mindoodb 0.0.23 → 0.0.32

package/dist/core/crypto/encryptedFields.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEncryptedFieldKeyId = getEncryptedFieldKeyId;
+exports.decryptEncryptedField = decryptEncryptedField;
+const types_1 = require("../types");
+/** Suffix of the companion field naming the key id of an `_encrypted` field. */
+const KEY_FIELD_SUFFIX = "_key";
+/**
+ * Resolves the symmetric key id for an `_encrypted` field following the
+ * `<field>_encrypted` / `<field>_encrypted_key` naming convention.
+ *
+ * Resolution order: explicit `override` -> the field's `<field>_key` companion
+ * field on the document -> the tenant default key (`"default"`).
+ */
+function getEncryptedFieldKeyId(data, encryptedFieldName, override) {
+    if (typeof override === "string" && override.trim()) {
+        return override;
+    }
+    const companion = data[`${encryptedFieldName}${KEY_FIELD_SUFFIX}`];
+    if (typeof companion === "string" && companion.trim()) {
+        return companion;
+    }
+    return types_1.DEFAULT_TENANT_KEY_ID;
+}
+/** Decodes a base64 string into bytes. */
+function base64ToUint8Array(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Decrypts a base64 `_encrypted` field to its UTF-8 plaintext.
+ *
+ * The key id is resolved with {@link getEncryptedFieldKeyId} unless
+ * `keyIdOverride` is provided. Returns `null` when the field is missing/blank
+ * or decryption fails (for example the named key is not present in the
+ * decryptor's key bag), so callers can treat unreadable fields as absent rather
+ * than throwing.
+ */
+async function decryptEncryptedField(decryptor, data, encryptedFieldName, keyIdOverride) {
+    const ciphertext = data[encryptedFieldName];
+    if (typeof ciphertext !== "string" || !ciphertext) {
+        return null;
+    }
+    const keyId = getEncryptedFieldKeyId(data, encryptedFieldName, keyIdOverride);
+    try {
+        const encrypted = base64ToUint8Array(ciphertext);
+        const decrypted = await decryptor.decryptPayload(encrypted, keyId);
+        return new TextDecoder().decode(decrypted);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=encryptedFields.js.map

package/dist/core/crypto/encryptedFields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedFields.js","sourceRoot":"","sources":["../../../src/core/crypto/encryptedFields.ts"],"names":[],"mappings":";;AAqBA,wDAaC;AAqBD,sDAkBC;AAzED,oCAAiD;AAWjD,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,IAA6B,EAC7B,kBAA0B,EAC1B,QAAwB;IAExB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,gBAAgB,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,6BAAqB,CAAC;AAC/B,CAAC;AAED,0CAA0C;AAC1C,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,qBAAqB,CACzC,SAAkC,EAClC,IAA6B,EAC7B,kBAA0B,EAC1B,aAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/crypto/pbkdf2Iterations.d.ts

@@ -9,4 +9,16 @@ export declare const MIN_PBKDF2_ITERATIONS = 60000;
  * 3) defaultIterations
  */
 export declare function resolvePbkdf2Iterations(defaultIterations?: number): number;
+/**
+ * Resolve the PBKDF2 iteration count to use when DECRYPTING a stored key blob.
+ *
+ * Security hardening: a stored blob's `iterations` value is
+ * attacker-influenceable (a stolen identity file with `"iterations": 1` would
+ * otherwise make offline password cracking trivially cheap). We therefore floor
+ * any stored value at {@link MIN_PBKDF2_ITERATIONS}. This is backward compatible
+ * because every legitimately-written blob already used at least the floor on the
+ * encrypt path; flooring a tampered/too-low value simply derives a different key
+ * and the AES-GCM tag check then fails (a safe denial, not a downgrade).
+ */
+export declare function resolveStoredIterations(stored: number | undefined | null): number;
 //# sourceMappingURL=pbkdf2Iterations.d.ts.map

package/dist/core/crypto/pbkdf2Iterations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pbkdf2Iterations.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/pbkdf2Iterations.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAChD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,GAAE,MAAkC,GAAG,MAAM,CAgBrG"}
+{"version":3,"file":"pbkdf2Iterations.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/pbkdf2Iterations.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAChD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,GAAE,MAAkC,GAAG,MAAM,CAgBrG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAUjF"}

package/dist/core/crypto/pbkdf2Iterations.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_PBKDF2_ITERATIONS = exports.DEFAULT_PBKDF2_ITERATIONS = void 0;
 exports.resolvePbkdf2Iterations = resolvePbkdf2Iterations;
+exports.resolveStoredIterations = resolveStoredIterations;
 exports.DEFAULT_PBKDF2_ITERATIONS = 310000;
 exports.MIN_PBKDF2_ITERATIONS = 60000;
 /**
@@ -27,6 +28,28 @@ function resolvePbkdf2Iterations(defaultIterations = exports.DEFAULT_PBKDF2_ITER
     }
     return intValue;
 }
+/**
+ * Resolve the PBKDF2 iteration count to use when DECRYPTING a stored key blob.
+ *
+ * Security hardening: a stored blob's `iterations` value is
+ * attacker-influenceable (a stolen identity file with `"iterations": 1` would
+ * otherwise make offline password cracking trivially cheap). We therefore floor
+ * any stored value at {@link MIN_PBKDF2_ITERATIONS}. This is backward compatible
+ * because every legitimately-written blob already used at least the floor on the
+ * encrypt path; flooring a tampered/too-low value simply derives a different key
+ * and the AES-GCM tag check then fails (a safe denial, not a downgrade).
+ */
+function resolveStoredIterations(stored) {
+    const fallback = resolvePbkdf2Iterations(exports.DEFAULT_PBKDF2_ITERATIONS);
+    if (stored === undefined || stored === null) {
+        return fallback;
+    }
+    const parsed = Number(stored);
+    if (!Number.isFinite(parsed)) {
+        return fallback;
+    }
+    return Math.max(exports.MIN_PBKDF2_ITERATIONS, Math.floor(parsed));
+}
 function readOverride() {
     try {
         if (typeof globalThis !== "undefined") {

package/dist/core/crypto/pbkdf2Iterations.js.map

@@ -1 +1 @@
-{"version":3,"file":"pbkdf2Iterations.js","sourceRoot":"","sources":["../../../src/core/crypto/pbkdf2Iterations.ts"],"names":[],"mappings":";;;AAWA,0DAgBC;AA3BY,QAAA,yBAAyB,GAAG,MAAM,CAAC;AACnC,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,oBAA4B,iCAAyB;IAC3F,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,6BAAqB,EAAE,CAAC;QACrC,OAAO,6BAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,OAAO,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,UAA4E,CAAC;YACvF,IAAI,CAAC,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,CAAC,CAAC,4BAA4B,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;IAED,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"pbkdf2Iterations.js","sourceRoot":"","sources":["../../../src/core/crypto/pbkdf2Iterations.ts"],"names":[],"mappings":";;;AAWA,0DAgBC;AAaD,0DAUC;AAlDY,QAAA,yBAAyB,GAAG,MAAM,CAAC;AACnC,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,oBAA4B,iCAAyB;IAC3F,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,6BAAqB,EAAE,CAAC;QACrC,OAAO,6BAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,uBAAuB,CAAC,MAAiC;IACvE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,iCAAyB,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,6BAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,OAAO,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,UAA4E,CAAC;YACvF,IAAI,CAAC,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,CAAC,CAAC,4BAA4B,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;IAED,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/crypto/privateKeyEncryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privateKeyEncryption.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/privateKeyEncryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgCrD,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,UAAU,EAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;AAED,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAwCtB"}
+{"version":3,"file":"privateKeyEncryption.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/privateKeyEncryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgCrD,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,UAAU,EAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;AAED,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CA0CtB"}

package/dist/core/crypto/privateKeyEncryption.js

@@ -70,7 +70,9 @@ async function decryptPrivateKey(cryptoAdapter, encryptedKey, password, saltStri
     const iv = base64ToUint8Array(encryptedKey.iv);
     const tag = base64ToUint8Array(encryptedKey.tag);
     const saltBytes = base64ToUint8Array(encryptedKey.salt);
-    const iterations = encryptedKey.iterations || (0, pbkdf2Iterations_1.resolvePbkdf2Iterations)(pbkdf2Iterations_1.DEFAULT_PBKDF2_ITERATIONS);
+    // Floor the stored iteration count (audit finding #3): a tampered identity
+    // blob with a too-low value must not weaken the KDF on decrypt.
+    const iterations = (0, pbkdf2Iterations_1.resolveStoredIterations)(encryptedKey.iterations);
     const combinedSalt = buildCombinedSalt(saltBytes, saltString);
     const passwordKey = await subtle.importKey("raw", new TextEncoder().encode(password), { name: "PBKDF2" }, false, ["deriveBits", "deriveKey"]);
     const derivedKey = await subtle.deriveKey({

package/dist/core/crypto/privateKeyEncryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"privateKeyEncryption.js","sourceRoot":"","sources":["../../../src/core/crypto/privateKeyEncryption.ts"],"names":[],"mappings":";;AAiCA,8CA+DC;AAED,8CA6CC;AA7ID,yDAAwF;AAExF,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAqB,EAAE,UAAkB;IAClE,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/E,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,aAA4B,EAC5B,eAA2B,EAC3B,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,YAAY,CAAC,EAAE,CAAC,CAAC;IAEjB,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,0CAAuB,EAAC,4CAAyB,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;QACjC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX;QACE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG;KACZ,EACD,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CACpC;QACE,IAAI,EAAE,SAAS;QACf,EAAE;QACF,SAAS,EAAE,GAAG;KACf,EACD,UAAU,EACV,eAAe,CAAC,MAAqB,CACtC,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1B,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC;QAC9B,UAAU;KACX,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,aAA4B,EAC5B,YAAiC,EACjC,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IAEzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,IAAA,0CAAuB,EAAC,4CAAyB,CAAC,CAAC;IAEjG,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;QACjC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,OAAO,CACnB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAC3D,UAAU,EACV,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"privateKeyEncryption.js","sourceRoot":"","sources":["../../../src/core/crypto/privateKeyEncryption.ts"],"names":[],"mappings":";;AAiCA,8CA+DC;AAED,8CA+CC;AA/ID,yDAAiH;AAEjH,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAqB,EAAE,UAAkB;IAClE,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/E,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,aAA4B,EAC5B,eAA2B,EAC3B,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,YAAY,CAAC,EAAE,CAAC,CAAC;IAEjB,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,0CAAuB,EAAC,4CAAyB,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;QACjC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX;QACE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG;KACZ,EACD,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CACpC;QACE,IAAI,EAAE,SAAS;QACf,EAAE;QACF,SAAS,EAAE,GAAG;KACf,EACD,UAAU,EACV,eAAe,CAAC,MAAqB,CACtC,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1B,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC;QAC9B,UAAU;KACX,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,aAA4B,EAC5B,YAAiC,EACjC,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IAEzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAA,0CAAuB,EAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAEpE,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC;QACjC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,OAAO,CACnB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAC3D,UAAU,EACV,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/dist/core/databaseIdValidation.d.ts

@@ -6,7 +6,7 @@
  */
 export declare const DATABASE_ID_REGEX: RegExp;
 export declare const MAX_DATABASE_ID_LENGTH = 64;
-export declare const DATABASE_ID_REQUIREMENTS = "Database IDs must be 1-64 characters, start with a letter or digit, and contain only letters, digits, dots, and hyphens.";
+export declare const DATABASE_ID_REQUIREMENTS = "Database IDs must be 1-64 characters, start with a letter or digit, and contain only letters, digits, dots, hyphens, and underscores.";
 export declare function getDatabaseIdValidationError(value: unknown, fieldName?: string): string | null;
 export declare function isValidDatabaseId(value: unknown): value is string;
 export declare function validateDatabaseId(value: unknown, fieldName?: string): string;

package/dist/core/databaseIdValidation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"databaseIdValidation.d.ts","sourceRoot":"","sources":["../../src/core/databaseIdValidation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAgC,CAAC;AAC/D,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,wBAAwB,6HACuF,CAAC;AAE7H,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAS,GAAG,MAAM,GAAG,IAAI,CAc9F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAS,GAAG,MAAM,CAM7E"}
+{"version":3,"file":"databaseIdValidation.d.ts","sourceRoot":"","sources":["../../src/core/databaseIdValidation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAiC,CAAC;AAChE,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,wBAAwB,0IACoG,CAAC;AAE1I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAS,GAAG,MAAM,GAAG,IAAI,CAc9F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAS,GAAG,MAAM,CAM7E"}

package/dist/core/databaseIdValidation.js

@@ -10,18 +10,18 @@ exports.validateDatabaseId = validateDatabaseId;
  * Database IDs are embedded in server routes and storage names, so keep the
  * accepted character set intentionally narrow and consistent everywhere.
  */
-exports.DATABASE_ID_REGEX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+exports.DATABASE_ID_REGEX = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 exports.MAX_DATABASE_ID_LENGTH = 64;
-exports.DATABASE_ID_REQUIREMENTS = "Database IDs must be 1-64 characters, start with a letter or digit, and contain only letters, digits, dots, and hyphens.";
+exports.DATABASE_ID_REQUIREMENTS = "Database IDs must be 1-64 characters, start with a letter or digit, and contain only letters, digits, dots, hyphens, and underscores.";
 function getDatabaseIdValidationError(value, fieldName = "dbId") {
     if (typeof value !== "string" || value.length === 0) {
         return `${fieldName} is required and must be a non-empty string`;
     }
     if (value.length > exports.MAX_DATABASE_ID_LENGTH) {
-        return `${fieldName} must be at most ${exports.MAX_DATABASE_ID_LENGTH} characters`;
+        return `${fieldName} ${JSON.stringify(value.slice(0, exports.MAX_DATABASE_ID_LENGTH))}… must be at most ${exports.MAX_DATABASE_ID_LENGTH} characters`;
     }
     if (!exports.DATABASE_ID_REGEX.test(value)) {
-        return `${fieldName} must start with a letter or digit and contain only letters, digits, dots, and hyphens`;
+        return `${fieldName} ${JSON.stringify(value)} must start with a letter or digit and contain only letters, digits, dots, hyphens, and underscores`;
     }
     return null;
 }

package/dist/core/databaseIdValidation.js.map

@@ -1 +1 @@
-{"version":3,"file":"databaseIdValidation.js","sourceRoot":"","sources":["../../src/core/databaseIdValidation.ts"],"names":[],"mappings":";;;AAWA,oEAcC;AAED,8CAEC;AAED,gDAMC;AArCD;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,6BAA6B,CAAC;AAClD,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAC5B,QAAA,wBAAwB,GACnC,0HAA0H,CAAC;AAE7H,SAAgB,4BAA4B,CAAC,KAAc,EAAE,SAAS,GAAG,MAAM;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,GAAG,SAAS,6CAA6C,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,8BAAsB,EAAE,CAAC;QAC1C,OAAO,GAAG,SAAS,oBAAoB,8BAAsB,aAAa,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,yBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,wFAAwF,CAAC;IAC9G,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,OAAO,4BAA4B,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAS,GAAG,MAAM;IACnE,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"databaseIdValidation.js","sourceRoot":"","sources":["../../src/core/databaseIdValidation.ts"],"names":[],"mappings":";;;AAWA,oEAcC;AAED,8CAEC;AAED,gDAMC;AArCD;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,8BAA8B,CAAC;AACnD,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAC5B,QAAA,wBAAwB,GACnC,uIAAuI,CAAC;AAE1I,SAAgB,4BAA4B,CAAC,KAAc,EAAE,SAAS,GAAG,MAAM;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,GAAG,SAAS,6CAA6C,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,8BAAsB,EAAE,CAAC;QAC1C,OAAO,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,8BAAsB,CAAC,CAAC,qBAAqB,8BAAsB,aAAa,CAAC;IACxI,CAAC;IAED,IAAI,CAAC,yBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,qGAAqG,CAAC;IACpJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,OAAO,4BAA4B,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAS,GAAG,MAAM;IACnE,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC"}

package/dist/core/errors.d.ts

@@ -7,4 +7,30 @@ export declare class SymmetricKeyNotFoundError extends Error {
     readonly keyId: string;
     constructor(keyId: string);
 }
+/**
+ * Error thrown when a document id cannot be resolved in the database (no
+ * `doc_create` entry exists). Callers that treat "missing" as a regular
+ * outcome (e.g. probing several databases for an id) should catch this via
+ * {@link isDocumentMissingError} instead of matching message strings.
+ */
+export declare class DocumentNotFoundError extends Error {
+    readonly docId: string;
+    constructor(docId: string);
+}
+/**
+ * Error thrown when a document exists but its latest lifecycle entry is a
+ * deletion, so it cannot be materialized through the regular read/write APIs.
+ */
+export declare class DocumentDeletedError extends Error {
+    readonly docId: string;
+    constructor(docId: string);
+}
+/**
+ * True when `error` signals that a document id cannot be materialized —
+ * either unknown ({@link DocumentNotFoundError}) or deleted
+ * ({@link DocumentDeletedError}). Checks the error `name` in addition to
+ * `instanceof` so it stays reliable when two module copies of mindoodb are
+ * loaded (e.g. a bundled app next to a linked workspace build).
+ */
+export declare function isDocumentMissingError(error: unknown): boolean;
 //# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,KAAK,EAAE,MAAM,CAAC;gBAElB,KAAK,EAAE,MAAM;CAK1B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,KAAK,EAAE,MAAM,CAAC;gBAElB,KAAK,EAAE,MAAM;CAK1B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,KAAK,EAAE,MAAM,CAAC;gBAElB,KAAK,EAAE,MAAM;CAK1B;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAgB,KAAK,EAAE,MAAM,CAAC;gBAElB,KAAK,EAAE,MAAM;CAK1B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ9D"}

package/dist/core/errors.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SymmetricKeyNotFoundError = void 0;
+exports.DocumentDeletedError = exports.DocumentNotFoundError = exports.SymmetricKeyNotFoundError = void 0;
+exports.isDocumentMissingError = isDocumentMissingError;
 /**
  * Error thrown when a symmetric encryption key is not found in the KeyBag.
  * This error is used to identify documents that cannot be decrypted because
@@ -14,4 +15,44 @@ class SymmetricKeyNotFoundError extends Error {
     }
 }
 exports.SymmetricKeyNotFoundError = SymmetricKeyNotFoundError;
+/**
+ * Error thrown when a document id cannot be resolved in the database (no
+ * `doc_create` entry exists). Callers that treat "missing" as a regular
+ * outcome (e.g. probing several databases for an id) should catch this via
+ * {@link isDocumentMissingError} instead of matching message strings.
+ */
+class DocumentNotFoundError extends Error {
+    constructor(docId) {
+        super(`Document ${docId} not found`);
+        this.name = "DocumentNotFoundError";
+        this.docId = docId;
+    }
+}
+exports.DocumentNotFoundError = DocumentNotFoundError;
+/**
+ * Error thrown when a document exists but its latest lifecycle entry is a
+ * deletion, so it cannot be materialized through the regular read/write APIs.
+ */
+class DocumentDeletedError extends Error {
+    constructor(docId) {
+        super(`Document ${docId} has been deleted`);
+        this.name = "DocumentDeletedError";
+        this.docId = docId;
+    }
+}
+exports.DocumentDeletedError = DocumentDeletedError;
+/**
+ * True when `error` signals that a document id cannot be materialized —
+ * either unknown ({@link DocumentNotFoundError}) or deleted
+ * ({@link DocumentDeletedError}). Checks the error `name` in addition to
+ * `instanceof` so it stays reliable when two module copies of mindoodb are
+ * loaded (e.g. a bundled app next to a linked workspace build).
+ */
+function isDocumentMissingError(error) {
+    if (error instanceof DocumentNotFoundError || error instanceof DocumentDeletedError) {
+        return true;
+    }
+    return (error instanceof Error &&
+        (error.name === "DocumentNotFoundError" || error.name === "DocumentDeletedError"));
+}
 //# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,MAAa,yBAA0B,SAAQ,KAAK;IAGlD,YAAY,KAAa;QACvB,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,8DAQC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":";;;AAoDA,wDAQC;AA5DD;;;;GAIG;AACH,MAAa,yBAA0B,SAAQ,KAAK;IAGlD,YAAY,KAAa;QACvB,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,8DAQC;AAED;;;;;GAKG;AACH,MAAa,qBAAsB,SAAQ,KAAK;IAG9C,YAAY,KAAa;QACvB,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,sDAQC;AAED;;;GAGG;AACH,MAAa,oBAAqB,SAAQ,KAAK;IAG7C,YAAY,KAAa;QACvB,KAAK,CAAC,YAAY,KAAK,mBAAmB,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AARD,oDAQC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAClF,CAAC;AACJ,CAAC"}

package/dist/core/expressions/builder.d.ts

@@ -0,0 +1,102 @@
+import type { MindooDBAppBooleanExpression, MindooDBAppExpression, MindooDBAppViewExpressionDatePart } from "./types";
+type Primitive = string | number | boolean | bigint | symbol | null | undefined | Date;
+type NonTraversable = Primitive | Array<unknown>;
+type StringKey<T> = Extract<keyof T, string>;
+/** Dot-separated field paths available on a source document type. */
+export type MindooDBAppFieldPath<T> = T extends NonTraversable ? never : {
+    [K in StringKey<T>]: T[K] extends NonTraversable ? `${K}` : `${K}` | `${K}.${MindooDBAppFieldPath<T[K]>}`;
+}[StringKey<T>];
+/** Resolves the value type located at a dot-separated path. */
+export type MindooDBAppPathValue<T, TPath extends string> = TPath extends `${infer Head}.${infer Tail}` ? Head extends keyof T ? MindooDBAppPathValue<T[Head], Tail> : unknown : TPath extends keyof T ? T[TPath] : unknown;
+/**
+ * Helper arguments accepted by the TypeScript builder.
+ *
+ * Callers can pass a prebuilt expression node or any raw literal value. Raw
+ * values are wrapped into `{ kind: "literal" }` nodes automatically.
+ */
+export type MindooDBAppExpressionInput<T = unknown> = MindooDBAppExpression<T> | T;
+type ExpressionResult<TExpression> = TExpression extends MindooDBAppExpression<infer TResult> ? TResult : TExpression;
+type LetBindings = Record<string, MindooDBAppExpressionInput<unknown>>;
+type LetBindingRefs<TBindings extends LetBindings> = {
+    [K in keyof TBindings]: MindooDBAppExpression<ExpressionResult<TBindings[K]>>;
+};
+/**
+ * Creates the typed builder API used by applications to author Formula
+ * expressions in TypeScript.
+ *
+ * The first generic parameter describes the source document shape used by
+ * `field()`. The optional second generic parameter describes previously
+ * computed column values referenced via `value()`.
+ */
+export declare function createViewLanguage<TDocument extends Record<string, unknown>, TValueContext extends Record<string, unknown> = Record<string, unknown>>(): {
+    literal<T>(value: T): MindooDBAppExpression<T>;
+    string(value: string): MindooDBAppExpression<string>;
+    number(value: number): MindooDBAppExpression<number>;
+    boolean(value: boolean): MindooDBAppBooleanExpression;
+    field<TPath extends MindooDBAppFieldPath<TDocument>>(path: TPath): MindooDBAppExpression<MindooDBAppPathValue<TDocument, TPath>>;
+    value<TPath extends MindooDBAppFieldPath<TValueContext>>(path: TPath): MindooDBAppExpression<MindooDBAppPathValue<TValueContext, TPath>>;
+    origin(): MindooDBAppExpression<string>;
+    createdAt(): MindooDBAppExpression<string | null>;
+    decryptionKeyId(): MindooDBAppExpression<string | null>;
+    isWitnessed(): MindooDBAppBooleanExpression;
+    isAwaitingWitness(): MindooDBAppBooleanExpression;
+    attachmentNames(): MindooDBAppExpression<string[]>;
+    attachmentLengths(): MindooDBAppExpression<number[]>;
+    attachmentCount(): MindooDBAppExpression<number>;
+    childCount(): MindooDBAppExpression<number>;
+    childCategoryCount(): MindooDBAppExpression<number>;
+    childDocumentCount(): MindooDBAppExpression<number>;
+    descendantCount(): MindooDBAppExpression<number>;
+    descendantCategoryCount(): MindooDBAppExpression<number>;
+    descendantDocumentCount(): MindooDBAppExpression<number>;
+    siblingCount(): MindooDBAppExpression<number>;
+    add(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppExpression<number>;
+    sub(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppExpression<number>;
+    mul(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppExpression<number>;
+    div(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppExpression<number>;
+    mod(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppExpression<number>;
+    eq(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    neq(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    gt(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    gte(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    lt(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    lte(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    and(...args: MindooDBAppExpressionInput<boolean>[]): MindooDBAppBooleanExpression;
+    or(...args: MindooDBAppExpressionInput<boolean>[]): MindooDBAppBooleanExpression;
+    not(value: MindooDBAppExpressionInput<boolean>): MindooDBAppBooleanExpression;
+    concat(...args: MindooDBAppExpressionInput[]): MindooDBAppExpression<string>;
+    lower(value: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    upper(value: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    trim(value: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    left(value: MindooDBAppExpressionInput, by: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    right(value: MindooDBAppExpressionInput, by: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    toNumber(value: MindooDBAppExpressionInput): MindooDBAppExpression<number | null>;
+    toString(value: MindooDBAppExpressionInput): MindooDBAppExpression<string>;
+    toBoolean(value: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    contains(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    startsWith(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    endsWith(left: MindooDBAppExpressionInput, right: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    coalesce<T>(...args: MindooDBAppExpressionInput<T>[]): MindooDBAppExpression<T>;
+    exists(value: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    notExists(value: MindooDBAppExpressionInput): MindooDBAppBooleanExpression;
+    pathJoin(...args: MindooDBAppExpressionInput[]): MindooDBAppExpression<string>;
+    datePart(value: MindooDBAppExpressionInput, part: MindooDBAppViewExpressionDatePart): MindooDBAppExpression<string | number | null>;
+    decryptField(field: string, key?: MindooDBAppExpressionInput<string>): MindooDBAppExpression<string | null>;
+    decryptJson(field: string, path?: string, key?: MindooDBAppExpressionInput<string>): MindooDBAppExpression<unknown>;
+    json(field: string, path?: string): MindooDBAppExpression<unknown>;
+    /**
+     * Branching in the style of Domino's `@If`: any number of
+     * condition/value pairs followed by one final default value —
+     * `ifElse(cond1, val1, cond2, val2, ..., default)`. Conditions are
+     * checked in order; the value of the first matching condition wins,
+     * otherwise the default. The classic three-argument form
+     * `ifElse(condition, whenTrue, whenFalse)` is the smallest case.
+     *
+     * Multi-branch calls desugar into nested `if` AST nodes, so the
+     * serialized expression format is unchanged.
+     */
+    ifElse<T>(condition: MindooDBAppExpressionInput<boolean>, whenTrue: MindooDBAppExpressionInput<T>, ...moreBranchesAndDefault: MindooDBAppExpressionInput[]): MindooDBAppExpression<T>;
+    let<TBindings extends LetBindings, TResult>(bindings: TBindings, build: (refs: LetBindingRefs<TBindings>) => MindooDBAppExpressionInput<TResult>): MindooDBAppExpression<TResult>;
+};
+export {};
+//# sourceMappingURL=builder.d.ts.map

package/dist/core/expressions/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../src/core/expressions/builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,iCAAiC,EAClC,MAAM,SAAS,CAAC;AAEjB,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;AACvF,KAAK,cAAc,GAAG,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;AACjD,KAAK,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAe7C,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,cAAc,GAC1D,KAAK,GACL;KACG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAChB,CAAC,CAAC,CAAC,CAAC,SAAS,cAAc,GACvB,GAAG,CAAC,EAAE,GACN,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;CACpD,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpB,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,IACtD,KAAK,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GACvC,IAAI,SAAS,MAAM,CAAC,GAClB,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GACnC,OAAO,GACT,KAAK,SAAS,MAAM,CAAC,GACnB,CAAC,CAAC,KAAK,CAAC,GACR,OAAO,CAAC;AAEhB;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,CAAC,CAAC,GAAG,OAAO,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEnF,KAAK,gBAAgB,CAAC,WAAW,IAAI,WAAW,SAAS,qBAAqB,CAAC,MAAM,OAAO,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC;AAEtH,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;AACvE,KAAK,cAAc,CAAC,SAAS,SAAS,WAAW,IAAI;KAClD,CAAC,IAAI,MAAM,SAAS,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9E,CAAC;AAyBF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YAG7D,CAAC,SAAS,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;kBAGhC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;kBAGtC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;mBAGrC,OAAO,GAAG,4BAA4B;UAG/C,KAAK,SAAS,oBAAoB,CAAC,SAAS,CAAC,QAAQ,KAAK,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;UAG1H,KAAK,SAAS,oBAAoB,CAAC,aAAa,CAAC,QAAQ,KAAK,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;cAG9H,qBAAqB,CAAC,MAAM,CAAC;iBAG1B,qBAAqB,CAAC,MAAM,GAAG,IAAI,CAAC;uBAG9B,qBAAqB,CAAC,MAAM,GAAG,IAAI,CAAC;mBAGxC,4BAA4B;yBAGtB,4BAA4B;uBAG9B,qBAAqB,CAAC,MAAM,EAAE,CAAC;yBAG7B,qBAAqB,CAAC,MAAM,EAAE,CAAC;uBAGjC,qBAAqB,CAAC,MAAM,CAAC;kBAGlC,qBAAqB,CAAC,MAAM,CAAC;0BAGrB,qBAAqB,CAAC,MAAM,CAAC;0BAG7B,qBAAqB,CAAC,MAAM,CAAC;uBAGhC,qBAAqB,CAAC,MAAM,CAAC;+BAGrB,qBAAqB,CAAC,MAAM,CAAC;+BAG7B,qBAAqB,CAAC,MAAM,CAAC;oBAGxC,qBAAqB,CAAC,MAAM,CAAC;cAGnC,0BAA0B,SAAS,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;cAG7F,0BAA0B,SAAS,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;cAG7F,0BAA0B,SAAS,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;cAG7F,0BAA0B,SAAS,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;cAG7F,0BAA0B,SAAS,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;aAG9F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;cAG3F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;aAG7F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;cAG3F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;aAG7F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;cAG3F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;iBAGzF,0BAA0B,CAAC,OAAO,CAAC,EAAE,GAAG,4BAA4B;gBAGrE,0BAA0B,CAAC,OAAO,CAAC,EAAE,GAAG,4BAA4B;eAGrE,0BAA0B,CAAC,OAAO,CAAC,GAAG,4BAA4B;oBAG7D,0BAA0B,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC;iBAG/D,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;iBAG1D,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;gBAG3D,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;gBAG1D,0BAA0B,MAAM,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;iBAGzF,0BAA0B,MAAM,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;oBAGvF,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,GAAG,IAAI,CAAC;oBAGjE,0BAA0B,GAAG,qBAAqB,CAAC,MAAM,CAAC;qBAGzD,0BAA0B,GAAG,4BAA4B;mBAG3D,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;qBAG1F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;mBAG9F,0BAA0B,SAAS,0BAA0B,GAAG,4BAA4B;aAGlG,CAAC,WAAW,0BAA0B,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;kBAGjE,0BAA0B,GAAG,4BAA4B;qBAGtD,0BAA0B,GAAG,4BAA4B;sBAGxD,0BAA0B,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC;oBAG9D,0BAA0B,QAAQ,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;wBAG/G,MAAM,QAAQ,0BAA0B,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAC,MAAM,GAAG,IAAI,CAAC;uBAGxF,MAAM,SAAS,MAAM,QAAQ,0BAA0B,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC;gBAGvG,MAAM,SAAS,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC;IAGlE;;;;;;;;;;OAUG;WACI,CAAC,aACK,0BAA0B,CAAC,OAAO,CAAC,YACpC,0BAA0B,CAAC,CAAC,CAAC,6BACZ,0BAA0B,EAAE,GACtD,qBAAqB,CAAC,CAAC,CAAC;QAmBvB,SAAS,SAAS,WAAW,EAAE,OAAO,YAC9B,SAAS,SACZ,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,KAAK,0BAA0B,CAAC,OAAO,CAAC,GAC9E,qBAAqB,CAAC,OAAO,CAAC;EAcpC"}