@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/dist/{chunk-7PFOKQOJ.js → chunk-J4L4AS2W.js}

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-shape/satellites/validate.ts
 function validateSatelliteDeclaration(input) {
@@ -47,4 +47,4 @@ export {
   validateSatelliteDeclaration,
   hashFields
 };
-//# sourceMappingURL=chunk-7PFOKQOJ.js.map
+//# sourceMappingURL=chunk-J4L4AS2W.js.map

package/dist/{chunk-PZZWAHEJ.js → chunk-JPSOFWJR.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-PZZWAHEJ.js.map
+//# sourceMappingURL=chunk-JPSOFWJR.js.map

package/dist/{chunk-B24ODIKE.js → chunk-JRCO67NG.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-B24ODIKE.js.map
+//# sourceMappingURL=chunk-JRCO67NG.js.map

package/dist/{chunk-PNEBCVXP.js → chunk-JW3I3NNZ.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -33,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-PNEBCVXP.js.map
+//# sourceMappingURL=chunk-JW3I3NNZ.js.map

package/dist/{chunk-MXNYMFHE.js → chunk-JZMPSQBH.js}

@@ -1,7 +1,7 @@
 import {
   buildLiveReduction,
   compareReduced
-} from "./chunk-2SPWVX6W.js";
+} from "./chunk-SJ2P7UXD.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
@@ -9,14 +9,14 @@ import {
   bindDistinctReducers,
   moneySum,
   sum
-} from "./chunk-J3ECXFU7.js";
+} from "./chunk-TOTCZFRF.js";
 import {
   isDateTruncKey,
   projectDateTruncKeys
 } from "./chunk-XBKH4FOC.js";
 import {
   readPath
-} from "./chunk-WQHEEYQA.js";
+} from "./chunk-NLDBQHDV.js";
 
 // src/with-lookup/reduce/window.ts
 function isWindowFn(v) {
@@ -212,4 +212,4 @@ export {
   WindowedQuery,
   WindowSelection
 };
-//# sourceMappingURL=chunk-MXNYMFHE.js.map
+//# sourceMappingURL=chunk-JZMPSQBH.js.map

package/dist/{chunk-IIQMNZXT.js → chunk-K5TVSOPQ.js}

@@ -2,20 +2,20 @@ import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION
-} from "./chunk-6I5RRBPP.js";
+} from "./chunk-YCTSQV7K.js";
 import {
   installViaBinder
-} from "./chunk-ZZLIFVZG.js";
+} from "./chunk-ZG7DBIVX.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   TamperedError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -472,4 +472,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-IIQMNZXT.js.map
+//# sourceMappingURL=chunk-K5TVSOPQ.js.map

package/dist/{chunk-ZPXCQNXJ.js → chunk-K75SL74I.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-ZPXCQNXJ.js.map
+//# sourceMappingURL=chunk-K75SL74I.js.map

package/dist/{chunk-TA5VTIC4.js → chunk-KA4AAUST.js}

@@ -1,6 +1,6 @@
 import {
   CollectionNotHydratedError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/query/hydration.ts
 var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
@@ -50,4 +50,4 @@ function gateTerminal(gate, terminal, compute) {
 export {
   gateTerminal
 };
-//# sourceMappingURL=chunk-TA5VTIC4.js.map
+//# sourceMappingURL=chunk-KA4AAUST.js.map

package/dist/chunk-KHSBMLQE.js

@@ -0,0 +1,161 @@
+import {
+  NoydbError
+} from "./chunk-ISIXU45J.js";
+
+// src/kernel/validation.ts
+var WeakSecretError = class extends NoydbError {
+  reason;
+  /**
+   * Remediation copy. Empty string when no truthful advice was
+   * available — a `customValidator` rejected the phrase and supplied
+   * none, so the hub has no rules to describe (#1430). Never populated
+   * with the built-in copy in that case: wrong advice is worse than
+   * none, especially for a vault whose own credentials violate it.
+   */
+  suggestion;
+  constructor(reason, suggestion) {
+    const advice = suggestion ?? "";
+    super("WEAK_SECRET", advice ? `Weak secret (${reason}). ${advice}` : `Weak secret (${reason}).`);
+    this.name = "WeakSecretError";
+    this.reason = reason;
+    this.suggestion = advice;
+  }
+};
+var DEFAULT_MIN_WORDS = 6;
+var DEFAULT_MIN_WORD_LENGTH = 3;
+var EXPORT_SECRET_MIN_LENGTH = 12;
+var EXPORT_SECRET_ADVICE = `An export secret must be at least ${EXPORT_SECRET_MIN_LENGTH} characters. Any characters are allowed \u2014 a passphrase, a generated token, or a password-manager string all qualify. It is not the owner phrase rule: uppercase, digits and punctuation are fine.`;
+var EXPORT_SECRET_POLICY = {
+  customValidator: (s) => {
+    if (s.length === 0) return { ok: false, reason: "empty", suggestion: EXPORT_SECRET_ADVICE };
+    if (s.length < EXPORT_SECRET_MIN_LENGTH) {
+      return { ok: false, reason: "too-few-words", suggestion: EXPORT_SECRET_ADVICE };
+    }
+    if (new Set(s).size === 1) {
+      return { ok: false, reason: "repeated-adjacent", suggestion: EXPORT_SECRET_ADVICE };
+    }
+    return { ok: true, words: s.split(" ").filter(Boolean).length };
+  }
+};
+var SUGGESTIONS = {
+  empty: "Provide a phrase of at least 6 lowercase words separated by single spaces.",
+  "invalid-chars": "Use only lowercase letters [a-z] and single spaces. No punctuation, symbols, digits, or uppercase.",
+  "leading-or-trailing-space": "Trim leading and trailing spaces.",
+  "double-space": "Use exactly one space between words.",
+  "too-few-words": 'Use at least 6 words by default (8 under strict policy). Example: "correct horse battery staple printer toaster".',
+  "word-too-short": 'Each word must be at least 3 characters. Drop short fillers like "a", "is", "of".',
+  "repeated-adjacent": "Avoid repeating the same word twice in a row."
+};
+function validateSecret(s, opts) {
+  if (opts?.customValidator) {
+    return opts.customValidator(s);
+  }
+  const minWords = opts?.minWords ?? DEFAULT_MIN_WORDS;
+  const minWordLength = opts?.minWordLength ?? DEFAULT_MIN_WORD_LENGTH;
+  const rejectRepeated = opts?.rejectRepeatedAdjacent ?? true;
+  if (s.length === 0) {
+    return { ok: false, reason: "empty" };
+  }
+  if (s !== s.trim()) {
+    return { ok: false, reason: "leading-or-trailing-space" };
+  }
+  if (s.includes("  ")) {
+    return { ok: false, reason: "double-space" };
+  }
+  const charPattern = opts?.pattern ?? /^[a-z]+( [a-z]+)*$/;
+  if (!charPattern.test(s)) {
+    return { ok: false, reason: "invalid-chars" };
+  }
+  const words = s.split(" ");
+  if (words.length < minWords) {
+    return { ok: false, reason: "too-few-words", minimum: minWords, got: words.length };
+  }
+  for (const w of words) {
+    if (w.length < minWordLength) {
+      return { ok: false, reason: "word-too-short", minimum: minWordLength, got: w.length };
+    }
+  }
+  if (rejectRepeated) {
+    for (let i = 1; i < words.length; i++) {
+      if (words[i] === words[i - 1]) {
+        return { ok: false, reason: "repeated-adjacent" };
+      }
+    }
+  }
+  return { ok: true, words: words.length };
+}
+function resolveSuggestion(result, customValidatorInUse) {
+  if (result.suggestion !== void 0) return result.suggestion;
+  if (customValidatorInUse) return void 0;
+  return SUGGESTIONS[result.reason];
+}
+function assertStrongSecret(s, opts) {
+  if (opts?.allowWeakSecret) return;
+  const result = validateSecret(s, opts);
+  if (result.ok) return;
+  throw new WeakSecretError(
+    result.reason,
+    resolveSuggestion(result, opts?.customValidator !== void 0)
+  );
+}
+function estimateEntropy(secret) {
+  const result = validateSecret(secret);
+  if (!result.ok) return 0;
+  return Math.round(result.words * Math.log2(7776));
+}
+var DEFAULT_ECHO_PROMPT_MIN_WORDS = 3;
+var DEFAULT_ECHO_MIN_WORD_LENGTH = 1;
+function validateEchoSecretDetailed(parts, opts) {
+  for (const part of [parts.prompt, parts.echo, parts.key]) {
+    if (part.trim().length === 0) return { result: { ok: false, reason: "empty" }, failedCheck: "empty" };
+  }
+  const promptPolicy = {
+    minWords: opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS,
+    minWordLength: opts?.prompt?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
+    ...opts?.prompt?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.prompt.rejectRepeatedAdjacent },
+    ...opts?.prompt?.pattern !== void 0 && { pattern: opts.prompt.pattern },
+    ...opts?.prompt?.customValidator !== void 0 && { customValidator: opts.prompt.customValidator }
+  };
+  const promptResult = validateSecret(parts.prompt, promptPolicy);
+  if (!promptResult.ok) return { result: promptResult, failedCheck: "prompt" };
+  const combinedPolicy = {
+    ...opts?.combined?.minWords !== void 0 && { minWords: opts.combined.minWords },
+    minWordLength: opts?.combined?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,
+    ...opts?.combined?.rejectRepeatedAdjacent !== void 0 && { rejectRepeatedAdjacent: opts.combined.rejectRepeatedAdjacent },
+    ...opts?.combined?.pattern !== void 0 && { pattern: opts.combined.pattern },
+    ...opts?.combined?.customValidator !== void 0 && { customValidator: opts.combined.customValidator }
+  };
+  const combinedResult = validateSecret(`${parts.prompt} ${parts.echo} ${parts.key}`, combinedPolicy);
+  return { result: combinedResult, failedCheck: "combined" };
+}
+function validateEchoSecret(parts, opts) {
+  return validateEchoSecretDetailed(parts, opts).result;
+}
+function promptSuggestion(reason, minWords) {
+  if (reason === "too-few-words") {
+    return `The prompt (the part you type first) must be at least ${minWords} words. Example: "sono chiamato vicio".`;
+  }
+  return `The prompt (the part you type first) is the problem. ${SUGGESTIONS[reason]}`;
+}
+function assertStrongEchoSecret(parts, opts) {
+  if (opts?.allowWeakSecret) return;
+  const { result, failedCheck } = validateEchoSecretDetailed(parts, opts);
+  if (result.ok) return;
+  const promptMinWords = opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS;
+  const customInUse = failedCheck === "prompt" ? opts?.prompt?.customValidator !== void 0 : opts?.combined?.customValidator !== void 0;
+  const suggestion = result.suggestion !== void 0 ? result.suggestion : failedCheck === "prompt" && !customInUse ? promptSuggestion(result.reason, promptMinWords) : resolveSuggestion(result, customInUse);
+  throw new WeakSecretError(result.reason, suggestion);
+}
+
+export {
+  WeakSecretError,
+  EXPORT_SECRET_POLICY,
+  validateSecret,
+  assertStrongSecret,
+  estimateEntropy,
+  DEFAULT_ECHO_PROMPT_MIN_WORDS,
+  DEFAULT_ECHO_MIN_WORD_LENGTH,
+  validateEchoSecret,
+  assertStrongEchoSecret
+};
+//# sourceMappingURL=chunk-KHSBMLQE.js.map

package/dist/chunk-KHSBMLQE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/validation.ts"],"sourcesContent":["/**\n * Secret validation — phrase format (per the three-tier session-tiers\n * design, locked 2026-05-04).\n *\n * Secrets are **phrases**: multiple simple words, easy to remember,\n * structurally constrained so a weak choice cannot silently collapse the\n * security floor. The format is intentionally narrow: lowercase letters\n * and single spaces only, no punctuation, no symbols, no digits.\n *\n * - Default minimum: 6 words (~77 bits with the 7,776-word EFF list).\n * - Strict minimum: 8 words (~103 bits).\n * - Per-word minimum: 3 characters (excludes \"a\", \"is\", \"of\").\n * - Adjacent repeats rejected (\"the the\").\n *\n * The hub runs validation default-on at every secret ingress\n * (`createOwnerKeyring`, `grant`, `rotateSecret`); test fixtures and\n * CLI scripts override via `{ allowWeakSecret: true }`.\n *\n * @module\n */\nimport { NoydbError } from './errors.js'\n\n/** All reasons a phrase can be rejected. */\nexport type WeakSecretReason =\n  | 'empty'\n  | 'invalid-chars'\n  | 'leading-or-trailing-space'\n  | 'double-space'\n  | 'too-few-words'\n  | 'word-too-short'\n  | 'repeated-adjacent'\n\n/** Per-vault knobs. Aligns with `VaultPolicy.secret`. */\nexport interface SecretPolicy {\n  /** Minimum number of words. Default 6. Strict policy uses 8. */\n  readonly minWords?: number\n  /** Minimum characters per word. Default 3. */\n  readonly minWordLength?: number\n  /** Reject adjacent identical words (\"the the\"). Default true. */\n  readonly rejectRepeatedAdjacent?: boolean\n  /**\n   * Override the default character-class rule (`/^[a-z]+( [a-z]+)*$/`).\n   *\n   * The hub's strict default is lowercase-letters-and-single-spaces\n   * because that's what the EFF wordlist generator emits and what\n   * most attacker password lists are keyed on. Use this knob to allow\n   * digits, uppercase, hyphens, or non-Latin scripts when the\n   * consumer's audience needs them — e.g.:\n   *\n   * ```ts\n   * // Thai + English mix with digits permitted\n   * pattern: /^[\\p{L}0-9 ]+( [\\p{L}0-9 ]+)*$/u\n   *\n   * // Allow uppercase + hyphens (secret-with-hyphens style)\n   * pattern: /^[A-Za-z]+([- ][A-Za-z]+)*$/\n   * ```\n   *\n   * The OTHER structural rules still apply (min-words split by space,\n   * min-word-length, repeated-adjacent, leading/trailing whitespace,\n   * double-space). For non-space-delimited word semantics, use\n   * {@link customValidator} instead.\n   *\n   */\n  readonly pattern?: RegExp\n  /**\n   * Replace ALL validation entirely with a custom function. When set,\n   * none of the other SecretPolicy fields apply — the consumer\n   * owns every rule (word splitting, character classes, entropy\n   * thresholds, allowlist/denylist). Use sparingly; this is the\n   * escape hatch for domain-specific phrase formats:\n   *\n   *   - Localized wordlists with non-space word boundaries\n   *   - BIP-39 seed phrases (24 words, fixed wordlist, etc.)\n   *   - Organization-specific HR password policies\n   *\n   * The returned `SecretValidationResult` is what\n   * {@link assertStrongSecret} dispatches on — `ok: true` accepts;\n   * `ok: false` throws `WeakSecretError` with the supplied reason.\n   *\n   * ⚠️ Also supply `suggestion` on a rejection (#1430). Because this\n   * knob replaces every default rule, the hub's built-in remediation\n   * copy no longer describes anything true about your vault — so it is\n   * deliberately NOT used here. Omitting `suggestion` yields a bare\n   * `Weak secret (<reason>).`, which is less helpful but never wrong.\n   *\n   */\n  readonly customValidator?: (phrase: string) => SecretValidationResult\n}\n\n/** Result of a check. Discriminated union — compile-time exhaustive. */\nexport type SecretValidationResult =\n  | { readonly ok: true; readonly words: number }\n  | {\n      readonly ok: false\n      readonly reason: WeakSecretReason\n      readonly minimum?: number\n      readonly got?: number\n      /**\n       * Remediation copy for THIS failure, overriding the hub's built-in\n       * `SUGGESTIONS` map (#1430).\n       *\n       * Only a {@link SecretPolicy.customValidator} has any business\n       * setting it: the built-in copy describes the hub's default rules\n       * (\"lowercase letters and single spaces\", \"at least 6 words\"), and\n       * a vault that replaced those rules gets advice contradicting the\n       * format it actually accepts. Supply the copy your rules justify —\n       * and note that a validator returning no `suggestion` produces a\n       * bare `Weak secret (<reason>).` rather than false advice.\n       */\n      readonly suggestion?: string\n    }\n\n/**\n * Thrown by `assertStrongSecret()` and by every hub ingress\n * point (`createOwnerKeyring`, `grant`, `rotateSecret`) when a\n * supplied phrase fails the structural rules above.\n */\nexport class WeakSecretError extends NoydbError {\n  readonly reason: WeakSecretReason\n  /**\n   * Remediation copy. Empty string when no truthful advice was\n   * available — a `customValidator` rejected the phrase and supplied\n   * none, so the hub has no rules to describe (#1430). Never populated\n   * with the built-in copy in that case: wrong advice is worse than\n   * none, especially for a vault whose own credentials violate it.\n   */\n  readonly suggestion: string\n  constructor(reason: WeakSecretReason, suggestion?: string) {\n    const advice = suggestion ?? ''\n    super('WEAK_SECRET', advice ? `Weak secret (${reason}). ${advice}` : `Weak secret (${reason}).`)\n    this.name = 'WeakSecretError'\n    this.reason = reason\n    this.suggestion = advice\n  }\n}\n\nconst DEFAULT_MIN_WORDS = 6\nconst DEFAULT_MIN_WORD_LENGTH = 3\n\n/** The floor, in characters. See {@link EXPORT_SECRET_POLICY}.\n *  ⚠️ NOT exported from the package: knip is right that it reaches no published\n *  entry point, and the number a consumer needs is already in the error message\n *  (`WeakSecretError.suggestion`). Publishing it so a UI can validate ahead of\n *  the call is one line, and worth doing when someone asks rather than on spec. */\nconst EXPORT_SECRET_MIN_LENGTH = 12\n\n/** ⚠️ Carried on every verdict, because `resolveSuggestion` suppresses the\n *  built-in advice whenever a `customValidator` owns the rules — and advice\n *  quoting the six-word phrase rules would be the opposite of the truth here\n *  (the exact misdirection #1430 fixed for the owner path). */\nconst EXPORT_SECRET_ADVICE =\n  `An export secret must be at least ${EXPORT_SECRET_MIN_LENGTH} characters. Any characters are allowed — ` +\n  'a passphrase, a generated token, or a password-manager string all qualify. ' +\n  'It is not the owner phrase rule: uppercase, digits and punctuation are fine.'\n\n/**\n * The bar an EXPORT secret must clear (family#177).\n *\n * ⭐ DELIBERATELY NOT THE OWNER BAR, and the difference is not laxity. The\n * owner default is phrase-shaped — six lowercase words, each ≥3 characters,\n * `/^[a-z]+( [a-z]+)*$/` — because it is a thing a human memorises and types\n * daily, and because that is the shape the EFF generator emits. An export\n * secret is typed once into a dialog or produced by a password manager, so the\n * phrase rules refuse the strongest things a caller is likely to use:\n * `8f3a9c2b1d4e7f0a` fails on `invalid-chars`, and `Tax-Returns-2026!` fails\n * twice over.\n *\n * ⛔ SO THE BAR IS LENGTH, 12 CHARACTERS, AND NOTHING ELSE. Measured against\n * the real secrets in this repo and the shapes a consumer actually passes:\n *\n *   BLOCKED  p · pw · pw1 · r-pw · aud-pw · bob-pw · new-pw · alice-pw · hunter2\n *   ALLOWED  Tax-Returns-2026! · 8f3a9c2b1d4e7f0a · source-pw-2026 ·\n *            client-takeaway · correct horse battery staple\n *\n * That is the whole claim: it refuses what a human picks when they are not\n * thinking, and refuses nothing a human or a generator picks when they are.\n *\n * ⚠️ A single repeated character is refused too, because `aaaaaaaaaaaa` clears\n * any length floor and clears no attacker's wordlist.\n *\n * ⚠️ 12 characters is a FLOOR, not a claim about entropy — roughly 40-50 bits\n * for a human-chosen password, well under the owner phrase's ~77. It is sized\n * to stop the hazard (a one-character export secret on a file built to travel)\n * without blocking ordinary use, and the PBKDF2 600K derivation still sits\n * underneath it. A consumer who wants more passes a longer secret.\n */\nexport const EXPORT_SECRET_POLICY: SecretPolicy = {\n  customValidator: (s: string): SecretValidationResult => {\n    if (s.length === 0) return { ok: false, reason: 'empty', suggestion: EXPORT_SECRET_ADVICE }\n    if (s.length < EXPORT_SECRET_MIN_LENGTH) {\n      return { ok: false, reason: 'too-few-words', suggestion: EXPORT_SECRET_ADVICE }\n    }\n    if (new Set(s).size === 1) {\n      return { ok: false, reason: 'repeated-adjacent', suggestion: EXPORT_SECRET_ADVICE }\n    }\n    return { ok: true, words: s.split(' ').filter(Boolean).length }\n  },\n}\n\nconst SUGGESTIONS: Record<WeakSecretReason, string> = {\n  empty: 'Provide a phrase of at least 6 lowercase words separated by single spaces.',\n  'invalid-chars':\n    'Use only lowercase letters [a-z] and single spaces. No punctuation, symbols, digits, or uppercase.',\n  'leading-or-trailing-space': 'Trim leading and trailing spaces.',\n  'double-space': 'Use exactly one space between words.',\n  'too-few-words':\n    'Use at least 6 words by default (8 under strict policy). Example: \"correct horse battery staple printer toaster\".',\n  'word-too-short': 'Each word must be at least 3 characters. Drop short fillers like \"a\", \"is\", \"of\".',\n  'repeated-adjacent': 'Avoid repeating the same word twice in a row.',\n}\n\n/**\n * Inspect a phrase against the format rules and return a structured\n * verdict. Never throws — callers either branch on `ok` or pass the\n * result to {@link assertStrongSecret} for the throwing flavour.\n */\nexport function validateSecret(\n  s: string,\n  opts?: SecretPolicy,\n): SecretValidationResult {\n  // Escape hatch: customValidator owns the entire decision. None of\n  // the structural rules below run when this is set — the consumer is\n  // responsible for the full validation contract.\n  if (opts?.customValidator) {\n    return opts.customValidator(s)\n  }\n\n  const minWords = opts?.minWords ?? DEFAULT_MIN_WORDS\n  const minWordLength = opts?.minWordLength ?? DEFAULT_MIN_WORD_LENGTH\n  const rejectRepeated = opts?.rejectRepeatedAdjacent ?? true\n\n  if (s.length === 0) {\n    return { ok: false, reason: 'empty' }\n  }\n\n  if (s !== s.trim()) {\n    return { ok: false, reason: 'leading-or-trailing-space' }\n  }\n\n  if (s.includes('  ')) {\n    return { ok: false, reason: 'double-space' }\n  }\n\n  // The default character class is lowercase-letters-and-spaces;\n  // consumers can override via SecretPolicy.pattern (e.g. to\n  // allow digits, uppercase, or non-Latin scripts). Word splitting\n  // below remains space-based — for non-space word semantics the\n  // consumer should use customValidator instead.\n  const charPattern = opts?.pattern ?? /^[a-z]+( [a-z]+)*$/\n  if (!charPattern.test(s)) {\n    return { ok: false, reason: 'invalid-chars' }\n  }\n\n  const words = s.split(' ')\n\n  if (words.length < minWords) {\n    return { ok: false, reason: 'too-few-words', minimum: minWords, got: words.length }\n  }\n\n  for (const w of words) {\n    if (w.length < minWordLength) {\n      return { ok: false, reason: 'word-too-short', minimum: minWordLength, got: w.length }\n    }\n  }\n\n  if (rejectRepeated) {\n    for (let i = 1; i < words.length; i++) {\n      if (words[i] === words[i - 1]) {\n        return { ok: false, reason: 'repeated-adjacent' }\n      }\n    }\n  }\n\n  return { ok: true, words: words.length }\n}\n\n/**\n * Throw {@link WeakSecretError} when the phrase fails. Used by\n * `createOwnerKeyring`, `grant`, and `rotateSecret` at ingress.\n *\n * Pass `{ allowWeakSecret: true }` to bypass — intended for test\n * fixtures, CLI scripts, and dev environments. The override never\n * loosens the cryptographic key derivation; it only relaxes the\n * structural-strength gate.\n */\n/**\n * Pick the remediation copy for a failed check (#1430).\n *\n * The built-in `SUGGESTIONS` map describes the hub's DEFAULT rules. A\n * `customValidator` replaces those rules wholesale, so quoting the map\n * then tells the user to do something the vault will reject — the\n * reported case was a vault accepting `ann-saraphia1-2026`-shaped\n * phrases being advised \"no digits, no punctuation, six English words\".\n * The rejection was right and the advice was the opposite of the truth.\n *\n * Precedence: the validator's own copy, else nothing when a validator\n * owns the rules, else the built-in map. Same rationale as\n * {@link promptSuggestion}, which already overrides the map where it\n * would misdirect.\n */\nfunction resolveSuggestion(\n  result: Extract<SecretValidationResult, { ok: false }>,\n  customValidatorInUse: boolean,\n): string | undefined {\n  if (result.suggestion !== undefined) return result.suggestion\n  if (customValidatorInUse) return undefined\n  return SUGGESTIONS[result.reason]\n}\n\nexport function assertStrongSecret(\n  s: string,\n  opts?: SecretPolicy & { allowWeakSecret?: boolean },\n): void {\n  if (opts?.allowWeakSecret) return\n  const result = validateSecret(s, opts)\n  if (result.ok) return\n  throw new WeakSecretError(\n    result.reason,\n    resolveSuggestion(result, opts?.customValidator !== undefined),\n  )\n}\n\n/**\n * Estimate the entropy of a phrase, given the EFF 7,776-word list as\n * the assumed wordlist. ~12.9 bits per word.\n *\n * Returns 0 for any input that fails the phrase format — character-class\n * estimates aren't comparable to phrase entropy, and surfacing 0 makes\n * weak inputs visible in any UI that displays an entropy meter.\n */\nexport function estimateEntropy(secret: string): number {\n  const result = validateSecret(secret)\n  if (!result.ok) return 0\n  return Math.round(result.words * Math.log2(7776))\n}\n\n/** Dedicated floors for the echo mode's three parts (spec resolved Q1/Q5). */\nexport interface EchoSecretPolicy {\n  /** Floor for the typed prompt — the brute-forceable-in-isolation part. */\n  readonly prompt?: SecretPolicy\n  /** Policy for the combined parts (defaults to the standard whole-secret rules). */\n  readonly combined?: SecretPolicy\n}\n\nexport const DEFAULT_ECHO_PROMPT_MIN_WORDS = 3\n/**\n * Default per-word character floor for echo-mode validation (prompt AND\n * combined checks). Relaxed to 1 from the standard 3-char floor\n * ({@link DEFAULT_MIN_WORD_LENGTH}) — echo secrets are natural-language\n * sentences (spec #940's canonical example is Italian), and Romance\n * languages are full of 2-letter function words (\"mi\", \"da\", \"al\") that\n * the standard floor would otherwise reject even though the combined\n * secret is plenty strong. Word-COUNT floors (prompt 3, combined 6) are\n * unchanged — this only relaxes per-word length.\n */\nexport const DEFAULT_ECHO_MIN_WORD_LENGTH = 1\n\n/** Which of `validateEchoSecret`'s three internal checks produced a result. */\ntype EchoSecretCheck = 'empty' | 'prompt' | 'combined'\n\n/**\n * `validateEchoSecret` plus which check produced the result — lets\n * `assertStrongEchoSecret` pick the prompt-specific suggestion without\n * re-running `validateSecret` on the failure path. Internal: NOT\n * package-exported (the public `validateEchoSecret`/`SecretValidationResult`\n * contract stays exactly as before).\n */\nfunction validateEchoSecretDetailed(\n  parts: { readonly prompt: string; readonly echo: string; readonly key: string },\n  opts?: EchoSecretPolicy,\n): { readonly result: SecretValidationResult; readonly failedCheck: EchoSecretCheck } {\n  // Trimmed: a whitespace-only part carries no secret material, so it is\n  // 'empty' rather than a confusing spacing complaint.\n  for (const part of [parts.prompt, parts.echo, parts.key]) {\n    if (part.trim().length === 0) return { result: { ok: false, reason: 'empty' }, failedCheck: 'empty' }\n  }\n  // Field-by-field construction (not a spread of `opts?.prompt`) so an\n  // explicit `{ prompt: { minWords: undefined } }` override falls back to\n  // the ECHO prompt default (3) rather than reintroducing `undefined` as\n  // an own property that would then hit `validateSecret`'s STANDARD\n  // default (6) — a spread copies an explicit-`undefined` key verbatim and\n  // clobbers the default set here. Each optional field is included only\n  // when actually set (`exactOptionalPropertyTypes`).\n  const promptPolicy: SecretPolicy = {\n    minWords: opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS,\n    minWordLength: opts?.prompt?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,\n    ...(opts?.prompt?.rejectRepeatedAdjacent !== undefined\n      && { rejectRepeatedAdjacent: opts.prompt.rejectRepeatedAdjacent }),\n    ...(opts?.prompt?.pattern !== undefined && { pattern: opts.prompt.pattern }),\n    ...(opts?.prompt?.customValidator !== undefined && { customValidator: opts.prompt.customValidator }),\n  }\n  const promptResult = validateSecret(parts.prompt, promptPolicy)\n  if (!promptResult.ok) return { result: promptResult, failedCheck: 'prompt' }\n  // Same field-by-field construction as promptPolicy above (not a spread of\n  // `opts?.combined`) so the combined check's minWordLength defaults to the\n  // echo floor too, while minWords keeps the standard whole-secret default\n  // (6) when the caller doesn't override it.\n  const combinedPolicy: SecretPolicy = {\n    ...(opts?.combined?.minWords !== undefined && { minWords: opts.combined.minWords }),\n    minWordLength: opts?.combined?.minWordLength ?? DEFAULT_ECHO_MIN_WORD_LENGTH,\n    ...(opts?.combined?.rejectRepeatedAdjacent !== undefined\n      && { rejectRepeatedAdjacent: opts.combined.rejectRepeatedAdjacent }),\n    ...(opts?.combined?.pattern !== undefined && { pattern: opts.combined.pattern }),\n    ...(opts?.combined?.customValidator !== undefined && { customValidator: opts.combined.customValidator }),\n  }\n  const combinedResult = validateSecret(`${parts.prompt} ${parts.echo} ${parts.key}`, combinedPolicy)\n  return { result: combinedResult, failedCheck: 'combined' }\n}\n\n/** Validate a 3-part echo secret. Never throws. */\nexport function validateEchoSecret(\n  parts: { readonly prompt: string; readonly echo: string; readonly key: string },\n  opts?: EchoSecretPolicy,\n): SecretValidationResult {\n  return validateEchoSecretDetailed(parts, opts).result\n}\n\n/**\n * Suggestion copy for a failure that came from the PROMPT's dedicated floor.\n * The generic `SUGGESTIONS` copy quotes the 6-word whole-secret floor, which\n * misdirects an owner whose prompt only has to clear 3 words.\n */\nfunction promptSuggestion(reason: WeakSecretReason, minWords: number): string {\n  if (reason === 'too-few-words') {\n    return `The prompt (the part you type first) must be at least ${minWords} words. Example: \"sono chiamato vicio\".`\n  }\n  return `The prompt (the part you type first) is the problem. ${SUGGESTIONS[reason]}`\n}\n\n/** Throwing form of {@link validateEchoSecret}. */\nexport function assertStrongEchoSecret(\n  parts: { readonly prompt: string; readonly echo: string; readonly key: string },\n  opts?: EchoSecretPolicy & { allowWeakSecret?: boolean },\n): void {\n  if (opts?.allowWeakSecret) return\n  const { result, failedCheck } = validateEchoSecretDetailed(parts, opts)\n  if (result.ok) return\n\n  const promptMinWords = opts?.prompt?.minWords ?? DEFAULT_ECHO_PROMPT_MIN_WORDS\n  // #1430 — a validator-supplied suggestion outranks both the prompt copy\n  // and the map, and the half that failed decides which validator is the\n  // one that owns the rules here.\n  const customInUse = failedCheck === 'prompt'\n    ? opts?.prompt?.customValidator !== undefined\n    : opts?.combined?.customValidator !== undefined\n  const suggestion = result.suggestion !== undefined\n    ? result.suggestion\n    : failedCheck === 'prompt' && !customInUse\n      ? promptSuggestion(result.reason, promptMinWords)\n      : resolveSuggestion(result, customInUse)\n\n  throw new WeakSecretError(result.reason, suggestion)\n}\n"],"mappings":";;;;;AAqHO,IAAM,kBAAN,cAA8B,WAAW;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EACT,YAAY,QAA0B,YAAqB;AACzD,UAAM,SAAS,cAAc;AAC7B,UAAM,eAAe,SAAS,gBAAgB,MAAM,MAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC/F,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;AAEA,IAAM,oBAAoB;AAC1B,IAAM,0BAA0B;AAOhC,IAAM,2BAA2B;AAMjC,IAAM,uBACJ,qCAAqC,wBAAwB;AAmCxD,IAAM,uBAAqC;AAAA,EAChD,iBAAiB,CAAC,MAAsC;AACtD,QAAI,EAAE,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,YAAY,qBAAqB;AAC1F,QAAI,EAAE,SAAS,0BAA0B;AACvC,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,YAAY,qBAAqB;AAAA,IAChF;AACA,QAAI,IAAI,IAAI,CAAC,EAAE,SAAS,GAAG;AACzB,aAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB,YAAY,qBAAqB;AAAA,IACpF;AACA,WAAO,EAAE,IAAI,MAAM,OAAO,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,OAAO;AAAA,EAChE;AACF;AAEA,IAAM,cAAgD;AAAA,EACpD,OAAO;AAAA,EACP,iBACE;AAAA,EACF,6BAA6B;AAAA,EAC7B,gBAAgB;AAAA,EAChB,iBACE;AAAA,EACF,kBAAkB;AAAA,EAClB,qBAAqB;AACvB;AAOO,SAAS,eACd,GACA,MACwB;AAIxB,MAAI,MAAM,iBAAiB;AACzB,WAAO,KAAK,gBAAgB,CAAC;AAAA,EAC/B;AAEA,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,QAAM,iBAAiB,MAAM,0BAA0B;AAEvD,MAAI,EAAE,WAAW,GAAG;AAClB,WAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACtC;AAEA,MAAI,MAAM,EAAE,KAAK,GAAG;AAClB,WAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,EAC1D;AAEA,MAAI,EAAE,SAAS,IAAI,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,QAAQ,eAAe;AAAA,EAC7C;AAOA,QAAM,cAAc,MAAM,WAAW;AACrC,MAAI,CAAC,YAAY,KAAK,CAAC,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAAA,EAC9C;AAEA,QAAM,QAAQ,EAAE,MAAM,GAAG;AAEzB,MAAI,MAAM,SAAS,UAAU;AAC3B,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,SAAS,UAAU,KAAK,MAAM,OAAO;AAAA,EACpF;AAEA,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,SAAS,eAAe;AAC5B,aAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB,SAAS,eAAe,KAAK,EAAE,OAAO;AAAA,IACtF;AAAA,EACF;AAEA,MAAI,gBAAgB;AAClB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAI,MAAM,CAAC,MAAM,MAAM,IAAI,CAAC,GAAG;AAC7B,eAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,OAAO;AACzC;AA0BA,SAAS,kBACP,QACA,sBACoB;AACpB,MAAI,OAAO,eAAe,OAAW,QAAO,OAAO;AACnD,MAAI,qBAAsB,QAAO;AACjC,SAAO,YAAY,OAAO,MAAM;AAClC;AAEO,SAAS,mBACd,GACA,MACM;AACN,MAAI,MAAM,gBAAiB;AAC3B,QAAM,SAAS,eAAe,GAAG,IAAI;AACrC,MAAI,OAAO,GAAI;AACf,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,kBAAkB,QAAQ,MAAM,oBAAoB,MAAS;AAAA,EAC/D;AACF;AAUO,SAAS,gBAAgB,QAAwB;AACtD,QAAM,SAAS,eAAe,MAAM;AACpC,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,SAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI,CAAC;AAClD;AAUO,IAAM,gCAAgC;AAWtC,IAAM,+BAA+B;AAY5C,SAAS,2BACP,OACA,MACoF;AAGpF,aAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,GAAG;AACxD,QAAI,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,QAAQ,EAAE,IAAI,OAAO,QAAQ,QAAQ,GAAG,aAAa,QAAQ;AAAA,EACtG;AAQA,QAAM,eAA6B;AAAA,IACjC,UAAU,MAAM,QAAQ,YAAY;AAAA,IACpC,eAAe,MAAM,QAAQ,iBAAiB;AAAA,IAC9C,GAAI,MAAM,QAAQ,2BAA2B,UACxC,EAAE,wBAAwB,KAAK,OAAO,uBAAuB;AAAA,IAClE,GAAI,MAAM,QAAQ,YAAY,UAAa,EAAE,SAAS,KAAK,OAAO,QAAQ;AAAA,IAC1E,GAAI,MAAM,QAAQ,oBAAoB,UAAa,EAAE,iBAAiB,KAAK,OAAO,gBAAgB;AAAA,EACpG;AACA,QAAM,eAAe,eAAe,MAAM,QAAQ,YAAY;AAC9D,MAAI,CAAC,aAAa,GAAI,QAAO,EAAE,QAAQ,cAAc,aAAa,SAAS;AAK3E,QAAM,iBAA+B;AAAA,IACnC,GAAI,MAAM,UAAU,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS,SAAS;AAAA,IACjF,eAAe,MAAM,UAAU,iBAAiB;AAAA,IAChD,GAAI,MAAM,UAAU,2BAA2B,UAC1C,EAAE,wBAAwB,KAAK,SAAS,uBAAuB;AAAA,IACpE,GAAI,MAAM,UAAU,YAAY,UAAa,EAAE,SAAS,KAAK,SAAS,QAAQ;AAAA,IAC9E,GAAI,MAAM,UAAU,oBAAoB,UAAa,EAAE,iBAAiB,KAAK,SAAS,gBAAgB;AAAA,EACxG;AACA,QAAM,iBAAiB,eAAe,GAAG,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,GAAG,IAAI,cAAc;AAClG,SAAO,EAAE,QAAQ,gBAAgB,aAAa,WAAW;AAC3D;AAGO,SAAS,mBACd,OACA,MACwB;AACxB,SAAO,2BAA2B,OAAO,IAAI,EAAE;AACjD;AAOA,SAAS,iBAAiB,QAA0B,UAA0B;AAC5E,MAAI,WAAW,iBAAiB;AAC9B,WAAO,yDAAyD,QAAQ;AAAA,EAC1E;AACA,SAAO,wDAAwD,YAAY,MAAM,CAAC;AACpF;AAGO,SAAS,uBACd,OACA,MACM;AACN,MAAI,MAAM,gBAAiB;AAC3B,QAAM,EAAE,QAAQ,YAAY,IAAI,2BAA2B,OAAO,IAAI;AACtE,MAAI,OAAO,GAAI;AAEf,QAAM,iBAAiB,MAAM,QAAQ,YAAY;AAIjD,QAAM,cAAc,gBAAgB,WAChC,MAAM,QAAQ,oBAAoB,SAClC,MAAM,UAAU,oBAAoB;AACxC,QAAM,aAAa,OAAO,eAAe,SACrC,OAAO,aACP,gBAAgB,YAAY,CAAC,cAC3B,iBAAiB,OAAO,QAAQ,cAAc,IAC9C,kBAAkB,QAAQ,WAAW;AAE3C,QAAM,IAAI,gBAAgB,OAAO,QAAQ,UAAU;AACrD;","names":[]}

package/dist/{chunk-JWLVBYP4.js → chunk-KUGUML7H.js}

@@ -9,13 +9,13 @@ import {
   exportDekSet,
   generateEphemeralKey,
   importDekSet
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-party/session/session.ts
 var DEFAULT_TTL_MS = 60 * 60 * 1e3;
@@ -323,4 +323,4 @@ export {
   clearDevUnlock,
   isDevUnlockActive
 };
-//# sourceMappingURL=chunk-JWLVBYP4.js.map
+//# sourceMappingURL=chunk-KUGUML7H.js.map

package/dist/{chunk-GWYZEPBY.js → chunk-L4J5NC2Q.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-formula/overlay-views/with-overlayed-view.ts
 function withOverlayedView(spec) {
@@ -33,4 +33,4 @@ function withOverlayedView(spec) {
 export {
   withOverlayedView
 };
-//# sourceMappingURL=chunk-GWYZEPBY.js.map
+//# sourceMappingURL=chunk-L4J5NC2Q.js.map

package/dist/{chunk-PIF3TNU2.js → chunk-LIX4QPMM.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-WQHEEYQA.js";
+} from "./chunk-NLDBQHDV.js";
 
 // src/with-lookup/indexing/index-snapshot.ts
 var FIELD_INDEX_SNAPSHOT_VERSION = 1;
@@ -933,4 +933,4 @@ export {
   normalizeIndexDefs,
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-PIF3TNU2.js.map
+//# sourceMappingURL=chunk-LIX4QPMM.js.map

package/dist/{chunk-LCY6ANV2.js → chunk-LWQFGR34.js}

@@ -1,9 +1,9 @@
 import {
   matchesReferencingValue
-} from "./chunk-S2BQV6HM.js";
+} from "./chunk-RIACRFWA.js";
 import {
   PeriodClosedError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/via/dispatch.ts
 function touchFor(batch, collection) {
@@ -173,4 +173,4 @@ export {
   forgetDerivedFanout,
   selfWriteFieldEqual
 };
-//# sourceMappingURL=chunk-LCY6ANV2.js.map
+//# sourceMappingURL=chunk-LWQFGR34.js.map

package/dist/{chunk-HQPS27BT.js → chunk-MMSSHMHW.js}

@@ -1,7 +1,7 @@
 import {
   NoydbError,
   ValidationError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-shape/links/names.ts
 var LINK_COLLECTION_PREFIX = "_links_";
@@ -60,4 +60,4 @@ export {
   linkRowKey,
   LinkIntegrityError
 };
-//# sourceMappingURL=chunk-HQPS27BT.js.map
+//# sourceMappingURL=chunk-MMSSHMHW.js.map

package/dist/{chunk-T5EXREMW.js → chunk-N25Z6PR4.js}

@@ -3,20 +3,20 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-TLIFNRU5.js";
+} from "./chunk-63LZLRWG.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-IF2M43G4.js";
+} from "./chunk-PBRD75JF.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-QHG7GQKM.js";
+} from "./chunk-5JNEDW7I.js";
 import {
   buildSealedRecordEnvelope,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -44,6 +44,7 @@ async function saveSchemaManifest(store, vault, manifest, expectedVersion, getDE
     {}
   );
   await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion);
+  return env;
 }
 async function computeAggregateHash(collections) {
   return sha256Hex(canonicalJson(collections));
@@ -84,4 +85,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-T5EXREMW.js.map
+//# sourceMappingURL=chunk-N25Z6PR4.js.map

package/dist/chunk-N25Z6PR4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/manifest/types.ts","../src/with-shape/manifest/storage.ts","../src/with-shape/manifest/derive.ts"],"sourcesContent":["/**\n * The pod-wide **schema manifest** record type (#941).\n *\n * This is an INDEX, not a full-inline manifest: `SchemaManifest.collections`\n * carries per-collection *metadata* (generation / content hash / field ids),\n * never the JSON Schema body itself. The JSON Schema stays the source of\n * truth at `_schemas/<collection>`, encrypted under that collection's own\n * DEK (see `with-shape/persisted-schemas`). Inlining full schemas into one\n * pod-wide manifest record would either leak every collection's schema to a\n * principal scoped to a single collection, or force the manifest itself\n * onto a collection-DEK it has no business holding — the index preserves\n * per-collection DEK isolation while still giving a single place to answer\n * \"what schema generation is this pod at, and does collection X's stored\n * schema match its declared content hash.\"\n *\n * `aggregateHash` binds the whole per-collection index's content: it is\n * `sha256Hex(canonicalJson(collections))`, so any change to any collection's\n * entry (a new generation, a changed hash, added/renamed field ids) changes\n * `aggregateHash` too. Canonical JSON (sorted object keys, no whitespace)\n * makes the hash independent of the map's key insertion order.\n *\n * @module\n */\n\n/** Per-collection entry inside a {@link SchemaManifest}'s `collections` index. */\nexport interface SchemaManifestEntry {\n  /** The vault-wide schema-fence generation this collection's schema was last written at. */\n  readonly generation: number\n  /** SHA-256 (hex) of the collection's canonicalised JSON Schema (see `persisted-schemas/derive.ts`). */\n  readonly contentHash: string\n  /** Stable per-field ids (#946), keyed by the field's current name. Absent when the collection has none. */\n  readonly fieldIds?: Record<string, string>\n}\n\n/**\n * The pod-wide schema manifest — one record per pod, stored at\n * `_manifest/schema` (see `storage.ts`). An INDEX over the per-collection\n * `_schemas/<collection>` entries, not the schemas themselves.\n */\nexport interface SchemaManifest {\n  readonly v: 1\n  readonly kind: 'schema'\n  /** Pod-wide schema-fence generation (`FenceDoc.currentSchemaVersion`) as of this manifest's derivation. */\n  readonly generation: number\n  /** Per-collection index: collection name → its manifest entry. */\n  readonly collections: Record<string, SchemaManifestEntry>\n  /** `sha256Hex(canonicalJson(collections))` — the pod-wide content binding over the index. */\n  readonly aggregateHash: string\n}\n\n/** The record id the schema manifest is stored under inside `_manifest`. */\nexport const MANIFEST_SCHEMA_RECORD_ID = 'schema' as const\n","/**\n * Read / write the pod-wide `_manifest/schema` envelope.\n *\n * Mirrors `with-shape/persisted-schemas/storage.ts`'s shape: the same\n * standard noy-db record envelope, AES-GCM encrypted with a collection DEK\n * (here, the `_manifest` collection's own DEK — the manifest INDEX\n * discloses collection names + hashes + generations + field ids, metadata\n * rather than schema bodies, so it gets the same encryption grain as\n * `_schemas` itself).\n *\n * Storage layout:\n *\n *   <vault>/_manifest/schema   →   EncryptedEnvelope\n *\n * Unlike `persisted-schemas/storage.ts` (which takes an already-resolved\n * `EnclaveKey`), these functions take a `getDEK` resolver and call\n * `getDEK(MANIFEST_COLLECTION)` themselves — there is exactly one manifest\n * record per pod, so there is no per-collection DEK the caller needs to\n * pick; resolving it here keeps every manifest call-site symmetric.\n *\n * @module\n */\n\nimport { buildSealedRecordEnvelope, openEnvelopeJson, writeEnvelopeBody, type EnclaveKey } from '../../capsule/index.js'\nimport { canonicalJson, sha256Hex } from '../../with-commit/history/ledger/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest, type SchemaManifestEntry } from './types.js'\n\n/** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */\nexport type GetManifestDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/**\n * A decrypted schema-manifest read paired with the wrapping envelope's `_v`\n * — the optimistic-concurrency token. Pass `version` back to\n * {@link saveSchemaManifest} (via `writeSchemaManifest`'s `expectedVersion`)\n * to make the write a strict CAS.\n */\nexport interface LoadedSchemaManifest {\n  /** Wrapping envelope `_v`. */\n  readonly version: number\n  /** Decrypted schema manifest. */\n  readonly manifest: SchemaManifest\n}\n\n/**\n * Read the `_manifest/schema` envelope together with its wrapping `_v`.\n * Returns `undefined` when no manifest has ever been written, when the\n * envelope fails to decrypt (wrong DEK), or when it doesn't parse as a\n * `v: 1, kind: 'schema'` manifest.\n */\nexport async function loadSchemaManifestEntry(\n  store: NoydbStore,\n  vault: string,\n  getDEK: GetManifestDEK,\n): Promise<LoadedSchemaManifest | undefined> {\n  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID)\n  if (!envelope) return undefined\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  try {\n    const plaintext = await openEnvelopeJson({ collection: MANIFEST_COLLECTION, id: MANIFEST_SCHEMA_RECORD_ID }, envelope, dek)\n    const parsed = JSON.parse(plaintext) as SchemaManifest\n    if (parsed.v !== 1 || parsed.kind !== 'schema') return undefined\n    return { version: envelope._v, manifest: parsed }\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist the schema manifest as a strict CAS write:\n * `expectedVersion` must match the stored envelope's `_v` (0 when no\n * envelope exists yet) or `store.put` throws `ConflictError` — surfaced by\n * `writer.ts`'s `writeSchemaManifest` as `ManifestConflictError` rather than\n * retried.\n */\nexport async function saveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  manifest: SchemaManifest,\n  expectedVersion: number,\n  getDEK: GetManifestDEK,\n  // family#197 — returns the envelope it WROTE, so the ledger append can hash\n  // exactly that rather than re-reading the record (where a concurrent writer's\n  // newer envelope would be hashed against our version number).\n): Promise<EncryptedEnvelope> {\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  const json = JSON.stringify(manifest)\n  const env = await buildSealedRecordEnvelope(\n    { collection: MANIFEST_COLLECTION, id: MANIFEST_SCHEMA_RECORD_ID, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, json, dek),\n    {},\n  )\n  await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion)\n  return env\n}\n\n/**\n * `sha256Hex(canonicalJson(collections))` — the pod-wide content binding\n * over a schema manifest's per-collection index. Canonical JSON sorts\n * object keys at every depth, so the result is independent of the map's\n * key insertion order. Shared by the writer's tests and (#941 Task 3) the\n * derivation path, so the hash is computed identically everywhere.\n */\nexport async function computeAggregateHash(\n  collections: Record<string, SchemaManifestEntry>,\n): Promise<string> {\n  return sha256Hex(canonicalJson(collections))\n}\n","/**\n * Derive the pod-wide {@link SchemaManifest} from the per-collection\n * `_schemas/<collection>` records — the source of truth (#941 Task 3).\n *\n * The manifest is an INDEX, never a cache with independent state: every\n * field in a {@link SchemaManifestEntry} is a direct projection of the\n * matching `PersistedSchemaEnvelope` (`hash` → `contentHash`, `fieldIds` →\n * `fieldIds`, `generation` → `generation`, falling back to the live fence's\n * `currentSchemaVersion` for a legacy pre-#946 envelope that never got a\n * generation stamp). Re-running this function against the same stored state\n * always produces the same manifest — that's what makes round-trip identity\n * (AC #2: dump → restore → re-derive matches the original) hold for free,\n * with no special-cased restore logic.\n *\n * A collection whose `_schemas/<collection>` envelope decrypts successfully\n * but has no derivable content (`hash === null` — a stub envelope for a\n * non-Zod validator) is legitimately omitted from the index: there is no\n * content hash to bind.\n *\n * ## Scoped principals: \"cannot decrypt\" is NOT \"doesn't exist\"\n *\n * A `_schemas/<collection>` envelope is encrypted under **that data\n * collection's own DEK** — the same key its records use — NOT a shared\n * `_schemas`-wide key. In a team vault, a collection-scoped grantee (e.g.\n * `grant(..., { role: 'operator', permissions: { invoices: 'rw' } })`) holds\n * only the DEKs their `permissions` name, plus every system-prefixed (`_*`)\n * collection's DEK — `_manifest` included, by `grant()`'s \"propagate system\n * collections to every role\" rule (`keyring.ts`). So a member scoped to\n * `invoices` CAN decrypt `_manifest/schema` (the pod-wide index) but CANNOT\n * decrypt a sibling's `_schemas/customers` envelope — even though that\n * envelope is right there in `store.list(vault, SCHEMAS_COLLECTION)`.\n *\n * `lookupDEK` (the {@link LookupDEK} passed in) reflects this: it returns\n * `undefined` for a collection name whose DEK the caller does not hold —\n * deliberately NEVER minting a fresh one (see the module doc on\n * `LookupDEK` for why). This function distinguishes that case\n * (`undecodableCollections`) from \"the schema envelope legitimately has no\n * derivable content\" (`hash === null`) — the caller (`sync.ts`) MUST treat\n * an incomplete view differently: writing a manifest derived from a\n * partial view would silently drop every collection this principal can't\n * see. See `sync.ts`'s module doc for how the sync path handles this.\n *\n * @module\n */\n\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { loadFence } from '../schema-update/fence.js'\nimport { loadPersistedSchema, SCHEMAS_COLLECTION } from '../persisted-schemas/storage.js'\nimport { computeAggregateHash } from './storage.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { SchemaManifest, SchemaManifestEntry } from './types.js'\n\n/**\n * A NON-MINTING DEK lookup: returns the collection's DEK if the caller\n * already holds it, `undefined` otherwise. Deliberately distinct from\n * `storage.ts`'s `GetManifestDEK` (which mints+persists a fresh DEK for an\n * absent collection — correct for a caller about to WRITE that collection,\n * e.g. `_manifest` itself). `deriveSchemaManifest` only ever READS sibling\n * collections it never created and has no business minting keys for — an\n * absent DEK here means \"not my collection to see,\" never \"new collection\n * that needs a key.\" Minting here would be worse than a no-op: it would\n * silently persist a garbage DEK into the caller's OWN `_keyring/<user>`\n * file (via `ensureCollectionDEK`'s `persistKeyring` side effect) that\n * still can't decrypt anything — see `sync.ts` / `with-pod/open.ts`'s\n * fix notes (#941 review).\n */\nexport type LookupDEK = (collectionName: string) => Promise<EnclaveKey | undefined>\n\nexport interface DeriveSchemaManifestResult {\n  /** The derived manifest — an index over every collection this principal could decrypt. */\n  readonly manifest: SchemaManifest\n  /**\n   * Names present in `_schemas` (per `store.list`) whose envelope this\n   * principal could NOT decrypt — either no DEK held for that collection,\n   * or the DEK held failed to decrypt/parse it (treated the same: the\n   * caller cannot verify what's there, so it cannot safely be omitted or\n   * asserted). Empty for a principal with full visibility (typically the\n   * owner/admin/custodian). Non-empty means `manifest.collections` is\n   * DEFINITELY INCOMPLETE relative to the pod's true collection set —\n   * see `sync.ts` for why that must gate whether the manifest gets written.\n   */\n  readonly undecodableCollections: readonly string[]\n}\n\n/**\n * Read the fence generation + every `_schemas/<collection>` envelope this\n * principal can decrypt, and project them into a fresh {@link SchemaManifest}.\n * `lookupDEK` is called once per collection found under `_schemas` (never\n * mints — see {@link LookupDEK}). Names whose DEK isn't held, or whose\n * envelope fails to decrypt/parse despite holding a DEK, are reported via\n * `undecodableCollections` rather than silently dropped from the result.\n */\nexport async function deriveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  lookupDEK: LookupDEK,\n): Promise<DeriveSchemaManifestResult> {\n  const fence = await loadFence(store, vault)\n  const collectionNames = await store.list(vault, SCHEMAS_COLLECTION)\n\n  const collections: Record<string, SchemaManifestEntry> = {}\n  const undecodableCollections: string[] = []\n  for (const name of collectionNames) {\n    const dek = await lookupDEK(name)\n    if (dek === undefined) {\n      undecodableCollections.push(name) // present in _schemas, but not decodable by this principal\n      continue\n    }\n\n    const payload = await loadPersistedSchema(store, vault, name, dek)\n    if (!payload) {\n      // Held a DEK but still couldn't decrypt/parse — cannot distinguish\n      // \"wrong key after all\" from real corruption from here; treat as\n      // undecodable (never silently drop) rather than \"no content.\"\n      undecodableCollections.push(name)\n      continue\n    }\n    if (payload.hash === null) continue // legitimately no derivable content (stub envelope)\n\n    const entry: SchemaManifestEntry = {\n      generation: payload.generation ?? fence.currentSchemaVersion,\n      contentHash: payload.hash,\n    }\n    collections[name] = payload.fieldIds !== undefined ? { ...entry, fieldIds: payload.fieldIds } : entry\n  }\n\n  const aggregateHash = await computeAggregateHash(collections)\n  const manifest: SchemaManifest = { v: 1, kind: 'schema', generation: fence.currentSchemaVersion, collections, aggregateHash }\n  return { manifest, undecodableCollections }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmDO,IAAM,4BAA4B;;;ACAzC,eAAsB,wBACpB,OACA,OACA,QAC2C;AAC3C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,qBAAqB,yBAAyB;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,qBAAqB,IAAI,0BAA0B,GAAG,UAAU,GAAG;AAC1H,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,MAAM,KAAK,OAAO,SAAS,SAAU,QAAO;AACvD,WAAO,EAAE,SAAS,SAAS,IAAI,UAAU,OAAO;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,mBACpB,OACA,OACA,UACA,iBACA,QAI4B;AAC5B,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,QAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,QAAM,MAAM,MAAM;AAAA,IAChB,EAAE,YAAY,qBAAqB,IAAI,2BAA2B,SAAS,kBAAkB,EAAE;AAAA,IAC/F,CAAC,aAAa,kBAAkB,UAAU,MAAM,GAAG;AAAA,IACnD,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,qBAAqB,2BAA2B,KAAK,eAAe;AAC3F,SAAO;AACT;AASA,eAAsB,qBACpB,aACiB;AACjB,SAAO,UAAU,cAAc,WAAW,CAAC;AAC7C;;;AChBA,eAAsB,qBACpB,OACA,OACA,WACqC;AACrC,QAAM,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1C,QAAM,kBAAkB,MAAM,MAAM,KAAK,OAAO,kBAAkB;AAElE,QAAM,cAAmD,CAAC;AAC1D,QAAM,yBAAmC,CAAC;AAC1C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,MAAM,MAAM,UAAU,IAAI;AAChC,QAAI,QAAQ,QAAW;AACrB,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,oBAAoB,OAAO,OAAO,MAAM,GAAG;AACjE,QAAI,CAAC,SAAS;AAIZ,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAM;AAE3B,UAAM,QAA6B;AAAA,MACjC,YAAY,QAAQ,cAAc,MAAM;AAAA,MACxC,aAAa,QAAQ;AAAA,IACvB;AACA,gBAAY,IAAI,IAAI,QAAQ,aAAa,SAAY,EAAE,GAAG,OAAO,UAAU,QAAQ,SAAS,IAAI;AAAA,EAClG;AAEA,QAAM,gBAAgB,MAAM,qBAAqB,WAAW;AAC5D,QAAM,WAA2B,EAAE,GAAG,GAAG,MAAM,UAAU,YAAY,MAAM,sBAAsB,aAAa,cAAc;AAC5H,SAAO,EAAE,UAAU,uBAAuB;AAC5C;","names":[]}

package/dist/{chunk-ND6S2DKC.js → chunk-N5S2BCW3.js}

@@ -6,7 +6,7 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -62,4 +62,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-ND6S2DKC.js.map
+//# sourceMappingURL=chunk-N5S2BCW3.js.map

package/dist/{chunk-63INIVE4.js → chunk-NIZH2TYZ.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -62,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-63INIVE4.js.map
+//# sourceMappingURL=chunk-NIZH2TYZ.js.map

package/dist/{chunk-WQHEEYQA.js → chunk-NLDBQHDV.js}

@@ -1,6 +1,6 @@
 import {
   UnsafePatternError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/kernel/query/predicate.ts
 function readPath(record, path) {
@@ -272,4 +272,4 @@ export {
   evaluateClause,
   hasFnClause
 };
-//# sourceMappingURL=chunk-WQHEEYQA.js.map
+//# sourceMappingURL=chunk-NLDBQHDV.js.map

package/dist/{chunk-SKSHWV3E.js → chunk-NQQ4MOPC.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-WVML7HUZ.js";
+} from "./chunk-UXH4AKH3.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-A7WASOCG.js");
+      const { liberateVault } = await import("./liberate-7KHXCLNJ.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-SKSHWV3E.js.map
+//# sourceMappingURL=chunk-NQQ4MOPC.js.map

package/dist/{chunk-B6EWMGFX.js → chunk-NUBI6PYH.js}

@@ -1,7 +1,7 @@
 import {
   signBytes,
   verifyBytes
-} from "./chunk-WRLWEYHY.js";
+} from "./chunk-EFINFZIF.js";
 
 // src/with-audit/attestation/scheme.ts
 var ENCLAVE_SCHEME = { sign: signBytes, verify: verifyBytes };
@@ -9,4 +9,4 @@ var ENCLAVE_SCHEME = { sign: signBytes, verify: verifyBytes };
 export {
   ENCLAVE_SCHEME
 };
-//# sourceMappingURL=chunk-B6EWMGFX.js.map
+//# sourceMappingURL=chunk-NUBI6PYH.js.map

package/dist/{chunk-VWUSOPBF.js → chunk-NYEXUZDW.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-ZZLIFVZG.js";
+} from "./chunk-ZG7DBIVX.js";
 import {
   SealedHandle
-} from "./chunk-VUBRHJ4H.js";
+} from "./chunk-CR5UPYIJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
-} from "./chunk-JGYCKX56.js";
+} from "./chunk-ISIXU45J.js";
 
 // src/via/classified/descriptor.ts
 function isClassifiedFieldSpec(x) {
@@ -270,4 +270,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-VWUSOPBF.js.map
+//# sourceMappingURL=chunk-NYEXUZDW.js.map