@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/chunk-WIGQB62E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO passphrase: the re-key passphrase is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nexport const WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: req.decidedAt ?? req.requestedAt,\n    _iv: '', _data: body, _by: req.decidedBy ?? req.requester,\n  }\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data) as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data) as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a passphrase the requester will use. */\n  readonly reKey?: { readonly passphrase: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4BO,IAAM,iCAAiC;AAGvC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IAAsB,IAAI,kBAAkB;AAAA,IAAG,KAAK,IAAI,aAAa,IAAI;AAAA,IACjF,KAAK;AAAA,IAAI,OAAO;AAAA,IAAM,KAAK,IAAI,aAAa,IAAI;AAAA,EAClD;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,GAAwB,SAAS,IAAI,GAAG;AAC5E;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-EMIGCR7X.js → chunk-WXSYDNBT.js}

@@ -1,4 +1,4 @@
-// src/meta/public-envelope/types.ts
+// src/with-party/directory/public-envelope/types.ts
 var PUBLIC_ENVELOPE_FIELDS = [
   "name",
   "description",
@@ -36,4 +36,4 @@ export {
   DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
   resolveSchema
 };
-//# sourceMappingURL=chunk-EMIGCR7X.js.map
+//# sourceMappingURL=chunk-WXSYDNBT.js.map

package/dist/chunk-WXSYDNBT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/directory/public-envelope/types.ts"],"sourcesContent":["/**\n * Public envelope — owner-curated plaintext metadata, readable\n * before vault unlock or bundle decryption.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\n\n/**\n * Either a single string (used when the developer's app is\n * single-locale) or a locale → string map for i18n. Mirrors the\n * shape `@noy-db/hub/i18n` already uses for record fields, so the\n * existing `resolveI18nText` resolver applies.\n */\nexport type PublicEnvelopeText = string | Record<string, string>\n\n/**\n * Persisted shape — both `_meta/public-envelope` and the bundle\n * header carry this. The version number is monotonic per vault and\n * helps cache invalidators detect change without hashing the JSON.\n */\nexport interface PublicEnvelope {\n  readonly _noydb_public: 1\n  readonly version: number\n  readonly name?: PublicEnvelopeText\n  readonly description?: PublicEnvelopeText\n  /** Inline `data:` URL (`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). */\n  readonly icon?: string\n  /** ISO-8601 timestamp; auto-set on first envelope write, immutable thereafter. */\n  readonly createdAt?: string\n  /** ISO-8601 timestamp; auto-updated on every `setPublicEnvelope` call. */\n  readonly updatedAt?: string\n  /** BCP-47 fallback locale for renderers when the user's locale isn't covered. */\n  readonly defaultLocale?: string\n}\n\n/** Field names the developer can allow in `PublicEnvelopeSchema.fields`. */\nexport const PUBLIC_ENVELOPE_FIELDS = [\n  'name',\n  'description',\n  'icon',\n  'createdAt',\n  'updatedAt',\n  'defaultLocale',\n] as const\n\nexport type PublicEnvelopeField = (typeof PUBLIC_ENVELOPE_FIELDS)[number]\n\n/**\n * Build-time schema. The developer enables the feature and bounds\n * what the owner can set. `true` is shorthand for \"all defaults\" —\n * gives the owner the full field set with the standard caps.\n */\nexport interface PublicEnvelopeSchema {\n  /**\n   * Allowed field names. Setting `name`/`description`/`icon`/`defaultLocale` is\n   * gated on the field being listed here. `createdAt` / `updatedAt` are managed\n   * by the hub; including them is a no-op (the owner cannot set them\n   * directly). Default: every field above.\n   */\n  readonly fields?: ReadonlyArray<PublicEnvelopeField>\n  /**\n   * Maximum icon size — measured as the length of the data-URL\n   * string. Default 256 KB.\n   */\n  readonly maxIconBytes?: number\n  /** Allowed icon MIME types. Default ['image/png', 'image/svg+xml']. */\n  readonly iconMimeTypes?: ReadonlyArray<string>\n  /** Maximum length of `name` / `description` per locale. Default 200. */\n  readonly maxStringChars?: number\n}\n\n/** Default schema values; merged onto every developer-supplied schema. */\nexport const DEFAULT_PUBLIC_ENVELOPE_SCHEMA = {\n  fields: PUBLIC_ENVELOPE_FIELDS,\n  maxIconBytes: 256 * 1024,\n  iconMimeTypes: ['image/png', 'image/svg+xml'] as const,\n  maxStringChars: 200,\n} as const satisfies Required<PublicEnvelopeSchema>\n\n/** Resolved schema after merging developer override onto defaults. */\nexport interface ResolvedPublicEnvelopeSchema {\n  readonly fields: ReadonlyArray<PublicEnvelopeField>\n  readonly maxIconBytes: number\n  readonly iconMimeTypes: ReadonlyArray<string>\n  readonly maxStringChars: number\n}\n\n/**\n * Merge developer schema onto the defaults. The shorthand `true`\n * resolves to the full default schema; an explicit object only\n * overrides the keys it provides.\n */\nexport function resolveSchema(\n  schema: true | PublicEnvelopeSchema | undefined,\n): ResolvedPublicEnvelopeSchema | undefined {\n  if (!schema) return undefined\n  if (schema === true) {\n    return {\n      fields: DEFAULT_PUBLIC_ENVELOPE_SCHEMA.fields,\n      maxIconBytes: DEFAULT_PUBLIC_ENVELOPE_SCHEMA.maxIconBytes,\n      iconMimeTypes: DEFAULT_PUBLIC_ENVELOPE_SCHEMA.iconMimeTypes,\n      maxStringChars: DEFAULT_PUBLIC_ENVELOPE_SCHEMA.maxStringChars,\n    }\n  }\n  return {\n    fields: schema.fields ?? DEFAULT_PUBLIC_ENVELOPE_SCHEMA.fields,\n    maxIconBytes: schema.maxIconBytes ?? DEFAULT_PUBLIC_ENVELOPE_SCHEMA.maxIconBytes,\n    iconMimeTypes: schema.iconMimeTypes ?? DEFAULT_PUBLIC_ENVELOPE_SCHEMA.iconMimeTypes,\n    maxStringChars: schema.maxStringChars ?? DEFAULT_PUBLIC_ENVELOPE_SCHEMA.maxStringChars,\n  }\n}\n"],"mappings":";AAsCO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA6BO,IAAM,iCAAiC;AAAA,EAC5C,QAAQ;AAAA,EACR,cAAc,MAAM;AAAA,EACpB,eAAe,CAAC,aAAa,eAAe;AAAA,EAC5C,gBAAgB;AAClB;AAeO,SAAS,cACd,QAC0C;AAC1C,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL,QAAQ,+BAA+B;AAAA,MACvC,cAAc,+BAA+B;AAAA,MAC7C,eAAe,+BAA+B;AAAA,MAC9C,gBAAgB,+BAA+B;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,OAAO,UAAU,+BAA+B;AAAA,IACxD,cAAc,OAAO,gBAAgB,+BAA+B;AAAA,IACpE,eAAe,OAAO,iBAAiB,+BAA+B;AAAA,IACtE,gBAAgB,OAAO,kBAAkB,+BAA+B;AAAA,EAC1E;AACF;","names":[]}

package/dist/chunk-WZSCE6RM.js

@@ -0,0 +1,466 @@
+import {
+  dictCollectionName
+} from "./chunk-NUEQU36L.js";
+import {
+  getAtPath,
+  presentI18nForJoin
+} from "./chunk-EOXAAJTY.js";
+import {
+  PeriodClosedError,
+  UnknownDictCodeError,
+  ValidationError
+} from "./chunk-S7VFUQM2.js";
+
+// src/via/lookup/registry.ts
+function enforceStaticDictOnPut(staticFields, record) {
+  if (!staticFields || Object.keys(staticFields).length === 0) return;
+  if (!record || typeof record !== "object") return;
+  const obj = record;
+  for (const [field, desc] of Object.entries(staticFields)) {
+    if (desc.validateCodes === false) continue;
+    const known = new Set(desc.keys);
+    const values = getAtPath(obj, field);
+    for (const value of values) {
+      if (value === void 0 || value === null) continue;
+      const codes = Array.isArray(value) ? value : [value];
+      for (const code of codes) {
+        if (typeof code !== "string") continue;
+        if (!known.has(code)) {
+          throw new UnknownDictCodeError(desc.name, field, code);
+        }
+      }
+    }
+  }
+}
+function resolveDictSource(leftCollection, field, staticDescriptorByField, dictKeyFieldRegistry, getDictionaryHandle) {
+  const staticFields = staticDescriptorByField.get(leftCollection);
+  if (staticFields && field in staticFields) {
+    const desc = staticFields[field];
+    const rows = Object.entries(desc.table).map(
+      ([key, labels]) => ({ key, labels, ...labels })
+    );
+    const source = {
+      snapshot() {
+        return rows;
+      },
+      lookupById(id) {
+        return rows.find((e) => e["key"] === id);
+      }
+    };
+    if (desc.displayLocale !== void 0) {
+      ;
+      source.displayLocale = desc.displayLocale;
+    }
+    return source;
+  }
+  const dictFields = dictKeyFieldRegistry.get(leftCollection);
+  if (!dictFields || !(field in dictFields)) return null;
+  const dictName = dictFields[field];
+  if (!dictName) return null;
+  const handle = getDictionaryHandle(dictName);
+  return {
+    snapshot() {
+      return handle.snapshotEntries();
+    },
+    lookupById(id) {
+      const entries = handle.snapshotEntries();
+      return entries.find((e) => e["key"] === id);
+    }
+  };
+}
+async function updateReferencingRecords(registry, getCollection, name, oldKey, newKey) {
+  for (const [collectionName, dictFields] of registry) {
+    const fields = Object.entries(dictFields).filter(([, dn]) => dn === name).map(([field]) => field);
+    if (fields.length === 0) continue;
+    const coll = getCollection(collectionName);
+    const records = await coll.list();
+    for (const record of records) {
+      let changed = false;
+      const updated = { ...record };
+      for (const field of fields) {
+        if (updated[field] === oldKey) {
+          updated[field] = newKey;
+          changed = true;
+        }
+      }
+      if (changed) {
+        const id = record["id"];
+        if (id !== void 0) {
+          await coll.put(id, updated);
+        }
+      }
+    }
+  }
+}
+function resolveLabelFromMap(labels, locale, fallback) {
+  if (labels[locale] !== void 0) return labels[locale];
+  const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
+  for (const fb of chain) {
+    if (fb === "any") {
+      const any = Object.values(labels)[0];
+      if (any !== void 0) return any;
+    } else if (labels[fb] !== void 0) {
+      return labels[fb];
+    }
+  }
+  return void 0;
+}
+function lookupToStaticDictCompat(desc) {
+  if (desc.backing !== "static" || desc.table === void 0) return void 0;
+  return {
+    _noydbStaticDict: true,
+    _viaBrand: "i18n",
+    name: desc.dimension,
+    table: desc.table,
+    keys: desc.keys ?? Object.keys(desc.table),
+    ...desc.displayLocale !== void 0 ? { displayLocale: desc.displayLocale } : {},
+    ...desc.onMissing !== void 0 ? { onMissing: desc.onMissing } : {},
+    ...desc.substitute !== void 0 ? { substitute: desc.substitute } : {},
+    validateCodes: desc.vocabulary === "closed"
+  };
+}
+function collectLookupDictCompat(lookupFields) {
+  const dictFieldMap = {};
+  const staticEntries = [];
+  for (const [field, desc] of Object.entries(lookupFields ?? {})) {
+    if (desc.backing === "reserved") {
+      dictFieldMap[field] = desc.dimension;
+    } else {
+      const compat = lookupToStaticDictCompat(desc);
+      if (compat) staticEntries.push([field, compat]);
+    }
+  }
+  return { dictFieldMap, staticEntries };
+}
+function materializeBackingTable(descriptor, rows) {
+  const keys = new Set(rows.keys());
+  const owner = /* @__PURE__ */ new Map();
+  for (const key of keys) owner.set(key, key);
+  const altIndex = /* @__PURE__ */ new Map();
+  const altFields = descriptor.altKeys ?? [];
+  for (const [canonicalKey, row] of rows) {
+    for (const altField of altFields) {
+      const value = coerceLookupKey(row[altField]);
+      if (value === void 0 || value === "") continue;
+      const existingOwner = owner.get(value);
+      if (existingOwner !== void 0 && existingOwner !== canonicalKey) {
+        throw new ValidationError(
+          `lookup "${descriptor.dimension}": altKey field "${altField}" value "${value}" is claimed by both "${existingOwner}" and "${canonicalKey}" \u2014 key/altKey values must be unique across the dimension.`
+        );
+      }
+      owner.set(value, canonicalKey);
+      altIndex.set(value, canonicalKey);
+    }
+  }
+  return { keys, altIndex };
+}
+function checkLookupMembership(descriptor, key, getDictionary, getCollection) {
+  if (descriptor.backing === "static") {
+    const known = descriptor.keys ?? (descriptor.table ? Object.keys(descriptor.table) : []);
+    return known.includes(key);
+  }
+  if (descriptor.backing === "reserved") {
+    if ((descriptor.keys ?? []).includes(key)) return true;
+    return getDictionary(descriptor.dimension).snapshotEntries().some((e) => e["key"] === key);
+  }
+  return buildLookupAltIndex(descriptor, getDictionary, getCollection).keys.has(key);
+}
+function coerceLookupKey(raw) {
+  return typeof raw === "string" || typeof raw === "number" ? String(raw) : void 0;
+}
+function resolveBackingRowKey(descriptor, row) {
+  return coerceLookupKey(row[descriptor.key]);
+}
+function matchesReferencingValue(rec, field, compareKey) {
+  return coerceLookupKey(rec[field]) === compareKey;
+}
+function buildLookupAltIndex(descriptor, getDictionary, getCollection) {
+  if (descriptor.backing === "static") {
+    return materializeBackingTable(descriptor, new Map(Object.entries(descriptor.table ?? {})));
+  }
+  if (descriptor.backing === "reserved") {
+    const entries = getDictionary(descriptor.dimension).snapshotEntries();
+    return materializeBackingTable(descriptor, new Map(entries.map((e) => [String(e["key"]), e])));
+  }
+  const rows = getCollection(descriptor.dimension).querySourceForJoin().snapshot();
+  const keyed = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const row = r;
+    const key = resolveBackingRowKey(descriptor, row);
+    if (key !== void 0) keyed.set(key, row);
+  }
+  return materializeBackingTable(descriptor, keyed);
+}
+function collectLookupRefEdges(collectionName, lookupFields) {
+  const edges = [];
+  for (const [field, desc] of Object.entries(lookupFields ?? {})) {
+    if (desc.backing === "static") continue;
+    const backing = desc.backing === "reserved" ? dictCollectionName(desc.dimension) : desc.dimension;
+    edges.push({
+      referencing: { collection: collectionName, field },
+      sources: [
+        { collection: backing, field: "*" },
+        ...desc.present?.label !== void 0 ? [{ collection: backing, field: desc.present.label }] : []
+      ],
+      onDelete: desc.onDelete,
+      keyField: desc.key
+    });
+  }
+  return edges;
+}
+function registerLookupRefEdges(graph, collectionName, lookupFields) {
+  for (const e of collectLookupRefEdges(collectionName, lookupFields)) {
+    graph.registerDerived(e.referencing, e.sources, "ref", "record", e.onDelete, e.keyField);
+  }
+}
+function buildLookupSnapshotRows(descriptor, isReservedDimension, getDictionary, getCollection) {
+  const dimension = descriptor.dimension;
+  if (isReservedDimension(dimension)) {
+    const rows = /* @__PURE__ */ new Map();
+    for (const entry of getDictionary(dimension).snapshotEntries()) {
+      const key = entry["key"];
+      if (typeof key === "string") rows.set(key, entry);
+    }
+    return rows;
+  }
+  if (descriptor.backing === "collection") {
+    const rawRows = getCollection(dimension).querySourceForJoin().snapshot();
+    const rows = /* @__PURE__ */ new Map();
+    for (const r of rawRows) {
+      const row = r;
+      const key = resolveBackingRowKey(descriptor, row);
+      if (key !== void 0) rows.set(key, row);
+    }
+    return rows;
+  }
+  return void 0;
+}
+
+// src/via/lookup/snapshot.ts
+function readRowField(row, field, by, locale, fallback) {
+  if (!row || field === void 0) return void 0;
+  const raw = row[field];
+  if (by === void 0) return typeof raw === "string" ? raw : void 0;
+  if (!raw || typeof raw !== "object") return void 0;
+  const map = raw;
+  const val = map[locale];
+  if (typeof val === "string") return val;
+  if (typeof fallback === "string" && typeof map[fallback] === "string") return map[fallback];
+  return void 0;
+}
+function buildLookupSnapshot(dimension, rows, descriptor) {
+  void dimension;
+  return {
+    row: (key) => rows.get(key),
+    label: (key, locale, fallback) => readRowField(rows.get(key), descriptor.present?.label, descriptor.present?.by, locale, fallback),
+    compareKeys: (a, b, locale) => {
+      const sortField = descriptor.sortBy ?? descriptor.present?.label;
+      const av = readRowField(rows.get(a), sortField, descriptor.present?.by, locale) ?? a;
+      const bv = readRowField(rows.get(b), sortField, descriptor.present?.by, locale) ?? b;
+      return av < bv ? -1 : av > bv ? 1 : 0;
+    }
+  };
+}
+function presentLookupForJoin(record, locale, lookupFields, getSnapshotRows) {
+  let result = record;
+  for (const [field, desc] of Object.entries(lookupFields)) {
+    if (desc.present === void 0) continue;
+    const raw = record[field];
+    if (typeof raw !== "string") continue;
+    const rows = desc.backing === "static" ? desc.table ? new Map(Object.entries(desc.table)) : void 0 : getSnapshotRows(desc);
+    if (!rows) continue;
+    const label = buildLookupSnapshot(desc.dimension, rows, desc).label(raw, locale);
+    if (label === void 0) continue;
+    if (result === record) result = { ...record };
+    result[`${field}Label`] = label;
+  }
+  return result;
+}
+function buildPresentForJoin(i18nFields, lookupFields, getSnapshotRows) {
+  const hasI18n = i18nFields !== void 0 && Object.keys(i18nFields).length > 0;
+  const hasLookup = lookupFields !== void 0 && Object.keys(lookupFields).length > 0;
+  if (!hasI18n && !hasLookup) return void 0;
+  const resolveRows = getSnapshotRows ?? (() => void 0);
+  return (record, locale) => {
+    if (record === null || typeof record !== "object") return record;
+    let result = record;
+    if (hasI18n) result = presentI18nForJoin(result, i18nFields, locale);
+    if (hasLookup) result = presentLookupForJoin(result, locale, lookupFields, resolveRows);
+    return result;
+  };
+}
+
+// src/port/with/lookup-strategy.ts
+function isLookupDescriptor(x) {
+  return typeof x === "object" && x !== null && x._viaBrand === "lookup";
+}
+
+// src/kernel/via/dispatch.ts
+function touchFor(batch, collection) {
+  let t = batch.get(collection);
+  if (!t) {
+    t = { puts: /* @__PURE__ */ new Set(), deletes: /* @__PURE__ */ new Map() };
+    batch.set(collection, t);
+  }
+  return t;
+}
+function resolveRollupDeleteIntents(registry, collectionName, deleted) {
+  if (!registry) return [];
+  const intents = [];
+  for (const { spec } of registry.strategiesForSource(collectionName)) {
+    if (!spec.rollup || spec.rollup.from !== collectionName) continue;
+    const kv = deleted[spec.rollup.key];
+    if (typeof kv === "string" || typeof kv === "number") intents.push({ into: spec.source, parentId: String(kv), field: spec.rollup.field });
+  }
+  return intents;
+}
+function findRollupSpecForIntent(registry, collectionName, intent) {
+  return registry?.strategiesForSource(collectionName).find((s) => s.spec.source === intent.into && s.spec.rollup?.field === intent.field && s.spec.rollup?.from === collectionName)?.spec;
+}
+var WaveContext = class {
+  _seen = /* @__PURE__ */ new Set();
+  seen(targetKey) {
+    if (this._seen.has(targetKey)) return true;
+    this._seen.add(targetKey);
+    return false;
+  }
+};
+async function runGraphDispatchWave(vault, batch) {
+  const wave = new WaveContext();
+  for (const [collectionName, touch] of batch) {
+    if (vault.graph.dependentsOf(collectionName).length === 0) continue;
+    const coll = vault._getCollection(collectionName);
+    if (!coll) continue;
+    for (const id of touch.puts) {
+      try {
+        const stored = await coll._getStoredRecordForDispatch(id);
+        if (!stored) continue;
+        await coll.dispatchDerivations(id, stored.record, stored.version, wave);
+        await coll.dispatchMaterializedViews(id, stored.record, wave);
+      } catch (err) {
+        console.warn(`[via-dispatch] wave recompute failed for ${collectionName}/${id}:`, err);
+        vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
+      }
+    }
+    for (const [id, intents] of touch.deletes) {
+      try {
+        await coll._recomputeDeletedRollups(intents, wave);
+      } catch (err) {
+        console.warn(`[via-dispatch] wave delete-recompute failed for ${collectionName}/${id}:`, err);
+        vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
+      }
+    }
+  }
+}
+async function putDerivedOutput(outColl, id, value, ctx, options) {
+  try {
+    await outColl.put(id, value, options);
+    return "written";
+  } catch (err) {
+    if (!(err instanceof PeriodClosedError)) throw err;
+    const targetCollection = outColl.name;
+    const event = {
+      source: ctx.source,
+      target: { collection: targetCollection, id },
+      period: err.periodName,
+      endDate: err.endDate
+    };
+    ctx.emit("derivation:skipped-frozen", event);
+    if (ctx.audit) await ctx.audit(event);
+    return "skipped-frozen";
+  }
+}
+function ledgerAuditHook(ledger, actor) {
+  if (!ledger) return void 0;
+  return async (e) => {
+    await ledger.append({
+      op: "lifecycle",
+      collection: e.target.collection,
+      id: e.target.id,
+      version: 0,
+      actor,
+      payloadHash: "",
+      reason: JSON.stringify({ event: "derivation-skipped-frozen", ...e })
+    });
+  };
+}
+async function forgetDerivedFanout(vault, ref, envelope, stats, lookupCompareKeys) {
+  const edges = vault.graph.derivedArtifactsOf(ref.collection);
+  if (edges.length === 0) return;
+  const coll = vault._getCollection(ref.collection);
+  if (!coll) return;
+  if (edges.some((e) => e.kind === "ref")) {
+    const { cascaded, nullified, residue } = await applyLookupRefsFanout(vault, ref.collection, ref.id, lookupCompareKeys);
+    stats.lookupReferencesCascaded += cascaded;
+    stats.lookupReferencesNullified += nullified;
+    stats.lookupReferencesResidue.push(...residue);
+  }
+  if (edges.some((e) => e.kind === "mv")) {
+    stats.recordsErased += await coll.dispatchMaterializedViewsOnDelete(ref.id);
+  }
+  if (edges.some((e) => e.kind === "derivation")) {
+    stats.recordsErased += await coll.dispatchArrayDerivationsOnDelete(ref.id, true);
+  }
+  if (envelope && edges.some((e) => e.kind === "rollup")) {
+    const priorRecord = await coll._decodeEnvelope(envelope, ref.id);
+    if (priorRecord) {
+      for (const r of await coll.dispatchRollupsOnDelete(ref.id, priorRecord)) {
+        if (r.outcome === "written") stats.aggregatesRecomputed += 1;
+        else if (r.outcome === "skipped-frozen") stats.residueFrozen.push(`${r.into}:${r.parentId}`);
+      }
+    }
+  }
+}
+async function applyLookupRefsFanout(vault, backing, key, compareKeys) {
+  let cascaded = 0;
+  let nullified = 0;
+  const residue = [];
+  for (const { referencing, onDelete, keyField } of vault.graph.referencingEdgesOf(backing)) {
+    if (onDelete === "restrict") continue;
+    const compareKey = keyField === "id" ? key : compareKeys.get(keyField);
+    if (compareKey === void 0) {
+      residue.push(`${backing}:${key}:${referencing.collection}.${referencing.field}`);
+      continue;
+    }
+    const coll = vault._getCollection(referencing.collection);
+    if (!coll) continue;
+    const matches = (await coll.list()).filter((rec) => matchesReferencingValue(rec, referencing.field, compareKey));
+    for (const rec of matches) {
+      const id = rec["id"];
+      if (id === void 0) continue;
+      if (onDelete === "cascade") {
+        await coll.delete(id);
+        cascaded++;
+      } else if (onDelete === "nullify") {
+        await coll.put(id, { ...rec, [referencing.field]: null });
+        nullified++;
+      }
+    }
+  }
+  return { cascaded, nullified, residue };
+}
+
+export {
+  enforceStaticDictOnPut,
+  resolveDictSource,
+  updateReferencingRecords,
+  resolveLabelFromMap,
+  collectLookupDictCompat,
+  checkLookupMembership,
+  coerceLookupKey,
+  matchesReferencingValue,
+  buildLookupAltIndex,
+  registerLookupRefEdges,
+  buildLookupSnapshotRows,
+  buildLookupSnapshot,
+  buildPresentForJoin,
+  isLookupDescriptor,
+  touchFor,
+  resolveRollupDeleteIntents,
+  findRollupSpecForIntent,
+  runGraphDispatchWave,
+  putDerivedOutput,
+  ledgerAuditHook,
+  forgetDerivedFanout
+};
+//# sourceMappingURL=chunk-WZSCE6RM.js.map