@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/chunk-2OZXVKVP.js

@@ -0,0 +1,367 @@
+import {
+  loadVaultPolicy,
+  saveVaultPolicy
+} from "./chunk-G4JYND6L.js";
+import {
+  PolicyDeniedError,
+  ValidationError
+} from "./chunk-S7VFUQM2.js";
+
+// src/with-party/policy/presets.ts
+var PERSONAL_POLICY = Object.freeze({
+  passphrase: {
+    minWords: 6,
+    minWordLength: 3,
+    rejectRepeatedAdjacent: true
+  },
+  gates: {
+    "rotate-passphrase": {
+      minTier: 1,
+      // Any second factor satisfies the gate — off-device kinds (TOTP,
+      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;
+      // platform-bound kinds (platform WebAuthn, password, PIN) are
+      // accepted because requiring "something off-device" is overkill
+      // for personal/SMB threat models. Consumers needing the off-device
+      // guarantee should use STRICT_POLICY or override this gate.
+      factors: [{
+        anyOf: [
+          "totp",
+          "email-otp",
+          "recovery",
+          "webauthn-roaming",
+          "webauthn-platform",
+          "password",
+          "pin"
+        ]
+      }]
+    },
+    "recover-passphrase": {
+      minTier: 1,
+      enabled: true
+    },
+    // rotate-recovery: deliberate paper-sheet regeneration
+    // when the user remembers their passphrase. PERSONAL allows tier-1 —
+    // knowing the passphrase is enough.
+    "rotate-recovery": { minTier: 1 },
+    "enroll-authenticator": { minTier: 1 },
+    "remove-authenticator": { minTier: 1 },
+    // update-authenticator: meta-only mutation (slot rename, label
+    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
+    // unlock alone. The structural anti-slot-swap guard inside the
+    // implementation enforces wrap-material/id/method immutability
+    // regardless of this gate's settings.
+    "update-authenticator": { minTier: 1 },
+    "rotate-unlock": { minTier: 2 },
+    "enroll-user": { minTier: 1 },
+    "revoke-user": { minTier: 1 },
+    // Peer-recovery is a high-trust intentional op — co-owners
+    // recovering each other should not need an off-device factor in
+    // the personal/SMB threat model (the partner is already vetted by
+    // virtue of being a co-owner). Tier-1 unlock is the floor; the
+    // STRICT preset adds a recovery/email-OTP requirement.
+    "peer-recover-user": { minTier: 1 },
+    // update-user: post-grant identity mutation (role/displayName/
+    // permissions). PERSONAL_POLICY treats this on par with enroll-user
+    // / revoke-user — tier-1 unlock alone. The role-elevation guard
+    // inside the implementation is the structural backstop that this
+    // gate's settings cannot weaken.
+    "update-user": { minTier: 1 },
+    "export-bundle": { minTier: 1 },
+    "export-plaintext": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "view-user-auth": {
+      minTier: 1,
+      enabled: false
+    },
+    // ─── User envelope gates ──────────────────────────────────────────
+    // edit-own-profile: tier 3 floor — any active session can edit their
+    //   own profile/preferences. Tightening to require a TOTP for
+    //   profile changes is a one-line override.
+    // view-team-profiles: tier 2 floor — an authenticated session can
+    //   read teammates' profiles (display names, avatars, locales).
+    //   Setting `enabled: false` makes vault.user.list() return only
+    //   self (privacy-strict opt-out).
+    "edit-own-profile": { minTier: 3 },
+    "view-team-profiles": { minTier: 2 },
+    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE
+    // withdrawal (export-and-delete/freeze). Fail-closed by default —
+    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).
+    // Listed explicitly (not just relying on the built-in default) so it is
+    // discoverable in describeGate / policy dumps.
+    "client-unilateral-withdraw": { minTier: 1, enabled: false },
+    // Two-party withdrawal: filing a request is non-destructive
+    // (tier-1, enabled so a read-only client can ask); deciding it is the
+    // destructive step (tier-2 floor + owner/admin role, enforced in code).
+    "user-request-withdrawal": { minTier: 1 },
+    "approve-user-withdrawal": { minTier: 2 }
+  }
+});
+var STRICT_POLICY = Object.freeze({
+  passphrase: {
+    minWords: 8,
+    minWordLength: 3,
+    rejectRepeatedAdjacent: true
+  },
+  gates: {
+    "rotate-passphrase": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp", "recovery"], count: 2 }]
+    },
+    "recover-passphrase": {
+      minTier: 1,
+      enabled: true
+    },
+    // rotate-recovery: STRICT requires an off-device factor —
+    // rotating recovery is an off-site-trust event; a stolen unlocked
+    // laptop must not be able to silently mint a new sheet for the
+    // attacker. Matches the `peer-recover-user` STRICT default.
+    "rotate-recovery": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp", "webauthn-roaming"] }]
+    },
+    "enroll-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "remove-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    // STRICT update-authenticator: same factor floor as enroll/remove.
+    // Even though meta changes don't touch wrap material, a malicious
+    // rename could mislead the user about which device a slot
+    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
+    // shared workstation). STRICT requires a fresh factor proof.
+    "update-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "rotate-unlock": { minTier: 1 },
+    "enroll-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "revoke-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    // STRICT peer-recovery: the issuer must present a recovery code
+    // OR a fresh off-device second factor at the moment of recovery.
+    // This binds the high-trust operation to a verifiable proof
+    // (recovery sheet photographed by an attacker won't suffice —
+    // they'd also need tier-1 unlock first; this gate is the freshness
+    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)
+    // accepted; platform-bound kinds (Touch ID, password, PIN)
+    // intentionally excluded under STRICT because they don't survive
+    // device theft — the off-device requirement is the whole point.
+    "peer-recover-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
+    },
+    // STRICT update-user: matches the enroll-user / revoke-user shape
+    // (off-device factor required). Update-user is admin-shaped — it
+    // mutates someone else's role/permissions; STRICT requires a fresh
+    // off-device factor proof so the operator affirmatively re-asserts
+    // identity at the moment of mutation. Platform-bound factors
+    // (Touch ID / password / PIN) intentionally excluded: same logic as
+    // peer-recover-user — the off-device requirement is the whole
+    // point under STRICT.
+    "update-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "export-bundle": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }],
+      warn: { sharedDevice: "block" }
+    },
+    "export-plaintext": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
+      warn: { sharedDevice: "block" }
+    },
+    "view-user-auth": {
+      minTier: 1,
+      enabled: false
+    },
+    // ─── User envelope gates ──────────────────────────────────────────
+    // STRICT: profile edits require a TOTP/email-OTP factor (typical
+    // shared-workstation hardening — your name/avatar shouldn't change
+    // without a fresh second-factor proof).
+    "edit-own-profile": {
+      minTier: 2,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "view-team-profiles": { minTier: 2 },
+    // STRICT: still fail-closed, but if a regulated firm flips enabled:true
+    // they inherit a two-factor proof + shared-device block for the
+    // destructive withdrawal (mirrors export-plaintext's hardening).
+    "client-unilateral-withdraw": {
+      minTier: 1,
+      enabled: false,
+      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
+      warn: { sharedDevice: "block" }
+    },
+    // STRICT: filing stays tier-1; the destructive APPROVE demands an
+    // off-device factor + shared-device block (mirrors export-bundle).
+    "user-request-withdrawal": { minTier: 1 },
+    "approve-user-withdrawal": {
+      minTier: 2,
+      factors: [{ anyOf: ["totp", "email-otp"] }],
+      warn: { sharedDevice: "block" }
+    }
+  }
+});
+function mergePolicy(base, override) {
+  if (!override) return base;
+  const passphrase = override.passphrase ?? base.passphrase;
+  return {
+    ...passphrase !== void 0 ? { passphrase } : {},
+    gates: {
+      ...base.gates,
+      ...override.gates ?? {}
+    }
+  };
+}
+
+// src/with-party/policy/engine.ts
+var DEFAULT_FRESHNESS_MS = 5 * 60 * 1e3;
+async function checkGate(policy, gate, context) {
+  const configured = policy.gates[gate];
+  if (!configured) {
+    if (gate.startsWith("app:")) {
+      return;
+    }
+    throw deny(gate, "disabled", { minTier: 1, enabled: false });
+  }
+  if (configured.enabled === false) {
+    throw deny(gate, "disabled", configured);
+  }
+  if (context.activeTier > configured.minTier) {
+    throw deny(gate, "insufficient-tier", configured);
+  }
+  if (configured.factors && configured.factors.length > 0) {
+    const presented = context.factors ?? [];
+    const now = context.now ?? Date.now();
+    for (const requirement of configured.factors) {
+      const matches = countMatchingFactors(presented, requirement, now);
+      const need = requirement.count ?? 1;
+      if (matches.fresh < need) {
+        if (matches.totalKindMatches < need) {
+          throw deny(gate, "missing-factor", configured);
+        }
+        throw deny(gate, "stale-proof", configured);
+      }
+    }
+  }
+  if (configured.warn?.sharedDevice === "block" && context.sharedDevice === true) {
+    throw deny(gate, "shared-device-blocked", configured);
+  }
+}
+async function describeGate(policy, gate, context) {
+  try {
+    await checkGate(policy, gate, context);
+    return { ok: true };
+  } catch (err) {
+    if (err instanceof PolicyDeniedError) {
+      return { ok: false, reason: err.reason, required: err.required };
+    }
+    throw err;
+  }
+}
+function countMatchingFactors(presented, requirement, now) {
+  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS;
+  let totalKindMatches = 0;
+  let fresh = 0;
+  for (const proof of presented) {
+    if (!requirement.anyOf.includes(proof.kind)) continue;
+    totalKindMatches += 1;
+    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now;
+    if (Number.isFinite(minted) && now - minted <= freshnessMs) {
+      fresh += 1;
+    }
+  }
+  return { totalKindMatches, fresh };
+}
+function deny(gate, reason, required) {
+  return new PolicyDeniedError(gate, reason, required);
+}
+
+// src/with-party/policy/noydb-facade.ts
+var NoydbPolicy = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * Touch the policy enforcer for a vault (records activity, resets
+   * idle timer). Also touches the legacy session timer. No-op if no enforcer.
+   */
+  touchPolicy(vault) {
+    this.deps.resetSessionTimer();
+    if (vault) {
+      this.deps.policyEnforcers.get(vault)?.touch();
+    }
+  }
+  /**
+   * Check that a policy-guarded operation is permitted.
+   * Throws `SessionPolicyError` if re-auth is required.
+   */
+  checkPolicyOperation(vault, op) {
+    this.deps.policyEnforcers.get(vault)?.checkOperation(op);
+  }
+  /**
+   * Read the active policy for a vault. Loads from `_meta/policy` on
+   * first call; subsequent calls hit the in-memory cache. Throws
+   * `ValidationError` if the vault has not been opened.
+   */
+  async getPolicy(vault) {
+    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
+    const cached = this.deps.policyCache.get(vault);
+    if (cached) return cached;
+    await this.bootstrapPolicy(vault);
+    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY;
+  }
+  /**
+   * Replace the policy document at `_meta/policy` and update the
+   * in-memory cache. Gated by the `enroll-user` policy (a policy
+   * change is fundamentally a privilege-management action).
+   */
+  async updatePolicy(vault, override) {
+    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
+    const current = await this.getPolicy(vault);
+    const merged = mergePolicy(current, override);
+    if (this.deps.encrypted) {
+      await saveVaultPolicy(this.deps.store, vault, merged);
+    }
+    this.deps.policyCache.set(vault, merged);
+    return merged;
+  }
+  /** Read or persist the vault policy at `_meta/policy` on first open. */
+  async bootstrapPolicy(vault, opts) {
+    const onDisk = await loadVaultPolicy(this.deps.store, vault);
+    if (onDisk) {
+      this.deps.policyCache.set(vault, onDisk);
+      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts);
+      return;
+    }
+    const initial = this.deps.policyOption ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption) : PERSONAL_POLICY;
+    await saveVaultPolicy(this.deps.store, vault, initial);
+    this.deps.policyCache.set(vault, initial);
+    await this.deps.assertRecoveryEnrolled(vault, initial, opts);
+  }
+};
+var createNoydbPolicy = (deps) => new NoydbPolicy(deps);
+
+export {
+  PERSONAL_POLICY,
+  STRICT_POLICY,
+  mergePolicy,
+  DEFAULT_FRESHNESS_MS,
+  checkGate,
+  describeGate,
+  createNoydbPolicy
+};
+//# sourceMappingURL=chunk-2OZXVKVP.js.map

package/dist/chunk-2OZXVKVP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/policy/presets.ts","../src/with-party/policy/engine.ts","../src/with-party/policy/noydb-facade.ts"],"sourcesContent":["import type { VaultPolicy } from '../../kernel/types.js'\n\n/**\n * Default policy for personal vaults and SMB deployments — the gates\n * that need an off-device factor get one (TOTP / email-OTP / paper\n * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the\n * floor only for `rotate-unlock` because that's the\n * \"change my PIN\" flow.\n *\n * The unspecified gates (e.g. `view-user-auth`) inherit the engine\n * default of `{ enabled: false, minTier: 1 }` — they fail closed.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Built-in gates\n */\nexport const PERSONAL_POLICY: VaultPolicy = Object.freeze({\n  passphrase: {\n    minWords: 6,\n    minWordLength: 3,\n    rejectRepeatedAdjacent: true,\n  },\n  gates: {\n    'rotate-passphrase': {\n      minTier: 1,\n      // Any second factor satisfies the gate — off-device kinds (TOTP,\n      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;\n      // platform-bound kinds (platform WebAuthn, password, PIN) are\n      // accepted because requiring \"something off-device\" is overkill\n      // for personal/SMB threat models. Consumers needing the off-device\n      // guarantee should use STRICT_POLICY or override this gate.\n      factors: [{\n        anyOf: [\n          'totp', 'email-otp', 'recovery',\n          'webauthn-roaming', 'webauthn-platform',\n          'password', 'pin',\n        ],\n      }],\n    },\n    'recover-passphrase': {\n      minTier: 1,\n      enabled: true,\n    },\n    // rotate-recovery: deliberate paper-sheet regeneration\n    // when the user remembers their passphrase. PERSONAL allows tier-1 —\n    // knowing the passphrase is enough.\n    'rotate-recovery': { minTier: 1 },\n    'enroll-authenticator': { minTier: 1 },\n    'remove-authenticator': { minTier: 1 },\n    // update-authenticator: meta-only mutation (slot rename, label\n    // changes). Symmetric with enroll/remove under PERSONAL — tier-1\n    // unlock alone. The structural anti-slot-swap guard inside the\n    // implementation enforces wrap-material/id/method immutability\n    // regardless of this gate's settings.\n    'update-authenticator': { minTier: 1 },\n    'rotate-unlock': { minTier: 2 },\n    'enroll-user': { minTier: 1 },\n    'revoke-user': { minTier: 1 },\n    // Peer-recovery is a high-trust intentional op — co-owners\n    // recovering each other should not need an off-device factor in\n    // the personal/SMB threat model (the partner is already vetted by\n    // virtue of being a co-owner). Tier-1 unlock is the floor; the\n    // STRICT preset adds a recovery/email-OTP requirement.\n    'peer-recover-user': { minTier: 1 },\n    // update-user: post-grant identity mutation (role/displayName/\n    // permissions). PERSONAL_POLICY treats this on par with enroll-user\n    // / revoke-user — tier-1 unlock alone. The role-elevation guard\n    // inside the implementation is the structural backstop that this\n    // gate's settings cannot weaken.\n    'update-user': { minTier: 1 },\n    'export-bundle': { minTier: 1 },\n    'export-plaintext': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'view-user-auth': {\n      minTier: 1,\n      enabled: false,\n    },\n    // ─── User envelope gates ──────────────────────────────────────────\n    // edit-own-profile: tier 3 floor — any active session can edit their\n    //   own profile/preferences. Tightening to require a TOTP for\n    //   profile changes is a one-line override.\n    // view-team-profiles: tier 2 floor — an authenticated session can\n    //   read teammates' profiles (display names, avatars, locales).\n    //   Setting `enabled: false` makes vault.user.list() return only\n    //   self (privacy-strict opt-out).\n    'edit-own-profile': { minTier: 3 },\n    'view-team-profiles': { minTier: 2 },\n    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE\n    // withdrawal (export-and-delete/freeze). Fail-closed by default —\n    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).\n    // Listed explicitly (not just relying on the built-in default) so it is\n    // discoverable in describeGate / policy dumps.\n    'client-unilateral-withdraw': { minTier: 1, enabled: false },\n    // Two-party withdrawal: filing a request is non-destructive\n    // (tier-1, enabled so a read-only client can ask); deciding it is the\n    // destructive step (tier-2 floor + owner/admin role, enforced in code).\n    'user-request-withdrawal': { minTier: 1 },\n    'approve-user-withdrawal': { minTier: 2 },\n  },\n}) as VaultPolicy\n\n/**\n * Strict policy for regulated deployments and shared workstations —\n * raises the phrase floor to 8 words, demands two distinct factors for\n * exports, and blocks export-on-shared-device. Use as a base for\n * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`\n * tweaks.\n */\nexport const STRICT_POLICY: VaultPolicy = Object.freeze({\n  passphrase: {\n    minWords: 8,\n    minWordLength: 3,\n    rejectRepeatedAdjacent: true,\n  },\n  gates: {\n    'rotate-passphrase': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp', 'recovery'], count: 2 }],\n    },\n    'recover-passphrase': {\n      minTier: 1,\n      enabled: true,\n    },\n    // rotate-recovery: STRICT requires an off-device factor —\n    // rotating recovery is an off-site-trust event; a stolen unlocked\n    // laptop must not be able to silently mint a new sheet for the\n    // attacker. Matches the `peer-recover-user` STRICT default.\n    'rotate-recovery': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp', 'webauthn-roaming'] }],\n    },\n    'enroll-authenticator': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'remove-authenticator': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    // STRICT update-authenticator: same factor floor as enroll/remove.\n    // Even though meta changes don't touch wrap material, a malicious\n    // rename could mislead the user about which device a slot\n    // corresponds to (\"MacBook Touch ID\" → \"iPhone Touch ID\" on a\n    // shared workstation). STRICT requires a fresh factor proof.\n    'update-authenticator': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'rotate-unlock': { minTier: 1 },\n    'enroll-user': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'revoke-user': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    // STRICT peer-recovery: the issuer must present a recovery code\n    // OR a fresh off-device second factor at the moment of recovery.\n    // This binds the high-trust operation to a verifiable proof\n    // (recovery sheet photographed by an attacker won't suffice —\n    // they'd also need tier-1 unlock first; this gate is the freshness\n    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)\n    // accepted; platform-bound kinds (Touch ID, password, PIN)\n    // intentionally excluded under STRICT because they don't survive\n    // device theft — the off-device requirement is the whole point.\n    'peer-recover-user': {\n      minTier: 1,\n      factors: [{ anyOf: ['recovery', 'totp', 'email-otp', 'webauthn-roaming'] }],\n    },\n    // STRICT update-user: matches the enroll-user / revoke-user shape\n    // (off-device factor required). Update-user is admin-shaped — it\n    // mutates someone else's role/permissions; STRICT requires a fresh\n    // off-device factor proof so the operator affirmatively re-asserts\n    // identity at the moment of mutation. Platform-bound factors\n    // (Touch ID / password / PIN) intentionally excluded: same logic as\n    // peer-recover-user — the off-device requirement is the whole\n    // point under STRICT.\n    'update-user': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'export-bundle': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n      warn: { sharedDevice: 'block' },\n    },\n    'export-plaintext': {\n      minTier: 1,\n      factors: [{ anyOf: ['totp', 'email-otp'], count: 2 }],\n      warn: { sharedDevice: 'block' },\n    },\n    'view-user-auth': {\n      minTier: 1,\n      enabled: false,\n    },\n    // ─── User envelope gates ──────────────────────────────────────────\n    // STRICT: profile edits require a TOTP/email-OTP factor (typical\n    // shared-workstation hardening — your name/avatar shouldn't change\n    // without a fresh second-factor proof).\n    'edit-own-profile': {\n      minTier: 2,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n    },\n    'view-team-profiles': { minTier: 2 },\n    // STRICT: still fail-closed, but if a regulated firm flips enabled:true\n    // they inherit a two-factor proof + shared-device block for the\n    // destructive withdrawal (mirrors export-plaintext's hardening).\n    'client-unilateral-withdraw': {\n      minTier: 1,\n      enabled: false,\n      factors: [{ anyOf: ['totp', 'email-otp'], count: 2 }],\n      warn: { sharedDevice: 'block' },\n    },\n    // STRICT: filing stays tier-1; the destructive APPROVE demands an\n    // off-device factor + shared-device block (mirrors export-bundle).\n    'user-request-withdrawal': { minTier: 1 },\n    'approve-user-withdrawal': {\n      minTier: 2,\n      factors: [{ anyOf: ['totp', 'email-otp'] }],\n      warn: { sharedDevice: 'block' },\n    },\n  },\n}) as VaultPolicy\n\n/**\n * Merge a developer override onto a preset. Unspecified gates inherit;\n * specified gates fully replace the preset's entry for that gate.\n *\n * Example:\n *\n * ```ts\n * mergePolicy(PERSONAL_POLICY, {\n *   gates: {\n *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },\n *   },\n * })\n * // → PERSONAL_POLICY plus the new app gate; existing gates intact.\n * ```\n */\nexport function mergePolicy(\n  base: VaultPolicy,\n  override?: Partial<VaultPolicy>,\n): VaultPolicy {\n  if (!override) return base\n  const passphrase = override.passphrase ?? base.passphrase\n  return {\n    ...(passphrase !== undefined ? { passphrase } : {}),\n    gates: {\n      ...base.gates,\n      ...(override.gates ?? {}),\n    },\n  }\n}\n","/**\n * Policy gate engine — the {@link checkGate} entry point.\n *\n * Given a configured {@link VaultPolicy}, an active session tier, and\n * the factor proofs an actor is presenting, decide whether the gate\n * permits the action. On denial, throws {@link PolicyDeniedError} with\n * a stable {@link PolicyDenyReason} so consumers can branch in error\n * UIs.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → checkGate() API\n *\n * @module\n */\nimport { PolicyDeniedError, type PolicyDenyReason } from '../../kernel/errors.js'\nimport type {\n  ActiveTier,\n  FactorProof,\n  GateName,\n  GatePolicy,\n  VaultPolicy,\n  FactorRequirement,\n} from '../../kernel/types.js'\n\n/** Default freshness window — 5 minutes. */\nexport const DEFAULT_FRESHNESS_MS = 5 * 60 * 1000\n\n/** Caller-supplied context for one `checkGate` invocation. */\nexport interface CheckGateContext {\n  /** Tier the active session currently holds. */\n  readonly activeTier: ActiveTier\n  /** Proofs the actor is presenting for this gate. */\n  readonly factors?: ReadonlyArray<FactorProof>\n  /**\n   * If the host knows the actor is on a shared device, set this to\n   * `true` so the engine can apply `warn.sharedDevice` rules. Defaults\n   * to `false`.\n   */\n  readonly sharedDevice?: boolean\n  /**\n   * Override `now()` for tests. Defaults to `Date.now()`.\n   * @internal\n   */\n  readonly now?: number\n}\n\n/**\n * Decide whether `gate` permits the action under `context`. Throws\n * {@link PolicyDeniedError} on denial; resolves with `void` on success.\n *\n * Lookup rules:\n * - **Built-in gates** without a configured policy fail closed\n *   (`enabled: false`).\n * - **App-defined gates** (`app:*`) without a configured policy are\n *   treated as no-op (allow). The developer registered the policy if\n *   they wanted enforcement; absence means the gate is informational.\n */\nexport async function checkGate(\n  policy: VaultPolicy,\n  gate: GateName,\n  context: CheckGateContext,\n): Promise<void> {\n  const configured = policy.gates[gate]\n  if (!configured) {\n    if (gate.startsWith('app:')) {\n      // Custom app gate without a policy — the developer hasn't\n      // registered one; engine treats it as an unenforced label.\n      return\n    }\n    // Built-in gate without a policy — fail closed.\n    throw deny(gate, 'disabled', { minTier: 1, enabled: false })\n  }\n\n  if (configured.enabled === false) {\n    throw deny(gate, 'disabled', configured)\n  }\n\n  // Tier check first — cheap and a hard prerequisite.\n  if (context.activeTier > configured.minTier) {\n    // Higher number is a LOWER tier in this model (1 is most privileged).\n    throw deny(gate, 'insufficient-tier', configured)\n  }\n\n  // Factor checks — every requirement entry must be satisfied.\n  if (configured.factors && configured.factors.length > 0) {\n    const presented = context.factors ?? []\n    const now = context.now ?? Date.now()\n    for (const requirement of configured.factors) {\n      const matches = countMatchingFactors(presented, requirement, now)\n      const need = requirement.count ?? 1\n      if (matches.fresh < need) {\n        if (matches.totalKindMatches < need) {\n          throw deny(gate, 'missing-factor', configured)\n        }\n        // Some matched the kind list but not the freshness window.\n        throw deny(gate, 'stale-proof', configured)\n      }\n    }\n  }\n\n  // Soft signals — only `'block'` raises here.\n  if (configured.warn?.sharedDevice === 'block' && context.sharedDevice === true) {\n    throw deny(gate, 'shared-device-blocked', configured)\n  }\n}\n\n/**\n * Same as {@link checkGate} but returns a structured verdict instead\n * of throwing. Useful when an error UI wants to show the user\n * \"you'll need TOTP plus a recovery code to do that\" without first\n * triggering the action.\n */\nexport async function describeGate(\n  policy: VaultPolicy,\n  gate: GateName,\n  context: CheckGateContext,\n): Promise<{ ok: true } | { ok: false; reason: PolicyDenyReason; required: GatePolicy }> {\n  try {\n    await checkGate(policy, gate, context)\n    return { ok: true }\n  } catch (err) {\n    if (err instanceof PolicyDeniedError) {\n      return { ok: false, reason: err.reason, required: err.required }\n    }\n    throw err\n  }\n}\n\nfunction countMatchingFactors(\n  presented: ReadonlyArray<FactorProof>,\n  requirement: FactorRequirement,\n  now: number,\n): { totalKindMatches: number; fresh: number } {\n  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS\n  let totalKindMatches = 0\n  let fresh = 0\n  for (const proof of presented) {\n    if (!requirement.anyOf.includes(proof.kind)) continue\n    totalKindMatches += 1\n    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now\n    if (Number.isFinite(minted) && now - minted <= freshnessMs) {\n      fresh += 1\n    }\n  }\n  return { totalKindMatches, fresh }\n}\n\nfunction deny(gate: GateName, reason: PolicyDenyReason, required: GatePolicy): PolicyDeniedError {\n  return new PolicyDeniedError(gate, reason, required)\n}\n","/**\n * Noydb-side policy / session-policy facade.\n *\n * Holds the vault-policy read/update/bootstrap logic (`getPolicy`,\n * `updatePolicy`, `bootstrapPolicy`) and the per-vault session-policy\n * enforcer wiring (`touchPolicy`, `checkPolicyOperation`). The session\n * *timer* and the managed-recovery enrolment check stay kernel-resident on\n * `Noydb` (interleaved with the instance lifecycle) and arrive here as the\n * `resetSessionTimer` / `assertRecoveryEnrolled` callbacks. The policy cache\n * and the enforcer map stay `Noydb`-resident too (touched by\n * `openVault`/`close`) and arrive by reference; behaviour is byte-identical\n * to the inline `Noydb` methods it replaced — every other dependency the\n * moving code touched on `this.*` arrives via {@link NoydbPolicyDeps}.\n *\n * Internal service — reached through `noydb.getPolicy(...)` etc. Public\n * contract ({@link NoydbPolicyApi} / {@link NoydbPolicyDeps} /\n * {@link NoydbPolicyFactory}) lives in the kernel spine; `createNoydb()`\n * wires this file's {@link createNoydbPolicy} in via a pre-resolved dynamic\n * import (the S4 gate recipe).\n */\nimport { ValidationError } from '../../kernel/errors.js'\nimport { PERSONAL_POLICY, mergePolicy } from './presets.js'\nimport { loadVaultPolicy, saveVaultPolicy } from './storage.js'\nimport type { VaultPolicy, ReAuthOperation, NoydbPolicyApi, NoydbPolicyDeps, NoydbPolicyFactory } from '../../kernel/types.js'\n\nexport class NoydbPolicy implements NoydbPolicyApi {\n  constructor(private readonly deps: NoydbPolicyDeps) {}\n\n  /**\n   * Touch the policy enforcer for a vault (records activity, resets\n   * idle timer). Also touches the legacy session timer. No-op if no enforcer.\n   */\n  touchPolicy(vault?: string): void {\n    this.deps.resetSessionTimer()\n    if (vault) {\n      this.deps.policyEnforcers.get(vault)?.touch()\n    }\n  }\n\n  /**\n   * Check that a policy-guarded operation is permitted.\n   * Throws `SessionPolicyError` if re-auth is required.\n   */\n  checkPolicyOperation(vault: string, op: ReAuthOperation): void {\n    this.deps.policyEnforcers.get(vault)?.checkOperation(op)\n  }\n\n  /**\n   * Read the active policy for a vault. Loads from `_meta/policy` on\n   * first call; subsequent calls hit the in-memory cache. Throws\n   * `ValidationError` if the vault has not been opened.\n   */\n  async getPolicy(vault: string): Promise<VaultPolicy> {\n    if (this.deps.isClosed()) throw new ValidationError('Instance is closed')\n    const cached = this.deps.policyCache.get(vault)\n    if (cached) return cached\n    await this.bootstrapPolicy(vault)\n    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY\n  }\n\n  /**\n   * Replace the policy document at `_meta/policy` and update the\n   * in-memory cache. Gated by the `enroll-user` policy (a policy\n   * change is fundamentally a privilege-management action).\n   */\n  async updatePolicy(vault: string, override: Partial<VaultPolicy>): Promise<VaultPolicy> {\n    if (this.deps.isClosed()) throw new ValidationError('Instance is closed')\n    const current = await this.getPolicy(vault)\n    const merged = mergePolicy(current, override)\n    if (this.deps.encrypted) {\n      await saveVaultPolicy(this.deps.store, vault, merged)\n    }\n    this.deps.policyCache.set(vault, merged)\n    return merged\n  }\n\n  /** Read or persist the vault policy at `_meta/policy` on first open. */\n  async bootstrapPolicy(\n    vault: string,\n    opts?: { skipManagedCheck?: boolean },\n  ): Promise<void> {\n    const onDisk = await loadVaultPolicy(this.deps.store, vault)\n    if (onDisk) {\n      // Honour the on-disk document; developer overrides cannot\n      // weaken what the vault committed to at creation time.\n      this.deps.policyCache.set(vault, onDisk)\n      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts)\n      return\n    }\n    // First time — persist the developer's policy (or default preset).\n    const initial = this.deps.policyOption\n      ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption)\n      : PERSONAL_POLICY\n    await saveVaultPolicy(this.deps.store, vault, initial)\n    this.deps.policyCache.set(vault, initial)\n    await this.deps.assertRecoveryEnrolled(vault, initial, opts)\n  }\n}\n\n/**\n * Factory that builds the `NoydbPolicy` service. `createNoydb()`\n * pre-resolves this via a dynamic import (mirrors\n * `with-party/directory/user-envelope/api.js#createUserApi`) and threads\n * it through `NoydbOptions.policyFactory` so `Noydb`'s constructor can\n * build `this.policyManager` synchronously.\n */\nexport const createNoydbPolicy: NoydbPolicyFactory = (deps) => new NoydbPolicy(deps)\n"],"mappings":";;;;;;;;;;AAcO,IAAM,kBAA+B,OAAO,OAAO;AAAA,EACxD,YAAY;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA,IACf,wBAAwB;AAAA,EAC1B;AAAA,EACA,OAAO;AAAA,IACL,qBAAqB;AAAA,MACnB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOT,SAAS,CAAC;AAAA,QACR,OAAO;AAAA,UACL;AAAA,UAAQ;AAAA,UAAa;AAAA,UACrB;AAAA,UAAoB;AAAA,UACpB;AAAA,UAAY;AAAA,QACd;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,sBAAsB;AAAA,MACpB,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA;AAAA;AAAA;AAAA,IAIA,mBAAmB,EAAE,SAAS,EAAE;AAAA,IAChC,wBAAwB,EAAE,SAAS,EAAE;AAAA,IACrC,wBAAwB,EAAE,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMrC,wBAAwB,EAAE,SAAS,EAAE;AAAA,IACrC,iBAAiB,EAAE,SAAS,EAAE;AAAA,IAC9B,eAAe,EAAE,SAAS,EAAE;AAAA,IAC5B,eAAe,EAAE,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM5B,qBAAqB,EAAE,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlC,eAAe,EAAE,SAAS,EAAE;AAAA,IAC5B,iBAAiB,EAAE,SAAS,EAAE;AAAA,IAC9B,oBAAoB;AAAA,MAClB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,oBAAoB,EAAE,SAAS,EAAE;AAAA,IACjC,sBAAsB,EAAE,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnC,8BAA8B,EAAE,SAAS,GAAG,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA,IAI3D,2BAA2B,EAAE,SAAS,EAAE;AAAA,IACxC,2BAA2B,EAAE,SAAS,EAAE;AAAA,EAC1C;AACF,CAAC;AASM,IAAM,gBAA6B,OAAO,OAAO;AAAA,EACtD,YAAY;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA,IACf,wBAAwB;AAAA,EAC1B;AAAA,EACA,OAAO;AAAA,IACL,qBAAqB;AAAA,MACnB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,aAAa,UAAU,GAAG,OAAO,EAAE,CAAC;AAAA,IAClE;AAAA,IACA,sBAAsB;AAAA,MACpB,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,mBAAmB;AAAA,MACjB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,aAAa,kBAAkB,EAAE,CAAC;AAAA,IAChE;AAAA,IACA,wBAAwB;AAAA,MACtB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,wBAAwB;AAAA,MACtB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,wBAAwB;AAAA,MACtB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,iBAAiB,EAAE,SAAS,EAAE;AAAA,IAC9B,eAAe;AAAA,MACb,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,eAAe;AAAA,MACb,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,qBAAqB;AAAA,MACnB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,QAAQ,aAAa,kBAAkB,EAAE,CAAC;AAAA,IAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,eAAe;AAAA,MACb,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,iBAAiB;AAAA,MACf,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,MAC1C,MAAM,EAAE,cAAc,QAAQ;AAAA,IAChC;AAAA,IACA,oBAAoB;AAAA,MAClB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,GAAG,OAAO,EAAE,CAAC;AAAA,MACpD,MAAM,EAAE,cAAc,QAAQ;AAAA,IAChC;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,oBAAoB;AAAA,MAClB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC5C;AAAA,IACA,sBAAsB,EAAE,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA,IAInC,8BAA8B;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,GAAG,OAAO,EAAE,CAAC;AAAA,MACpD,MAAM,EAAE,cAAc,QAAQ;AAAA,IAChC;AAAA;AAAA;AAAA,IAGA,2BAA2B,EAAE,SAAS,EAAE;AAAA,IACxC,2BAA2B;AAAA,MACzB,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,WAAW,EAAE,CAAC;AAAA,MAC1C,MAAM,EAAE,cAAc,QAAQ;AAAA,IAChC;AAAA,EACF;AACF,CAAC;AAiBM,SAAS,YACd,MACA,UACa;AACb,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,aAAa,SAAS,cAAc,KAAK;AAC/C,SAAO;AAAA,IACL,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,IACjD,OAAO;AAAA,MACL,GAAG,KAAK;AAAA,MACR,GAAI,SAAS,SAAS,CAAC;AAAA,IACzB;AAAA,EACF;AACF;;;ACrOO,IAAM,uBAAuB,IAAI,KAAK;AAgC7C,eAAsB,UACpB,QACA,MACA,SACe;AACf,QAAM,aAAa,OAAO,MAAM,IAAI;AACpC,MAAI,CAAC,YAAY;AACf,QAAI,KAAK,WAAW,MAAM,GAAG;AAG3B;AAAA,IACF;AAEA,UAAM,KAAK,MAAM,YAAY,EAAE,SAAS,GAAG,SAAS,MAAM,CAAC;AAAA,EAC7D;AAEA,MAAI,WAAW,YAAY,OAAO;AAChC,UAAM,KAAK,MAAM,YAAY,UAAU;AAAA,EACzC;AAGA,MAAI,QAAQ,aAAa,WAAW,SAAS;AAE3C,UAAM,KAAK,MAAM,qBAAqB,UAAU;AAAA,EAClD;AAGA,MAAI,WAAW,WAAW,WAAW,QAAQ,SAAS,GAAG;AACvD,UAAM,YAAY,QAAQ,WAAW,CAAC;AACtC,UAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;AACpC,eAAW,eAAe,WAAW,SAAS;AAC5C,YAAM,UAAU,qBAAqB,WAAW,aAAa,GAAG;AAChE,YAAM,OAAO,YAAY,SAAS;AAClC,UAAI,QAAQ,QAAQ,MAAM;AACxB,YAAI,QAAQ,mBAAmB,MAAM;AACnC,gBAAM,KAAK,MAAM,kBAAkB,UAAU;AAAA,QAC/C;AAEA,cAAM,KAAK,MAAM,eAAe,UAAU;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAGA,MAAI,WAAW,MAAM,iBAAiB,WAAW,QAAQ,iBAAiB,MAAM;AAC9E,UAAM,KAAK,MAAM,yBAAyB,UAAU;AAAA,EACtD;AACF;AAQA,eAAsB,aACpB,QACA,MACA,SACuF;AACvF,MAAI;AACF,UAAM,UAAU,QAAQ,MAAM,OAAO;AACrC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS;AAAA,IACjE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,qBACP,WACA,aACA,KAC6C;AAC7C,QAAM,cAAc,YAAY,eAAe;AAC/C,MAAI,mBAAmB;AACvB,MAAI,QAAQ;AACZ,aAAW,SAAS,WAAW;AAC7B,QAAI,CAAC,YAAY,MAAM,SAAS,MAAM,IAAI,EAAG;AAC7C,wBAAoB;AACpB,UAAM,SAAS,MAAM,WAAW,KAAK,MAAM,MAAM,QAAQ,IAAI;AAC7D,QAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU,aAAa;AAC1D,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,EAAE,kBAAkB,MAAM;AACnC;AAEA,SAAS,KAAK,MAAgB,QAA0B,UAAyC;AAC/F,SAAO,IAAI,kBAAkB,MAAM,QAAQ,QAAQ;AACrD;;;AC3HO,IAAM,cAAN,MAA4C;AAAA,EACjD,YAA6B,MAAuB;AAAvB;AAAA,EAAwB;AAAA,EAAxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7B,YAAY,OAAsB;AAChC,SAAK,KAAK,kBAAkB;AAC5B,QAAI,OAAO;AACT,WAAK,KAAK,gBAAgB,IAAI,KAAK,GAAG,MAAM;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAqB,OAAe,IAA2B;AAC7D,SAAK,KAAK,gBAAgB,IAAI,KAAK,GAAG,eAAe,EAAE;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,UAAU,OAAqC;AACnD,QAAI,KAAK,KAAK,SAAS,EAAG,OAAM,IAAI,gBAAgB,oBAAoB;AACxE,UAAM,SAAS,KAAK,KAAK,YAAY,IAAI,KAAK;AAC9C,QAAI,OAAQ,QAAO;AACnB,UAAM,KAAK,gBAAgB,KAAK;AAChC,WAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,OAAe,UAAsD;AACtF,QAAI,KAAK,KAAK,SAAS,EAAG,OAAM,IAAI,gBAAgB,oBAAoB;AACxE,UAAM,UAAU,MAAM,KAAK,UAAU,KAAK;AAC1C,UAAM,SAAS,YAAY,SAAS,QAAQ;AAC5C,QAAI,KAAK,KAAK,WAAW;AACvB,YAAM,gBAAgB,KAAK,KAAK,OAAO,OAAO,MAAM;AAAA,IACtD;AACA,SAAK,KAAK,YAAY,IAAI,OAAO,MAAM;AACvC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,gBACJ,OACA,MACe;AACf,UAAM,SAAS,MAAM,gBAAgB,KAAK,KAAK,OAAO,KAAK;AAC3D,QAAI,QAAQ;AAGV,WAAK,KAAK,YAAY,IAAI,OAAO,MAAM;AACvC,YAAM,KAAK,KAAK,uBAAuB,OAAO,QAAQ,IAAI;AAC1D;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,KAAK,eACtB,YAAY,iBAAiB,KAAK,KAAK,YAAY,IACnD;AACJ,UAAM,gBAAgB,KAAK,KAAK,OAAO,OAAO,OAAO;AACrD,SAAK,KAAK,YAAY,IAAI,OAAO,OAAO;AACxC,UAAM,KAAK,KAAK,uBAAuB,OAAO,SAAS,IAAI;AAAA,EAC7D;AACF;AASO,IAAM,oBAAwC,CAAC,SAAS,IAAI,YAAY,IAAI;","names":[]}

package/dist/{chunk-HNRHLRDC.js → chunk-2REPHKET.js}

@@ -1,4 +1,4 @@
-// src/materialized-views/stale.ts
+// src/with-formula/materialized-views/stale.ts
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -11,7 +11,7 @@ function markMVStale(registry, mvName) {
 function isMVStale(registry, mvName) {
   return _staleByRegistry.get(registry)?.has(mvName) ?? false;
 }
-async function resolveStaleMVOnRead(accessor, outputCollection) {
+async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
   const registry = accessor.registry();
   const pending = _staleByRegistry.get(registry);
   if (!pending || pending.size === 0) return;
@@ -30,12 +30,13 @@ async function resolveStaleMVOnRead(accessor, outputCollection) {
       continue;
     }
     if (executor === null) {
-      ({ MaterializedViewExecutor: executor } = await import("./executor-BWXXDQ7K.js"));
+      ({ MaterializedViewExecutor: executor } = await import("./executor-KSHKRJXP.js"));
     }
     await executor.refresh(reg, {
       getCollection: (n) => accessor.getCollection(n),
       getActiveTxContext: () => accessor.getActiveTxContext(),
-      getQueryContext: () => accessor.getQueryContext()
+      getQueryContext: () => accessor.getQueryContext(),
+      ...dispatchCtx !== void 0 ? { dispatchCtx } : {}
     });
     pending.delete(name);
   }
@@ -50,4 +51,4 @@ export {
   resolveStaleMVOnRead,
   clearMVStale
 };
-//# sourceMappingURL=chunk-HNRHLRDC.js.map
+//# sourceMappingURL=chunk-2REPHKET.js.map

package/dist/chunk-2REPHKET.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { MVQueryContext } from './types.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      pending.delete(name)\n      continue\n    }\n    if (executor === null) {\n      ({ MaterializedViewExecutor: executor } = (await import('./executor.js')) as {\n        MaterializedViewExecutor: typeof MVExecutorType\n      })\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n"],"mappings":";AAoCA,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AACnC,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAMpC,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AACR,cAAQ,OAAO,IAAI;AACnB;AAAA,IACF;AACA,QAAI,aAAa,MAAM;AACrB,OAAC,EAAE,0BAA0B,SAAS,IAAK,MAAM,OAAO,wBAAe;AAAA,IAGzE;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAAA,EACrB;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;","names":[]}

package/dist/{chunk-PE2FR4J3.js → chunk-3JXPAHOZ.js}

@@ -1,22 +1,28 @@
+import {
+  LEDGER_COLLECTION,
+  LEDGER_DELTAS_COLLECTION
+} from "./chunk-I7FD46FF.js";
 import {
   canonicalJson,
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-Z6FNBOTC.js";
+} from "./chunk-UF362QVH.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
 import {
-  decrypt,
   encrypt
-} from "./chunk-PP6W64Y3.js";
+} from "./chunk-3OPY6MK2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-YN5IAHN6.js";
 import {
   ConflictError,
   LedgerContentionError
-} from "./chunk-B6PB7JLN.js";
+} from "./chunk-S7VFUQM2.js";
 
-// src/history/ledger/patch.ts
+// src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
   const ops = [];
   diff(prev, next, "", ops);
@@ -221,11 +227,7 @@ function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
-// src/history/ledger/constants.ts
-var LEDGER_COLLECTION = "_ledger";
-var LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
-
-// src/history/ledger/store.ts
+// src/with-commit/history/ledger/store.ts
 var MAX_APPEND_ATTEMPTS = 8;
 var LedgerStore = class {
   adapter;
@@ -416,7 +418,7 @@ var LedgerStore = class {
       return JSON.parse(envelope._data);
     }
     const dek = await this.getDEK(LEDGER_COLLECTION);
-    const json = await decrypt(envelope._iv, envelope._data, dek);
+    const json = await openEnvelopeJson(envelope, dek);
     return JSON.parse(json);
   }
   /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
@@ -666,7 +668,7 @@ var LedgerStore = class {
       return JSON.parse(envelope._data);
     }
     const dek = await this.getDEK(LEDGER_COLLECTION);
-    const json = await decrypt(envelope._iv, envelope._data, dek);
+    const json = await openEnvelopeJson(envelope, dek);
     return JSON.parse(json);
   }
 };
@@ -679,8 +681,6 @@ function sleepBackoff(attempt) {
 export {
   computePatch,
   applyPatch,
-  LEDGER_COLLECTION,
-  LEDGER_DELTAS_COLLECTION,
   LedgerStore
 };
-//# sourceMappingURL=chunk-PE2FR4J3.js.map
+//# sourceMappingURL=chunk-3JXPAHOZ.js.map