose first `upto` components are > `probe`. */\n  private upperBound(probe: readonly SortKey[], upto: number, from: number, to: number): number {\n    let lo = from\n    let hi = to\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compare(this.entries[mid]!, probe, upto) <= 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  /**\n   * The persistable form of this index (#1359). Each entry's tuple stays an\n   * ARRAY of `[kind, key]` pairs: nothing is joined into a string, so a\n   * string component may hold any byte and the per-component kind partition\n   * survives the round trip intact.\n   */\n  toSnapshot(): CompoundIndexSnapshot {\n    return {\n      v: FIELD_INDEX_SNAPSHOT_VERSION,\n      t: 'compound',\n      fields: [...this.fields],\n      nextSeq: this.nextSeq,\n      entries: this.entries.map(\n        e => [e.keys.map(k => [k.kind, k.key] as WireKey), e.seq, e.id] as WireCompoundEntry,\n      ),\n    }\n  }\n\n  /**\n   * Adopt a validated snapshot, or refuse it. Same contract as\n   * `SortedIndex.loadSnapshot`: all-or-nothing, and an entry naming a record\n   * the cache does not hold rejects the whole blob so crash residue becomes a\n   * rebuild rather than a wrong answer. A snapshot whose field tuple is not\n   * exactly this index's is refused — the declaration changed under it.\n   */\n  loadSnapshot(snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    if (snap.t !== 'compound') return false\n    if (snap.fields.length !== this.fields.length) return false\n    for (let i = 0; i < snap.fields.length; i++) if (snap.fields[i] !== this.fields[i]) return false\n    const staged: CompoundEntry[] = []\n    for (const [keys, seq, id] of snap.entries) {\n      if (!isLive(id)) return false\n      staged.push({ keys: keys.map(k => ({ kind: k[0] as SortKey['kind'], key: k[1] })), seq, id })\n    }\n    this.entries.length = 0\n    for (const e of staged) this.entries.push(e)\n    this.nextSeq = snap.nextSeq\n    return true\n  }\n\n  /**\n   * Insertion point that keeps ties in `seq` order. A fresh entry lands at\n   * the end of its tie run; a REINSTATED one (see {@link add}) lands back at\n   * its own rank inside it.\n   */\n  private insertionPoint(entry: CompoundEntry): number {\n    const to = this.upperBound(entry.keys, this.fields.length, 0, this.entries.length)\n    let i = to\n    while (i > 0 && this.compare(this.entries[i - 1]!, entry.keys, this.fields.length) === 0\n      && this.entries[i - 1]!.seq > entry.seq) {\n      i--\n    }\n    return i\n  }\n\n  private compare(entry: CompoundEntry, probe: readonly SortKey[], upto: number): number {\n    for (let i = 0; i < upto; i++) {\n      const c = compareKeys(entry.keys[i]!, probe[i]!)\n      if (c !== 0) return c\n    }\n    return 0\n  }\n}\n\n/**\n * The tuple key for one record, or `undefined` when any component is\n * nullish or has no order-defined runtime type. Canonicalizes through the\n * same per-field closure the hash and sorted indexes use, so a Via-covered\n * component lives in one key space across all three.\n */\nexport function tupleKeyOf<T>(\n  fields: readonly string[],\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const field of fields) {\n    const value = readPath(record, field)\n    if (value === null || value === undefined) return undefined\n    const key = toSortKey(value, canonicalize?.(field, value))\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Probe keys for an equality prefix, or `undefined` if any operand is unorderable. */\nexport function probeKeysOf(values: readonly unknown[]): SortKey[] | undefined {\n  const keys: SortKey[] = []\n  for (const value of values) {\n    const key = toSortKey(value, undefined)\n    if (!key) return undefined\n    keys.push(key)\n  }\n  return keys\n}\n\n/** Build the whole index from a snapshot. Entry seqs follow snapshot order. */\nexport function buildCompoundIndex<T>(\n  idx: CompoundIndex,\n  records: ReadonlyArray<{ id: string; record: T }>,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  idx.clear()\n  for (const { id, record } of records) {\n    idx.add(id, tupleKeyOf(idx.fields, record, canonicalize))\n  }\n}\n\n/** Stable map key for a field tuple. `\\0` cannot appear in a field path. */\nexport function compoundKey(fields: readonly string[]): string {\n  return fields.join('\\u0000')\n}\n","/**\n * Secondary indexes for the query DSL.\n *\n * ships **in-memory hash indexes**:\n *   - Built during `Collection.ensureHydrated()` from the decrypted cache\n *   - Maintained incrementally on `put` and `delete`\n *   - Consulted by the query executor for `==` and `in` operators on\n *     indexed fields, falling back to a linear scan otherwise\n *   - Live entirely in memory — no adapter writes for the index itself\n *\n * Persistent encrypted index blobs (the spec's \"store as a separate\n * AES-256-GCM blob\" note) are deferred to a follow-up issue. The reasons\n * are documented in the PR body — short version: at the target\n * scale of 1K–50K records, building the index during hydrate is free,\n * so persistence buys nothing measurable.\n */\n\nimport { readPath } from '../../kernel/query/predicate.js'\nimport { stringifyBucketKey, isProbeableBucketKey } from '../../kernel/query/distinct-key.js'\nimport { SortedIndex, buildSortedIndex, type RangeOperator } from './sorted-indexes.js'\nimport {\n  CompoundIndex,\n  buildCompoundIndex,\n  compoundKey,\n  probeKeysOf,\n  tupleKeyOf,\n  type CompoundRangeProbe,\n} from './compound-indexes.js'\nimport {\n  compoundIndexKey,\n  sortedIndexKey,\n  type FieldIndexSnapshot,\n} from './index-snapshot.js'\n\n/**\n * Index declaration accepted by `Collection`'s constructor.\n *\n * Accepts:\n *   - `string` — a single-field hash index (`'clientId'`)\n *   - `{ fields: [...] }` or `readonly string[]` — a composite index\n *     over an ordered field tuple. Only lazy-mode\n *     collections consume composite declarations today; eager mode\n *     silently treats a composite as equivalent to declaring each\n *     component field as its own single-field index.\n *\n * Additive variants (unique constraints, partial indexes) will land as\n * further union members without breaking existing declarations.\n */\nexport type IndexDef =\n  | string\n  | {\n      readonly fields: readonly string[]\n      /**\n       * Enforce that no two records share this field tuple. A MULTI-field\n       * tuple is a COMPOUND unique — uniqueness over the tuple, never over\n       * each component on its own (`['workerId','employerId']` allows one\n       * worker at many employers). Null-distinct: a record with `null` or\n       * `undefined` in any constrained field is exempt.\n       *\n       * ⚠️ **What \"unique\" means depends on the collection's mode (#1358),\n       * and one of the four cannot promise prevention at all:**\n       *\n       * - eager (default) — prevented, from the in-memory map.\n       * - lazy (`prefetch: false`) — prevented, by a point lookup through the\n       *   persisted `_idx/` mirror. Requires `withIndexing()`.\n       * - tiered (`tiers: [...]`) — prevented across every tier whose DEK the\n       *   writer holds. **A tier the writer cannot read is outside the\n       *   guarantee** — those records are unreadable, so no local check can\n       *   see them, and a duplicate against one is accepted.\n       * - CRDT (`crdt: '...'`) — **NOT prevented.** Uniqueness cannot be\n       *   enforced across concurrent replicas: two replicas that are offline\n       *   from each other can both accept the same value, and no local check\n       *   can prevent that. The write always succeeds and both records are\n       *   kept; the collision is reported on the `unique:violation` event as\n       *   a `UniqueConstraintError`, both when it happens and when a later\n       *   session first sees the two records together. What you get is\n       *   uniqueness within what this writer could see at write time, plus\n       *   detection when the replicas meet.\n       */\n      readonly unique?: boolean\n      readonly kind?: IndexKind\n      /**\n       * Persist this index as an encrypted sidecar so a restart reuses it\n       * instead of rebuilding (#1359). Only meaningful with `kind: 'sorted'`\n       * — the hash index is not persisted. OPT-IN until measured: at the\n       * 1K–50K target scale rebuild-on-open is free, and a sidecar is a\n       * write on every debounce window plus a blob at rest.\n       */\n      readonly persist?: boolean\n    }\n  | readonly string[]\n\n/**\n * The access structure an index declaration asks for (#1344).\n *\n * `'hash'` (the default, and what every pre-#1344 declaration means) is\n * the equality/`in` bucket map. `'sorted'` additionally maintains an\n * ordered array over the same canonicalized keys, which lights up\n * index-driven `<`, `<=`, `>`, `>=`, `between`, `startsWith` and\n * `orderBy(field).limit(n)`. A `'sorted'` declaration keeps the hash\n * index too — `==`/`in` stay O(1).\n */\ntype IndexKind = 'hash' | 'sorted'\n\n/**\n * Normalize a declared `IndexDef[]` into a uniform `{ fields, unique? }`\n * shape: `string` → `{fields:[s]}`, `string[]` → `{fields}`, object →\n * passthrough. Pure — used by `Collection`'s sensitive-field leak check\n * and by `getDeclaredIndexes()` (introspection).\n */\nexport function normalizeIndexDefs(\n  defs: readonly IndexDef[],\n): ReadonlyArray<{ readonly fields: readonly string[]; readonly unique?: boolean }> {\n  return defs.map((def) => {\n    if (typeof def === 'string') return { fields: [def] }\n    if (Array.isArray(def)) return { fields: def }\n    return def as { readonly fields: readonly string[]; readonly unique?: boolean }\n  })\n}\n\n/**\n * Internal representation of a built hash index.\n *\n * Maps stringified field values to the set of record ids whose value\n * for that field matches. Stringification keeps the index simple and\n * works uniformly for primitives (`'open'`, `'42'`, `'true'`).\n *\n * Records whose indexed field is `undefined` or `null` are NOT inserted\n * — `query().where('field', '==', undefined)` falls back to a linear\n * scan, which is the conservative behavior.\n */\nexport interface HashIndex {\n  readonly field: string\n  readonly buckets: Map<string, Set<string>>\n}\n\n/**\n * Container for all indexes on a single collection.\n *\n * Methods are pure with respect to the in-memory `buckets` Map — they\n * never touch the adapter or the keyring. The Collection class owns\n * lifecycle (build on hydrate, maintain on put/delete).\n */\nexport class CollectionIndexes {\n  private readonly indexes = new Map<string, HashIndex>()\n\n  /**\n   * Sorted (range) indexes, keyed by field — the #1344 half. Parallel to\n   * `indexes` above and maintained at the SAME mutation sites, through the\n   * SAME `canonicalize` closure, so the two can never disagree about which\n   * key space a field lives in.\n   */\n  private readonly sorted = new Map<string, SortedIndex>()\n\n  /**\n   * Compound (tuple-keyed) sorted indexes, keyed by the joined field\n   * tuple — the #1345 half. Third parallel map, maintained at the SAME\n   * mutation sites through the SAME `canonicalize` closure as the other\n   * two, so no field can end up in disagreeing key spaces.\n   */\n  private readonly compound = new Map<string, CompoundIndex>()\n\n  /**\n   * The indexes declared `persist: true` (#1359), keyed by their SIDECAR key\n   * (`s:<field>` / `c:<f1>,<f2>`). A separate map rather than a flag on the\n   * index classes: persistence is a property of the DECLARATION, and the\n   * index classes stay unaware of storage.\n   */\n  private readonly persistable = new Map<string, SortedIndex | CompoundIndex>()\n\n  /**\n   * Per-field bucket-key canonicalizer (#672 review C1), registered ONCE\n   * via {@link setCanonicalizer} when the collection wires indexing up\n   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by\n   * EVERY bucket-mutation site — `build`/`upsert`/`remove` — so bucket\n   * membership is symmetric by construction: a value can never be added\n   * under a canonical key and later removed under the raw one (or vice\n   * versa), which is what stranded ids on `put`/`delete` before this fix.\n   */\n  private canonicalize?: (field: string, value: unknown) => string | undefined\n\n  /**\n   * Register the bucket-key canonicalizer. Called once, where the\n   * collection constructs its indexing state — safe to call again (the\n   * closure is simply replaced) but there is normally only one caller.\n   */\n  setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void {\n    this.canonicalize = fn\n  }\n\n  /**\n   * Declare an index. Subsequent record additions are tracked under it.\n   * Calling this twice for the same field is a no-op (idempotent).\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { field, buckets: new Map() })\n  }\n\n  /**\n   * Declare a sorted (range) index on a field. Independent of\n   * {@link declare} — callers that want both `==` speed and range speed\n   * declare both (which is what `withIndexing()` does for a\n   * `kind: 'sorted'` declaration). Idempotent.\n   */\n  declareSorted(field: string, opts?: { readonly persist?: boolean }): void {\n    let idx = this.sorted.get(field)\n    if (!idx) {\n      idx = new SortedIndex(field)\n      this.sorted.set(field, idx)\n    }\n    if (opts?.persist) this.persistable.set(sortedIndexKey(field), idx)\n  }\n\n  /** True if the given field has a declared SORTED index. */\n  hasSorted(field: string): boolean {\n    return this.sorted.has(field)\n  }\n\n  /** All sorted-index field names, in declaration order. */\n  sortedFields(): string[] {\n    return [...this.sorted.keys()]\n  }\n\n  /** Number of entries in a field's sorted index (0 when undeclared). */\n  sortedSize(field: string): number {\n    return this.sorted.get(field)?.size ?? 0\n  }\n\n  /**\n   * Range lookup: ids whose `field` satisfies the operator. Returns\n   * `null` when no SORTED index covers the field — the caller falls back\n   * to a linear scan. An empty set means \"the index covers this field and\n   * nothing matches\", which is authoritative.\n   */\n  lookupRange(field: string, op: RangeOperator, value: unknown): ReadonlySet<string> | null {\n    return this.sorted.get(field)?.lookup(op, value) ?? null\n  }\n\n  /**\n   * Ids of every indexed record in `field` order. `null` when no sorted\n   * index covers the field. Records whose value is nullish or has no\n   * order-defined type are absent — compare against {@link sortedSize}\n   * before treating the result as the full collection.\n   */\n  orderedIds(field: string, direction: 'asc' | 'desc'): readonly string[] | null {\n    return this.sorted.get(field)?.orderedIds(direction) ?? null\n  }\n\n  /**\n   * Declare a compound (multi-field) sorted index over an ordered field\n   * tuple. A tuple shorter than two fields is a single-field sorted index\n   * and is ignored here. Idempotent.\n   */\n  declareCompound(fields: readonly string[], opts?: { readonly persist?: boolean }): void {\n    if (fields.length < 2) return\n    const key = compoundKey(fields)\n    let idx = this.compound.get(key)\n    if (!idx) {\n      idx = new CompoundIndex([...fields])\n      this.compound.set(key, idx)\n    }\n    if (opts?.persist) this.persistable.set(compoundIndexKey(fields), idx)\n  }\n\n  /** Every declared field tuple, in declaration order. */\n  compoundTuples(): ReadonlyArray<readonly string[]> {\n    return [...this.compound.values()].map(idx => idx.fields)\n  }\n\n  /**\n   * Number of records the tuple's index holds (0 when undeclared). A\n   * record with a nullish or non-orderable component is absent, so a\n   * caller that removes clauses from the plan MUST compare this against\n   * the snapshot size before trusting the result.\n   */\n  compoundSize(fields: readonly string[]): number {\n    return this.compound.get(compoundKey(fields))?.size ?? 0\n  }\n\n  /**\n   * Compound lookup: ids whose leading components equal `prefixValues`,\n   * optionally narrowed by a range on the component just past them.\n   * `null` when no compound index covers the tuple, or when an operand\n   * has no order-defined type — the caller falls back to a linear scan.\n   */\n  lookupCompound(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    range?: CompoundRangeProbe,\n  ): ReadonlySet<string> | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.lookup(prefix, range)\n  }\n\n  /**\n   * Ids matching an equality prefix, ordered by the remaining components.\n   * `null` when no compound index covers the tuple or an operand has no\n   * order-defined type. See {@link compoundSize} for the coverage caveat.\n   */\n  compoundOrderedIds(\n    fields: readonly string[],\n    prefixValues: readonly unknown[],\n    direction: 'asc' | 'desc',\n  ): readonly string[] | null {\n    const idx = this.compound.get(compoundKey(fields))\n    if (!idx) return null\n    const prefix = probeKeysOf(prefixValues)\n    if (!prefix) return null\n    return idx.orderedIds(prefix, direction)\n  }\n\n  /** True if the given field has a declared index. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Build all declared indexes from a snapshot of records.\n   * Called once per hydration. O(N × indexes.size). Buckets through the\n   * registered {@link setCanonicalizer} closure, same as `upsert`/`remove`.\n   */\n  build<T>(records: ReadonlyArray<{ id: string; record: T }>, skip: ReadonlySet<string> = EMPTY_KEYS): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n      for (const { id, record } of records) {\n        addToIndex(idx, id, record, this.canonicalize)\n      }\n    }\n    // `skip` names the sidecar keys a persisted snapshot already restored\n    // (#1359) — rebuilding them would throw that work away AND renumber every\n    // `seq`, which is what the whole ordered fast path rests on.\n    for (const [field, idx] of this.sorted) {\n      if (skip.has(sortedIndexKey(field))) continue\n      buildSortedIndex(idx, records, this.canonicalize)\n    }\n    for (const idx of this.compound.values()) {\n      if (skip.has(compoundIndexKey(idx.fields))) continue\n      buildCompoundIndex(idx, records, this.canonicalize)\n    }\n  }\n\n  /** Sidecar keys of every index declared `persist: true`, in declaration order. */\n  persistableKeys(): readonly string[] {\n    return [...this.persistable.keys()]\n  }\n\n  /** The persistable snapshot behind one sidecar key, or `undefined` if it is not declared. */\n  snapshotIndex(key: string): FieldIndexSnapshot | undefined {\n    return this.persistable.get(key)?.toSnapshot()\n  }\n\n  /**\n   * Adopt a validated snapshot into the index behind `key`. `false` means the\n   * caller must rebuild that index from the cache — the index is left\n   * untouched, never half-loaded.\n   */\n  restoreIndex(key: string, snap: FieldIndexSnapshot, isLive: (id: string) => boolean): boolean {\n    return this.persistable.get(key)?.loadSnapshot(snap, isLive) ?? false\n  }\n\n  /**\n   * Insert or update a single record across all indexes.\n   * Called by `Collection.put()` after the encrypted write succeeds.\n   *\n   * If `previousRecord` is provided, the record is removed from any old\n   * buckets first — this is the update path. Pass `null` for fresh adds.\n   */\n  upsert<T>(id: string, newRecord: T, previousRecord: T | null): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    // Detach the compound and sorted entries FIRST, holding the rank each one had. An\n    // in-place `put` does not move a record within `snapshot()`, so it must\n    // not move it within a tie run either — otherwise an index-served\n    // `orderBy(...).limit(n)` page disagrees with the stable scan-and-sort\n    // it is required to reproduce exactly (#1345, #1369). The `this.remove()`\n    // below re-runs both removals, which are then no-ops.\n    const ranks = new Map<string, number | undefined>()\n    const sortedRanks = new Map<string, number | undefined>()\n    if (previousRecord !== null) {\n      for (const [key, idx] of this.compound) {\n        ranks.set(key, idx.remove(id, tupleKeyOf(idx.fields, previousRecord, this.canonicalize)))\n      }\n      // Same for the single-field sorted indexes (#1369) — the defect and the\n      // remedy are identical, and the two implementations must agree.\n      for (const [key, idx] of this.sorted) {\n        const value = readPath(previousRecord, idx.field)\n        if (value === null || value === undefined) continue\n        sortedRanks.set(key, idx.remove(id, value, this.canonicalize?.(idx.field, value)))\n      }\n      this.remove(id, previousRecord)\n    }\n    for (const idx of this.indexes.values()) {\n      addToIndex(idx, id, newRecord, this.canonicalize)\n    }\n    for (const [key, idx] of this.sorted) {\n      const value = readPath(newRecord, idx.field)\n      if (value === null || value === undefined) continue\n      idx.add(id, value, this.canonicalize?.(idx.field, value), sortedRanks.get(key))\n    }\n    for (const [key, idx] of this.compound) {\n      idx.add(id, tupleKeyOf(idx.fields, newRecord, this.canonicalize), ranks.get(key))\n    }\n  }\n\n  /**\n   * Remove a record from all indexes. Called by `Collection.delete()`\n   * (and as the first half of `upsert` for the update path).\n   */\n  remove<T>(id: string, record: T): void {\n    if (this.indexes.size === 0 && this.sorted.size === 0 && this.compound.size === 0) return\n    for (const idx of this.indexes.values()) {\n      removeFromIndex(idx, id, record, this.canonicalize)\n    }\n    for (const idx of this.sorted.values()) {\n      const value = readPath(record, idx.field)\n      if (value === null || value === undefined) continue\n      idx.remove(id, value, this.canonicalize?.(idx.field, value))\n    }\n    for (const idx of this.compound.values()) {\n      idx.remove(id, tupleKeyOf(idx.fields, record, this.canonicalize))\n    }\n  }\n\n  /** Drop all index data. Called when the collection is invalidated. */\n  clear(): void {\n    for (const idx of this.indexes.values()) {\n      idx.buckets.clear()\n    }\n    for (const idx of this.sorted.values()) {\n      idx.clear()\n    }\n    for (const idx of this.compound.values()) {\n      idx.clear()\n    }\n  }\n\n  /**\n   * Equality lookup: return the set of record ids whose `field` matches\n   * the given value. Returns `null` if no index covers the field — the\n   * caller should fall back to a linear scan.\n   *\n   * ⛔ ALSO `null` when the OPERAND has no bucket ADDRESS (#1402) — a\n   * nullish operand, or an object one, which every object-valued record in\n   * the collection shares. Answering those from the buckets returns rows\n   * the scan does not, silently, and only on the collections that happen to\n   * have an index. See `isProbeableBucketKey` for the two measurements.\n   *\n   * The returned Set is a reference to the index's internal storage —\n   * callers must NOT mutate it.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!isProbeableBucketKey(value)) return null\n    const key = stringifyKey(value)\n    return idx.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup: return the union of record ids whose `field` matches any\n   * of the given values. Returns `null` if no index covers the field.\n   *\n   * ⛔ ALSO `null` when ANY member of `values` has no bucket address\n   * (#1402) — one unaddressable member poisons the whole union, since the\n   * result is a union and there is no partial answer to hand back. Same\n   * measurement as {@link lookupEqual}.\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    if (!values.every(isProbeableBucketKey)) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const key = stringifyKey(value)\n      const bucket = idx.buckets.get(key)\n      if (bucket) {\n        for (const id of bucket) out.add(id)\n      }\n    }\n    return out\n  }\n\n  /**\n   * One record id per NON-EMPTY bucket of `field`'s hash index, in bucket\n   * order — the index-backed spine of `Query.distinct()` (#1347). `null` when\n   * no hash index covers the field, so the caller scans instead.\n   *\n   * The bucket set IS the distinct key set, so this costs O(buckets) rather\n   * than O(records). It returns REPRESENTATIVE IDS rather than the keys\n   * themselves on purpose: a bucket key is a canonical string (money's\n   * BigInt-normalized scaled int, say), and `distinct()` owes its caller the\n   * field's real value, which only the record carries.\n   *\n   * Bucket insertion order is first-seen record order — `build()` walks the\n   * snapshot in order and `upsert()` appends — which is why an index-backed\n   * `distinct()` and a scanned one agree on ORDER too, not merely on the set.\n   * Empty buckets are skipped defensively; `removeFromIndex` already deletes\n   * them, so this is belt-and-braces against a future partial removal path.\n   */\n  bucketRepresentatives(field: string): readonly string[] | null {\n    const idx = this.indexes.get(field)\n    if (!idx) return null\n    const out: string[] = []\n    for (const bucket of idx.buckets.values()) {\n      for (const id of bucket) {\n        out.push(id)\n        break\n      }\n    }\n    return out\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\nconst EMPTY_KEYS: ReadonlySet<string> = new Set()\n\n/**\n * Stringify a value into a stable bucket key.\n *\n * ⚠️ The DEFINITION moved to `kernel/query/distinct-key.ts` (#1347) and is\n * only aliased here. `distinct()` / `countDistinct()` recompute this key on\n * the scan path, and an index-backed `distinct()` reads the buckets it made —\n * one definition is what stops those two answers from drifting apart. Change\n * the shared function, not a copy.\n */\nconst stringifyKey = stringifyBucketKey\n\nfunction addToIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  let bucket = idx.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    idx.buckets.set(key, bucket)\n  }\n  bucket.add(id)\n}\n\nfunction removeFromIndex<T>(\n  idx: HashIndex,\n  id: string,\n  record: T,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  const value = readPath(record, idx.field)\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(idx.field, value) ?? stringifyKey(value)\n  const bucket = idx.buckets.get(key)\n  if (!bucket) return\n  bucket.delete(id)\n  // Clean up empty buckets so the Map doesn't accumulate dead keys.\n  if (bucket.size === 0) idx.buckets.delete(key)\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBO,IAAM,+BAA+B;AAkCrC,SAAS,eAAe,OAAuB;AACpD,SAAO,KAAK,mBAAmB,KAAK,CAAC;AACvC;AAGO,SAAS,iBAAiB,QAAmC;AAClE,SAAO,KAAK,OAAO,IAAI,kBAAkB,EAAE,KAAK,GAAG,CAAC;AACtD;AAGA,SAAS,UAAU,GAA0B;AAC3C,MAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,QAAM,CAAC,MAAM,GAAG,IAAI;AAEpB,MAAI,SAAS,KAAK,SAAS,EAAG,QAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG;AACnF,MAAI,SAAS,EAAG,QAAO,OAAO,QAAQ;AACtC,SAAO;AACT;AAEA,SAAS,MAAM,GAAyB;AACtC,SAAO,OAAO,MAAM,YAAY,OAAO,UAAU,CAAC,KAAK,KAAK;AAC9D;AAUO,SAAS,wBAAwB,MAAyC;AAC/E,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,IAAI;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,MAAI,EAAE,GAAG,MAAM,6BAA8B,QAAO;AACpD,MAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,QAAQ,EAAE,SAAS,CAAC,EAAG,QAAO;AACjE,QAAM,UAAU,EAAE,SAAS;AAC3B,QAAM,UAAU,EAAE,SAAS;AAE3B,MAAI,EAAE,GAAG,MAAM,UAAU;AACvB,QAAI,OAAO,EAAE,OAAO,MAAM,SAAU,QAAO;AAC3C,UAAM,MAAyB,CAAC;AAChC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,KAAK,EAAE,IAAI;AAC7B,UAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAG,QAAO;AACpC,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAAgB,KAAwB,KAAK,EAAE,CAAC;AAAA,IAC5D;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAY,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACtF,WAAO,EAAE,GAAG,8BAA8B,GAAG,UAAU,OAAO,EAAE,OAAO,GAAG,SAAS,SAAS,IAAI;AAAA,EAClG;AAEA,MAAI,EAAE,GAAG,MAAM,YAAY;AACzB,UAAM,SAAS,EAAE,QAAQ;AACzB,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,CAAC,OAAO,MAAM,OAAK,OAAO,MAAM,QAAQ,EAAG,QAAO;AACvG,UAAM,MAA2B,CAAC;AAClC,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAG,QAAO;AAChD,YAAM,CAAC,MAAM,KAAK,EAAE,IAAI;AACxB,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,OAAO,UAAU,CAAC,KAAK,MAAM,SAAS,EAAG,QAAO;AAC5F,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,WAAW,OAAO,OAAO,SAAU,QAAO;AACpE,UAAI,KAAK,CAAC,MAA4B,KAAK,EAAE,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,YAAY,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,OAAK,EAAE,CAAC,CAAC,CAAC,EAAG,QAAO;AACjE,WAAO,EAAE,GAAG,8BAA8B,GAAG,YAAY,QAAQ,SAAS,SAAS,IAAI;AAAA,EACzF;AAEA,SAAO;AACT;AAQA,SAAS,YAAY,MAAyC,MAAkC;AAC9F,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,kBAAkB,KAAK,IAAI,CAAC,GAAI,KAAK,CAAC,CAAE;AAClD,QAAI,IAAI,EAAG,QAAO;AAClB,QAAI,MAAM,KAAK,KAAK,IAAI,CAAC,KAAM,KAAK,CAAC,EAAI,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAuB,GAA+B;AAC/E,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,IAAI,EAAE,CAAC;AACb,UAAM,IAAI,EAAE,CAAC;AACb,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACpC,QAAI,OAAO,EAAE,CAAC,MAAM,YAAY,OAAO,EAAE,CAAC,MAAM,UAAU;AACxD,UAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,IACtC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACxB,aAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;;;AClGO,IAAM,cAAN,MAAkB;AAAA,EAIvB,YAAqB,OAAe;AAAf;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAHJ,UAAmB,CAAC;AAAA,EAC7B,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,OAAgB,cAAkC,KAAoB;AACpF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI;AACT,UAAM,QAAe,EAAE,GAAG,IAAI,KAAK,OAAO,KAAK,WAAW,GAAG;AAC7D,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAO,IAAY,OAAgB,cAAsD;AACvF,UAAM,KAAK,UAAU,OAAO,YAAY;AACxC,QAAI,CAAC,GAAI,QAAO;AAEhB,aAAS,IAAI,KAAK,WAAW,EAAE,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC9D,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,YAAY,GAAG,EAAE,MAAM,EAAG;AAC9B,UAAI,EAAE,OAAO,IAAI;AACf,aAAK,QAAQ,OAAO,GAAG,CAAC;AACxB,eAAO,EAAE;AAAA,MACX;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,WAAqC;AAC9C,QAAI,cAAc,MAAO,QAAO,KAAK,QAAQ,IAAI,OAAK,EAAE,EAAE;AAC1D,UAAM,MAAgB,CAAC;AACvB,QAAI,MAAM,KAAK,QAAQ;AACvB,WAAO,MAAM,GAAG;AACd,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,KAAK,YAAY,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,CAAE,MAAM,EAAG;AACzF,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,IAAmB,OAA6B;AACrD,QAAI,OAAO,aAAc,QAAO,KAAK,OAAO,KAAK;AACjD,QAAI,OAAO,WAAW;AACpB,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAChE,YAAMA,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,YAAMC,MAAK,UAAU,MAAM,CAAC,GAAG,MAAS;AACxC,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK,MAAM,KAAK,WAAWD,GAAE,GAAG,KAAK,WAAWC,GAAE,CAAC;AAAA,IAC5D;AACA,UAAM,QAAQ,UAAU,OAAO,MAAS;AACxC,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,UAAM,KAAK,KAAK,WAAW,KAAK;AAChC,UAAM,KAAK,KAAK,WAAW,KAAK;AAEhC,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,WAAW,MAAM,IAAI;AACvD,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB;AAC3B,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,OAAO,OAA6B;AAC1C,QAAI,OAAO,UAAU,SAAU,QAAO,oBAAI,IAAI;AAC9C,UAAM,MAAM,oBAAI,IAAY;AAC5B,UAAM,OAAO,KAAK,WAAW,EAAE,MAAM,aAAa,KAAK,MAAM,CAAC;AAC9D,aAAS,IAAI,MAAM,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC/C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,EAAE,SAAS,YAAa;AAC5B,UAAI,CAAE,EAAE,IAAe,WAAW,KAAK,EAAG;AAC1C,UAAI,IAAI,EAAE,EAAE;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,MAAiC;AAClD,WAAO,CAAC,KAAK,aAAa,OAAK,IAAI,IAAI,GAAG,KAAK,aAAa,OAAK,KAAK,IAAI,CAAC;AAAA,EAC7E;AAAA,EAEQ,aAAa,QAAyC;AAC5D,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UAC3C,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,IAAI,EAAG,MAAK,MAAM;AAAA,UACtD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAAwB;AACzC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,YAAY,KAAK,QAAQ,GAAG,GAAI,KAAK,KAAK,EAAG,MAAK,MAAM;AAAA,UACvD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAkC;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAoB;AAAA,IAChF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,YAAY,KAAK,UAAU,KAAK,MAAO,QAAO;AAC7D,UAAM,SAAkB,CAAC;AACzB,eAAW,CAAC,MAAM,KAAK,KAAK,EAAE,KAAK,KAAK,SAAS;AAC/C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAuB,KAAK,KAAK,GAAG,CAAC;AAAA,IACrD;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAAsB;AAC3C,QAAI,IAAI,KAAK,WAAW,KAAK;AAC7B,WAAO,IAAI,KAAK,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACtG;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,iBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,UAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,IAAI,IAAI,OAAO,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,EACrD;AACF;;;AC1OO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,YAAqB,QAA2B;AAA3B;AAAA,EAA4B;AAAA,EAA5B;AAAA,EAHJ,UAA2B,CAAC;AAAA,EACrC,UAAU;AAAA,EAIlB,IAAI,OAAe;AACjB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,SAAS;AACtB,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,IAAY,MAAsC,KAAoB;AACxE,QAAI,CAAC,KAAM;AACX,UAAM,QAAuB,EAAE,MAAM,KAAK,OAAO,KAAK,WAAW,GAAG;AACpE,SAAK,QAAQ,OAAO,KAAK,eAAe,KAAK,GAAG,GAAG,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,IAAY,MAA0D;AAC3E,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM;AAC7C,aAAS,IAAI,MAAM,IAAI,IAAI,KAAK;AAC9B,UAAI,KAAK,QAAQ,CAAC,EAAG,OAAO,IAAI;AAC9B,cAAM,CAAC,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AACvC,eAAO,KAAM;AAAA,MACf;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,QAA4B,OAAyC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,QAAI,CAAC,MAAO,QAAO,KAAK,MAAM,MAAM,EAAE;AACtC,UAAM,IAAI,OAAO;AACjB,QAAI,KAAK,KAAK,OAAO,OAAQ,QAAO,oBAAI,IAAI;AAE5C,QAAI,MAAM,OAAO,cAAc;AAC7B,UAAI,OAAO,MAAM,UAAU,SAAU,QAAO,oBAAI,IAAI;AACpD,YAAM,MAAM,oBAAI,IAAY;AAC5B,YAAM,QAAQ,KAAK,WAAW,CAAC,GAAG,QAAQ,EAAE,MAAM,aAAa,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE;AACnG,eAAS,IAAI,OAAO,IAAI,IAAI,KAAK;AAC/B,cAAM,MAAM,KAAK,QAAQ,CAAC,EAAG,KAAK,CAAC;AACnC,YAAI,IAAI,SAAS,YAAa;AAC9B,YAAI,CAAE,IAAI,IAAe,WAAW,MAAM,KAAK,EAAG;AAClD,YAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAAA,MAC7B;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,OAAO,WAAW;AAC1B,UAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5E,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,YAAMC,MAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAS;AAC9C,UAAI,CAACD,OAAM,CAACC,OAAMD,IAAG,SAASC,IAAG,KAAM,QAAO,oBAAI,IAAI;AACtD,aAAO,KAAK;AAAA,QACV,KAAK,WAAW,CAAC,GAAG,QAAQD,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,QAChD,KAAK,WAAW,CAAC,GAAG,QAAQC,GAAE,GAAG,IAAI,GAAG,MAAM,EAAE;AAAA,MAClD;AAAA,IACF;AAEA,UAAM,QAAQ,UAAU,MAAM,OAAO,MAAS;AAC9C,QAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAG3B,UAAM,CAAC,WAAW,OAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI;AACjE,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,UAAM,KAAK,KAAK,WAAW,CAAC,GAAG,QAAQ,KAAK,GAAG,IAAI,GAAG,MAAM,EAAE;AAC9D,YAAQ,MAAM,IAAI;AAAA,MAChB,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,WAAW,EAAE;AAAA,MACjC,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,KAAK;AACH,eAAO,KAAK,MAAM,IAAI,OAAO;AAAA,MAC/B,SAAS;AACP,cAAM,cAAqB,MAAM;AACjC,aAAK;AACL,eAAO,oBAAI,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAA4B,WAAqC;AAC1E,UAAM,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,QAAQ,OAAO,MAAM;AACjD,UAAM,MAAgB,CAAC;AACvB,QAAI,cAAc,OAAO;AACvB,eAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC5D,aAAO;AAAA,IACT;AACA,QAAI,MAAM;AACV,WAAO,MAAM,MAAM;AACjB,UAAI,QAAQ,MAAM;AAClB,aAAO,QAAQ,QAAQ,KAAK,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAI,KAAK,QAAQ,MAAM,CAAC,EAAG,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG;AACpH;AAAA,MACF;AACA,eAAS,IAAI,OAAO,IAAI,KAAK,IAAK,KAAI,KAAK,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC9D,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,MAAc,IAAyB;AACnD,UAAM,MAAM,oBAAI,IAAY;AAC5B,aAAS,IAAI,MAAM,IAAI,IAAI,IAAK,KAAI,IAAI,KAAK,QAAQ,CAAC,EAAG,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,IAAI,OAA2B,MAAgC;AACrE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,MACnD,KAAK,WAAW,OAAO,MAAM,GAAG,KAAK,QAAQ,MAAM;AAAA,IACrD;AAAA,EACF;AAAA;AAAA,EAGQ,QAAQ,MAAc,IAAY,GAAW,MAAgC;AACnF,WAAO;AAAA,MACL,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,IAAI,IAAI;AAAA,MAC5C,KAAK,aAAa,MAAM,IAAI,GAAG,OAAK,KAAK,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,aAAa,MAAc,IAAY,GAAW,QAA2C;AACnG,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,OAAO,KAAK,QAAQ,GAAG,EAAG,KAAK,CAAC,EAAG,IAAI,EAAG,MAAK,MAAM;AAAA,UACpD,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,IAAI,EAAG,MAAK,MAAM;AAAA,UAC7D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,WAAW,OAA2B,MAAc,MAAc,IAAoB;AAC5F,QAAI,KAAK;AACT,QAAI,KAAK;AACT,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAI,OAAO,IAAI,KAAK,EAAG,MAAK,MAAM;AAAA,UAC9D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAoC;AAClC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,MACH,QAAQ,CAAC,GAAG,KAAK,MAAM;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,SAAS,KAAK,QAAQ;AAAA,QACpB,OAAK,CAAC,EAAE,KAAK,IAAI,OAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAY,GAAG,EAAE,KAAK,EAAE,EAAE;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,MAA0B,QAA0C;AAC/E,QAAI,KAAK,MAAM,WAAY,QAAO;AAClC,QAAI,KAAK,OAAO,WAAW,KAAK,OAAO,OAAQ,QAAO;AACtD,aAAS,IAAI,GAAG,IAAI,KAAK,OAAO,QAAQ,IAAK,KAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAG,QAAO;AAC3F,UAAM,SAA0B,CAAC;AACjC,eAAW,CAAC,MAAM,KAAK,EAAE,KAAK,KAAK,SAAS;AAC1C,UAAI,CAAC,OAAO,EAAE,EAAG,QAAO;AACxB,aAAO,KAAK,EAAE,MAAM,KAAK,IAAI,QAAM,EAAE,MAAM,EAAE,CAAC,GAAsB,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,CAAC;AAAA,IAC9F;AACA,SAAK,QAAQ,SAAS;AACtB,eAAW,KAAK,OAAQ,MAAK,QAAQ,KAAK,CAAC;AAC3C,SAAK,UAAU,KAAK;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,OAA8B;AACnD,UAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,KAAK,QAAQ,MAAM;AACjF,QAAI,IAAI;AACR,WAAO,IAAI,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAI,MAAM,MAAM,KAAK,OAAO,MAAM,MAAM,KAClF,KAAK,QAAQ,IAAI,CAAC,EAAG,MAAM,MAAM,KAAK;AACzC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,OAAsB,OAA2B,MAAsB;AACrF,aAAS,IAAI,GAAG,IAAI,MAAM,KAAK;AAC7B,YAAM,IAAI,YAAY,MAAM,KAAK,CAAC,GAAI,MAAM,CAAC,CAAE;AAC/C,UAAI,MAAM,EAAG,QAAO;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AACF;AAQO,SAAS,WACd,QACA,QACA,cACuB;AACvB,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,SAAS,QAAQ,KAAK;AACpC,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,UAAM,MAAM,UAAU,OAAO,eAAe,OAAO,KAAK,CAAC;AACzD,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,YAAY,QAAmD;AAC7E,QAAM,OAAkB,CAAC;AACzB,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,UAAU,OAAO,MAAS;AACtC,QAAI,CAAC,IAAK,QAAO;AACjB,SAAK,KAAK,GAAG;AAAA,EACf;AACA,SAAO;AACT;AAGO,SAAS,mBACd,KACA,SACA,cACM;AACN,MAAI,MAAM;AACV,aAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,QAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,QAAQ,YAAY,CAAC;AAAA,EAC1D;AACF;AAGO,SAAS,YAAY,QAAmC;AAC7D,SAAO,OAAO,KAAK,IAAQ;AAC7B;;;AC1PO,SAAS,mBACd,MACkF;AAClF,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,QAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,QAAQ,CAAC,GAAG,EAAE;AACpD,QAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,EAAE,QAAQ,IAAI;AAC7C,WAAO;AAAA,EACT,CAAC;AACH;AAyBO,IAAM,oBAAN,MAAwB;AAAA,EACZ,UAAU,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrC,SAAS,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQtC,WAAW,oBAAI,IAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1C,cAAc,oBAAI,IAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,iBAAiB,IAAiE;AAChF,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,OAAO,SAAS,oBAAI,IAAI,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,OAAe,MAA6C;AACxE,QAAI,MAAM,KAAK,OAAO,IAAI,KAAK;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,YAAY,KAAK;AAC3B,WAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,eAAe,KAAK,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA,EAGA,UAAU,OAAwB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,eAAyB;AACvB,WAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AAAA;AAAA,EAGA,WAAW,OAAuB;AAChC,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,QAAQ;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,OAAe,IAAmB,OAA4C;AACxF,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,KAAK;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,OAAe,WAAqD;AAC7E,WAAO,KAAK,OAAO,IAAI,KAAK,GAAG,WAAW,SAAS,KAAK;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,QAA2B,MAA6C;AACtF,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,MAAM,YAAY,MAAM;AAC9B,QAAI,MAAM,KAAK,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,cAAc,CAAC,GAAG,MAAM,CAAC;AACnC,WAAK,SAAS,IAAI,KAAK,GAAG;AAAA,IAC5B;AACA,QAAI,MAAM,QAAS,MAAK,YAAY,IAAI,iBAAiB,MAAM,GAAG,GAAG;AAAA,EACvE;AAAA;AAAA,EAGA,iBAAmD;AACjD,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,SAAO,IAAI,MAAM;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAa,QAAmC;AAC9C,WAAO,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC,GAAG,QAAQ;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACE,QACA,cACA,OAC4B;AAC5B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,OAAO,QAAQ,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBACE,QACA,cACA,WAC0B;AAC1B,UAAM,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAS,YAAY,YAAY;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,IAAI,WAAW,QAAQ,SAAS;AAAA,EACzC;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAS,SAAmD,OAA4B,YAAkB;AACxG,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAClB,iBAAW,EAAE,IAAI,OAAO,KAAK,SAAS;AACpC,mBAAW,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,MAC/C;AAAA,IACF;AAIA,eAAW,CAAC,OAAO,GAAG,KAAK,KAAK,QAAQ;AACtC,UAAI,KAAK,IAAI,eAAe,KAAK,CAAC,EAAG;AACrC,uBAAiB,KAAK,SAAS,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,KAAK,IAAI,iBAAiB,IAAI,MAAM,CAAC,EAAG;AAC5C,yBAAmB,KAAK,SAAS,KAAK,YAAY;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,kBAAqC;AACnC,WAAO,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC;AAAA,EACpC;AAAA;AAAA,EAGA,cAAc,KAA6C;AACzD,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,KAAa,MAA0B,QAA0C;AAC5F,WAAO,KAAK,YAAY,IAAI,GAAG,GAAG,aAAa,MAAM,MAAM,KAAK;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAU,IAAY,WAAc,gBAAgC;AAClE,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AAOnF,UAAM,QAAQ,oBAAI,IAAgC;AAClD,UAAM,cAAc,oBAAI,IAAgC;AACxD,QAAI,mBAAmB,MAAM;AAC3B,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,cAAM,IAAI,KAAK,IAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,gBAAgB,KAAK,YAAY,CAAC,CAAC;AAAA,MAC1F;AAGA,iBAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,cAAM,QAAQ,SAAS,gBAAgB,IAAI,KAAK;AAChD,YAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,oBAAY,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC,CAAC;AAAA,MACnF;AACA,WAAK,OAAO,IAAI,cAAc;AAAA,IAChC;AACA,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,iBAAW,KAAK,IAAI,WAAW,KAAK,YAAY;AAAA,IAClD;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,QAAQ;AACpC,YAAM,QAAQ,SAAS,WAAW,IAAI,KAAK;AAC3C,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,IAAI,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,GAAG,YAAY,IAAI,GAAG,CAAC;AAAA,IAChF;AACA,eAAW,CAAC,KAAK,GAAG,KAAK,KAAK,UAAU;AACtC,UAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,WAAW,KAAK,YAAY,GAAG,MAAM,IAAI,GAAG,CAAC;AAAA,IAClF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAU,IAAY,QAAiB;AACrC,QAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,SAAS,EAAG;AACnF,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,sBAAgB,KAAK,IAAI,QAAQ,KAAK,YAAY;AAAA,IACpD;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,YAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAI,OAAO,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,CAAC;AAAA,IAC7D;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,OAAO,IAAI,WAAW,IAAI,QAAQ,QAAQ,KAAK,YAAY,CAAC;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAGA,QAAc;AACZ,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI,QAAQ,MAAM;AAAA,IACpB;AACA,eAAW,OAAO,KAAK,OAAO,OAAO,GAAG;AACtC,UAAI,MAAM;AAAA,IACZ;AACA,eAAW,OAAO,KAAK,SAAS,OAAO,GAAG;AACxC,UAAI,MAAM;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY,OAAe,OAA4C;AACrE,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO;AACzC,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,OAAe,QAAwD;AAC9E,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,OAAO,MAAM,oBAAoB,EAAG,QAAO;AAChD,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,UAAI,QAAQ;AACV,mBAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,sBAAsB,OAAyC;AAC7D,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK;AAClC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAgB,CAAC;AACvB,eAAW,UAAU,IAAI,QAAQ,OAAO,GAAG;AACzC,iBAAW,MAAM,QAAQ;AACvB,YAAI,KAAK,EAAE;AACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAC/C,IAAM,aAAkC,oBAAI,IAAI;AAWhD,IAAM,eAAe;AAErB,SAAS,WACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,MAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,QAAI,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO,IAAI,EAAE;AACf;AAEA,SAAS,gBACP,KACA,IACA,QACA,cACM;AACN,QAAM,QAAQ,SAAS,QAAQ,IAAI,KAAK;AACxC,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,IAAI,OAAO,KAAK,KAAK,aAAa,KAAK;AAClE,QAAM,SAAS,IAAI,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO,OAAO,EAAE;AAEhB,MAAI,OAAO,SAAS,EAAG,KAAI,QAAQ,OAAO,GAAG;AAC/C;","names":["lo","hi","lo","hi"]}

package/dist/{chunk-4JPMZTJY.js → chunk-3Y5JLSXS.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -62,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-4JPMZTJY.js.map
+//# sourceMappingURL=chunk-3Y5JLSXS.js.map

package/dist/{chunk-XSPFDUDG.js → chunk-45VHWE4C.js}

@@ -5,10 +5,13 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-LIOVX5TJ.js";
+} from "./chunk-FZXRLNJO.js";
+import {
+  keyringClearance
+} from "./chunk-UHFGK6YA.js";
 import {
   parseDekKey
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-RIZTZJX6.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -31,10 +34,10 @@ import {
   rekeyEnvelopeIfNeeded,
   unwrapKey,
   wrapKey
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-SV2PM2OY.js";
+} from "./chunk-2ELOCEXE.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -52,7 +55,7 @@ import {
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-party/team/roster-epoch.ts
 function assertRosterEpochCurrent(found, expected, userId) {
@@ -121,7 +124,24 @@ function rosterCanonical(file) {
     // the tag stops verifying, so a store cannot downgrade a file to the
     // no-epoch shape. It can only replay a file that genuinely never had one,
     // which is why absence must read as UNKNOWN rather than as zero.
-    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {}
+    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {},
+    // core#58 — the advisory clearance, bound ONLY WHEN PRESENT.
+    //
+    // ⛔ The conditional spread is mandatory here for the identical reason
+    // given for `roster_epoch` directly above: `file.clearance ?? null` would
+    // change the canonical string for every keyring written before this field
+    // existed, fail every one of their tags, and render every existing vault
+    // unopenable. Do not "tidy" it into the `?? null` shape the older optional
+    // fields use.
+    //
+    // ⚠️ Why bind it at all, when it is DERIVED from `dek_slots` which is
+    // already bound? Because "derived" is a property of how WE write it, not of
+    // what a store must send back. Binding it costs one conditional and makes a
+    // forged value fail the tag instead of merely disagreeing with the slots —
+    // which is the difference between a caught tamper and a silent one, for a
+    // reader who trusted the cheap number. It is defence in depth for a field
+    // whose whole risk is being read instead of the DEK map.
+    ...file.clearance !== void 0 ? { clearance: file.clearance } : {}
   });
 }
 async function mintRosterTag(file, rosterKey) {
@@ -161,6 +181,13 @@ function mismatchReason(file) {
   if (file._noydb_keyring !== NOYDB_KEYRING_VERSION) return "format-superseded";
   return "roster-tag-mismatch";
 }
+function stampAuthority(authority, previousEpoch) {
+  return {
+    ...authority,
+    roster_epoch: nextRosterEpoch(previousEpoch),
+    clearance: keyringClearance(Object.keys(authority.deks ?? {}))
+  };
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -366,9 +393,11 @@ async function verifyTypedEcho(block, echo) {
 // src/with-party/team/reserved-secret-collections.ts
 var SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 var BROKER_COLLECTION = "_broker";
+var BROKER_MEMBER_COLLECTION = "_broker_member";
 var SECRET_BEARING_RESERVED_COLLECTIONS = /* @__PURE__ */ new Set([
   SYNC_CREDENTIALS_COLLECTION,
-  BROKER_COLLECTION
+  BROKER_COLLECTION,
+  BROKER_MEMBER_COLLECTION
 ]);
 function isSecretBearingReservedCollection(name) {
   return SECRET_BEARING_RESERVED_COLLECTIONS.has(name);
@@ -553,7 +582,7 @@ async function createOwnerKeyring(store, vault, opts) {
       [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
     }
   };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
+  const withEpoch = stampAuthority(authorityWithDeks, void 0);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -649,6 +678,9 @@ async function grant(store, vault, callerKeyring, options) {
       throw new PrivilegeEscalationError(collName);
     }
   }
+  if (!granteeMayHoldSecrets) {
+    wrappedDeks[BROKER_MEMBER_COLLECTION] = await wrapKey(await generateDEK(), newKek);
+  }
   const canary = await mintKeyringCanary(newKek);
   const authority = {
     user_id: options.userId,
@@ -660,7 +692,7 @@ async function grant(store, vault, callerKeyring, options) {
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(previousGrantFound?.file.roster_epoch) };
+  const withEpoch = stampAuthority(authorityWithDeks, previousGrantFound?.file.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -772,7 +804,7 @@ async function revoke(store, vault, callerKeyring, options) {
     });
     if (unverified.length > 0) {
       console.warn(
-        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (noy-db#1114).`
+        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (vLannaAi/noy-db#1114).`
       );
     }
   }
@@ -897,7 +929,7 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
-  const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(target.roster_epoch) };
+  const withEpoch = stampAuthority(edited, target.roster_epoch);
   const next = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
@@ -1036,7 +1068,7 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       deks: updatedDeks,
       permissions: updatedPermissions
     };
-    const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(userKeyringFile.roster_epoch) };
+    const withEpoch = stampAuthority(edited, userKeyringFile.roster_epoch);
     const updatedKeyring = {
       ...withEpoch,
       roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
@@ -1076,7 +1108,7 @@ async function changeSecret(store, vault, keyring, opts) {
     ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingAuthority?.roster_epoch) };
+  const withEpoch = stampAuthority(authorityWithDeks, existingAuthority?.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1151,7 +1183,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
+  const withEpoch = stampAuthority(authorityWithDeks, void 0);
   return {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1333,7 +1365,7 @@ async function persistKeyring(store, vault, keyring) {
     deks: wrappedDeks,
     ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
   };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingFound?.file.roster_epoch) };
+  const withEpoch = stampAuthority(authorityWithDeks, existingFound?.file.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1403,6 +1435,7 @@ export {
   mintRosterTag,
   assertRosterAuthenticated,
   assertRosterTagValid,
+  stampAuthority,
   WeakSecretError,
   validateSecret,
   assertStrongSecret,
@@ -1417,10 +1450,12 @@ export {
   verifyTypedEcho,
   SYNC_CREDENTIALS_COLLECTION,
   BROKER_COLLECTION,
+  BROKER_MEMBER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
   requireRosterKey,
   deriveKekForKeyring,
+  parseKeyringEnvelope,
   readKeyringFile,
   assertKeyringNotExpired,
   loadKeyring,
@@ -1445,4 +1480,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-XSPFDUDG.js.map
+//# sourceMappingURL=chunk-45VHWE4C.js.map