@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

package/dist/{chunk-DL4GCSTS.js → chunk-Y2RYUWSQ.js}

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 import {
   SearchNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-lookup/search/tokenize.ts
 var WORD = /[\p{L}\p{N}]+/gu;
@@ -421,31 +421,31 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search } = await import("./collection-facade-V63BEBGU.js");
+      const { search } = await import("./collection-facade-PPKNUR2J.js");
       return search(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve } = await import("./collection-facade-V63BEBGU.js");
+      const { retrieve } = await import("./collection-facade-PPKNUR2J.js");
       return retrieve(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo } = await import("./collection-facade-V63BEBGU.js");
+      const { similarTo } = await import("./collection-facade-PPKNUR2J.js");
       return similarTo(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex } = await import("./collection-facade-V63BEBGU.js");
+      const { warmIndex } = await import("./collection-facade-PPKNUR2J.js");
       return warmIndex(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex } = await import("./collection-facade-V63BEBGU.js");
+      const { flushIndex } = await import("./collection-facade-PPKNUR2J.js");
       return flushIndex(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite } = await import("./collection-facade-V63BEBGU.js");
+      const { embedOnWrite } = await import("./collection-facade-PPKNUR2J.js");
       return embedOnWrite(ctx, id, record, version);
     },
     async rebuildEmbeddings(ctx) {
-      const { rebuildEmbeddings } = await import("./collection-facade-V63BEBGU.js");
+      const { rebuildEmbeddings } = await import("./collection-facade-PPKNUR2J.js");
       return rebuildEmbeddings(ctx);
     }
   };
@@ -492,4 +492,4 @@ export {
   buildBlobFieldEntries,
   withSearch
 };
-//# sourceMappingURL=chunk-DL4GCSTS.js.map
+//# sourceMappingURL=chunk-Y2RYUWSQ.js.map

package/dist/{chunk-7IV7GVOS.js → chunk-YCTSQV7K.js}

@@ -1,11 +1,11 @@
 import {
   assertTierAccess
-} from "./chunk-XQGKS4OW.js";
+} from "./chunk-VKZ3TDET.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-LJ744WXU.js";
+} from "./chunk-F2FD4LSB.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
   unwrapCek,
   wrapCek,
   writeEnvelopeBody
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -36,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -3193,4 +3193,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-7IV7GVOS.js.map
+//# sourceMappingURL=chunk-YCTSQV7K.js.map

package/dist/{chunk-IFUYLIEY.js → chunk-YF7P2DG7.js}

@@ -1,6 +1,6 @@
 import {
   CargoNotEnabledError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -12,4 +12,4 @@ var NO_CARGO = {
 export {
   NO_CARGO
 };
-//# sourceMappingURL=chunk-IFUYLIEY.js.map
+//# sourceMappingURL=chunk-YF7P2DG7.js.map

package/dist/{chunk-PIO6NW7O.js → chunk-ZG7DBIVX.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/via/index.ts
 function isViaPrefixProbe(x) {
@@ -30,4 +30,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-PIO6NW7O.js.map
+//# sourceMappingURL=chunk-ZG7DBIVX.js.map

package/dist/{chunk-NUZ7ROUZ.js → chunk-ZGJ775X7.js}

@@ -1,6 +1,6 @@
 import {
   linkI18nVia
-} from "./chunk-UQRKAM2R.js";
+} from "./chunk-3M2KK7O7.js";
 
 // src/via/i18n/dictionary.ts
 function dictKey(name, keysOrMap, opts) {
@@ -71,4 +71,4 @@ export {
   dictKey,
   staticDict
 };
-//# sourceMappingURL=chunk-NUZ7ROUZ.js.map
+//# sourceMappingURL=chunk-ZGJ775X7.js.map

package/dist/{chunk-6BEBWHNL.js → chunk-ZQQLOEWN.js}

@@ -3,13 +3,13 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   ConflictError,
   USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES,
   UserEnvelopeOversizedError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-party/directory/storage.ts
 var META_COLLECTION = "_meta";
@@ -138,4 +138,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-6BEBWHNL.js.map
+//# sourceMappingURL=chunk-ZQQLOEWN.js.map

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-Z2KP6PNF.js";
+} from "../chunk-CJBWJO5P.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-ID4ZBC3X.js";
-import "../chunk-PIO6NW7O.js";
-import "../chunk-URGHKZPL.js";
+} from "../chunk-NYEXUZDW.js";
+import "../chunk-ZG7DBIVX.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 export {
   ClassifiedConfigError,
   ClassifiedNeverStoredError,

package/dist/{classified-marker-7HXDMYHI.js → classified-marker-HKMRC7SC.js}

@@ -11,11 +11,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-PIORIMMR.js");
+  const { persistClassifiedMarker } = await import("./register-BB34SK7E.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-SO2L2Z5J.js");
+  const { loadPersistedSchema } = await import("./storage-5EGY5OYE.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -23,4 +23,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-7HXDMYHI.js.map
+//# sourceMappingURL=classified-marker-HKMRC7SC.js.map

package/dist/{reveal-UAPBG743.js → classify-reveal-YSJKJEIR.js}

@@ -1,18 +1,13 @@
-import {
-  dualReadSealedSlot
-} from "./chunk-5A3HOTP5.js";
-import "./chunk-Q4DBU5RM.js";
 import {
   isTombstone
-} from "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
+} from "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
 import {
   ClassifiedRevealError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
-// src/capsule/enclave-aes/classify/reveal.ts
-async function revealSealedField(ctx, id, field) {
+// src/capsule/plumbing/classify-reveal.ts
+async function revealSealedField(d, ctx, id, field) {
   const env = await ctx.getEnvelope(id);
   if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {
     throw new ClassifiedRevealError(ctx.collection, field, `record "${id}" not found in "${ctx.collection}"`);
@@ -30,9 +25,9 @@ async function revealSealedField(ctx, id, field) {
   }
   const cek = await ctx.resolveCek(env);
   const dek = await ctx.getDEK();
-  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek));
+  return JSON.parse(await d.dualReadSealedSlot(blob, field, ctx.collection, cek, dek));
 }
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-UAPBG743.js.map
+//# sourceMappingURL=classify-reveal-YSJKJEIR.js.map

package/dist/classify-reveal-YSJKJEIR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/plumbing/classify-reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal — plumbing, not cipher (family#168).\n *\n * Decrypt ONE sealed slot from the raw envelope: no full record view, no\n * `collection.get()`, so no spurious 'get' consent entry. Fail-closed gates\n * (b)/(c) live here; gate (a) (`storage:'never'`) fires in `collection.reveal`\n * before any strategy call.\n *\n * ⭐ The only capsule-bound thing it touches is `dualReadSealedSlot`, which is\n * already plumbing (`sealed-slot.ts`) — so this module was inside\n * `enclave-aes/classify/` for no reason anyone could name, and\n * `via/classified/active.ts` reached it with a dynamic import past the barrel.\n * See `classify-verify.ts`'s header for what that cost.\n * @module\n */\nimport type { CapsuleKey } from '../contract.js'\nimport type { ClassifyVerifyDeps } from './classify-verify.js'\nimport { isTombstone } from './tombstone.js'\nimport { ClassifiedRevealError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\n\n/** Reveal needs ONLY the dual-read — spelled as a slice of the verify deps so\n *  `makeCapsule()` binds one object for both engines. */\nexport type ClassifyRevealDeps = Pick<ClassifyVerifyDeps, 'dualReadSealedSlot'>\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<CapsuleKey | undefined>\n  getDEK(): Promise<CapsuleKey>\n}\n\nexport async function revealSealedField(\n  d: ClassifyRevealDeps,\n  ctx: RevealEngineCtx,\n  id: string,\n  field: string,\n): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await d.dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;AAiCA,eAAsB,kBACpB,GACA,KACA,IACA,OACkB;AAClB,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,EAAE,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACrF;","names":[]}

package/dist/{verify-QWO5UKD6.js → classify-verify-ZCTKYQ43.js}

@@ -1,34 +1,24 @@
-import {
-  blindedEqual,
-  dualReadSealedSlot,
-  openVdigPayload
-} from "./chunk-5A3HOTP5.js";
 import {
   VDIG_ITERATIONS,
-  pbkdf2VerifyDigest
-} from "./chunk-Q4DBU5RM.js";
-import {
-  evaluateKofN
-} from "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import {
   base64ToBuffer,
+  evaluateKofN,
   generateSalt,
   normalizeForVerify
-} from "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
+} from "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-2RH5SEY7.js";
+} from "./chunk-ISIXU45J.js";
 
-// src/capsule/enclave-aes/classify/verify.ts
-async function padOnce(iter = VDIG_ITERATIONS) {
-  const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
-  await blindedEqual(dummy, dummy);
+// src/capsule/plumbing/classify-verify.ts
+async function padOnce(d, iter = VDIG_ITERATIONS) {
+  const dummy = await d.pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
+  await d.blindedEqual(dummy, dummy);
 }
-async function padFalse() {
-  await padOnce();
+async function padFalse(d) {
+  await padOnce(d);
   return { ok: false };
 }
 function refuseSealedResidue(collection, field) {
@@ -37,32 +27,32 @@ function refuseSealedResidue(collection, field) {
     `field "${field}" carries a recoverable _sealed slot but no _vdig \u2014 storage-form transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`
   );
 }
-async function verifyDigestField(ctx, id, field, candidate, policy) {
+async function verifyDigestField(d, ctx, id, field, candidate, policy) {
   const env = await ctx.getEnvelope(id);
-  if (env === null || (env._tier ?? 0) > 0) return padFalse();
+  if (env === null || (env._tier ?? 0) > 0) return padFalse(d);
   const blob = env._vdig?.[field];
   if (blob === void 0) {
     if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
-    return padFalse();
+    return padFalse(d);
   }
   const cek = await ctx.resolveCek(env);
-  if (cek === void 0) return padFalse();
+  if (cek === void 0) return padFalse(d);
   let payload;
   try {
-    payload = await openVdigPayload(blob, cek, ctx.collection, id, field);
+    payload = await d.openVdigPayload(blob, cek, ctx.collection, id, field);
   } catch {
-    return padFalse();
+    return padFalse(d);
   }
   const normalized = normalizeForVerify(policy.normalize, candidate);
-  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
-  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash));
+  const digest = await d.pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
+  const ok = await d.blindedEqual(digest, base64ToBuffer(payload.cur.hash));
   if (!ok) return { ok: false };
   if (policy.rotateDays !== void 0 && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 864e5) {
     return { ok: true, mustRotate: true };
   }
   return { ok: true };
 }
-async function verifyTextField(ctx, id, field, candidate, normalize) {
+async function verifyTextField(d, ctx, id, field, candidate, normalize) {
   const env = await ctx.getEnvelope(id);
   const blob = env?._sealed?.[field];
   let stored;
@@ -70,18 +60,18 @@ async function verifyTextField(ctx, id, field, candidate, normalize) {
     const cek = await ctx.resolveCek(env);
     const dek = await ctx.getDEK();
     try {
-      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
+      stored = String(JSON.parse(await d.dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
     } catch {
       stored = void 0;
     }
   }
-  await padOnce();
+  await padOnce(d);
   const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate));
   const b = stored !== void 0 ? new TextEncoder().encode(normalizeForVerify(normalize, stored)) : a;
-  const eq = await blindedEqual(a, b);
+  const eq = await d.blindedEqual(a, b);
   return { ok: stored !== void 0 && eq };
 }
-async function matchGroupFields(ctx, id, answers, members, opts) {
+async function matchGroupFields(d, ctx, id, answers, members, opts) {
   if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {
     throw new ClassifiedVerifyError(
       ctx.collection,
@@ -113,21 +103,21 @@ async function matchGroupFields(ctx, id, answers, members, opts) {
     const candidate = normalized.get(m.field);
     const blob = env?._vdig?.[m.field];
     if (env === null || cek === void 0 || blob === void 0) {
-      await padOnce();
+      await padOnce(d);
       results.push(false);
       continue;
     }
     try {
-      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field);
+      const payload = await d.openVdigPayload(blob, cek, ctx.collection, id, m.field);
       if (candidate === void 0) {
-        await padOnce(payload.iter);
+        await padOnce(d, payload.iter);
         results.push(false);
         continue;
       }
-      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
-      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
+      const digest = await d.pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
+      results.push(await d.blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
     } catch {
-      await padOnce();
+      await padOnce(d);
       results.push(false);
     }
   }
@@ -138,4 +128,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-QWO5UKD6.js.map
+//# sourceMappingURL=classify-verify-ZCTKYQ43.js.map

package/dist/classify-verify-ZCTKYQ43.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/plumbing/classify-verify.ts"],"sourcesContent":["/**\n * The classify VERIFY oracle — plumbing, not cipher (family#168).\n *\n * ⭐ WHY IT LIVES HERE. Every line below is hub's verify PROTOCOL: the C4\n * timing pad, the R6 residue refusal, the `_tier > 0` non-comparability rule,\n * the k-of-n denominator. None of it chooses a cipher. What it needs from a\n * capsule is four functions — `pbkdf2VerifyDigest`, `blindedEqual`,\n * `openVdigPayload` and the bound `dualReadSealedSlot` — and family#168\n * promoted the first two to {@link CapsulePrimitives} precisely so this module\n * could stop living inside `enclave-aes/classify/`.\n *\n * ⛔ IT WAS NOT A CARVE-OUT, IT WAS A MISSING PRIMITIVE. Until family#168 the\n * four orchestrators below were reached by `via/classified/active.ts` and\n * `kernel/collection.ts` through a dynamic `import()` straight past the\n * enclave barrel, grandfathered in `DYNAMIC_ENCLAVE_BYPASS`. A build whose\n * `#capsule` resolves to another capsule still loaded THESE engines bound to\n * the REFERENCE cipher — the swap silently did not reach the verify oracle.\n * Nothing failed, because the engines happened to be correct for AES.\n *\n * ⚠️ LAZINESS IS THE CALLER'S, AND IT MOVED. `makeCapsule()` binds these\n * through a thunk that `import()`s this module on first call, so opting into\n * `withClassified()` does not drag a PBKDF2 oracle into every bundle. The\n * bundle gate's `classified` scenario measures that; its comments used to say\n * the laziness lived at `active.ts`'s dynamic import, which is no longer true.\n * @module\n */\nimport { VDIG_ITERATIONS, type CapsuleKey, type CapsulePrimitives, type VdigPayload } from '../contract.js'\nimport { generateSalt, base64ToBuffer } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { evaluateKofN } from './kofn.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../kernel/types.js'\n\n/** What the verify engines need from the bound capsule. */\nexport interface ClassifyVerifyDeps {\n  readonly pbkdf2VerifyDigest: CapsulePrimitives['pbkdf2VerifyDigest']\n  readonly blindedEqual: CapsulePrimitives['blindedEqual']\n  readonly openVdigPayload: CapsulePrimitives['openVdigPayload']\n  readonly dualReadSealedSlot: (\n    blob: string, field: string, collection: string, cek: CapsuleKey | undefined, dek: CapsuleKey,\n  ) => Promise<string>\n}\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<CapsuleKey | undefined>\n  getDEK(): Promise<CapsuleKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(d: ClassifyVerifyDeps, iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await d.pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await d.blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(d: ClassifyVerifyDeps): Promise<ClassifiedVerdict> {\n  await padOnce(d)\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  d: ClassifyVerifyDeps,\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse(d)\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse(d)\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse(d)\n\n  let payload: VdigPayload\n  try {\n    payload = await d.openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse(d) // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await d.pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await d.blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  d: ClassifyVerifyDeps,\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await d.dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce(d)\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await d.blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  d: ClassifyVerifyDeps,\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce(d)\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await d.openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(d, payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await d.pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await d.blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce(d)\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyDA,eAAe,QAAQ,GAAuB,OAAe,iBAAgC;AAC3F,QAAM,QAAQ,MAAM,EAAE,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACtF,QAAM,EAAE,aAAa,OAAO,KAAK;AACnC;AAEA,eAAe,SAAS,GAAmD;AACzE,QAAM,QAAQ,CAAC;AACf,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,GACA,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS,CAAC;AAC3D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS,CAAC;AAAA,EACnB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS,CAAC;AAExC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,EAAE,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACxE,QAAQ;AACN,WAAO,SAAS,CAAC;AAAA,EACnB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,EAAE,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACpG,QAAM,KAAK,MAAM,EAAE,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACxE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,GACA,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,EAAE,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC/F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ,CAAC;AACf,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,EAAE,aAAa,GAAG,CAAC;AACpC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,GACA,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ,CAAC;AACf,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,EAAE,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC9E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,GAAG,QAAQ,IAAI;AAC7B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,EAAE,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACnG,cAAQ,KAAK,MAAM,EAAE,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC7E,QAAQ;AACN,YAAM,QAAQ,CAAC;AACf,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/collection-facade-PPKNUR2J.js

@@ -0,0 +1,38 @@
+import {
+  buildPersistedIndexCallbacks,
+  embedOnWrite,
+  flushIndex,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+} from "./chunk-TT4D52EK.js";
+import "./chunk-PZNK4HTV.js";
+import "./chunk-Y2RYUWSQ.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-NYMLINRP.js";
+import "./chunk-ZGJ775X7.js";
+import "./chunk-AHA7UALU.js";
+import "./chunk-3M2KK7O7.js";
+import "./chunk-ZG7DBIVX.js";
+import "./chunk-5JNEDW7I.js";
+import "./chunk-F2FD4LSB.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
+export {
+  buildPersistedIndexCallbacks,
+  embedOnWrite,
+  flushIndex,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-PPKNUR2J.js.map

package/dist/{computed-LZLSYOPG.js → computed-UCYVPMZA.js}

@@ -1,10 +1,10 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-OR3OHKU6.js";
-import "./chunk-2RH5SEY7.js";
+} from "./chunk-VSN5FLMI.js";
+import "./chunk-ISIXU45J.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-LZLSYOPG.js.map
+//# sourceMappingURL=computed-UCYVPMZA.js.map

package/dist/consent/index.js

@@ -2,19 +2,16 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-ND6S2DKC.js";
+} from "../chunk-N5S2BCW3.js";
 import {
   NO_CONSENT
 } from "../chunk-GSAK56VF.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 
 // src/with-audit/consent/active.ts
 function withConsent() {

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/cover/index.js

@@ -14,15 +14,12 @@ import {
   saveCover,
   validateCoverInput,
   validateCoverSize
-} from "../chunk-WQUIJPN4.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
-import "../chunk-2RH5SEY7.js";
+} from "../chunk-OQA7UF2Q.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
+import "../chunk-ISIXU45J.js";
 export {
   COVER_FIELDS,
   COVER_RECORD_ID,

package/dist/custody/index.js

@@ -2,21 +2,19 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-AI35LNWQ.js";
-import "../chunk-QVUMKG3Z.js";
-import "../chunk-6BEBWHNL.js";
-import "../chunk-XQGKS4OW.js";
-import "../chunk-LJ744WXU.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-O6VOR4NH.js";
-import "../chunk-VZFTON37.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-HTRLQ4ZZ.js";
-import "../chunk-EPPAEGH5.js";
-import "../chunk-URGHKZPL.js";
+} from "../chunk-NQQ4MOPC.js";
+import "../chunk-UXH4AKH3.js";
+import "../chunk-ZQQLOEWN.js";
+import "../chunk-KHSBMLQE.js";
+import "../chunk-VKZ3TDET.js";
+import "../chunk-F2FD4LSB.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   CustodyNotEnabledError
-} from "../chunk-2RH5SEY7.js";
+} from "../chunk-ISIXU45J.js";
 export {
   CustodyApi,
   CustodyNotEnabledError,

package/dist/{dead-filter-PZIJ4F4G.js → dead-filter-YOBWRG4O.js}

@@ -1,18 +1,15 @@
 import {
   liveBaseIdSet
-} from "./chunk-X6Z2SIRF.js";
-import "./chunk-WRLWEYHY.js";
-import "./chunk-O6VOR4NH.js";
-import "./chunk-VZFTON37.js";
-import "./chunk-NH2UOV3B.js";
-import "./chunk-HTRLQ4ZZ.js";
-import "./chunk-EPPAEGH5.js";
-import "./chunk-URGHKZPL.js";
-import "./chunk-2RH5SEY7.js";
+} from "./chunk-E2JIE4S3.js";
+import "./chunk-EFINFZIF.js";
+import "./chunk-I4S7IZSS.js";
+import "./chunk-XWWDZKLS.js";
+import "./chunk-CR5UPYIJ.js";
+import "./chunk-ISIXU45J.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-SO2L2Z5J.js");
+  const { loadPersistedSchema } = await import("./storage-5EGY5OYE.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -32,4 +29,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-PZIJ4F4G.js.map
+//# sourceMappingURL=dead-filter-YOBWRG4O.js.map

package/dist/{dead-filter-PZIJ4F4G.js.map → dead-filter-YOBWRG4O.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}