@noy-db/hub 0.2.0-pre.8 → 0.3.0-pre.1

package/dist/team/index.d.cts

@@ -1,118 +0,0 @@
-import { b1 as NoydbStore, a$ as UnlockedKeyring } from '../types-DjunxzJa.cjs';
-export { br as BundleRecipient, ce as EnrollAuthenticatorOptions, cf as EnrollAuthenticatorWrappingDEKsOptions, cg as EnrollAuthenticatorWrappingKEKOptions, cL as ListUsersOptions, d7 as PaperRecoveryEntry, df as PresenceHandle, dB as RecoverPassphraseInput, dC as RecoverPassphraseResult, dD as RecoverUserOptions, dE as RecoveryProof, dH as RotatePassphraseInput, dT as SlotRewrapCeremony, dU as SlotRewrapContext, d$ as SyncEngine, e7 as SyncTransaction, ek as UpdateAuthenticatorOptions, ez as WrappedDeksBlob, eF as buildRecipientKeyringFile, eG as burnPaperRecoveryEntry, fp as changeSecret, fq as createOwnerKeyring, eJ as deriveMagicLinkContentKey, eK as enrollAuthenticator, fr as ensureCollectionDEK, eM as evaluateExportCapability, eN as evaluateImportCapability, eO as findAuthenticator, fs as grant, eP as hasExportCapability, eQ as hasImportCapability, eS as isMagicLinkGrantExpired, eX as listMagicLinkGrants, eY as listUsers, eZ as listUsersWithEnvelopes, ft as loadKeyring, e$ as loadPaperRecoveryEntries, f2 as magicLinkGrantRecordId, f3 as mintPaperRecoveryEntry, f5 as mintWrappedDeksBlob, fu as persistKeyring, f7 as readMagicLinkGrantRecord, eV as recoverPassphrase, f8 as recoverUser, f9 as removeAuthenticator, fv as revoke, fc as revokeMagicLinkGrant, eW as rotatePassphrase, fd as savePaperRecoveryEntries, fg as unwrapDeksFromBlob, fh as unwrapDeksFromPaperEntry, fj as unwrapMagicLinkGrant, fw as updateAuthenticator, fx as updateKeyringIdentity, fo as writeMagicLinkGrant } from '../types-DjunxzJa.cjs';
-import '../lazy-builder-wY4pMCEe.cjs';
-import '../predicate-BSAGEyu5.cjs';
-import '../strategy-DSTrsZ8t.cjs';
-import '../strategy-BSxFXGzb.cjs';
-import '../index-4fBVt8j9.cjs';
-import '@noy-db/attestation';
-
-/**
- * _sync_credentials reserved collection —
- *
- * Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as
- * encrypted records inside the vault itself. Tokens are wrapped with the
- * compartment's own DEK, live on disk as ciphertext like any other record, and
- * are accessed only through the dedicated API in this module — never via
- * `vault.collection('_sync_credentials')`.
- *
- * Design decisions
- * ────────────────
- *
- * **Why a reserved collection, not a separate store?**
- * The compartment's existing encryption stack (AES-256-GCM + collection DEK)
- * is exactly the right primitive for protecting OAuth tokens at rest. Using a
- * separate store would require a new encryption surface, new adapter calls,
- * and a new backup/restore path — all of which already exist for collections.
- *
- * **Why not exposed as a regular collection?**
- * The same reason `_keyring` and `_ledger` aren't: they have invariants that
- * must be enforced (naming scheme, no cross-user leakage, no schema
- * validation, no history/ledger writes for privacy). Routing through a
- * dedicated API enforces those invariants.
- *
- * **Token lifecycle:**
- * - `putCredential(vault, adapterId, token)` — store or overwrite
- * - `getCredential(vault, adapterId)` — load and decrypt
- * - `deleteCredential(vault, adapterId)` — remove
- * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)
- *
- * The `adapterId` is the record ID within the `_sync_credentials` collection.
- * It should be a stable, human-readable identifier for the adapter instance
- * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).
- *
- * **ACL:** only `owner` and `admin` roles can read/write sync credentials.
- * Operators, viewers, and clients cannot call this API. The check is made
- * against the caller's keyring role at call time.
- */
-
-/** The reserved collection name. Never collides with user collections. */
-declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
-/**
- * An OAuth/auth token stored in `_sync_credentials`.
- *
- * Fields mirror the OAuth2 token response shape. `customData` is an escape
- * hatch for adapter-specific secrets (API keys, connection strings, etc.)
- * that don't fit the OAuth2 shape.
- */
-interface SyncCredential {
-    /** Stable identifier for the adapter instance (e.g. 'google-drive'). */
-    readonly adapterId: string;
-    /** OAuth token type, usually 'Bearer'. */
-    readonly tokenType: string;
-    /** The access token. Expires at `expiresAt` if set. */
-    readonly accessToken: string;
-    /** Long-lived refresh token for renewing the access token. */
-    readonly refreshToken?: string;
-    /** ISO timestamp when `accessToken` expires. Absent means "no expiry". */
-    readonly expiresAt?: string;
-    /** Space-separated OAuth scopes. */
-    readonly scopes?: string;
-    /** Adapter-specific opaque data (API keys, endpoints, etc.). */
-    readonly customData?: Record<string, string>;
-}
-/**
- * Store or overwrite a sync credential for the given adapter.
- *
- * The credential is encrypted with the `_sync_credentials` collection DEK
- * (auto-generated on first use). The record ID is the `adapterId`.
- *
- * Requires owner or admin role.
- */
-declare function putCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, credential: SyncCredential): Promise<void>;
-/**
- * Load and decrypt a sync credential for the given adapter ID.
- *
- * Returns `null` if no credential exists for this adapter.
- * Requires owner or admin role.
- */
-declare function getCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<SyncCredential | null>;
-/**
- * Delete a sync credential by adapter ID.
- *
- * No-op if the credential doesn't exist. Requires owner or admin role.
- */
-declare function deleteCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<void>;
-/**
- * List all adapter IDs that have stored credentials.
- *
- * Returns only the IDs, never the credential payloads. Useful for
- * displaying "connected adapters" in UI without decrypting tokens.
- * Requires owner or admin role.
- */
-declare function listCredentials(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<string[]>;
-/**
- * Check whether a credential exists and whether its access token has expired.
- *
- * Returns `{ exists: false }` if no credential is stored, or
- * `{ exists: true, expired: boolean }` based on the `expiresAt` field.
- * Requires owner or admin role.
- */
-declare function credentialStatus(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<{
-    exists: false;
-} | {
-    exists: true;
-    expired: boolean;
-}>;
-
-export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential };

package/dist/tx/index.cjs

@@ -1,544 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/errors.ts
-var NoydbError, FieldFrozenError, InvariantError, AmendmentForbiddenError, ConflictError, ValidationError;
-var init_errors = __esm({
-  "src/errors.ts"() {
-    "use strict";
-    NoydbError = class extends Error {
-      /** Machine-readable error code. Stable across library versions. */
-      code;
-      constructor(code, message) {
-        super(message);
-        this.name = "NoydbError";
-        this.code = code;
-      }
-    };
-    FieldFrozenError = class extends NoydbError {
-      collection;
-      id;
-      fields;
-      constructor(collection, id, fields) {
-        super(
-          "FIELD_FROZEN",
-          `Cannot change frozen field(s) on ${collection}/${id}: ${fields.join(", ")}. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
-        );
-        this.name = "FieldFrozenError";
-        this.collection = collection;
-        this.id = id;
-        this.fields = fields;
-      }
-    };
-    InvariantError = class extends NoydbError {
-      constructor(message) {
-        super("INVARIANT_VIOLATED", message);
-        this.name = "InvariantError";
-      }
-    };
-    AmendmentForbiddenError = class extends NoydbError {
-      userId;
-      role;
-      constructor(userId, role) {
-        super(
-          "AMENDMENT_FORBIDDEN",
-          `User "${userId}" with role "${role}" cannot open an amendment transaction. Amendments require admin or owner role.`
-        );
-        this.name = "AmendmentForbiddenError";
-        this.userId = userId;
-        this.role = role;
-      }
-    };
-    ConflictError = class extends NoydbError {
-      /** The actual stored version at the time of conflict. */
-      version;
-      constructor(version, message = "Version conflict") {
-        super("CONFLICT", message);
-        this.name = "ConflictError";
-        this.version = version;
-      }
-    };
-    ValidationError = class extends NoydbError {
-      constructor(message = "Validation error") {
-        super("VALIDATION_ERROR", message);
-        this.name = "ValidationError";
-      }
-    };
-  }
-});
-
-// src/guards/executor.ts
-var executor_exports = {};
-__export(executor_exports, {
-  GuardExecutor: () => GuardExecutor
-});
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return a === b;
-  if (typeof a !== typeof b) return false;
-  if (typeof a !== "object") return a === b;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a)) {
-    const aa = a;
-    const bb = b;
-    if (aa.length !== bb.length) return false;
-    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const ak = Object.keys(ao);
-  const bk = Object.keys(bo);
-  if (ak.length !== bk.length) return false;
-  for (const k of ak) {
-    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-    if (!deepEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-var GuardExecutor;
-var init_executor = __esm({
-  "src/guards/executor.ts"() {
-    "use strict";
-    init_errors();
-    GuardExecutor = {
-      /**
-       * Compare existing vs incoming for each `frozenFields.fields` entry
-       * when `frozenFields.when(existing)` is true. Throws
-       * `FieldFrozenError` listing every changed frozen field.
-       */
-      async checkFrozenFields(guard, id, existing, incoming) {
-        const ff = guard.frozenFields;
-        if (!ff) return;
-        if (existing === null) return;
-        if (!ff.when(existing)) return;
-        const changed = [];
-        for (const f of ff.fields) {
-          if (existing[f] !== incoming[f]) {
-            if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
-          }
-        }
-        if (changed.length > 0) {
-          throw new FieldFrozenError(guard.collection, id, changed);
-        }
-      },
-      /**
-       * Run a single guard's invariant over its slice of the change-set.
-       * Any throw is converted to `InvariantError` unless it already is one.
-       */
-      async runInvariant(guard, changes, ctx) {
-        const amendment = guard.amendment;
-        if (!amendment) return;
-        try {
-          await amendment.invariant(changes, ctx);
-        } catch (err) {
-          if (err instanceof InvariantError) throw err;
-          throw new InvariantError(
-            err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-          );
-        }
-      }
-    };
-  }
-});
-
-// src/tx/index.ts
-var tx_exports = {};
-__export(tx_exports, {
-  TxCollection: () => TxCollection,
-  TxContext: () => TxContext,
-  TxVault: () => TxVault,
-  runTransaction: () => runTransaction,
-  withTransactions: () => withTransactions
-});
-module.exports = __toCommonJS(tx_exports);
-
-// src/tx/transaction.ts
-init_errors();
-
-// src/bundle/ulid.ts
-var CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function encodeBase32(value, length) {
-  let out = "";
-  let v = value;
-  for (let i = 0; i < length; i++) {
-    out = CROCKFORD_ALPHABET[v % 32] + out;
-    v = Math.floor(v / 32);
-  }
-  return out;
-}
-function generateULID() {
-  const now = Date.now();
-  const timestampHigh = Math.floor(now / 16777216);
-  const timestampLow = now & 16777215;
-  const tsPart = encodeBase32(timestampHigh, 5) + encodeBase32(timestampLow, 5);
-  const randBytes = new Uint8Array(10);
-  crypto.getRandomValues(randBytes);
-  const rand1 = randBytes[0] * 2 ** 32 + (randBytes[1] << 24 >>> 0) + (randBytes[2] << 16) + (randBytes[3] << 8) + randBytes[4];
-  const rand2 = randBytes[5] * 2 ** 32 + (randBytes[6] << 24 >>> 0) + (randBytes[7] << 16) + (randBytes[8] << 8) + randBytes[9];
-  const randPart = encodeBase32(rand1, 8) + encodeBase32(rand2, 8);
-  return tsPart + randPart;
-}
-
-// src/tx/transaction.ts
-var TxContext = class {
-  /** Stable id for this transaction; shared by all writes it performs. */
-  txId = generateULID();
-  /** @internal */
-  _ops = [];
-  /**
-   * @internal — write log built up in Phase 2. Each entry records the
-   * envelope captured BEFORE the write so a mid-batch failure can
-   * restore prior state via `revertExecuted`. Side-effect writes (e.g.
-   * recursive derivation outputs fired inside `Collection.put`) are
-   * appended here in execution order so they roll back alongside the
-   * main staged ops.
-   */
-  _executed = [];
-  /** @internal */
-  _db;
-  /**
-   * @internal — true when this TxContext was opened in amendment
-   * mode. Toggles the lazy-`beginAmendment` + role-check path on first
-   * `tx.vault(name)` and unlocks the post-Phase-2 invariant + audit run.
-   */
-  _amendment;
-  /** @internal — vaults that have already had `beginAmendment` called. */
-  _amendmentVaults = /* @__PURE__ */ new Map();
-  /** @internal */
-  constructor(db, amendment = false) {
-    this._db = db;
-    this._amendment = amendment;
-  }
-  /** Scope subsequent `collection()` calls to the named vault. */
-  vault(name) {
-    const v = this._db.vault(name);
-    if (this._amendment && !this._amendmentVaults.has(name)) {
-      const role = v.role;
-      if (role !== "admin" && role !== "owner") {
-        throw new AmendmentForbiddenError(v.userId, role);
-      }
-      const reg = v._getGuardRegistry();
-      if (reg === null) {
-        throw new ValidationError(
-          `Vault "${name}": amendment mode requires at least one guardStrategy registered via createNoydb({ guardStrategies }). Open the vault with guardStrategies before calling db.transaction({ amendment: true }).`
-        );
-      }
-      reg.beginAmendment();
-      this._amendmentVaults.set(name, v);
-    }
-    return new TxVault(this, v);
-  }
-};
-var TxVault = class {
-  /** @internal */
-  _ctx;
-  /** @internal */
-  _vault;
-  /** @internal */
-  constructor(ctx, vault) {
-    this._ctx = ctx;
-    this._vault = vault;
-  }
-  /** Scope subsequent op calls to the named collection. */
-  collection(name) {
-    const c = this._vault.collection(name);
-    return new TxCollection(this._ctx, this._vault, c, name);
-  }
-};
-var TxCollection = class {
-  /** @internal */
-  _ctx;
-  /** @internal */
-  _vault;
-  /** @internal */
-  _coll;
-  /** @internal */
-  _name;
-  /** @internal */
-  constructor(ctx, vault, coll, name) {
-    this._ctx = ctx;
-    this._vault = vault;
-    this._coll = coll;
-    this._name = name;
-  }
-  /**
-   * Read the current committed value, or the most-recently-staged
-   * value from the same transaction if one exists.
-   */
-  async get(id) {
-    for (let i = this._ctx._ops.length - 1; i >= 0; i--) {
-      const op = this._ctx._ops[i];
-      if (op.vaultName === this._vault.name && op.collectionName === this._name && op.id === id) {
-        if (op.type === "delete") return null;
-        return op.record;
-      }
-    }
-    return this._coll.get(id);
-  }
-  /**
-   * Stage a put. Does not write until the transaction body returns.
-   * Supply `{ expectedVersion }` to enforce optimistic concurrency
-   * during the commit pre-flight.
-   */
-  put(id, record, options) {
-    const op = {
-      type: "put",
-      vaultName: this._vault.name,
-      collectionName: this._name,
-      id,
-      record
-    };
-    if (options?.expectedVersion !== void 0) op.expectedVersion = options.expectedVersion;
-    if (options?.reason !== void 0) op.reason = options.reason;
-    this._ctx._ops.push(op);
-  }
-  /**
-   * Stage a delete. Does not write until the transaction body returns.
-   * Supply `{ expectedVersion }` to enforce optimistic concurrency
-   * during the commit pre-flight.
-   */
-  delete(id, options) {
-    const op = {
-      type: "delete",
-      vaultName: this._vault.name,
-      collectionName: this._name,
-      id
-    };
-    if (options?.expectedVersion !== void 0) op.expectedVersion = options.expectedVersion;
-    this._ctx._ops.push(op);
-  }
-};
-async function runTransaction(db, fn, options) {
-  if (options?.amendment) {
-    if (typeof options.reason !== "string" || options.reason.trim().length === 0) {
-      throw new ValidationError(
-        "db.transaction({ amendment: true }) requires a non-empty `reason` string."
-      );
-    }
-  }
-  const ctx = new TxContext(db, options?.amendment === true);
-  const bodyResult = await fn(ctx);
-  if (ctx._ops.length === 0) {
-    if (ctx._amendment) {
-      for (const v of ctx._amendmentVaults.values()) {
-        const reg = v._getGuardRegistry();
-        if (reg !== null) {
-          reg.consumeChanges();
-          reg.consumeMeta();
-        }
-      }
-    }
-    return bodyResult;
-  }
-  const priorEnvelopes = /* @__PURE__ */ new Map();
-  const store = db._store;
-  for (const op of ctx._ops) {
-    const key = keyOf(op);
-    if (!priorEnvelopes.has(key)) {
-      const env = await store.get(op.vaultName, op.collectionName, op.id);
-      priorEnvelopes.set(key, env);
-    }
-    if (op.expectedVersion !== void 0) {
-      const env = priorEnvelopes.get(key) ?? null;
-      const actual = env?._v ?? 0;
-      if (actual !== op.expectedVersion) {
-        throw new ConflictError(
-          actual,
-          `Transaction pre-flight: ${op.vaultName}/${op.collectionName}/${op.id} expected v${op.expectedVersion}, found v${actual}`
-        );
-      }
-    }
-  }
-  db._setActiveTxContext(ctx);
-  try {
-    try {
-      for (const op of ctx._ops) {
-        const coll = db.vault(op.vaultName).collection(op.collectionName);
-        const key = keyOf(op);
-        const prior = priorEnvelopes.get(key) ?? null;
-        ctx._executed.push({ op, priorEnvelope: prior });
-        if (op.type === "put") {
-          await coll.put(op.id, op.record, op.reason !== void 0 ? { reason: op.reason } : void 0);
-        } else {
-          await coll.delete(op.id);
-        }
-      }
-    } catch (err) {
-      await revertExecuted(ctx._executed, store, db);
-      if (ctx._amendment) {
-        for (const v of ctx._amendmentVaults.values()) {
-          const reg = v._getGuardRegistry();
-          if (reg !== null) {
-            reg.consumeChanges();
-            reg.consumeMeta();
-          }
-        }
-      }
-      throw err;
-    }
-  } finally {
-    db._clearActiveTxContext(ctx);
-  }
-  if (ctx._amendment) {
-    const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
-    try {
-      for (const [vaultName, v] of ctx._amendmentVaults) {
-        const registry = v._getGuardRegistry();
-        if (registry === null) continue;
-        const changesByCollection = registry.consumeChanges();
-        const meta = registry.consumeMeta();
-        if (changesByCollection.size === 0) continue;
-        const readOnlyVault = v._getReadOnlyFacade();
-        if (readOnlyVault === null) continue;
-        const invariantsPassed = [];
-        for (const [collection, changes] of changesByCollection) {
-          const guards = registry.guardsFor(collection).filter((g) => g.amendment !== void 0);
-          for (const guard of guards) {
-            await GuardExecutor2.runInvariant(guard, changes, {
-              existing: null,
-              vault: readOnlyVault,
-              userId: v.userId,
-              role: v.role
-            });
-          }
-          if (guards.length > 0) invariantsPassed.push(collection);
-        }
-        const ledger = v._getLedgerOrNull();
-        if (ledger) {
-          const role = v.role;
-          const amendment = {
-            reason: options.reason,
-            role,
-            changes: meta,
-            invariantsPassed
-          };
-          await ledger.append({
-            op: "amendment",
-            collection: "",
-            id: "",
-            version: 0,
-            actor: v.userId,
-            // No payload to hash — the per-record entries already
-            // captured `payloadHash` at their own append time. We use
-            // a sha256 of the canonical reason string so the field is
-            // populated with something deterministic and non-empty.
-            payloadHash: "",
-            amendment
-          });
-        }
-        void vaultName;
-      }
-    } catch (err) {
-      await revertExecuted(ctx._executed, store, db);
-      throw err instanceof InvariantError ? err : new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-  return bodyResult;
-}
-async function revertExecuted(executed, store, db) {
-  for (const { op, priorEnvelope } of executed.slice().reverse()) {
-    try {
-      if (priorEnvelope) {
-        await store.put(op.vaultName, op.collectionName, op.id, priorEnvelope);
-      } else {
-        await store.delete(op.vaultName, op.collectionName, op.id);
-      }
-      if (db) {
-        const coll = db.vault(op.vaultName).collection(op.collectionName);
-        await coll._invalidateCacheEntry(op.id);
-      }
-    } catch {
-    }
-  }
-}
-function keyOf(op) {
-  return `${op.vaultName}\0${op.collectionName}\0${op.id}`;
-}
-
-// src/tx/dry-run.ts
-var SEP = " ";
-var keyOf2 = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
-async function runDryRun(db, fn) {
-  const ctx = new TxContext(db);
-  await fn(ctx);
-  const lastOp = /* @__PURE__ */ new Map();
-  for (const op of ctx._ops) lastOp.set(keyOf2(op), op);
-  const affected = [];
-  const guardViolations = [];
-  for (const op of lastOp.values()) {
-    const v = db.vault(op.vaultName);
-    const coll = v.collection(op.collectionName);
-    const before = await coll.get(op.id);
-    if (op.type === "delete") {
-      affected.push({ vault: op.vaultName, op: "delete", collection: op.collectionName, docId: op.id, before, after: null });
-      continue;
-    }
-    const after = op.record ?? null;
-    affected.push({
-      vault: op.vaultName,
-      op: before === null ? "create" : "update",
-      collection: op.collectionName,
-      docId: op.id,
-      before,
-      after
-    });
-    const registry = v._getGuardRegistry();
-    if (!registry) continue;
-    const guards = registry.guardsFor(op.collectionName);
-    if (guards.length === 0) continue;
-    const facade = v._getReadOnlyFacade();
-    if (!facade) continue;
-    const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
-    try {
-      await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
-      for (const g of guards) {
-        await GuardExecutor2.checkFrozenFields(g, op.id, before, after);
-      }
-    } catch (err) {
-      guardViolations.push({
-        vault: op.vaultName,
-        collection: op.collectionName,
-        docId: op.id,
-        message: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-  return { affected, guardViolations };
-}
-
-// src/tx/active.ts
-function withTransactions() {
-  return { runTransaction, runDryRun };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  TxCollection,
-  TxContext,
-  TxVault,
-  runTransaction,
-  withTransactions
-});
-//# sourceMappingURL=index.cjs.map