mindoodb 0.0.23 → 0.0.32

package/dist/core/appendonlystores/network/NetworkTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NetworkTransport.d.ts","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/NetworkTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,SAAS,EACV,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAE1F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,WAAW,CAAC,IAAI,MAAM,CAAC;IAEvB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5E;;;OAGG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,WAAW,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,gBAAgB,CAAC,CACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhE;;OAEG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpE;;OAEG;IACH,2BAA2B,CAAC,CAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;OAEG;IACH,gCAAgC,CAAC,CAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,mCAAmC,CAAC,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,UAAU,CACR,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EAAE,GACZ,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAEpC;;;;;;;;;OASG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEtC;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5D;;;;;;;;;;OAUG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB"}
+{"version":3,"file":"NetworkTransport.d.ts","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/NetworkTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,SAAS,EACV,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAE1F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,WAAW,CAAC,IAAI,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CACd,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5E;;;OAGG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,WAAW,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,gBAAgB,CAAC,CACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhE;;OAEG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpE;;OAEG;IACH,2BAA2B,CAAC,CAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;OAEG;IACH,gCAAgC,CAAC,CAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,mCAAmC,CAAC,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,UAAU,CACR,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EAAE,GACZ,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAEpC;;;;;;;;;OASG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEhF;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5D;;;;;;;;;;OAUG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB"}

package/dist/core/appendonlystores/network/types.d.ts

@@ -44,7 +44,12 @@ export interface UserPublicKeys {
  */
 export interface NetworkAuthTokenPayload {
     /**
-     * Subject: the username of the authenticated user
+     * Subject of the authenticated session. Historically the cleartext username
+     * the client posted to `/auth/challenge`. With key-based challenges the
+     * username is optional, so `sub` may instead carry the authenticated device
+     * signing key (Ed25519, PEM) when no username was supplied. Treat it as an
+     * opaque principal id; identity for the read gate is resolved from
+     * {@link deviceSigningKey} where present.
      */
     sub: string;
     /**
@@ -63,6 +68,21 @@ export interface NetworkAuthTokenPayload {
      * Optional: database ID if token is scoped to a specific database
      */
     dbId?: string;
+    /**
+     * Optional: the signing public key (Ed25519, PEM) the device actually
+     * authenticated with (docs/accesscontrol.md §6.5). Determined by the server
+     * from which of the user's granted/wipe-targeted keys verified the challenge.
+     * Used to target a specific device for remote wipe.
+     */
+    deviceSigningKey?: string;
+    /**
+     * Optional: set when the authenticating device's signing key is the target of
+     * an admin-requested remote wipe (`wipeRequestedForSigningKeys`, §6.5). A
+     * wipe-scoped token may only fetch the admin-signed grant document carrying
+     * the directive, and bypasses the normal revocation check so a revoked device
+     * can still learn it must wipe.
+     */
+    wipe?: boolean;
 }
 /**
  * Challenge stored server-side for authentication.
@@ -73,9 +93,18 @@ export interface AuthChallenge {
      */
     challenge: string;
     /**
-     * The username this challenge was issued for
+     * The username this challenge was issued for. Optional: with key-based
+     * challenges the client may identify itself by its signing public key
+     * instead (see {@link signingPublicKey}), so the server no longer requires
+     * the cleartext username.
+     */
+    username?: string;
+    /**
+     * The device signing public key (Ed25519, PEM) this challenge was issued for,
+     * when the client identified itself by key rather than username. Used by
+     * {@link AuthenticationService.authenticate} to scope candidate keys.
      */
-    username: string;
+    signingPublicKey?: string;
     /**
      * Timestamp when the challenge was created (Unix epoch milliseconds)
      */
@@ -148,6 +177,27 @@ export interface NetworkSyncCapabilities {
      * walking attachment chunk metadata over the network.
      */
     supportsAttachmentReadPlanning: boolean;
+    /**
+     * Server's current wall-clock time (ms since Unix epoch) at the moment it
+     * answered the capabilities request. Clients use this for the clock-skew
+     * guard before syncing against an access-controlled tenant
+     * (docs/accesscontrol.md §4 "Clock-skew guard"), so a client with a wrong
+     * local clock cannot mis-stamp `createdAt`/trusted-time decisions.
+     */
+    serverTime?: number;
+    /**
+     * Whether the server implements the v1 access-control protocol (witness
+     * receipts + Tier 1 enforcement, docs/accesscontrol.md §5–§7). Clients use
+     * this to negotiate whether to enforce the clock-skew guard and to expect
+     * witness receipts on accepted entries.
+     */
+    supportsAccessControlV1?: boolean;
+    /**
+     * Whether the server enforces remote-wipe serving (docs/accesscontrol.md
+     * §6.5): a device whose signing key is wipe-targeted is served only the
+     * admin-signed grant document carrying the directive and no other data.
+     */
+    supportsRemoteWipeV1?: boolean;
 }
 /**
  * Network transport error types for error handling.
@@ -170,7 +220,11 @@ export declare enum NetworkErrorType {
     /** Server-side error */
     SERVER_ERROR = "SERVER_ERROR",
     /** User not found in directory */
-    USER_NOT_FOUND = "USER_NOT_FOUND"
+    USER_NOT_FOUND = "USER_NOT_FOUND",
+    /** Entry was denied by a Tier 1 access-control rule (docs/accesscontrol.md §7) */
+    ACCESS_DENIED = "ACCESS_DENIED",
+    /** Local/server clock skew exceeded tolerance during sync (§4 clock-skew guard) */
+    CLOCK_SKEW = "CLOCK_SKEW"
 }
 /**
  * Network transport error with type for structured error handling.

package/dist/core/appendonlystores/network/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,+BAA+B,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;OAIG;IACH,8BAA8B,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,oBAAY,gBAAgB;IAC1B,kCAAkC;IAClC,aAAa,kBAAkB;IAC/B,4BAA4B;IAC5B,YAAY,iBAAiB;IAC7B,oCAAoC;IACpC,iBAAiB,sBAAsB;IACvC,wCAAwC;IACxC,iBAAiB,sBAAsB;IACvC,kCAAkC;IAClC,aAAa,kBAAkB;IAC/B,uDAAuD;IACvD,iBAAiB,sBAAsB;IACvC,oDAAoD;IACpD,YAAY,iBAAiB;IAC7B,wBAAwB;IACxB,YAAY,iBAAiB;IAC7B,kCAAkC;IAClC,cAAc,mBAAmB;CAClC;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,KAAK;aAEnB,IAAI,EAAE,gBAAgB;aAEtB,YAAY,CAAC,EAAE,MAAM;gBAFrB,IAAI,EAAE,gBAAgB,EACtC,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,+BAA+B,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;OAIG;IACH,8BAA8B,EAAE,OAAO,CAAC;IACxC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,oBAAY,gBAAgB;IAC1B,kCAAkC;IAClC,aAAa,kBAAkB;IAC/B,4BAA4B;IAC5B,YAAY,iBAAiB;IAC7B,oCAAoC;IACpC,iBAAiB,sBAAsB;IACvC,wCAAwC;IACxC,iBAAiB,sBAAsB;IACvC,kCAAkC;IAClC,aAAa,kBAAkB;IAC/B,uDAAuD;IACvD,iBAAiB,sBAAsB;IACvC,oDAAoD;IACpD,YAAY,iBAAiB;IAC7B,wBAAwB;IACxB,YAAY,iBAAiB;IAC7B,kCAAkC;IAClC,cAAc,mBAAmB;IACjC,kFAAkF;IAClF,aAAa,kBAAkB;IAC/B,mFAAmF;IACnF,UAAU,eAAe;CAC1B;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,KAAK;aAEnB,IAAI,EAAE,gBAAgB;aAEtB,YAAY,CAAC,EAAE,MAAM;gBAFrB,IAAI,EAAE,gBAAgB,EACtC,OAAO,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,MAAM,YAAA;CAKxC"}

package/dist/core/appendonlystores/network/types.js

@@ -24,6 +24,10 @@ var NetworkErrorType;
     NetworkErrorType["SERVER_ERROR"] = "SERVER_ERROR";
     /** User not found in directory */
     NetworkErrorType["USER_NOT_FOUND"] = "USER_NOT_FOUND";
+    /** Entry was denied by a Tier 1 access-control rule (docs/accesscontrol.md §7) */
+    NetworkErrorType["ACCESS_DENIED"] = "ACCESS_DENIED";
+    /** Local/server clock skew exceeded tolerance during sync (§4 clock-skew guard) */
+    NetworkErrorType["CLOCK_SKEW"] = "CLOCK_SKEW";
 })(NetworkErrorType || (exports.NetworkErrorType = NetworkErrorType = {}));
 /**
  * Network transport error with type for structured error handling.

package/dist/core/appendonlystores/network/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/types.ts"],"names":[],"mappings":";;;AAyKA;;GAEG;AACH,IAAY,gBAmBX;AAnBD,WAAY,gBAAgB;IAC1B,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,iDAA6B,CAAA;IAC7B,oCAAoC;IACpC,2DAAuC,CAAA;IACvC,wCAAwC;IACxC,2DAAuC,CAAA;IACvC,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,uDAAuD;IACvD,2DAAuC,CAAA;IACvC,oDAAoD;IACpD,iDAA6B,CAAA;IAC7B,wBAAwB;IACxB,iDAA6B,CAAA;IAC7B,kCAAkC;IAClC,qDAAiC,CAAA;AACnC,CAAC,EAnBW,gBAAgB,gCAAhB,gBAAgB,QAmB3B;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,YACkB,IAAsB,EACtC,OAAe,EACC,YAAqB;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAkB;QAEtB,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AATD,oCASC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/types.ts"],"names":[],"mappings":";;;AA8NA;;GAEG;AACH,IAAY,gBAuBX;AAvBD,WAAY,gBAAgB;IAC1B,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,iDAA6B,CAAA;IAC7B,oCAAoC;IACpC,2DAAuC,CAAA;IACvC,wCAAwC;IACxC,2DAAuC,CAAA;IACvC,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,uDAAuD;IACvD,2DAAuC,CAAA;IACvC,oDAAoD;IACpD,iDAA6B,CAAA;IAC7B,wBAAwB;IACxB,iDAA6B,CAAA;IAC7B,kCAAkC;IAClC,qDAAiC,CAAA;IACjC,kFAAkF;IAClF,mDAA+B,CAAA;IAC/B,mFAAmF;IACnF,6CAAyB,CAAA;AAC3B,CAAC,EAvBW,gBAAgB,gCAAhB,gBAAgB,QAuB3B;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,YACkB,IAAsB,EACtC,OAAe,EACC,YAAqB;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAkB;QAEtB,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AATD,oCASC"}

package/dist/core/appendonlystores/scanUtils.d.ts

@@ -0,0 +1,27 @@
+import type { StoreEntryMetadata } from "../types";
+import type { StoreScanCursor, StoreScanFilters, StoreScanResult } from "./types";
+/**
+ * Shared helpers for cursor-based metadata scans over content-addressed
+ * stores. All stores order scans by `(receiptOrder ASC, id ASC)`; these
+ * utilities implement the doc-scoped fast path so a `docId`-filtered scan
+ * costs O(entries of that document) instead of O(entries in the store).
+ */
+/** Canonical scan ordering: `(receiptOrder ?? 0) ASC, id ASC`. */
+export declare function compareByReceiptOrderAndId(a: StoreEntryMetadata, b: StoreEntryMetadata): number;
+/** Whether `meta` sorts strictly after the (exclusive) scan cursor. */
+export declare function isAfterScanCursor(meta: StoreEntryMetadata, cursor: StoreScanCursor): boolean;
+/**
+ * Test whether a metadata entry passes the given scan filters
+ * (docId, entryTypes whitelist, creation-date range).
+ */
+export declare function metadataMatchesScanFilters(meta: StoreEntryMetadata, filters?: StoreScanFilters): boolean;
+/**
+ * Doc-scoped implementation of `scanEntriesSince`: takes the (unsorted)
+ * metadata of a single document — resolved through a store's docId index —
+ * and applies the canonical scan ordering, cursor, remaining filters and
+ * limit. The result contract matches the full-store scan exactly
+ * (`entries` in `(receiptOrder, id)` order, `nextCursor` pointing at the
+ * last returned entry, `hasMore` when further matching entries exist).
+ */
+export declare function scanDocScopedEntries(docEntries: StoreEntryMetadata[], cursor: StoreScanCursor | null, limit: number, filters?: StoreScanFilters): StoreScanResult;
+//# sourceMappingURL=scanUtils.d.ts.map

package/dist/core/appendonlystores/scanUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanUtils.d.ts","sourceRoot":"","sources":["../../../src/core/appendonlystores/scanUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAElF;;;;;GAKG;AAEH,kEAAkE;AAClE,wBAAgB,0BAA0B,CACxC,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAOR;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,eAAe,GACtB,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CA0BT;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,kBAAkB,EAAE,EAChC,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,gBAAgB,GACzB,eAAe,CA0BjB"}

package/dist/core/appendonlystores/scanUtils.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareByReceiptOrderAndId = compareByReceiptOrderAndId;
+exports.isAfterScanCursor = isAfterScanCursor;
+exports.metadataMatchesScanFilters = metadataMatchesScanFilters;
+exports.scanDocScopedEntries = scanDocScopedEntries;
+/**
+ * Shared helpers for cursor-based metadata scans over content-addressed
+ * stores. All stores order scans by `(receiptOrder ASC, id ASC)`; these
+ * utilities implement the doc-scoped fast path so a `docId`-filtered scan
+ * costs O(entries of that document) instead of O(entries in the store).
+ */
+/** Canonical scan ordering: `(receiptOrder ?? 0) ASC, id ASC`. */
+function compareByReceiptOrderAndId(a, b) {
+    const orderA = a.receiptOrder ?? 0;
+    const orderB = b.receiptOrder ?? 0;
+    if (orderA !== orderB) {
+        return orderA - orderB;
+    }
+    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+}
+/** Whether `meta` sorts strictly after the (exclusive) scan cursor. */
+function isAfterScanCursor(meta, cursor) {
+    const order = meta.receiptOrder ?? 0;
+    return (order > cursor.receiptOrder ||
+        (order === cursor.receiptOrder && meta.id > cursor.id));
+}
+/**
+ * Test whether a metadata entry passes the given scan filters
+ * (docId, entryTypes whitelist, creation-date range).
+ */
+function metadataMatchesScanFilters(meta, filters) {
+    if (filters?.docId && meta.docId !== filters.docId) {
+        return false;
+    }
+    if (filters?.entryTypes &&
+        filters.entryTypes.length > 0 &&
+        !filters.entryTypes.includes(meta.entryType)) {
+        return false;
+    }
+    if (filters?.creationDateFrom !== undefined &&
+        filters.creationDateFrom !== null &&
+        meta.createdAt < filters.creationDateFrom) {
+        return false;
+    }
+    if (filters?.creationDateUntil !== undefined &&
+        filters.creationDateUntil !== null &&
+        meta.createdAt >= filters.creationDateUntil) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Doc-scoped implementation of `scanEntriesSince`: takes the (unsorted)
+ * metadata of a single document — resolved through a store's docId index —
+ * and applies the canonical scan ordering, cursor, remaining filters and
+ * limit. The result contract matches the full-store scan exactly
+ * (`entries` in `(receiptOrder, id)` order, `nextCursor` pointing at the
+ * last returned entry, `hasMore` when further matching entries exist).
+ */
+function scanDocScopedEntries(docEntries, cursor, limit, filters) {
+    const sorted = [...docEntries].sort(compareByReceiptOrderAndId);
+    const page = [];
+    let hasMore = false;
+    for (const meta of sorted) {
+        if (cursor !== null && !isAfterScanCursor(meta, cursor)) {
+            continue;
+        }
+        if (!metadataMatchesScanFilters(meta, filters)) {
+            continue;
+        }
+        if (page.length < limit) {
+            page.push(meta);
+        }
+        else {
+            hasMore = true;
+            break;
+        }
+    }
+    const last = page.length > 0 ? page[page.length - 1] : null;
+    return {
+        entries: page,
+        nextCursor: last ? { receiptOrder: last.receiptOrder ?? 0, id: last.id } : cursor,
+        hasMore,
+    };
+}
+//# sourceMappingURL=scanUtils.js.map

package/dist/core/appendonlystores/scanUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanUtils.js","sourceRoot":"","sources":["../../../src/core/appendonlystores/scanUtils.ts"],"names":[],"mappings":";;AAWA,gEAUC;AAGD,8CASC;AAMD,gEA6BC;AAUD,oDA+BC;AA1GD;;;;;GAKG;AAEH,kEAAkE;AAClE,SAAgB,0BAA0B,CACxC,CAAqB,EACrB,CAAqB;IAErB,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,uEAAuE;AACvE,SAAgB,iBAAiB,CAC/B,IAAwB,EACxB,MAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IACrC,OAAO,CACL,KAAK,GAAG,MAAM,CAAC,YAAY;QAC3B,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,IAAwB,EACxB,OAA0B;IAE1B,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,OAAO,EAAE,UAAU;QACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7B,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,OAAO,EAAE,gBAAgB,KAAK,SAAS;QACvC,OAAO,CAAC,gBAAgB,KAAK,IAAI;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,gBAAgB,EACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,OAAO,EAAE,iBAAiB,KAAK,SAAS;QACxC,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAClC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,iBAAiB,EAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,UAAgC,EAChC,MAA8B,EAC9B,KAAa,EACb,OAA0B;IAE1B,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAyB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;QACjF,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/core/appendonlystores/types.d.ts

@@ -296,10 +296,31 @@ export interface ContentAddressedStore {
      * - Metadata is stored by entry id (always unique)
      * - Encrypted bytes are deduplicated by contentHash (same bytes stored once)
      *
+     * A remote (network) store may return witness receipts (stamped metadata with
+     * `receivedAt`/`receivedByPublicKey`/`receivedDateSignature`) for the accepted
+     * entries so the pushing client can persist the attestation on its local copy
+     * via {@link applyWitnessReceipts} (docs/accesscontrol.md §5.3). Local stores
+     * return `void`; callers that do not need receipts can ignore the result.
+     *
      * @param entries The entries to store
-     * @return A promise that resolves when all entries are stored
+     * @return A promise that resolves when all entries are stored, optionally
+     *   carrying witness receipts for the accepted entries.
+     */
+    putEntries(entries: StoreEntry[]): Promise<void | StoreEntryMetadata[]>;
+    /**
+     * Apply witness receipts to entries already present in this (local) store.
+     *
+     * Each receipt is the server-stamped metadata for an entry this store
+     * authored and pushed; applying it copies the witness fields (`receivedAt`,
+     * `receivedByPublicKey`, `receivedDateSignature`, `receiptScheme`) onto the
+     * stored entry and assigns it a fresh `receiptOrder` so the revision feed's
+     * `scanEntriesSince` cursor re-discovers it and re-anchors it from the
+     * provisional head to its committed `receivedAt` position (docs/accesscontrol.md
+     * §5.3, §8). Receipts for entries not present locally are ignored.
+     *
+     * Optional: stores without a receipt-order backbone may omit this.
      */
-    putEntries(entries: StoreEntry[]): Promise<void>;
+    applyWitnessReceipts?(receipts: StoreEntryMetadata[]): Promise<void>;
     /**
      * Get entries by their IDs.
      * Returns only entries that exist in this store.

package/dist/core/appendonlystores/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/appendonlystores/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAE3C;;;OAGG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAE3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;OAEG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;OAEG;IACH,KAAK,EAAE,2BAA2B,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,oBAAY,SAAS;IACnB,IAAI,SAAS;IACb,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,EAAE,qBAAqB,CAAC;IAEhC;;OAEG;IACH,eAAe,EAAE,qBAAqB,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;OAOG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;CAC1E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,IAAI,SAAS,CAAC;IAE1B;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEjD;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;;;;;OAeG;IACH,mCAAmC,CAAC,CAClC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEvF;;;;;;;;;;;OAWG;IACH,WAAW,CACT,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/B;;;;;;OAMG;IACH,gBAAgB,CAAC,CACf,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEnD;;;;OAIG;IACH,2BAA2B,CACzB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;OAGG;IACH,gCAAgC,CAC9B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C;;;OAGG;IACH,0BAA0B,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElF;;OAEG;IACH,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;;OAGG;IACH,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEnF;;OAEG;IACH,mBAAmB,CAAC,IAAI,qBAAqB,CAAC;IAE9C;;OAEG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEvD;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,IAAI,MAAM,CAAC;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/appendonlystores/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAE3C;;;OAGG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAE3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;OAEG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;OAEG;IACH,KAAK,EAAE,2BAA2B,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,oBAAY,SAAS;IACnB,IAAI,SAAS;IACb,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,EAAE,qBAAqB,CAAC;IAEhC;;OAEG;IACH,eAAe,EAAE,qBAAqB,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;OAOG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;CAC1E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,IAAI,SAAS,CAAC;IAE1B;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAC;IAExE;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEjD;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;;;;;OAeG;IACH,mCAAmC,CAAC,CAClC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEvF;;;;;;;;;;;OAWG;IACH,WAAW,CACT,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/B;;;;;;OAMG;IACH,gBAAgB,CAAC,CACf,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEnD;;;;OAIG;IACH,2BAA2B,CACzB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;OAGG;IACH,gCAAgC,CAC9B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C;;;OAGG;IACH,0BAA0B,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElF;;OAEG;IACH,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC;;;OAGG;IACH,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEnF;;OAEG;IACH,mBAAmB,CAAC,IAAI,qBAAqB,CAAC;IAE9C;;OAEG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEvD;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,IAAI,MAAM,CAAC;CAC7B"}

package/dist/core/cache/CacheManager.d.ts

@@ -15,10 +15,15 @@ export interface ICacheable {
      * Export the current dirty state to the cache store.
      * Called by CacheManager during flush.
      *
-     * @param store  The cache store to write to
+     * @param store   The cache store to write to
+     * @param options `force: true` on shutdown/deregister paths — implementations
+     *                must persist immediately and may not defer (e.g. a
+     *                VirtualView's minimum flush interval is bypassed)
      * @returns The number of entries written
      */
-    flushToCache(store: LocalCacheStore): Promise<number>;
+    flushToCache(store: LocalCacheStore, options?: {
+        force?: boolean;
+    }): Promise<number>;
     /**
      * Clear the dirty tracking state after a successful flush.
      */
@@ -65,8 +70,13 @@ export declare class CacheManager {
     private scheduleFlush;
     /**
      * Immediately flush all dirty cacheables.
+     *
+     * @param options `force: true` bypasses per-cacheable flush deferral
+     *   (used on dispose so shutdown never skips pending state)
      */
-    flush(): Promise<void>;
+    flush(options?: {
+        force?: boolean;
+    }): Promise<void>;
     /**
      * Flush all pending state and stop the periodic timer.
      */

package/dist/core/cache/CacheManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CacheManager.d.ts","sourceRoot":"","sources":["../../../src/core/cache/CacheManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,cAAc,IAAI,MAAM,CAAC;IAEzB;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtD;;OAEG;IACH,UAAU,IAAI,IAAI,CAAC;IAEnB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,MAAM,CAAS;gBAEX,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,MAAM;IAMlF,QAAQ,IAAI,eAAe;IAI3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAIrC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtD;;;OAGG;IACH,SAAS,IAAI,IAAI;IAKjB,OAAO,CAAC,aAAa;IAQrB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB5B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ/B"}
+{"version":3,"file":"CacheManager.d.ts","sourceRoot":"","sources":["../../../src/core/cache/CacheManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,cAAc,IAAI,MAAM,CAAC;IAEzB;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAErF;;OAEG;IACH,UAAU,IAAI,IAAI,CAAC;IAEnB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,MAAM,CAAS;gBAEX,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,MAAM;IAMlF,QAAQ,IAAI,eAAe;IAI3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAIrC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtD;;;OAGG;IACH,SAAS,IAAI,IAAI;IAKjB,OAAO,CAAC,aAAa;IAQrB;;;;;OAKG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBzD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ/B"}

package/dist/core/cache/CacheManager.js

@@ -34,7 +34,7 @@ class CacheManager {
     async deregister(cacheable) {
         if (cacheable.hasDirtyState()) {
             try {
-                await cacheable.flushToCache(this.store);
+                await cacheable.flushToCache(this.store, { force: true });
                 cacheable.clearDirty();
             }
             catch (e) {
@@ -62,8 +62,11 @@ class CacheManager {
     }
     /**
      * Immediately flush all dirty cacheables.
+     *
+     * @param options `force: true` bypasses per-cacheable flush deferral
+     *   (used on dispose so shutdown never skips pending state)
      */
-    async flush() {
+    async flush(options) {
         if (this.flushInProgress)
             return;
         this.flushInProgress = true;
@@ -72,7 +75,7 @@ class CacheManager {
                 if (!cacheable.hasDirtyState())
                     continue;
                 try {
-                    const count = await cacheable.flushToCache(this.store);
+                    const count = await cacheable.flushToCache(this.store, options);
                     cacheable.clearDirty();
                     this.logger.debug(`Flushed ${count} entries for ${cacheable.getCachePrefix()}`);
                 }
@@ -94,7 +97,7 @@ class CacheManager {
             clearTimeout(this.timer);
             this.timer = null;
         }
-        await this.flush();
+        await this.flush({ force: true });
     }
 }
 exports.CacheManager = CacheManager;

package/dist/core/cache/CacheManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"CacheManager.js","sourceRoot":"","sources":["../../../src/core/cache/CacheManager.ts"],"names":[],"mappings":";;;AACA,wCAAsE;AAuCtE;;;;;GAKG;AACH,MAAa,YAAY;IASvB,YAAY,KAAsB,EAAE,OAA6B,EAAE,MAAe;QAP1E,eAAU,GAAoB,IAAI,GAAG,EAAE,CAAC;QAExC,UAAK,GAAyC,IAAI,CAAC;QACnD,oBAAe,GAAY,KAAK,CAAC;QACjC,aAAQ,GAAY,KAAK,CAAC;QAIhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACvF,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAqB;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAqB;QACpC,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE;oBAAE,SAAS;gBAEzC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACvD,SAAS,CAAC,UAAU,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,gBAAgB,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AA9FD,oCA8FC"}
+{"version":3,"file":"CacheManager.js","sourceRoot":"","sources":["../../../src/core/cache/CacheManager.ts"],"names":[],"mappings":";;;AACA,wCAAsE;AA0CtE;;;;;GAKG;AACH,MAAa,YAAY;IASvB,YAAY,KAAsB,EAAE,OAA6B,EAAE,MAAe;QAP1E,eAAU,GAAoB,IAAI,GAAG,EAAE,CAAC;QAExC,UAAK,GAAyC,IAAI,CAAC;QACnD,oBAAe,GAAY,KAAK,CAAC;QACjC,aAAQ,GAAY,KAAK,CAAC;QAIhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACvF,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAqB;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAqB;QACpC,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE;oBAAE,SAAS;gBAEzC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAChE,SAAS,CAAC,UAAU,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,gBAAgB,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACF;AAjGD,oCAiGC"}

package/dist/core/crypto/EntrySignature.d.ts

@@ -0,0 +1,137 @@
+import type { StoreEntryAttachmentRef, StoreEntryMetadata } from "../types";
+/**
+ * Author entry signatures (security hardening, audit finding #5).
+ *
+ * Historically (early betas) a store entry's author signature (`StoreEntryMetadata.signature`)
+ * covered ONLY the encrypted payload bytes. That leaves every cleartext metadata
+ * field (`entryType`, `docId`, `decryptionKeyId`, `createdAt`, `dependencyIds`,
+ * `contentHash`, ...) unauthenticated: a relay holding any trusted key could
+ * tweak metadata on an un-witnessed/legacy entry and the legacy signature would
+ * still verify.
+ *
+ * This module adds a second, stronger author signature
+ * (`StoreEntryMetadata.metadataSignature`) computed over a **fixed, versioned,
+ * length-prefixed byte layout** that binds the security-relevant metadata
+ * alongside the `contentHash` (which itself is `SHA-256(encryptedData)`, so the
+ * ciphertext is transitively bound). It mirrors {@link WitnessReceipt} in style
+ * and is intentionally free of tenant/IO dependencies so it can be reused on
+ * both client and server and unit-tested in isolation.
+ *
+ * Backward compatibility: writers populate BOTH `signature` (legacy, over
+ * ciphertext) and `metadataSignature`. Verifiers prefer `metadataSignature`
+ * when present and fall back to the legacy `signature` for v1/legacy entries
+ * that predate this field, so old entries remain readable.
+ */
+/**
+ * Version byte of the canonical entry-signature layout. Any change to the field
+ * set or ordering MUST bump this value (and verifiers MUST reject unknown
+ * versions).
+ *
+ * Exception — backward-compatible trailing extensions: a strictly trailing,
+ * optional block whose absence produces ZERO bytes (so the layout is
+ * byte-identical to the prior version for entries that do not carry the new
+ * data) does NOT bump this value. The `attachmentRefs` block (see
+ * {@link buildEntrySigningBytes}) is such an extension: attachment-free entries —
+ * including every entry signed before the field existed — are unaffected and
+ * keep verifying.
+ */
+export declare const ENTRY_SIGNATURE_LAYOUT_VERSION = 1;
+/**
+ * The exact set of metadata fields bound by an author's `metadataSignature`, in
+ * the order they appear in the byte layout.
+ */
+export interface EntrySignatureFields {
+    entryType: string;
+    id: string;
+    docId: string;
+    decryptionKeyId: string;
+    createdAt: number;
+    dependencyIds: string[];
+    /** SHA-256 of the encrypted payload (transitively binds the ciphertext). */
+    contentHash: string;
+    /** Ed25519 public key (PEM) of the author. */
+    createdByPublicKey: string;
+    /**
+     * Optional snapshot of the document's attachment references as of this entry
+     * (see {@link StoreEntryMetadata.attachmentRefs}). Encoded as a backward-compatible
+     * TRAILING block (see {@link buildEntrySigningBytes}): when absent or empty it
+     * contributes ZERO bytes, so attachment-free entries (every legacy entry) keep
+     * the original v1 signing input and verify unchanged. Treat empty as absent.
+     */
+    attachmentRefs?: StoreEntryAttachmentRef[];
+}
+/** Options for the version-aware entry-signature verifiers. */
+export interface VerifyEntrySignatureOptions {
+    /**
+     * When true, an entry that lacks a `metadataSignature` (legacy/v1) is
+     * rejected instead of falling back to the ciphertext-only signature. Callers
+     * set this per entry based on the tenant's `requireMetadataSignatureSince`
+     * cutoff vs. the entry's trusted time.
+     */
+    requireMetadataSignature?: boolean;
+}
+/**
+ * Build the canonical, versioned, length-prefixed byte layout the author signs
+ * over.
+ *
+ * Layout:
+ * ```
+ * version(1 byte)
+ *  || len(entryType)          || entryType
+ *  || len(id)                 || id
+ *  || len(docId)              || docId
+ *  || len(decryptionKeyId)    || decryptionKeyId
+ *  || int64BE(createdAt)
+ *  || uint32BE(dependencyIds.length)
+ *  || ( len(dep) || dep ) *   (in array order)
+ *  || len(contentHash)        || contentHash
+ *  || len(createdByPublicKey) || createdByPublicKey
+ *  -- trailing attachmentRefs block, PRESENT ONLY IF attachmentRefs.length > 0 --
+ *  || uint32BE(attachmentRefs.length)
+ *  || ( len(attachmentId) || attachmentId
+ *       || len(lastChunkId) || lastChunkId
+ *       || int64BE(size) ) * (one triple per ref, in array order)
+ * ```
+ *
+ * The attachmentRefs block is a deliberately backward-compatible TRAILING
+ * extension: it is appended ONLY when there is at least one ref, so an
+ * attachment-free entry (every entry written before this field existed, and
+ * every future text-only revision) produces byte-for-byte the same input as the
+ * original layout and its existing signature still verifies. This is why the
+ * version byte intentionally stays `0x01` and is NOT bumped despite the new
+ * field: absence is byte-identical to the prior layout. Callers MUST treat an
+ * empty array as absent (the canonicalization in {@link entrySignatureFieldsFromEntry}
+ * guarantees this) and emit refs in a stable order (the writer sorts by
+ * `attachmentId`) so signing and verification produce identical bytes.
+ */
+export declare function buildEntrySigningBytes(fields: EntrySignatureFields, version?: number): Uint8Array;
+/** Project the signed fields out of an entry's metadata. */
+export declare function entrySignatureFieldsFromEntry(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs">): EntrySignatureFields;
+/**
+ * Sign the canonical entry layout with an already-imported Ed25519 private key.
+ * Returns the raw signature bytes to store as `metadataSignature`.
+ */
+export declare function signEntryMetadata(fields: EntrySignatureFields, signingPrivateKey: CryptoKey, subtle: SubtleCrypto, version?: number): Promise<Uint8Array>;
+/**
+ * Pure cryptographic verification of an entry's author signature, version-aware.
+ *
+ * - If `metadataSignature` is present, verifies it over {@link buildEntrySigningBytes}
+ *   (strong, metadata-binding scheme; v2+).
+ * - Otherwise falls back to the legacy `signature` over `encryptedData`
+ *   (v1/legacy entries that predate the metadata-binding scheme).
+ *
+ * This does NOT decide whether the author key is *trusted* — callers must
+ * separately confirm the key via the tenant directory.
+ */
+export declare function verifyEntrySignatureWithImportedKey(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs" | "signature"> & {
+    metadataSignature?: Uint8Array;
+}, encryptedData: Uint8Array, cryptoKey: CryptoKey, subtle: SubtleCrypto, opts?: VerifyEntrySignatureOptions): Promise<boolean>;
+/**
+ * Same as {@link verifyEntrySignatureWithImportedKey} but imports the author's
+ * PEM-encoded public key first. Convenient for one-off verifications (e.g. on
+ * the server's push path) where no key cache is available.
+ */
+export declare function verifyEntrySignatureCrypto(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs" | "signature"> & {
+    metadataSignature?: Uint8Array;
+}, encryptedData: Uint8Array, authorPublicKeyPem: string, subtle: SubtleCrypto, opts?: VerifyEntrySignatureOptions): Promise<boolean>;
+//# sourceMappingURL=EntrySignature.d.ts.map

package/dist/core/crypto/EntrySignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntrySignature.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,IAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAC5C;AAED,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AA6BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,OAAO,GAAE,MAAuC,GAC/C,UAAU,CAmCZ;AAED,4DAA4D;AAC5D,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,CACnB,GACA,oBAAoB,CAiBtB;AAgBD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,EAAE,SAAS,EAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,MAAuC,GAC/C,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAAE,EACtC,aAAa,EAAE,UAAU,EACzB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAAE,EACtC,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CASlB"}