@noy-db/hub 0.2.0-pre.23 → 0.2.0-pre.24

package/dist/index.js

@@ -3,10 +3,12 @@ import {
   issueDelegation,
   loadActiveDelegations,
   revokeDelegation
-} from "./chunk-AI4USDRI.js";
+} from "./chunk-XQO4TAJS.js";
 import {
   Collection,
   ComputedFieldError,
+  CustodyApi,
+  DEED_RECORD_ID,
   DEFAULT_FRESHNESS_MS,
   ELEVATION_AUDIT_COLLECTION,
   ElevatedHandle,
@@ -29,6 +31,7 @@ import {
   approveWithdrawal,
   checkGate,
   compileSequenceFormat,
+  createDeedOwner,
   createNoydb,
   derivePersistedSchema,
   describeAllUsersAuth,
@@ -39,10 +42,13 @@ import {
   estimateRecordBytes,
   evalComputedFields,
   exportAccessibleData,
+  isDeedVault,
   isLinkCollectionName,
   isRefArray,
   isZodSchema,
+  liberateVault,
   listWithdrawalRequests,
+  loadDeedMarker,
   loadVaultPolicy,
   mergePolicy,
   parseBytes,
@@ -58,10 +64,7 @@ import {
   validateSchemaOutput,
   withArchive,
   withdrawAccessibleData
-} from "./chunk-P65YMN5V.js";
-import {
-  STATE_VAULT_NAME
-} from "./chunk-ZC7J6ZYV.js";
+} from "./chunk-QOXZM3L2.js";
 import {
   isDiscriminant
 } from "./chunk-STNPB3UM.js";
@@ -74,37 +77,37 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "./chunk-C2RJVZZL.js";
-import "./chunk-ADB7GPM3.js";
+} from "./chunk-G4GW5VOS.js";
 import "./chunk-A3JMGXPG.js";
-import "./chunk-J6RGRZOY.js";
+import "./chunk-ADB7GPM3.js";
+import "./chunk-AO3QSMCU.js";
 import {
   CollectionFrame,
   VaultFrame
-} from "./chunk-TGIJTNM3.js";
+} from "./chunk-R5ZECURV.js";
 import {
   TxCollection,
   TxContext,
   TxVault,
   runTransaction
-} from "./chunk-IY24WS2P.js";
+} from "./chunk-BCMHJYVT.js";
 import {
   withDerivation,
   withRollup
-} from "./chunk-YPIOFSN3.js";
-import "./chunk-S45MDEEF.js";
-import "./chunk-6QAZ5O6X.js";
+} from "./chunk-IHAISFXP.js";
+import "./chunk-LMWVNF6X.js";
+import "./chunk-IEIADIPM.js";
 import {
   withMaterializedView
-} from "./chunk-6QE4DUYC.js";
-import "./chunk-5YTXYPES.js";
-import "./chunk-KOAJ3TZM.js";
-import "./chunk-IW4L4X65.js";
+} from "./chunk-ZDITTESU.js";
+import "./chunk-5A2FVGHT.js";
+import "./chunk-RFEXGW3L.js";
+import "./chunk-P5A4E53B.js";
 import {
   withOverlayedView
-} from "./chunk-JBBWALNI.js";
-import "./chunk-SQOK5UM6.js";
-import "./chunk-MBXKRHSS.js";
+} from "./chunk-DCICHSRS.js";
+import "./chunk-ZBENTRFS.js";
+import "./chunk-CCNRFAL3.js";
 import {
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_JOIN_MAX_ROWS,
@@ -114,7 +117,7 @@ import {
   buildLiveQuery,
   executePlan,
   resetJoinWarnings
-} from "./chunk-NV4IHBZS.js";
+} from "./chunk-3XJU3OHE.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -128,19 +131,19 @@ import {
   importExternalObjects,
   isPreCompressed,
   memoryObjectProjection
-} from "./chunk-WWVJXBOT.js";
-import "./chunk-2XA2ZML4.js";
-import "./chunk-3HNKR65T.js";
+} from "./chunk-SGM7CK7R.js";
+import "./chunk-FG6IQ3ZL.js";
+import "./chunk-U6LTLN7O.js";
 import {
   CollectionIndexes
-} from "./chunk-GJTKMME7.js";
+} from "./chunk-JKM2AVVH.js";
 import {
   avg,
   count,
   max,
   min,
   sum
-} from "./chunk-ZONKSLF2.js";
+} from "./chunk-TQMQZOMX.js";
 import {
   Aggregation,
   GROUPBY_MAX_CARDINALITY,
@@ -150,7 +153,7 @@ import {
   GroupedQueryN,
   groupAndReduce,
   reduceRecords
-} from "./chunk-JYNH4FIM.js";
+} from "./chunk-77WF53XY.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -165,11 +168,17 @@ import {
   readPath,
   rescaleScaledInt,
   scaleForCurrency
-} from "./chunk-U2XSUCDF.js";
+} from "./chunk-GEWIFM4J.js";
 import {
   mergeCrdtStates,
   resolveCrdtSnapshot
 } from "./chunk-J66GRPNH.js";
+import {
+  decryptExtractedPartition,
+  readMultiVaultBundleCompartment,
+  readNoydbBundleManifest,
+  writeMultiVaultBundle
+} from "./chunk-R43KS34V.js";
 import {
   MemoryRecipientSealer,
   MemorySealingKeyProvider,
@@ -183,7 +192,7 @@ import {
   savePersistedSchema,
   saveSealedPassphrase,
   sealRsaOaepTlv
-} from "./chunk-C6W5KVDV.js";
+} from "./chunk-XC32SZPW.js";
 import {
   NOYDB_BUNDLE_FORMAT_VERSION,
   NOYDB_BUNDLE_MAGIC,
@@ -194,7 +203,7 @@ import {
   readNoydbBundlePublicEnvelope,
   resetBrotliSupportCache,
   writeNoydbBundle
-} from "./chunk-WE2BUQD2.js";
+} from "./chunk-4TCMCCC3.js";
 import {
   PUBLIC_ENVELOPE_RECORD_ID,
   isPublicEnvelope,
@@ -202,14 +211,14 @@ import {
   readPublicEnvelope,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-JOK73NDT.js";
-import "./chunk-BZW5IL43.js";
+} from "./chunk-P7OL22JP.js";
+import "./chunk-DCA2BDHA.js";
 import {
   CONSENT_AUDIT_COLLECTION
-} from "./chunk-SQKAECUL.js";
+} from "./chunk-7ZCTUI26.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-I3IYTUUI.js";
+} from "./chunk-HHJ5DZCZ.js";
 import "./chunk-UF3BUNQZ.js";
 import {
   DICT_COLLECTION_PREFIX,
@@ -220,7 +229,7 @@ import {
   isDictKeyDescriptor,
   isStaticDictDescriptor,
   staticDict
-} from "./chunk-O5XKZCUD.js";
+} from "./chunk-7X4EF35A.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -230,7 +239,7 @@ import {
   resolveI18nText,
   resolvePolicy,
   validateI18nTextValue
-} from "./chunk-TNH5SLCD.js";
+} from "./chunk-HD4QCT2O.js";
 import {
   createBundleStore,
   routeStore,
@@ -242,7 +251,7 @@ import {
   withRetry,
   wrapBundleStore,
   wrapStore
-} from "./chunk-NSXNXLYM.js";
+} from "./chunk-5GZC2ZM3.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   credentialStatus,
@@ -250,7 +259,7 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "./chunk-EYK72OTL.js";
+} from "./chunk-JRMOSIH4.js";
 import {
   MAGIC_LINK_CONTENT_INFO_PREFIX,
   MAGIC_LINK_GRANTS_COLLECTION,
@@ -285,17 +294,17 @@ import {
   unwrapDeksFromShamirEntry,
   unwrapMagicLinkGrant,
   writeMagicLinkGrant
-} from "./chunk-HYJMAV53.js";
+} from "./chunk-OWAMTSAI.js";
 import {
   assertTierAccess,
   dekKey,
   effectiveClearance
-} from "./chunk-F5GWNSE2.js";
+} from "./chunk-TOMSCJRV.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "./chunk-UU6M64HI.js";
+} from "./chunk-UAK2AMO2.js";
 import {
   DIRECTORY_RECORD_ID,
   USER_ENVELOPE_COLLECTION,
@@ -323,7 +332,7 @@ import {
   saveUserEnvelope,
   validatePassphrase,
   visibilityRecordId
-} from "./chunk-FRRJIUSI.js";
+} from "./chunk-B5CSNGSE.js";
 import {
   BUNDLE_STORE_POLICY,
   INDEXED_STORE_POLICY,
@@ -343,7 +352,7 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "./chunk-7MRT7EPB.js";
+} from "./chunk-SOQE5DUV.js";
 import {
   generateULID,
   isULID
@@ -353,14 +362,14 @@ import {
   VaultInstant,
   diff,
   formatDiff
-} from "./chunk-TYMDCIQM.js";
+} from "./chunk-C472BRJ4.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION,
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-JDCPRJVS.js";
+} from "./chunk-AONK5GCC.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -369,14 +378,14 @@ import {
   parseIndex,
   sha256Hex
 } from "./chunk-PDVP3C2I.js";
-import "./chunk-CQYEDODS.js";
+import "./chunk-35U5YNRR.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION,
   NOYDB_SYNC_VERSION,
   createStore
-} from "./chunk-TA6HPKWQ.js";
+} from "./chunk-LR7CODVN.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -385,7 +394,7 @@ import {
   derivePresenceKey,
   encryptBytes,
   encryptDeterministic
-} from "./chunk-37VGJM3T.js";
+} from "./chunk-WQ3KAGOV.js";
 import {
   AlreadyElevatedError,
   AmendmentForbiddenError,
@@ -414,6 +423,7 @@ import {
   DirectoryDisabledError,
   ElevationExpiredError,
   ExportCapabilityError,
+  FederationMovedError,
   FieldFrozenError,
   FilenameSanitizationError,
   ForgetStrategyNotConfiguredError,
@@ -483,7 +493,7 @@ import {
   UnsupportedIndexOptionError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "./chunk-OTWT6BAJ.js";
+} from "./chunk-4BB4T3O7.js";
 
 // src/debug.ts
 function readPlaintextRecord(envelope) {
@@ -564,6 +574,9 @@ function withDeferredNumbering(config) {
   };
 }
 
+// src/constants.ts
+var STATE_VAULT_NAME = "__noydb_state__";
+
 // src/money/arith.ts
 function parseAmount(label, amount, scale, rounding) {
   const r = parseToScaledInt(amount, scale, rounding);
@@ -703,11 +716,13 @@ async function diffVault(vault, candidate, options = {}) {
       if (before === void 0 && after !== void 0) {
         added.push({ collection, id, record: after });
       } else if (before !== void 0 && after === void 0) {
-        deleted.push({ collection, id, record: before });
+        const metadata = options.includeMetadata ? await vault.collection(collection).getMetadata(id) ?? void 0 : void 0;
+        deleted.push({ collection, id, record: before, ...metadata !== void 0 ? { metadata } : {} });
       } else if (before !== void 0 && after !== void 0) {
         if (compareFn(before, after)) {
           unchanged?.push({ collection, id, record: after });
         } else {
+          const metadata = options.includeMetadata ? await vault.collection(collection).getMetadata(id) ?? void 0 : void 0;
           const fieldDiffs = diff(before, after);
           const fieldsChanged = uniqueTopLevelKeys(fieldDiffs);
           modified.push({
@@ -716,7 +731,8 @@ async function diffVault(vault, candidate, options = {}) {
             record: after,
             before,
             fieldsChanged,
-            fieldDiffs
+            fieldDiffs,
+            ...metadata !== void 0 ? { metadata } : {}
           });
         }
       }
@@ -848,6 +864,8 @@ export {
   ConflictError,
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
+  CustodyApi,
+  DEED_RECORD_ID,
   DEFAULT_CHUNK_SIZE,
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_FRESHNESS_MS,
@@ -875,6 +893,7 @@ export {
   ElevatedHandle,
   ElevationExpiredError,
   ExportCapabilityError,
+  FederationMovedError,
   FieldFrozenError,
   FilenameSanitizationError,
   ForgetStrategyNotConfiguredError,
@@ -1038,6 +1057,7 @@ export {
   coordinatedCutover,
   count,
   createBundleStore,
+  createDeedOwner,
   createEnforcer,
   createNoydb,
   createSession,
@@ -1045,6 +1065,7 @@ export {
   credentialStatus,
   decryptBytes,
   decryptDeterministic,
+  decryptExtractedPartition,
   dekKey,
   deleteCredential,
   deleteUserEnvelope,
@@ -1093,6 +1114,7 @@ export {
   immutableGuard,
   importExternalObjects,
   inferScripts,
+  isDeedVault,
   isDevUnlockActive,
   isDictCollectionName,
   isDictKeyDescriptor,
@@ -1112,6 +1134,7 @@ export {
   issueDelegation,
   recoverPassphrase as keyringRecoverPassphrase,
   rotatePassphrase as keyringRotatePassphrase,
+  liberateVault,
   listCredentials,
   listMagicLinkGrants,
   listUserEnvelopeIds,
@@ -1119,6 +1142,7 @@ export {
   listUsersWithEnvelopes,
   listWithdrawalRequests,
   loadActiveDelegations,
+  loadDeedMarker,
   loadDevUnlock,
   loadPaperRecoveryEntries,
   loadPersistedSchema,
@@ -1151,8 +1175,10 @@ export {
   putCredential,
   readDirectoryConfig,
   readMagicLinkGrantRecord,
+  readMultiVaultBundleCompartment,
   readNoydbBundle,
   readNoydbBundleHeader,
+  readNoydbBundleManifest,
   readNoydbBundlePublicEnvelope,
   readPath,
   readPlaintextRecord,
@@ -1221,6 +1247,7 @@ export {
   wrapBundleStore,
   wrapStore,
   writeMagicLinkGrant,
+  writeMultiVaultBundle,
   writeNoydbBundle
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/debug.ts","../src/schema-update/strategies.ts","../src/schema-update/cutover.ts","../src/numbering/descriptor.ts","../src/money/arith.ts","../src/money/branded.ts","../src/vault-diff.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  if (envelope._iv !== '') {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n","/** Bundled light update strategies. */\nimport { NonAdditiveSchemaChangeError, SchemaLockedError } from '../errors.js'\nimport type { SchemaUpdateStrategy, SchemaDelta } from './types.js'\n\n/** Allow any schema change. Explicit blind / back-compat. */\nexport function blindUpdate(): SchemaUpdateStrategy {\n  return { name: 'blindUpdate', onSchemaDelta: () => ({ action: 'allow' }) }\n}\n\n/** Allow additive changes; reject non-additive ones. The safety backstop. */\nexport function additiveOnly(): SchemaUpdateStrategy {\n  return {\n    name: 'additiveOnly',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'non-additive') {\n        return {\n          action: 'reject' as const,\n          error: new NonAdditiveSchemaChangeError(\n            `Non-additive schema change to \"${delta.collection}\" ` +\n              `(added: [${delta.added.join(', ')}], removed: [${delta.removed.join(', ')}], ` +\n              `changed: [${delta.changed.map(c => c.field).join(', ')}]). ` +\n              `Register a coordinatedCutover() strategy to migrate, or revert the change.`,\n          ),\n        }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n\n/**\n * Reject schema changes. With `fields`, reject only when one of those\n * fields is added/removed/changed; otherwise reject any non-`none` delta.\n */\nexport function lockSchema(opts?: { readonly fields?: readonly string[] }): SchemaUpdateStrategy {\n  const fields = opts?.fields\n  return {\n    name: 'lockSchema',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'none') return { action: 'allow' as const }\n      const touched = fields\n        ? [...delta.added, ...delta.removed, ...delta.changed.map(c => c.field)].filter(f => fields.includes(f))\n        : ['<any>']\n      if (touched.length === 0) return { action: 'allow' as const }\n      return {\n        action: 'reject' as const,\n        error: new SchemaLockedError(\n          `Schema for \"${delta.collection}\" is locked` +\n            (fields ? ` on fields [${fields.join(', ')}] (touched: [${touched.join(', ')}])` : '') +\n            `; the change was refused.`,\n        ),\n      }\n    },\n  }\n}\n","/** The coordinatedCutover update strategy (single-step — no from/to). */\nimport type { SchemaUpdateStrategy, SchemaDelta, TransformFn } from './types.js'\n\nexport function coordinatedCutover(opts: { readonly transform: TransformFn }): SchemaUpdateStrategy {\n  return {\n    name: 'coordinatedCutover',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'non-additive') {\n        return { action: 'cutover' as const, transform: opts.transform }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n","/**\n * @category capability\n * Deferred-numbering config descriptor. See\n * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.\n */\n\n/** A registered deferred-numbering series. */\nexport interface DeferredNumberingConfig {\n  /** Series name — the key passed to `vault.sequence(series)`. */\n  readonly series: string\n  /** Collection holding the records to number. */\n  readonly collection: string\n  /** Field on each record where the assigned serial is written. */\n  readonly field: string\n  /**\n   * Minimum wall-clock age (ms) before an entry is eligible at a pass, in\n   * addition to the interval commit-wait. Default 0 — the store-clock\n   * interval (`storeLatest ≤ now.earliest`) is the correctness mechanism.\n   */\n  readonly settleWindowMs: number\n}\n\n/** Declare a deferred-numbering series. Pass the result in `createNoydb({ numbering: [...] })`. */\nexport function withDeferredNumbering(config: {\n  series: string\n  collection: string\n  field: string\n  settleWindowMs?: number\n}): DeferredNumberingConfig {\n  return {\n    series: config.series,\n    collection: config.collection,\n    field: config.field,\n    settleWindowMs: config.settleWindowMs ?? 0,\n  }\n}\n","/**\n * Exact money arithmetic helpers (#337) — `mulRate` and `allocate`.\n *\n * Both operate on the canonical decoded string form that `get()`\n * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no\n * floating-point step anywhere, exact past 2^53. They are pure\n * functions with no vault or descriptor dependency: the working scale\n * is inferred from the amount's fractional digits (a canonical money\n * string always carries exactly the field's scale) or pinned with\n * `opts.scale`.\n *\n * Why these two: app-side invariants of the form\n * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)\n * carry ±0.01 tolerances ONLY because the math is major-unit floats +\n * round2. `mulRate` (VAT-style rate application with explicit\n * rounding) and `allocate` (largest-remainder split — parts sum to the\n * input EXACTLY, by construction) make those tolerances zero.\n */\n\nimport {\n  parseToScaledInt,\n  formatScaledInt,\n  rescaleScaledInt,\n  decimalScaleOf,\n  type RoundingMode,\n} from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\nexport interface MulRateOptions {\n  /**\n   * Output scale (fraction digits). Defaults to the amount's own\n   * fractional digits — for a canonical money string that IS the\n   * field's scale.\n   */\n  readonly scale?: number\n  /** Rounding for the final re-scale. Default `'half-up'`. */\n  readonly rounding?: RoundingMode\n}\n\nexport interface AllocateOptions {\n  /** Working scale. Defaults to the amount's own fractional digits. */\n  readonly scale?: number\n}\n\n/** Parse `amount` at `scale` or throw the standard money TypeError. */\nfunction parseAmount(label: string, amount: number | string, scale: number, rounding?: RoundingMode): bigint {\n  const r = parseToScaledInt(amount, scale, rounding)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(\n      r.reason === 'precision'\n        ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured`\n        : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`,\n    )\n  }\n  return r.value\n}\n\nfunction resolveScale(label: string, amount: number | string, explicit: number | undefined): number {\n  if (explicit !== undefined) {\n    if (!Number.isInteger(explicit) || explicit < 0) {\n      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`)\n    }\n    return explicit\n  }\n  const inferred = decimalScaleOf(amount)\n  if (inferred === null) {\n    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`)\n  }\n  return inferred\n}\n\n/**\n * Multiply a money amount by a decimal rate, exactly.\n *\n * The rate is parsed at its OWN full precision (`0.07` → `7` at scale\n * 2), the product computed in `BigInt` at `amountScale + rateScale`,\n * then re-scaled back to the output scale with the requested rounding —\n * one rounding step, at the very end.\n *\n * ```ts\n * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)\n * mulRate('33.33', '0.07')                        // '2.33'    (half-up)\n * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'\n * mulRate(100, 0.07, { scale: 2 })                // '7.00'\n * ```\n */\nexport function mulRate(\n  amount: number | string,\n  rate: number | string,\n  opts: MulRateOptions = {},\n): string {\n  const scale = resolveScale('mulRate', amount, opts.scale)\n  const rounding = opts.rounding ?? 'half-up'\n  const a = parseAmount('mulRate', amount, scale, rounding)\n\n  const rateScale = decimalScaleOf(rate)\n  if (rateScale === null) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n  const r = parseToScaledInt(rate, rateScale)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n\n  const product = a * r.value // scaled at scale + rateScale\n  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale)\n}\n\n/**\n * Split a money amount across weighted buckets with ZERO drift: the\n * returned parts sum to the input exactly, by construction\n * (largest-remainder method).\n *\n * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover\n * minor units (always fewer than the bucket count) go one each to the\n * buckets with the largest truncated remainders — ties broken by\n * position, earlier bucket first. Weights are parsed as exact decimals\n * (no float division anywhere); they must be non-negative with a\n * positive sum.\n *\n * ```ts\n * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']\n * allocate('0.05', [3, 7])        // ['0.02', '0.03']\n * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']\n * ```\n */\nexport function allocate(\n  amount: number | string,\n  weights: ReadonlyArray<number | string>,\n  opts: AllocateOptions = {},\n): string[] {\n  if (weights.length === 0) {\n    throw new MoneyUnsupportedError('allocate: weights must not be empty')\n  }\n  const scale = resolveScale('allocate', amount, opts.scale)\n  const a = parseAmount('allocate', amount, scale)\n\n  // Parse every weight as an exact decimal at a common scale, so the\n  // proportion arithmetic below is pure BigInt.\n  let weightScale = 0\n  for (const w of weights) {\n    const s = decimalScaleOf(w)\n    if (s === null) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`)\n    }\n    if (s > weightScale) weightScale = s\n  }\n  const scaledWeights = weights.map(w => {\n    const r = parseToScaledInt(w, weightScale)\n    if (!r.ok || r.value < 0n) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`)\n    }\n    return r.value\n  })\n  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n)\n  if (sumW === 0n) {\n    throw new MoneyUnsupportedError('allocate: weights must not all be zero')\n  }\n\n  // Largest-remainder over the MAGNITUDE; a negative amount negates the\n  // parts at the end, so Σparts === amount holds for both signs.\n  const negative = a < 0n\n  const mag = negative ? -a : a\n\n  const base: bigint[] = []\n  const remainders: Array<{ index: number; rem: bigint }> = []\n  let distributed = 0n\n  for (let i = 0; i < scaledWeights.length; i++) {\n    const product = mag * scaledWeights[i]!\n    const share = product / sumW\n    base.push(share)\n    distributed += share\n    remainders.push({ index: i, rem: product % sumW })\n  }\n\n  // Leftover minor units: strictly fewer than the bucket count.\n  let leftover = mag - distributed\n  remainders.sort((x, y) => (y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index))\n  for (const { index } of remainders) {\n    if (leftover === 0n) break\n    base[index] = base[index]! + 1n\n    leftover -= 1n\n  }\n\n  return base.map(p => formatScaledInt(negative && p !== 0n ? -p : p, scale))\n}\n","/**\n * Branded money output type (#338).\n *\n * The decoded read shape of a money field is an exact decimal STRING\n * (`'10000.00'`) — but a hand-written schema types it `string | number`,\n * which is honest about the input side and unhelpful on the output\n * side: every read site hand-coerces, and a missed coercion passes\n * typecheck silently (then surfaces as a runtime template warning, or\n * worse, as `'10000.00' * 100` arithmetic).\n *\n * {@link MoneyString} is the output-side brand: a `string` that has\n * been through noy-db's decode (or {@link asMoney}'s guard). Branding\n * is type-level only — zero runtime cost on the read path.\n *\n * ## Wiring the brand through a validator (the input/output asymmetry)\n *\n * Keep the permissive `string | number` on the INPUT side so write\n * sites are untouched, and brand the OUTPUT side. With Zod:\n *\n * ```ts\n * import type { MoneyString } from '@noy-db/hub'\n *\n * const moneyValue = z.union([z.number(), z.string()]) as unknown as\n *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>\n *\n * const Invoice = z.object({ id: z.string(), total: moneyValue })\n * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString\n * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number\n * ```\n *\n * The cast is sound for fields declared in `moneyFields`: reads pass\n * through `decodeMoneyFields`, which always produces the canonical\n * decimal string.\n */\n\nimport { decimalScaleOf } from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\ndeclare const MONEY_BRAND: unique symbol\n\n/**\n * An exact decimal string produced by noy-db's money decode\n * (`'10000.00'`). The brand exists only at the type level — at runtime\n * a `MoneyString` is a plain string.\n */\nexport type MoneyString = string & { readonly [MONEY_BRAND]: true }\n\n/**\n * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string\n * or a number, returns the canonical decimal string branded — throws\n * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at\n * trust boundaries (deserialized JSON, route params); values read\n * through `get()`/`list()` are already canonical.\n */\nexport function asMoney(value: string | number): MoneyString {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return String(value).trim() as MoneyString\n}\n\n/** Type guard: is `value` a decimal string acceptable as money? */\nexport function isMoneyString(value: unknown): value is MoneyString {\n  return typeof value === 'string' && isMoneyLike(value)\n}\n\n/**\n * The ONE sanctioned escape hatch to a JS `number` — explicit because\n * the conversion is lossy past 2^53. For display math and chart axes;\n * never feed the result back into stored amounts (use `mulRate` /\n * `allocate` for exact arithmetic).\n */\nexport function moneyNumber(value: MoneyString | string | number): number {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return Number(value)\n}\n\nfunction isMoneyLike(value: unknown): boolean {\n  if (typeof value === 'number') return Number.isFinite(value)\n  if (typeof value !== 'string') return false\n  return decimalScaleOf(value) !== null\n}\n","/**\n * Vault-level diff orchestrator.\n *\n * Compares a live `Vault`'s plaintext state against a candidate state\n * (another vault, a plain `{ collection: records[] }` map, or a vault\n * dump JSON) and returns a structured `VaultDiff` plan listing the\n * records that would be added, modified, or deleted to bring the live\n * vault into the candidate's shape.\n *\n * Builds on two existing record-level helpers:\n *\n *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed\n *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for\n *      each changed field of two records. Used here for the\n *      `fieldDiffs` of every `modified` entry, and (with empty result)\n *      as the default deep-equal check.\n *\n *   2. `Vault.exportStream()` from `./vault.ts` — the canonical\n *      decrypt-and-stream-records iterator. Used to walk both sides\n *      when the candidate is itself a `Vault`. ACL-scoped: collections\n *      the caller can't read silently drop out, the same way every\n *      other plaintext-emitting export pipeline filters them.\n *\n * The new orchestration is the **vault-level** enumeration: bucket\n * each record id into added (only in candidate), deleted (only in\n * vault), or modified (in both with field changes); leave the\n * field-level granularity to the existing `diff()`.\n *\n * Use cases:\n *\n *   - Import preview (`@noy-db/as-*` `fromString` returns a plan\n *     whose body is a `VaultDiff`).\n *   - Backup verification (\"does this `.noydb` bundle from yesterday\n *     match the current vault?\").\n *   - Two-vault reconciliation (\"what's different between Office A\n *     and Office B before we sync?\").\n *   - Test assertions (golden-file testing with one-liner\n *     `expect(plan.summary).toEqual(...)`).\n *\n * @module\n */\n\nimport type { Vault } from './vault.js'\nimport { diff as fieldDiff, type DiffEntry as FieldDiffEntry } from './history/diff.js'\n\n// ─── Public types ──────────────────────────────────────────────────────\n\n/** Per-record entry shape — added and deleted records carry only the record value. */\nexport interface VaultDiffEntry<T = unknown> {\n  readonly collection: string\n  readonly id: string\n  readonly record: T\n}\n\n/** Modified records carry both halves of the diff plus the field-level breakdown. */\nexport interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {\n  /** The record as it stands in the live vault. */\n  readonly before: T\n  /** Top-level keys whose values differ between `before` and `record`. */\n  readonly fieldsChanged: readonly string[]\n  /**\n   * Field-level diff entries from `diff(before, record)`. Reuses the\n   * existing per-record diff helper so consumers can render git-style\n   * `path: from → to` rows without re-walking the records.\n   */\n  readonly fieldDiffs: readonly FieldDiffEntry[]\n}\n\nexport interface VaultDiff<T = unknown> {\n  readonly added: readonly VaultDiffEntry<T>[]\n  readonly modified: readonly VaultDiffModifiedEntry<T>[]\n  readonly deleted: readonly VaultDiffEntry<T>[]\n  /** Only populated when `options.includeUnchanged: true`. */\n  readonly unchanged: readonly VaultDiffEntry<T>[] | undefined\n  readonly summary: {\n    readonly add: number\n    readonly modify: number\n    readonly delete: number\n    readonly total: number\n  }\n  /**\n   * Format the diff as a human-readable string.\n   *\n   *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)\n   *   - `'one-line'` — count plus a single overview line\n   *   - `'full'`    — count + one row per added/modified/deleted record (default)\n   */\n  format(opts?: { detail?: 'count' | 'one-line' | 'full' }): string\n}\n\nexport interface DiffOptions {\n  /** Restrict the diff to a subset of collections. */\n  readonly collections?: readonly string[]\n  /** Field on each record that carries its id. Defaults to `'id'`. */\n  readonly idKey?: string\n  /** Override the default deep-equal check for \"modified vs unchanged\". */\n  readonly compareFn?: (a: unknown, b: unknown) => boolean\n  /** If true, include unchanged records in the diff (off by default to save memory). */\n  readonly includeUnchanged?: boolean\n}\n\n/**\n * Candidate state to diff the vault against:\n *\n *   - A `Vault` instance — both sides are walked via `exportStream()`.\n *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`\n *     produces. Useful for diffing parsed file content against the live vault.\n *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the\n *     full vault state. Parsed and reduced to the map shape above.\n */\nexport type DiffCandidate<T = unknown> =\n  | Vault\n  | Record<string, readonly T[]>\n  | string\n\n// ─── Implementation ────────────────────────────────────────────────────\n\n/**\n * Compute the diff between a live vault and a candidate state.\n *\n * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is\n * O(n + m) in the row count of vault + candidate. For documented\n * 1K-50K-record vaults this is fine; a streaming variant lands as a\n * follow-up if a > 100K-record consumer arrives.\n */\nexport async function diffVault<T = unknown>(\n  vault: Vault,\n  candidate: DiffCandidate<T>,\n  options: DiffOptions = {},\n): Promise<VaultDiff<T>> {\n  const idKey = options.idKey ?? 'id'\n  const filter = options.collections ? new Set(options.collections) : null\n  const compareFn =\n    options.compareFn ?? ((a: unknown, b: unknown) => fieldDiff(a, b).length === 0)\n\n  // Side A — walk the live vault via exportStream(). Each chunk arrives\n  // already decrypted and ACL-scoped, so collections the caller can't\n  // read silently drop out. exportStream's records are typed `unknown[]`\n  // — diffVault is the type-erasure boundary; the caller asserts the\n  // record shape via the function's `<T>` generic.\n  const live = new Map<string, Map<string, T>>()\n  for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n    if (filter && !filter.has(chunk.collection)) continue\n    const collection = live.get(chunk.collection) ?? new Map<string, T>()\n    for (const record of chunk.records) {\n      const id = readIdField(record, idKey)\n      if (!id) continue\n      collection.set(id, record as T)\n    }\n    live.set(chunk.collection, collection)\n  }\n\n  // Side B — normalise the candidate into the same shape.\n  const cand = await normaliseCandidate<T>(candidate, idKey, filter)\n\n  // Walk every (collection, id) on either side and bucket.\n  const added: VaultDiffEntry<T>[] = []\n  const modified: VaultDiffModifiedEntry<T>[] = []\n  const deleted: VaultDiffEntry<T>[] = []\n  const unchanged: VaultDiffEntry<T>[] | undefined = options.includeUnchanged ? [] : undefined\n\n  const collectionNames = new Set([...live.keys(), ...cand.keys()])\n  for (const collection of [...collectionNames].sort()) {\n    const liveColl = live.get(collection) ?? new Map<string, T>()\n    const candColl = cand.get(collection) ?? new Map<string, T>()\n    const allIds = new Set([...liveColl.keys(), ...candColl.keys()])\n\n    for (const id of [...allIds].sort()) {\n      const before = liveColl.get(id)\n      const after = candColl.get(id)\n\n      if (before === undefined && after !== undefined) {\n        added.push({ collection, id, record: after })\n      } else if (before !== undefined && after === undefined) {\n        deleted.push({ collection, id, record: before })\n      } else if (before !== undefined && after !== undefined) {\n        if (compareFn(before, after)) {\n          unchanged?.push({ collection, id, record: after })\n        } else {\n          const fieldDiffs = fieldDiff(before, after)\n          const fieldsChanged = uniqueTopLevelKeys(fieldDiffs)\n          modified.push({\n            collection,\n            id,\n            record: after,\n            before,\n            fieldsChanged,\n            fieldDiffs,\n          })\n        }\n      }\n    }\n  }\n\n  const summary = {\n    add: added.length,\n    modify: modified.length,\n    delete: deleted.length,\n    total: added.length + modified.length + deleted.length,\n  }\n\n  return {\n    added,\n    modified,\n    deleted,\n    unchanged,\n    summary,\n    format(opts) {\n      return formatDiff(opts?.detail ?? 'full', { added, modified, deleted, summary })\n    },\n  }\n}\n\n// ─── Internals ─────────────────────────────────────────────────────────\n\nasync function normaliseCandidate<T>(\n  candidate: DiffCandidate<T>,\n  idKey: string,\n  filter: Set<string> | null,\n): Promise<Map<string, Map<string, T>>> {\n  const out = new Map<string, Map<string, T>>()\n\n  // Vault instance — duck-type via the exportStream method (matches\n  // vault.ts's structural shape without forcing a runtime instanceof check\n  // that would import the class and risk circular deps).\n  if (\n    typeof candidate === 'object' &&\n    candidate !== null &&\n    'exportStream' in candidate &&\n    typeof (candidate as Vault).exportStream === 'function'\n  ) {\n    for await (const chunk of (candidate as Vault).exportStream({ granularity: 'collection' })) {\n      if (filter && !filter.has(chunk.collection)) continue\n      const collection = out.get(chunk.collection) ?? new Map<string, T>()\n      for (const record of chunk.records) {\n        const id = readIdField(record, idKey)\n        if (!id) continue\n        collection.set(id, record as T)\n      }\n      out.set(chunk.collection, collection)\n    }\n    return out\n  }\n\n  // String — assume a vault.dump() JSON string. Parse and reduce to the map shape.\n  if (typeof candidate === 'string') {\n    let parsed: unknown\n    try {\n      parsed = JSON.parse(candidate)\n    } catch (err) {\n      throw new Error(\n        `diffVault: candidate string is not valid JSON (${(err as Error).message})`,\n      )\n    }\n    return collectionsFromObject<T>(parsed, idKey, filter)\n  }\n\n  // Plain object — `Record<collection, records[]>` (same shape as-json.toObject() returns).\n  return collectionsFromObject<T>(candidate, idKey, filter)\n}\n\nfunction collectionsFromObject<T>(\n  raw: unknown,\n  idKey: string,\n  filter: Set<string> | null,\n): Map<string, Map<string, T>> {\n  const out = new Map<string, Map<string, T>>()\n  if (raw === null || typeof raw !== 'object') {\n    throw new Error('diffVault: candidate must be a Vault, an object, or a JSON string')\n  }\n  // A vault dump JSON has a top-level shape like { _compartment, _keyring, <coll>: <records[]> }.\n  // We accept both: keys starting with `_` are skipped (they're metadata), the rest are collections.\n  for (const [key, value] of Object.entries(raw)) {\n    if (key.startsWith('_')) continue\n    if (filter && !filter.has(key)) continue\n    if (!Array.isArray(value)) continue\n    const collection = new Map<string, T>()\n    for (const record of value as readonly T[]) {\n      if (record === null || typeof record !== 'object') continue\n      const id = readIdField(record, idKey)\n      if (!id) continue\n      collection.set(id, record)\n    }\n    out.set(key, collection)\n  }\n  return out\n}\n\nfunction uniqueTopLevelKeys(diffs: readonly FieldDiffEntry[]): readonly string[] {\n  const keys = new Set<string>()\n  for (const d of diffs) {\n    // path is dot-separated; the top-level key is everything before the\n    // first `.` or `[`. (`a.b.c` → `a`, `tags[0]` → `tags`, `(root)` → `(root)`).\n    const m = /^[^.[]+/.exec(d.path)\n    if (m) keys.add(m[0])\n  }\n  return [...keys]\n}\n\n/**\n * Pull the id field off a record without going through `String(obj)`,\n * which would emit `[object Object]` for nested objects and silently\n * collapse rows that share the same parent. Only string and number ids\n * are accepted; anything else returns the empty string and the record\n * is skipped at the call site.\n */\nfunction readIdField(record: unknown, idKey: string): string {\n  if (record === null || typeof record !== 'object') return ''\n  const v = (record as Record<string, unknown>)[idKey]\n  if (typeof v === 'string') return v\n  if (typeof v === 'number' && Number.isFinite(v)) return String(v)\n  return ''\n}\n\ninterface FormatBuckets<T> {\n  readonly added: readonly VaultDiffEntry<T>[]\n  readonly modified: readonly VaultDiffModifiedEntry<T>[]\n  readonly deleted: readonly VaultDiffEntry<T>[]\n  readonly summary: VaultDiff<T>['summary']\n}\n\nfunction formatDiff<T>(\n  detail: 'count' | 'one-line' | 'full',\n  b: FormatBuckets<T>,\n): string {\n  const head = `${b.summary.add} added · ${b.summary.modify} modified · ${b.summary.delete} deleted`\n  if (detail === 'count') return head\n  if (b.summary.total === 0) return head + '\\n(no changes)'\n  if (detail === 'one-line') return head\n\n  const rows: string[] = [head, '']\n  for (const e of b.added) rows.push(`${e.collection}/${e.id}\\tadded`)\n  for (const e of b.modified) {\n    const fields = e.fieldDiffs\n      .map((f) => `${f.path}: ${shortJSON(f.from)} → ${shortJSON(f.to)}`)\n      .join(', ')\n    rows.push(`${e.collection}/${e.id}\\tmodified\\t${fields}`)\n  }\n  for (const e of b.deleted) rows.push(`${e.collection}/${e.id}\\tdeleted`)\n  return rows.join('\\n')\n}\n\nfunction shortJSON(value: unknown): string {\n  if (value === undefined) return 'undefined'\n  const s = JSON.stringify(value)\n  // JSON.stringify returns string for any JSON value except `undefined`\n  // (handled above), `function`, and `symbol`. Fall back to a static\n  // tag for those — never let an arbitrary object hit the default\n  // stringifier (which the lint rule explicitly bans).\n  if (typeof s !== 'string') return '<unrepresentable>'\n  return s.length > 60 ? s.slice(0, 57) + '...' : s\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBO,SAAS,oBACd,UACU;AACV,MAAI,SAAS,QAAQ,IAAI;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;;;ACrCO,SAAS,cAAoC;AAClD,SAAO,EAAE,MAAM,eAAe,eAAe,OAAO,EAAE,QAAQ,QAAQ,GAAG;AAC3E;AAGO,SAAS,eAAqC;AACnD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,gBAAgB;AACjC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,YACT,kCAAkC,MAAM,UAAU,cACpC,MAAM,MAAM,KAAK,IAAI,CAAC,gBAAgB,MAAM,QAAQ,KAAK,IAAI,CAAC,gBAC7D,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,UAE3D;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;AAMO,SAAS,WAAW,MAAsE;AAC/F,QAAM,SAAS,MAAM;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,QAAQ,QAAiB;AAC7D,YAAM,UAAU,SACZ,CAAC,GAAG,MAAM,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAK,OAAO,SAAS,CAAC,CAAC,IACrG,CAAC,OAAO;AACZ,UAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,QAAiB;AAC5D,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,UACT,eAAe,MAAM,UAAU,iBAC5B,SAAS,eAAe,OAAO,KAAK,IAAI,CAAC,gBAAgB,QAAQ,KAAK,IAAI,CAAC,OAAO,MACnF;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnDO,SAAS,mBAAmB,MAAiE;AAClG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,gBAAgB;AACjC,eAAO,EAAE,QAAQ,WAAoB,WAAW,KAAK,UAAU;AAAA,MACjE;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;;;ACUO,SAAS,sBAAsB,QAKV;AAC1B,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,IACd,gBAAgB,OAAO,kBAAkB;AAAA,EAC3C;AACF;;;ACUA,SAAS,YAAY,OAAe,QAAyB,OAAe,UAAiC;AAC3G,QAAM,IAAI,iBAAiB,QAAQ,OAAO,QAAQ;AAClD,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI;AAAA,MACR,EAAE,WAAW,cACT,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,kCAAkC,KAAK,wCACjF,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO,EAAE;AACX;AAEA,SAAS,aAAa,OAAe,QAAyB,UAAsC;AAClG,MAAI,aAAa,QAAW;AAC1B,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAC/C,YAAM,IAAI,sBAAsB,GAAG,KAAK,wCAAwC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,eAAe,MAAM;AACtC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,sBAAsB,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,0BAA0B;AAAA,EACtG;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,MACA,OAAuB,CAAC,GAChB;AACR,QAAM,QAAQ,aAAa,WAAW,QAAQ,KAAK,KAAK;AACxD,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,IAAI,YAAY,WAAW,QAAQ,OAAO,QAAQ;AAExD,QAAM,YAAY,eAAe,IAAI;AACrC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AACA,QAAM,IAAI,iBAAiB,MAAM,SAAS;AAC1C,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AAEA,QAAM,UAAU,IAAI,EAAE;AACtB,SAAO,gBAAgB,iBAAiB,SAAS,QAAQ,WAAW,OAAO,QAAQ,GAAG,KAAK;AAC7F;AAoBO,SAAS,SACd,QACA,SACA,OAAwB,CAAC,GACf;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,sBAAsB,qCAAqC;AAAA,EACvE;AACA,QAAM,QAAQ,aAAa,YAAY,QAAQ,KAAK,KAAK;AACzD,QAAM,IAAI,YAAY,YAAY,QAAQ,KAAK;AAI/C,MAAI,cAAc;AAClB,aAAW,KAAK,SAAS;AACvB,UAAM,IAAI,eAAe,CAAC;AAC1B,QAAI,MAAM,MAAM;AACd,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,0BAA0B;AAAA,IACjG;AACA,QAAI,IAAI,YAAa,eAAc;AAAA,EACrC;AACA,QAAM,gBAAgB,QAAQ,IAAI,OAAK;AACrC,UAAM,IAAI,iBAAiB,GAAG,WAAW;AACzC,QAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI;AACzB,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,iCAAiC;AAAA,IACxG;AACA,WAAO,EAAE;AAAA,EACX,CAAC;AACD,QAAM,OAAO,cAAc,OAAO,CAAC,KAAK,MAAM,MAAM,GAAG,EAAE;AACzD,MAAI,SAAS,IAAI;AACf,UAAM,IAAI,sBAAsB,wCAAwC;AAAA,EAC1E;AAIA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,WAAW,CAAC,IAAI;AAE5B,QAAM,OAAiB,CAAC;AACxB,QAAM,aAAoD,CAAC;AAC3D,MAAI,cAAc;AAClB,WAAS,IAAI,GAAG,IAAI,cAAc,QAAQ,KAAK;AAC7C,UAAM,UAAU,MAAM,cAAc,CAAC;AACrC,UAAM,QAAQ,UAAU;AACxB,SAAK,KAAK,KAAK;AACf,mBAAe;AACf,eAAW,KAAK,EAAE,OAAO,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,EACnD;AAGA,MAAI,WAAW,MAAM;AACrB,aAAW,KAAK,CAAC,GAAG,MAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,QAAQ,EAAE,KAAM;AACtF,aAAW,EAAE,MAAM,KAAK,YAAY;AAClC,QAAI,aAAa,GAAI;AACrB,SAAK,KAAK,IAAI,KAAK,KAAK,IAAK;AAC7B,gBAAY;AAAA,EACd;AAEA,SAAO,KAAK,IAAI,OAAK,gBAAgB,YAAY,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;AAC5E;;;ACnIO,SAAS,QAAQ,OAAqC;AAC3D,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,YAAY,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EAC7F;AACA,SAAO,OAAO,KAAK,EAAE,KAAK;AAC5B;AAGO,SAAS,cAAc,OAAsC;AAClE,SAAO,OAAO,UAAU,YAAY,YAAY,KAAK;AACvD;AAQO,SAAS,YAAY,OAA8C;AACxE,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,gBAAgB,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EACjG;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,eAAe,KAAK,MAAM;AACnC;;;AC0CA,eAAsB,UACpB,OACA,WACA,UAAuB,CAAC,GACD;AACvB,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,SAAS,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AACpE,QAAM,YACJ,QAAQ,cAAc,CAAC,GAAY,MAAe,KAAU,GAAG,CAAC,EAAE,WAAW;AAO/E,QAAM,OAAO,oBAAI,IAA4B;AAC7C,mBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,QAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,UAAM,aAAa,KAAK,IAAI,MAAM,UAAU,KAAK,oBAAI,IAAe;AACpE,eAAW,UAAU,MAAM,SAAS;AAClC,YAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,UAAI,CAAC,GAAI;AACT,iBAAW,IAAI,IAAI,MAAW;AAAA,IAChC;AACA,SAAK,IAAI,MAAM,YAAY,UAAU;AAAA,EACvC;AAGA,QAAM,OAAO,MAAM,mBAAsB,WAAW,OAAO,MAAM;AAGjE,QAAM,QAA6B,CAAC;AACpC,QAAM,WAAwC,CAAC;AAC/C,QAAM,UAA+B,CAAC;AACtC,QAAM,YAA6C,QAAQ,mBAAmB,CAAC,IAAI;AAEnF,QAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAChE,aAAW,cAAc,CAAC,GAAG,eAAe,EAAE,KAAK,GAAG;AACpD,UAAM,WAAW,KAAK,IAAI,UAAU,KAAK,oBAAI,IAAe;AAC5D,UAAM,WAAW,KAAK,IAAI,UAAU,KAAK,oBAAI,IAAe;AAC5D,UAAM,SAAS,oBAAI,IAAI,CAAC,GAAG,SAAS,KAAK,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC;AAE/D,eAAW,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACnC,YAAM,SAAS,SAAS,IAAI,EAAE;AAC9B,YAAM,QAAQ,SAAS,IAAI,EAAE;AAE7B,UAAI,WAAW,UAAa,UAAU,QAAW;AAC/C,cAAM,KAAK,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC;AAAA,MAC9C,WAAW,WAAW,UAAa,UAAU,QAAW;AACtD,gBAAQ,KAAK,EAAE,YAAY,IAAI,QAAQ,OAAO,CAAC;AAAA,MACjD,WAAW,WAAW,UAAa,UAAU,QAAW;AACtD,YAAI,UAAU,QAAQ,KAAK,GAAG;AAC5B,qBAAW,KAAK,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC;AAAA,QACnD,OAAO;AACL,gBAAM,aAAa,KAAU,QAAQ,KAAK;AAC1C,gBAAM,gBAAgB,mBAAmB,UAAU;AACnD,mBAAS,KAAK;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,KAAK,MAAM;AAAA,IACX,QAAQ,SAAS;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,OAAO,MAAM,SAAS,SAAS,SAAS,QAAQ;AAAA,EAClD;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM;AACX,aAAOA,YAAW,MAAM,UAAU,QAAQ,EAAE,OAAO,UAAU,SAAS,QAAQ,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAIA,eAAe,mBACb,WACA,OACA,QACsC;AACtC,QAAM,MAAM,oBAAI,IAA4B;AAK5C,MACE,OAAO,cAAc,YACrB,cAAc,QACd,kBAAkB,aAClB,OAAQ,UAAoB,iBAAiB,YAC7C;AACA,qBAAiB,SAAU,UAAoB,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC1F,UAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,YAAM,aAAa,IAAI,IAAI,MAAM,UAAU,KAAK,oBAAI,IAAe;AACnE,iBAAW,UAAU,MAAM,SAAS;AAClC,cAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,YAAI,CAAC,GAAI;AACT,mBAAW,IAAI,IAAI,MAAW;AAAA,MAChC;AACA,UAAI,IAAI,MAAM,YAAY,UAAU;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,SAAS;AAAA,IAC/B,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,kDAAmD,IAAc,OAAO;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,sBAAyB,QAAQ,OAAO,MAAM;AAAA,EACvD;AAGA,SAAO,sBAAyB,WAAW,OAAO,MAAM;AAC1D;AAEA,SAAS,sBACP,KACA,OACA,QAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,IAAI,WAAW,GAAG,EAAG;AACzB,QAAI,UAAU,CAAC,OAAO,IAAI,GAAG,EAAG;AAChC,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG;AAC3B,UAAM,aAAa,oBAAI,IAAe;AACtC,eAAW,UAAU,OAAuB;AAC1C,UAAI,WAAW,QAAQ,OAAO,WAAW,SAAU;AACnD,YAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,UAAI,CAAC,GAAI;AACT,iBAAW,IAAI,IAAI,MAAM;AAAA,IAC3B;AACA,QAAI,IAAI,KAAK,UAAU;AAAA,EACzB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAqD;AAC/E,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,OAAO;AAGrB,UAAM,IAAI,UAAU,KAAK,EAAE,IAAI;AAC/B,QAAI,EAAG,MAAK,IAAI,EAAE,CAAC,CAAC;AAAA,EACtB;AACA,SAAO,CAAC,GAAG,IAAI;AACjB;AASA,SAAS,YAAY,QAAiB,OAAuB;AAC3D,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,QAAM,IAAK,OAAmC,KAAK;AACnD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,EAAG,QAAO,OAAO,CAAC;AAChE,SAAO;AACT;AASA,SAASA,YACP,QACA,GACQ;AACR,QAAM,OAAO,GAAG,EAAE,QAAQ,GAAG,eAAY,EAAE,QAAQ,MAAM,kBAAe,EAAE,QAAQ,MAAM;AACxF,MAAI,WAAW,QAAS,QAAO;AAC/B,MAAI,EAAE,QAAQ,UAAU,EAAG,QAAO,OAAO;AACzC,MAAI,WAAW,WAAY,QAAO;AAElC,QAAM,OAAiB,CAAC,MAAM,EAAE;AAChC,aAAW,KAAK,EAAE,MAAO,MAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,QAAS;AACnE,aAAW,KAAK,EAAE,UAAU;AAC1B,UAAM,SAAS,EAAE,WACd,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,IAAI,CAAC,WAAM,UAAU,EAAE,EAAE,CAAC,EAAE,EACjE,KAAK,IAAI;AACZ,SAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,aAAe,MAAM,EAAE;AAAA,EAC1D;AACA,aAAW,KAAK,EAAE,QAAS,MAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,UAAW;AACvE,SAAO,KAAK,KAAK,IAAI;AACvB;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,KAAK,UAAU,KAAK;AAK9B,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,EAAE,SAAS,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI,QAAQ;AAClD;","names":["formatDiff"]}
+{"version":3,"sources":["../src/debug.ts","../src/schema-update/strategies.ts","../src/schema-update/cutover.ts","../src/numbering/descriptor.ts","../src/constants.ts","../src/money/arith.ts","../src/money/branded.ts","../src/vault-diff.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  if (envelope._iv !== '') {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n","/** Bundled light update strategies. */\nimport { NonAdditiveSchemaChangeError, SchemaLockedError } from '../errors.js'\nimport type { SchemaUpdateStrategy, SchemaDelta } from './types.js'\n\n/** Allow any schema change. Explicit blind / back-compat. */\nexport function blindUpdate(): SchemaUpdateStrategy {\n  return { name: 'blindUpdate', onSchemaDelta: () => ({ action: 'allow' }) }\n}\n\n/** Allow additive changes; reject non-additive ones. The safety backstop. */\nexport function additiveOnly(): SchemaUpdateStrategy {\n  return {\n    name: 'additiveOnly',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'non-additive') {\n        return {\n          action: 'reject' as const,\n          error: new NonAdditiveSchemaChangeError(\n            `Non-additive schema change to \"${delta.collection}\" ` +\n              `(added: [${delta.added.join(', ')}], removed: [${delta.removed.join(', ')}], ` +\n              `changed: [${delta.changed.map(c => c.field).join(', ')}]). ` +\n              `Register a coordinatedCutover() strategy to migrate, or revert the change.`,\n          ),\n        }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n\n/**\n * Reject schema changes. With `fields`, reject only when one of those\n * fields is added/removed/changed; otherwise reject any non-`none` delta.\n */\nexport function lockSchema(opts?: { readonly fields?: readonly string[] }): SchemaUpdateStrategy {\n  const fields = opts?.fields\n  return {\n    name: 'lockSchema',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'none') return { action: 'allow' as const }\n      const touched = fields\n        ? [...delta.added, ...delta.removed, ...delta.changed.map(c => c.field)].filter(f => fields.includes(f))\n        : ['<any>']\n      if (touched.length === 0) return { action: 'allow' as const }\n      return {\n        action: 'reject' as const,\n        error: new SchemaLockedError(\n          `Schema for \"${delta.collection}\" is locked` +\n            (fields ? ` on fields [${fields.join(', ')}] (touched: [${touched.join(', ')}])` : '') +\n            `; the change was refused.`,\n        ),\n      }\n    },\n  }\n}\n","/** The coordinatedCutover update strategy (single-step — no from/to). */\nimport type { SchemaUpdateStrategy, SchemaDelta, TransformFn } from './types.js'\n\nexport function coordinatedCutover(opts: { readonly transform: TransformFn }): SchemaUpdateStrategy {\n  return {\n    name: 'coordinatedCutover',\n    onSchemaDelta(delta: SchemaDelta) {\n      if (delta.kind === 'non-additive') {\n        return { action: 'cutover' as const, transform: opts.transform }\n      }\n      return { action: 'allow' as const }\n    },\n  }\n}\n","/**\n * @category capability\n * Deferred-numbering config descriptor. See\n * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.\n */\n\n/** A registered deferred-numbering series. */\nexport interface DeferredNumberingConfig {\n  /** Series name — the key passed to `vault.sequence(series)`. */\n  readonly series: string\n  /** Collection holding the records to number. */\n  readonly collection: string\n  /** Field on each record where the assigned serial is written. */\n  readonly field: string\n  /**\n   * Minimum wall-clock age (ms) before an entry is eligible at a pass, in\n   * addition to the interval commit-wait. Default 0 — the store-clock\n   * interval (`storeLatest ≤ now.earliest`) is the correctness mechanism.\n   */\n  readonly settleWindowMs: number\n}\n\n/** Declare a deferred-numbering series. Pass the result in `createNoydb({ numbering: [...] })`. */\nexport function withDeferredNumbering(config: {\n  series: string\n  collection: string\n  field: string\n  settleWindowMs?: number\n}): DeferredNumberingConfig {\n  return {\n    series: config.series,\n    collection: config.collection,\n    field: config.field,\n    settleWindowMs: config.settleWindowMs ?? 0,\n  }\n}\n","/**\n * Hub-core constants that must be referenceable without pulling any\n * subsystem chunk. Kept import-free.\n */\n\n/** Reserved fleet-wide control-plane vault name. Hub reserves it; @klum-db/lobby's StateManagementVault uses it. */\nexport const STATE_VAULT_NAME = '__noydb_state__'\n","/**\n * Exact money arithmetic helpers (#337) — `mulRate` and `allocate`.\n *\n * Both operate on the canonical decoded string form that `get()`\n * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no\n * floating-point step anywhere, exact past 2^53. They are pure\n * functions with no vault or descriptor dependency: the working scale\n * is inferred from the amount's fractional digits (a canonical money\n * string always carries exactly the field's scale) or pinned with\n * `opts.scale`.\n *\n * Why these two: app-side invariants of the form\n * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)\n * carry ±0.01 tolerances ONLY because the math is major-unit floats +\n * round2. `mulRate` (VAT-style rate application with explicit\n * rounding) and `allocate` (largest-remainder split — parts sum to the\n * input EXACTLY, by construction) make those tolerances zero.\n */\n\nimport {\n  parseToScaledInt,\n  formatScaledInt,\n  rescaleScaledInt,\n  decimalScaleOf,\n  type RoundingMode,\n} from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\nexport interface MulRateOptions {\n  /**\n   * Output scale (fraction digits). Defaults to the amount's own\n   * fractional digits — for a canonical money string that IS the\n   * field's scale.\n   */\n  readonly scale?: number\n  /** Rounding for the final re-scale. Default `'half-up'`. */\n  readonly rounding?: RoundingMode\n}\n\nexport interface AllocateOptions {\n  /** Working scale. Defaults to the amount's own fractional digits. */\n  readonly scale?: number\n}\n\n/** Parse `amount` at `scale` or throw the standard money TypeError. */\nfunction parseAmount(label: string, amount: number | string, scale: number, rounding?: RoundingMode): bigint {\n  const r = parseToScaledInt(amount, scale, rounding)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(\n      r.reason === 'precision'\n        ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured`\n        : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`,\n    )\n  }\n  return r.value\n}\n\nfunction resolveScale(label: string, amount: number | string, explicit: number | undefined): number {\n  if (explicit !== undefined) {\n    if (!Number.isInteger(explicit) || explicit < 0) {\n      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`)\n    }\n    return explicit\n  }\n  const inferred = decimalScaleOf(amount)\n  if (inferred === null) {\n    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`)\n  }\n  return inferred\n}\n\n/**\n * Multiply a money amount by a decimal rate, exactly.\n *\n * The rate is parsed at its OWN full precision (`0.07` → `7` at scale\n * 2), the product computed in `BigInt` at `amountScale + rateScale`,\n * then re-scaled back to the output scale with the requested rounding —\n * one rounding step, at the very end.\n *\n * ```ts\n * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)\n * mulRate('33.33', '0.07')                        // '2.33'    (half-up)\n * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'\n * mulRate(100, 0.07, { scale: 2 })                // '7.00'\n * ```\n */\nexport function mulRate(\n  amount: number | string,\n  rate: number | string,\n  opts: MulRateOptions = {},\n): string {\n  const scale = resolveScale('mulRate', amount, opts.scale)\n  const rounding = opts.rounding ?? 'half-up'\n  const a = parseAmount('mulRate', amount, scale, rounding)\n\n  const rateScale = decimalScaleOf(rate)\n  if (rateScale === null) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n  const r = parseToScaledInt(rate, rateScale)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n\n  const product = a * r.value // scaled at scale + rateScale\n  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale)\n}\n\n/**\n * Split a money amount across weighted buckets with ZERO drift: the\n * returned parts sum to the input exactly, by construction\n * (largest-remainder method).\n *\n * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover\n * minor units (always fewer than the bucket count) go one each to the\n * buckets with the largest truncated remainders — ties broken by\n * position, earlier bucket first. Weights are parsed as exact decimals\n * (no float division anywhere); they must be non-negative with a\n * positive sum.\n *\n * ```ts\n * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']\n * allocate('0.05', [3, 7])        // ['0.02', '0.03']\n * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']\n * ```\n */\nexport function allocate(\n  amount: number | string,\n  weights: ReadonlyArray<number | string>,\n  opts: AllocateOptions = {},\n): string[] {\n  if (weights.length === 0) {\n    throw new MoneyUnsupportedError('allocate: weights must not be empty')\n  }\n  const scale = resolveScale('allocate', amount, opts.scale)\n  const a = parseAmount('allocate', amount, scale)\n\n  // Parse every weight as an exact decimal at a common scale, so the\n  // proportion arithmetic below is pure BigInt.\n  let weightScale = 0\n  for (const w of weights) {\n    const s = decimalScaleOf(w)\n    if (s === null) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`)\n    }\n    if (s > weightScale) weightScale = s\n  }\n  const scaledWeights = weights.map(w => {\n    const r = parseToScaledInt(w, weightScale)\n    if (!r.ok || r.value < 0n) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`)\n    }\n    return r.value\n  })\n  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n)\n  if (sumW === 0n) {\n    throw new MoneyUnsupportedError('allocate: weights must not all be zero')\n  }\n\n  // Largest-remainder over the MAGNITUDE; a negative amount negates the\n  // parts at the end, so Σparts === amount holds for both signs.\n  const negative = a < 0n\n  const mag = negative ? -a : a\n\n  const base: bigint[] = []\n  const remainders: Array<{ index: number; rem: bigint }> = []\n  let distributed = 0n\n  for (let i = 0; i < scaledWeights.length; i++) {\n    const product = mag * scaledWeights[i]!\n    const share = product / sumW\n    base.push(share)\n    distributed += share\n    remainders.push({ index: i, rem: product % sumW })\n  }\n\n  // Leftover minor units: strictly fewer than the bucket count.\n  let leftover = mag - distributed\n  remainders.sort((x, y) => (y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index))\n  for (const { index } of remainders) {\n    if (leftover === 0n) break\n    base[index] = base[index]! + 1n\n    leftover -= 1n\n  }\n\n  return base.map(p => formatScaledInt(negative && p !== 0n ? -p : p, scale))\n}\n","/**\n * Branded money output type (#338).\n *\n * The decoded read shape of a money field is an exact decimal STRING\n * (`'10000.00'`) — but a hand-written schema types it `string | number`,\n * which is honest about the input side and unhelpful on the output\n * side: every read site hand-coerces, and a missed coercion passes\n * typecheck silently (then surfaces as a runtime template warning, or\n * worse, as `'10000.00' * 100` arithmetic).\n *\n * {@link MoneyString} is the output-side brand: a `string` that has\n * been through noy-db's decode (or {@link asMoney}'s guard). Branding\n * is type-level only — zero runtime cost on the read path.\n *\n * ## Wiring the brand through a validator (the input/output asymmetry)\n *\n * Keep the permissive `string | number` on the INPUT side so write\n * sites are untouched, and brand the OUTPUT side. With Zod:\n *\n * ```ts\n * import type { MoneyString } from '@noy-db/hub'\n *\n * const moneyValue = z.union([z.number(), z.string()]) as unknown as\n *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>\n *\n * const Invoice = z.object({ id: z.string(), total: moneyValue })\n * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString\n * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number\n * ```\n *\n * The cast is sound for fields declared in `moneyFields`: reads pass\n * through `decodeMoneyFields`, which always produces the canonical\n * decimal string.\n */\n\nimport { decimalScaleOf } from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\ndeclare const MONEY_BRAND: unique symbol\n\n/**\n * An exact decimal string produced by noy-db's money decode\n * (`'10000.00'`). The brand exists only at the type level — at runtime\n * a `MoneyString` is a plain string.\n */\nexport type MoneyString = string & { readonly [MONEY_BRAND]: true }\n\n/**\n * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string\n * or a number, returns the canonical decimal string branded — throws\n * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at\n * trust boundaries (deserialized JSON, route params); values read\n * through `get()`/`list()` are already canonical.\n */\nexport function asMoney(value: string | number): MoneyString {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return String(value).trim() as MoneyString\n}\n\n/** Type guard: is `value` a decimal string acceptable as money? */\nexport function isMoneyString(value: unknown): value is MoneyString {\n  return typeof value === 'string' && isMoneyLike(value)\n}\n\n/**\n * The ONE sanctioned escape hatch to a JS `number` — explicit because\n * the conversion is lossy past 2^53. For display math and chart axes;\n * never feed the result back into stored amounts (use `mulRate` /\n * `allocate` for exact arithmetic).\n */\nexport function moneyNumber(value: MoneyString | string | number): number {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return Number(value)\n}\n\nfunction isMoneyLike(value: unknown): boolean {\n  if (typeof value === 'number') return Number.isFinite(value)\n  if (typeof value !== 'string') return false\n  return decimalScaleOf(value) !== null\n}\n","/**\n * Vault-level diff orchestrator.\n *\n * Compares a live `Vault`'s plaintext state against a candidate state\n * (another vault, a plain `{ collection: records[] }` map, or a vault\n * dump JSON) and returns a structured `VaultDiff` plan listing the\n * records that would be added, modified, or deleted to bring the live\n * vault into the candidate's shape.\n *\n * Builds on two existing record-level helpers:\n *\n *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed\n *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for\n *      each changed field of two records. Used here for the\n *      `fieldDiffs` of every `modified` entry, and (with empty result)\n *      as the default deep-equal check.\n *\n *   2. `Vault.exportStream()` from `./vault.ts` — the canonical\n *      decrypt-and-stream-records iterator. Used to walk both sides\n *      when the candidate is itself a `Vault`. ACL-scoped: collections\n *      the caller can't read silently drop out, the same way every\n *      other plaintext-emitting export pipeline filters them.\n *\n * The new orchestration is the **vault-level** enumeration: bucket\n * each record id into added (only in candidate), deleted (only in\n * vault), or modified (in both with field changes); leave the\n * field-level granularity to the existing `diff()`.\n *\n * Use cases:\n *\n *   - Import preview (`@noy-db/as-*` `fromString` returns a plan\n *     whose body is a `VaultDiff`).\n *   - Backup verification (\"does this `.noydb` bundle from yesterday\n *     match the current vault?\").\n *   - Two-vault reconciliation (\"what's different between Office A\n *     and Office B before we sync?\").\n *   - Test assertions (golden-file testing with one-liner\n *     `expect(plan.summary).toEqual(...)`).\n *\n * @module\n */\n\nimport type { Vault } from './vault.js'\nimport { diff as fieldDiff, type DiffEntry as FieldDiffEntry } from './history/diff.js'\n\n// ─── Public types ──────────────────────────────────────────────────────\n\n/** Per-record entry shape — added and deleted records carry only the record value. */\nexport interface VaultDiffEntry<T = unknown> {\n  readonly collection: string\n  readonly id: string\n  readonly record: T\n  /**\n   * Unencrypted envelope metadata for the RECEIVER-side record.\n   * Populated only when `diffVault` is called with `{includeMetadata: true}`.\n   * Default: `undefined` (zero extra reads, no behavior change).\n   *\n   * Populated for `modified` (the CURRENT receiver state, before the candidate\n   * is applied) and `deleted` (the receiver envelope of the record being\n   * removed). `added` entries have no receiver envelope at diff time, so their\n   * `metadata` is always absent.\n   */\n  readonly metadata?: {\n    readonly version: number\n    readonly timestamp: string\n    readonly by?: string\n    readonly source?: string\n    readonly sourceTs?: string\n  }\n}\n\n/** Modified records carry both halves of the diff plus the field-level breakdown. */\nexport interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {\n  /** The record as it stands in the live vault. */\n  readonly before: T\n  /** Top-level keys whose values differ between `before` and `record`. */\n  readonly fieldsChanged: readonly string[]\n  /**\n   * Field-level diff entries from `diff(before, record)`. Reuses the\n   * existing per-record diff helper so consumers can render git-style\n   * `path: from → to` rows without re-walking the records.\n   */\n  readonly fieldDiffs: readonly FieldDiffEntry[]\n}\n\nexport interface VaultDiff<T = unknown> {\n  readonly added: readonly VaultDiffEntry<T>[]\n  readonly modified: readonly VaultDiffModifiedEntry<T>[]\n  readonly deleted: readonly VaultDiffEntry<T>[]\n  /** Only populated when `options.includeUnchanged: true`. */\n  readonly unchanged: readonly VaultDiffEntry<T>[] | undefined\n  readonly summary: {\n    readonly add: number\n    readonly modify: number\n    readonly delete: number\n    readonly total: number\n  }\n  /**\n   * Format the diff as a human-readable string.\n   *\n   *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)\n   *   - `'one-line'` — count plus a single overview line\n   *   - `'full'`    — count + one row per added/modified/deleted record (default)\n   */\n  format(opts?: { detail?: 'count' | 'one-line' | 'full' }): string\n}\n\nexport interface DiffOptions {\n  /** Restrict the diff to a subset of collections. */\n  readonly collections?: readonly string[]\n  /** Field on each record that carries its id. Defaults to `'id'`. */\n  readonly idKey?: string\n  /** Override the default deep-equal check for \"modified vs unchanged\". */\n  readonly compareFn?: (a: unknown, b: unknown) => boolean\n  /** If true, include unchanged records in the diff (off by default to save memory). */\n  readonly includeUnchanged?: boolean\n  /**\n   * When `true`, each entry in `added`, `modified`, and `deleted` will carry a\n   * `metadata` field with the RECEIVER-side envelope metadata\n   * (`version`, `timestamp`, `by?`, `source?`, `sourceTs?`).\n   *\n   * Off by default — no extra adapter reads, no behavior change for existing callers.\n   * (FR-5 read surface, #445)\n   */\n  readonly includeMetadata?: boolean\n}\n\n/**\n * Candidate state to diff the vault against:\n *\n *   - A `Vault` instance — both sides are walked via `exportStream()`.\n *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`\n *     produces. Useful for diffing parsed file content against the live vault.\n *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the\n *     full vault state. Parsed and reduced to the map shape above.\n */\nexport type DiffCandidate<T = unknown> =\n  | Vault\n  | Record<string, readonly T[]>\n  | string\n\n// ─── Implementation ────────────────────────────────────────────────────\n\n/**\n * Compute the diff between a live vault and a candidate state.\n *\n * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is\n * O(n + m) in the row count of vault + candidate. For documented\n * 1K-50K-record vaults this is fine; a streaming variant lands as a\n * follow-up if a > 100K-record consumer arrives.\n */\nexport async function diffVault<T = unknown>(\n  vault: Vault,\n  candidate: DiffCandidate<T>,\n  options: DiffOptions = {},\n): Promise<VaultDiff<T>> {\n  const idKey = options.idKey ?? 'id'\n  const filter = options.collections ? new Set(options.collections) : null\n  const compareFn =\n    options.compareFn ?? ((a: unknown, b: unknown) => fieldDiff(a, b).length === 0)\n\n  // Side A — walk the live vault via exportStream(). Each chunk arrives\n  // already decrypted and ACL-scoped, so collections the caller can't\n  // read silently drop out. exportStream's records are typed `unknown[]`\n  // — diffVault is the type-erasure boundary; the caller asserts the\n  // record shape via the function's `<T>` generic.\n  const live = new Map<string, Map<string, T>>()\n  for await (const chunk of vault.exportStream({ granularity: 'collection' })) {\n    if (filter && !filter.has(chunk.collection)) continue\n    const collection = live.get(chunk.collection) ?? new Map<string, T>()\n    for (const record of chunk.records) {\n      const id = readIdField(record, idKey)\n      if (!id) continue\n      collection.set(id, record as T)\n    }\n    live.set(chunk.collection, collection)\n  }\n\n  // Side B — normalise the candidate into the same shape.\n  const cand = await normaliseCandidate<T>(candidate, idKey, filter)\n\n  // Walk every (collection, id) on either side and bucket.\n  const added: VaultDiffEntry<T>[] = []\n  const modified: VaultDiffModifiedEntry<T>[] = []\n  const deleted: VaultDiffEntry<T>[] = []\n  const unchanged: VaultDiffEntry<T>[] | undefined = options.includeUnchanged ? [] : undefined\n\n  const collectionNames = new Set([...live.keys(), ...cand.keys()])\n  for (const collection of [...collectionNames].sort()) {\n    const liveColl = live.get(collection) ?? new Map<string, T>()\n    const candColl = cand.get(collection) ?? new Map<string, T>()\n    const allIds = new Set([...liveColl.keys(), ...candColl.keys()])\n\n    for (const id of [...allIds].sort()) {\n      const before = liveColl.get(id)\n      const after = candColl.get(id)\n\n      if (before === undefined && after !== undefined) {\n        // added: record only in candidate — no receiver envelope\n        added.push({ collection, id, record: after })\n      } else if (before !== undefined && after === undefined) {\n        // deleted: record only in receiver — attach metadata if requested\n        const metadata = options.includeMetadata\n          ? (await vault.collection(collection).getMetadata(id)) ?? undefined\n          : undefined\n        deleted.push({ collection, id, record: before, ...(metadata !== undefined ? { metadata } : {}) })\n      } else if (before !== undefined && after !== undefined) {\n        if (compareFn(before, after)) {\n          unchanged?.push({ collection, id, record: after })\n        } else {\n          // modified: record in both — attach receiver-side metadata if requested\n          const metadata = options.includeMetadata\n            ? (await vault.collection(collection).getMetadata(id)) ?? undefined\n            : undefined\n          const fieldDiffs = fieldDiff(before, after)\n          const fieldsChanged = uniqueTopLevelKeys(fieldDiffs)\n          modified.push({\n            collection,\n            id,\n            record: after,\n            before,\n            fieldsChanged,\n            fieldDiffs,\n            ...(metadata !== undefined ? { metadata } : {}),\n          })\n        }\n      }\n    }\n  }\n\n  const summary = {\n    add: added.length,\n    modify: modified.length,\n    delete: deleted.length,\n    total: added.length + modified.length + deleted.length,\n  }\n\n  return {\n    added,\n    modified,\n    deleted,\n    unchanged,\n    summary,\n    format(opts) {\n      return formatDiff(opts?.detail ?? 'full', { added, modified, deleted, summary })\n    },\n  }\n}\n\n// ─── Internals ─────────────────────────────────────────────────────────\n\nasync function normaliseCandidate<T>(\n  candidate: DiffCandidate<T>,\n  idKey: string,\n  filter: Set<string> | null,\n): Promise<Map<string, Map<string, T>>> {\n  const out = new Map<string, Map<string, T>>()\n\n  // Vault instance — duck-type via the exportStream method (matches\n  // vault.ts's structural shape without forcing a runtime instanceof check\n  // that would import the class and risk circular deps).\n  if (\n    typeof candidate === 'object' &&\n    candidate !== null &&\n    'exportStream' in candidate &&\n    typeof (candidate as Vault).exportStream === 'function'\n  ) {\n    for await (const chunk of (candidate as Vault).exportStream({ granularity: 'collection' })) {\n      if (filter && !filter.has(chunk.collection)) continue\n      const collection = out.get(chunk.collection) ?? new Map<string, T>()\n      for (const record of chunk.records) {\n        const id = readIdField(record, idKey)\n        if (!id) continue\n        collection.set(id, record as T)\n      }\n      out.set(chunk.collection, collection)\n    }\n    return out\n  }\n\n  // String — assume a vault.dump() JSON string. Parse and reduce to the map shape.\n  if (typeof candidate === 'string') {\n    let parsed: unknown\n    try {\n      parsed = JSON.parse(candidate)\n    } catch (err) {\n      throw new Error(\n        `diffVault: candidate string is not valid JSON (${(err as Error).message})`,\n      )\n    }\n    return collectionsFromObject<T>(parsed, idKey, filter)\n  }\n\n  // Plain object — `Record<collection, records[]>` (same shape as-json.toObject() returns).\n  return collectionsFromObject<T>(candidate, idKey, filter)\n}\n\nfunction collectionsFromObject<T>(\n  raw: unknown,\n  idKey: string,\n  filter: Set<string> | null,\n): Map<string, Map<string, T>> {\n  const out = new Map<string, Map<string, T>>()\n  if (raw === null || typeof raw !== 'object') {\n    throw new Error('diffVault: candidate must be a Vault, an object, or a JSON string')\n  }\n  // A vault dump JSON has a top-level shape like { _compartment, _keyring, <coll>: <records[]> }.\n  // We accept both: keys starting with `_` are skipped (they're metadata), the rest are collections.\n  for (const [key, value] of Object.entries(raw)) {\n    if (key.startsWith('_')) continue\n    if (filter && !filter.has(key)) continue\n    if (!Array.isArray(value)) continue\n    const collection = new Map<string, T>()\n    for (const record of value as readonly T[]) {\n      if (record === null || typeof record !== 'object') continue\n      const id = readIdField(record, idKey)\n      if (!id) continue\n      collection.set(id, record)\n    }\n    out.set(key, collection)\n  }\n  return out\n}\n\nfunction uniqueTopLevelKeys(diffs: readonly FieldDiffEntry[]): readonly string[] {\n  const keys = new Set<string>()\n  for (const d of diffs) {\n    // path is dot-separated; the top-level key is everything before the\n    // first `.` or `[`. (`a.b.c` → `a`, `tags[0]` → `tags`, `(root)` → `(root)`).\n    const m = /^[^.[]+/.exec(d.path)\n    if (m) keys.add(m[0])\n  }\n  return [...keys]\n}\n\n/**\n * Pull the id field off a record without going through `String(obj)`,\n * which would emit `[object Object]` for nested objects and silently\n * collapse rows that share the same parent. Only string and number ids\n * are accepted; anything else returns the empty string and the record\n * is skipped at the call site.\n */\nfunction readIdField(record: unknown, idKey: string): string {\n  if (record === null || typeof record !== 'object') return ''\n  const v = (record as Record<string, unknown>)[idKey]\n  if (typeof v === 'string') return v\n  if (typeof v === 'number' && Number.isFinite(v)) return String(v)\n  return ''\n}\n\ninterface FormatBuckets<T> {\n  readonly added: readonly VaultDiffEntry<T>[]\n  readonly modified: readonly VaultDiffModifiedEntry<T>[]\n  readonly deleted: readonly VaultDiffEntry<T>[]\n  readonly summary: VaultDiff<T>['summary']\n}\n\nfunction formatDiff<T>(\n  detail: 'count' | 'one-line' | 'full',\n  b: FormatBuckets<T>,\n): string {\n  const head = `${b.summary.add} added · ${b.summary.modify} modified · ${b.summary.delete} deleted`\n  if (detail === 'count') return head\n  if (b.summary.total === 0) return head + '\\n(no changes)'\n  if (detail === 'one-line') return head\n\n  const rows: string[] = [head, '']\n  for (const e of b.added) rows.push(`${e.collection}/${e.id}\\tadded`)\n  for (const e of b.modified) {\n    const fields = e.fieldDiffs\n      .map((f) => `${f.path}: ${shortJSON(f.from)} → ${shortJSON(f.to)}`)\n      .join(', ')\n    rows.push(`${e.collection}/${e.id}\\tmodified\\t${fields}`)\n  }\n  for (const e of b.deleted) rows.push(`${e.collection}/${e.id}\\tdeleted`)\n  return rows.join('\\n')\n}\n\nfunction shortJSON(value: unknown): string {\n  if (value === undefined) return 'undefined'\n  const s = JSON.stringify(value)\n  // JSON.stringify returns string for any JSON value except `undefined`\n  // (handled above), `function`, and `symbol`. Fall back to a static\n  // tag for those — never let an arbitrary object hit the default\n  // stringifier (which the lint rule explicitly bans).\n  if (typeof s !== 'string') return '<unrepresentable>'\n  return s.length > 60 ? s.slice(0, 57) + '...' : s\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBO,SAAS,oBACd,UACU;AACV,MAAI,SAAS,QAAQ,IAAI;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;;;ACrCO,SAAS,cAAoC;AAClD,SAAO,EAAE,MAAM,eAAe,eAAe,OAAO,EAAE,QAAQ,QAAQ,GAAG;AAC3E;AAGO,SAAS,eAAqC;AACnD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,gBAAgB;AACjC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,YACT,kCAAkC,MAAM,UAAU,cACpC,MAAM,MAAM,KAAK,IAAI,CAAC,gBAAgB,MAAM,QAAQ,KAAK,IAAI,CAAC,gBAC7D,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,UAE3D;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;AAMO,SAAS,WAAW,MAAsE;AAC/F,QAAM,SAAS,MAAM;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,OAAQ,QAAO,EAAE,QAAQ,QAAiB;AAC7D,YAAM,UAAU,SACZ,CAAC,GAAG,MAAM,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM,QAAQ,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAK,OAAO,SAAS,CAAC,CAAC,IACrG,CAAC,OAAO;AACZ,UAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,QAAiB;AAC5D,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,UACT,eAAe,MAAM,UAAU,iBAC5B,SAAS,eAAe,OAAO,KAAK,IAAI,CAAC,gBAAgB,QAAQ,KAAK,IAAI,CAAC,OAAO,MACnF;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnDO,SAAS,mBAAmB,MAAiE;AAClG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,OAAoB;AAChC,UAAI,MAAM,SAAS,gBAAgB;AACjC,eAAO,EAAE,QAAQ,WAAoB,WAAW,KAAK,UAAU;AAAA,MACjE;AACA,aAAO,EAAE,QAAQ,QAAiB;AAAA,IACpC;AAAA,EACF;AACF;;;ACUO,SAAS,sBAAsB,QAKV;AAC1B,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,IACd,gBAAgB,OAAO,kBAAkB;AAAA,EAC3C;AACF;;;AC7BO,IAAM,mBAAmB;;;ACuChC,SAAS,YAAY,OAAe,QAAyB,OAAe,UAAiC;AAC3G,QAAM,IAAI,iBAAiB,QAAQ,OAAO,QAAQ;AAClD,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI;AAAA,MACR,EAAE,WAAW,cACT,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,kCAAkC,KAAK,wCACjF,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO,EAAE;AACX;AAEA,SAAS,aAAa,OAAe,QAAyB,UAAsC;AAClG,MAAI,aAAa,QAAW;AAC1B,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAC/C,YAAM,IAAI,sBAAsB,GAAG,KAAK,wCAAwC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,eAAe,MAAM;AACtC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,sBAAsB,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,0BAA0B;AAAA,EACtG;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,MACA,OAAuB,CAAC,GAChB;AACR,QAAM,QAAQ,aAAa,WAAW,QAAQ,KAAK,KAAK;AACxD,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,IAAI,YAAY,WAAW,QAAQ,OAAO,QAAQ;AAExD,QAAM,YAAY,eAAe,IAAI;AACrC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AACA,QAAM,IAAI,iBAAiB,MAAM,SAAS;AAC1C,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AAEA,QAAM,UAAU,IAAI,EAAE;AACtB,SAAO,gBAAgB,iBAAiB,SAAS,QAAQ,WAAW,OAAO,QAAQ,GAAG,KAAK;AAC7F;AAoBO,SAAS,SACd,QACA,SACA,OAAwB,CAAC,GACf;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,sBAAsB,qCAAqC;AAAA,EACvE;AACA,QAAM,QAAQ,aAAa,YAAY,QAAQ,KAAK,KAAK;AACzD,QAAM,IAAI,YAAY,YAAY,QAAQ,KAAK;AAI/C,MAAI,cAAc;AAClB,aAAW,KAAK,SAAS;AACvB,UAAM,IAAI,eAAe,CAAC;AAC1B,QAAI,MAAM,MAAM;AACd,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,0BAA0B;AAAA,IACjG;AACA,QAAI,IAAI,YAAa,eAAc;AAAA,EACrC;AACA,QAAM,gBAAgB,QAAQ,IAAI,OAAK;AACrC,UAAM,IAAI,iBAAiB,GAAG,WAAW;AACzC,QAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI;AACzB,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,iCAAiC;AAAA,IACxG;AACA,WAAO,EAAE;AAAA,EACX,CAAC;AACD,QAAM,OAAO,cAAc,OAAO,CAAC,KAAK,MAAM,MAAM,GAAG,EAAE;AACzD,MAAI,SAAS,IAAI;AACf,UAAM,IAAI,sBAAsB,wCAAwC;AAAA,EAC1E;AAIA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,WAAW,CAAC,IAAI;AAE5B,QAAM,OAAiB,CAAC;AACxB,QAAM,aAAoD,CAAC;AAC3D,MAAI,cAAc;AAClB,WAAS,IAAI,GAAG,IAAI,cAAc,QAAQ,KAAK;AAC7C,UAAM,UAAU,MAAM,cAAc,CAAC;AACrC,UAAM,QAAQ,UAAU;AACxB,SAAK,KAAK,KAAK;AACf,mBAAe;AACf,eAAW,KAAK,EAAE,OAAO,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,EACnD;AAGA,MAAI,WAAW,MAAM;AACrB,aAAW,KAAK,CAAC,GAAG,MAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,QAAQ,EAAE,KAAM;AACtF,aAAW,EAAE,MAAM,KAAK,YAAY;AAClC,QAAI,aAAa,GAAI;AACrB,SAAK,KAAK,IAAI,KAAK,KAAK,IAAK;AAC7B,gBAAY;AAAA,EACd;AAEA,SAAO,KAAK,IAAI,OAAK,gBAAgB,YAAY,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;AAC5E;;;ACnIO,SAAS,QAAQ,OAAqC;AAC3D,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,YAAY,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EAC7F;AACA,SAAO,OAAO,KAAK,EAAE,KAAK;AAC5B;AAGO,SAAS,cAAc,OAAsC;AAClE,SAAO,OAAO,UAAU,YAAY,YAAY,KAAK;AACvD;AAQO,SAAS,YAAY,OAA8C;AACxE,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,gBAAgB,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EACjG;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,eAAe,KAAK,MAAM;AACnC;;;ACoEA,eAAsB,UACpB,OACA,WACA,UAAuB,CAAC,GACD;AACvB,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,SAAS,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AACpE,QAAM,YACJ,QAAQ,cAAc,CAAC,GAAY,MAAe,KAAU,GAAG,CAAC,EAAE,WAAW;AAO/E,QAAM,OAAO,oBAAI,IAA4B;AAC7C,mBAAiB,SAAS,MAAM,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC3E,QAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,UAAM,aAAa,KAAK,IAAI,MAAM,UAAU,KAAK,oBAAI,IAAe;AACpE,eAAW,UAAU,MAAM,SAAS;AAClC,YAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,UAAI,CAAC,GAAI;AACT,iBAAW,IAAI,IAAI,MAAW;AAAA,IAChC;AACA,SAAK,IAAI,MAAM,YAAY,UAAU;AAAA,EACvC;AAGA,QAAM,OAAO,MAAM,mBAAsB,WAAW,OAAO,MAAM;AAGjE,QAAM,QAA6B,CAAC;AACpC,QAAM,WAAwC,CAAC;AAC/C,QAAM,UAA+B,CAAC;AACtC,QAAM,YAA6C,QAAQ,mBAAmB,CAAC,IAAI;AAEnF,QAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAChE,aAAW,cAAc,CAAC,GAAG,eAAe,EAAE,KAAK,GAAG;AACpD,UAAM,WAAW,KAAK,IAAI,UAAU,KAAK,oBAAI,IAAe;AAC5D,UAAM,WAAW,KAAK,IAAI,UAAU,KAAK,oBAAI,IAAe;AAC5D,UAAM,SAAS,oBAAI,IAAI,CAAC,GAAG,SAAS,KAAK,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC;AAE/D,eAAW,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACnC,YAAM,SAAS,SAAS,IAAI,EAAE;AAC9B,YAAM,QAAQ,SAAS,IAAI,EAAE;AAE7B,UAAI,WAAW,UAAa,UAAU,QAAW;AAE/C,cAAM,KAAK,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC;AAAA,MAC9C,WAAW,WAAW,UAAa,UAAU,QAAW;AAEtD,cAAM,WAAW,QAAQ,kBACpB,MAAM,MAAM,WAAW,UAAU,EAAE,YAAY,EAAE,KAAM,SACxD;AACJ,gBAAQ,KAAK,EAAE,YAAY,IAAI,QAAQ,QAAQ,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC,EAAG,CAAC;AAAA,MAClG,WAAW,WAAW,UAAa,UAAU,QAAW;AACtD,YAAI,UAAU,QAAQ,KAAK,GAAG;AAC5B,qBAAW,KAAK,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC;AAAA,QACnD,OAAO;AAEL,gBAAM,WAAW,QAAQ,kBACpB,MAAM,MAAM,WAAW,UAAU,EAAE,YAAY,EAAE,KAAM,SACxD;AACJ,gBAAM,aAAa,KAAU,QAAQ,KAAK;AAC1C,gBAAM,gBAAgB,mBAAmB,UAAU;AACnD,mBAAS,KAAK;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,YACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,UAC/C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,KAAK,MAAM;AAAA,IACX,QAAQ,SAAS;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,OAAO,MAAM,SAAS,SAAS,SAAS,QAAQ;AAAA,EAClD;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM;AACX,aAAOA,YAAW,MAAM,UAAU,QAAQ,EAAE,OAAO,UAAU,SAAS,QAAQ,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAIA,eAAe,mBACb,WACA,OACA,QACsC;AACtC,QAAM,MAAM,oBAAI,IAA4B;AAK5C,MACE,OAAO,cAAc,YACrB,cAAc,QACd,kBAAkB,aAClB,OAAQ,UAAoB,iBAAiB,YAC7C;AACA,qBAAiB,SAAU,UAAoB,aAAa,EAAE,aAAa,aAAa,CAAC,GAAG;AAC1F,UAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,EAAG;AAC7C,YAAM,aAAa,IAAI,IAAI,MAAM,UAAU,KAAK,oBAAI,IAAe;AACnE,iBAAW,UAAU,MAAM,SAAS;AAClC,cAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,YAAI,CAAC,GAAI;AACT,mBAAW,IAAI,IAAI,MAAW;AAAA,MAChC;AACA,UAAI,IAAI,MAAM,YAAY,UAAU;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,SAAS;AAAA,IAC/B,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,kDAAmD,IAAc,OAAO;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,sBAAyB,QAAQ,OAAO,MAAM;AAAA,EACvD;AAGA,SAAO,sBAAyB,WAAW,OAAO,MAAM;AAC1D;AAEA,SAAS,sBACP,KACA,OACA,QAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,IAAI,WAAW,GAAG,EAAG;AACzB,QAAI,UAAU,CAAC,OAAO,IAAI,GAAG,EAAG;AAChC,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG;AAC3B,UAAM,aAAa,oBAAI,IAAe;AACtC,eAAW,UAAU,OAAuB;AAC1C,UAAI,WAAW,QAAQ,OAAO,WAAW,SAAU;AACnD,YAAM,KAAK,YAAY,QAAQ,KAAK;AACpC,UAAI,CAAC,GAAI;AACT,iBAAW,IAAI,IAAI,MAAM;AAAA,IAC3B;AACA,QAAI,IAAI,KAAK,UAAU;AAAA,EACzB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAqD;AAC/E,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,OAAO;AAGrB,UAAM,IAAI,UAAU,KAAK,EAAE,IAAI;AAC/B,QAAI,EAAG,MAAK,IAAI,EAAE,CAAC,CAAC;AAAA,EACtB;AACA,SAAO,CAAC,GAAG,IAAI;AACjB;AASA,SAAS,YAAY,QAAiB,OAAuB;AAC3D,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,QAAM,IAAK,OAAmC,KAAK;AACnD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,EAAG,QAAO,OAAO,CAAC;AAChE,SAAO;AACT;AASA,SAASA,YACP,QACA,GACQ;AACR,QAAM,OAAO,GAAG,EAAE,QAAQ,GAAG,eAAY,EAAE,QAAQ,MAAM,kBAAe,EAAE,QAAQ,MAAM;AACxF,MAAI,WAAW,QAAS,QAAO;AAC/B,MAAI,EAAE,QAAQ,UAAU,EAAG,QAAO,OAAO;AACzC,MAAI,WAAW,WAAY,QAAO;AAElC,QAAM,OAAiB,CAAC,MAAM,EAAE;AAChC,aAAW,KAAK,EAAE,MAAO,MAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,QAAS;AACnE,aAAW,KAAK,EAAE,UAAU;AAC1B,UAAM,SAAS,EAAE,WACd,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,IAAI,CAAC,WAAM,UAAU,EAAE,EAAE,CAAC,EAAE,EACjE,KAAK,IAAI;AACZ,SAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,aAAe,MAAM,EAAE;AAAA,EAC1D;AACA,aAAW,KAAK,EAAE,QAAS,MAAK,KAAK,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE,UAAW;AACvE,SAAO,KAAK,KAAK,IAAI;AACvB;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,KAAK,UAAU,KAAK;AAK9B,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,EAAE,SAAS,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI,QAAQ;AAClD;","names":["formatDiff"]}