@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/chunk-6G5ORS5D.js

@@ -0,0 +1,202 @@
+import {
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
+import {
+  encrypt
+} from "./chunk-3OPY6MK2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-YN5IAHN6.js";
+import {
+  ConflictError,
+  SequenceContentionError,
+  SequenceNotEnabledError,
+  SequenceOfflineError,
+  ValidationError
+} from "./chunk-S7VFUQM2.js";
+
+// src/with-commit/sequence/strategy.ts
+var NO_SEQUENCE = {
+  createStore() {
+    throw new SequenceNotEnabledError();
+  }
+};
+
+// src/with-commit/sequence/index.ts
+var SEQUENCE_COLLECTION = "_sequences";
+var MAX_NEXT_ATTEMPTS = 16;
+var SEQ_FORMAT_TOKEN = /\{([^{}]*)\}/g;
+var SEQ_PAD_TOKEN = /^seq:0(\d+)$/;
+var SEQ_PARTITION_TOKEN = /^partition\.(\d+)$/;
+function compileSequenceFormat(format, series, partition) {
+  const parts = partition ?? [];
+  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {
+    const token = m[1] ?? "";
+    if (token === "seq") continue;
+    if (SEQ_PAD_TOKEN.test(token)) continue;
+    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
+    if (partMatch) {
+      const idx = Number(partMatch[1]);
+      if (idx >= parts.length) {
+        throw new ValidationError(
+          `sequence("${series}"): format token "{${token}}" references partition index ${idx}, but only ${parts.length} partition component(s) were supplied.`
+        );
+      }
+      continue;
+    }
+    throw new ValidationError(
+      `sequence("${series}"): format contains unknown token "{${token}}". Accepted tokens: {seq}, {seq:0N}, {partition.i}.`
+    );
+  }
+  return (serial) => format.replace(SEQ_FORMAT_TOKEN, (full, token) => {
+    if (token === "seq") return String(serial);
+    const padMatch = SEQ_PAD_TOKEN.exec(token);
+    if (padMatch) return String(serial).padStart(Number(padMatch[1]), "0");
+    const partMatch = SEQ_PARTITION_TOKEN.exec(token);
+    if (partMatch) return String(parts[Number(partMatch[1])]);
+    return full;
+  });
+}
+function resolveSequenceKey(series, opts) {
+  const partition = opts?.partition;
+  if (!partition || partition.length === 0) return series;
+  const parts = partition.map((p) => {
+    if (typeof p === "number" && !Number.isFinite(p)) {
+      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`);
+    }
+    const s = String(p);
+    if (s === "") {
+      throw new ValidationError("sequence partition component must not be empty");
+    }
+    return encodeURIComponent(s);
+  });
+  return `${series}\0${parts.join("/")}`;
+}
+async function sleepBackoff(attempt) {
+  const ceil = Math.min(2 ** attempt, 32);
+  const ms = Math.floor(Math.random() * ceil);
+  await new Promise((r) => setTimeout(r, ms));
+}
+var SequenceStore = class {
+  adapter;
+  vault;
+  encrypted;
+  getDEK;
+  actor;
+  /**
+   * Memoized DEK promise. The `_sequences` collection DEK is created on
+   * first access; without sharing one promise, a burst of concurrent
+   * `next()` calls would each trigger DEK creation and diverge (one
+   * writer's ciphertext unreadable by another). One shared promise → one
+   * DEK.
+   */
+  dekPromise = null;
+  constructor(opts) {
+    this.adapter = opts.adapter;
+    this.vault = opts.vault;
+    this.encrypted = opts.encrypted;
+    this.getDEK = opts.getDEK;
+    this.actor = opts.actor;
+  }
+  /** A handle bound to one sequence name. */
+  handle(name) {
+    return {
+      next: () => this.next(name),
+      peek: () => this.peek(name),
+      seedTo: (n) => this.seedTo(name, n)
+    };
+  }
+  assertOnline() {
+    if (this.adapter.capabilities?.casAtomic !== true) {
+      throw new SequenceOfflineError();
+    }
+  }
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION);
+    return this.dekPromise;
+  }
+  async read(name) {
+    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
+    if (!env) return { env: null, value: 0 };
+    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    const state = JSON.parse(json);
+    return { env, value: state.value };
+  }
+  async encryptState(state, version) {
+    const json = JSON.stringify(state);
+    if (!this.encrypted) {
+      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+    }
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+  }
+  async peek(name) {
+    return (await this.read(name)).value;
+  }
+  async next(name) {
+    this.assertOnline();
+    let lastConflict;
+    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+      const { env, value } = await this.read(name);
+      const nextValue = value + 1;
+      const expectedVersion = env?._v ?? 0;
+      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1);
+      try {
+        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+        return nextValue;
+      } catch (err) {
+        if (err instanceof ConflictError) {
+          lastConflict = err;
+          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
+          continue;
+        }
+        throw err;
+      }
+    }
+    void lastConflict;
+    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+  }
+  async seedTo(name, n) {
+    this.assertOnline();
+    if (n <= 0) return;
+    let lastConflict;
+    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+      const { env, value } = await this.read(name);
+      if (value >= n) return;
+      const expectedVersion = env?._v ?? 0;
+      const envelope = await this.encryptState({ value: n }, expectedVersion + 1);
+      try {
+        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+        return;
+      } catch (err) {
+        if (err instanceof ConflictError) {
+          lastConflict = err;
+          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
+          continue;
+        }
+        throw err;
+      }
+    }
+    void lastConflict;
+    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+  }
+};
+
+// src/with-commit/sequence/active.ts
+function withSequence() {
+  return {
+    createStore(opts) {
+      return new SequenceStore(opts);
+    }
+  };
+}
+
+export {
+  withSequence,
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey,
+  SequenceStore
+};
+//# sourceMappingURL=chunk-6G5ORS5D.js.map

package/dist/chunk-6G5ORS5D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts","../src/with-commit/sequence/active.ts"],"sourcesContent":["/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { ConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _iv: '', _data: json, _by: this.actor }\n    }\n    const { iv, data } = await encrypt(json, await this.dek())\n    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _iv: iv, _data: data, _by: this.actor }\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (err instanceof ConflictError) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState({ value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (err instanceof ConflictError) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n","/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACAO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAClF,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,OAAsB,SAA6C;AAC5F,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM;AAAA,IAC3H;AACA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,CAAC;AACzD,WAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM;AAAA,EAC3H;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AAClF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,eAAe,eAAe;AAChC,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAC1E,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,eAAe;AAChC,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;;;ACrTO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-VTKGMEPP.js → chunk-6P5XCKSD.js}

@@ -2,9 +2,9 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-B6PB7JLN.js";
+} from "./chunk-S7VFUQM2.js";
 
-// src/overlay-views/registry.ts
+// src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
   _byName = /* @__PURE__ */ new Map();
   /**
@@ -37,6 +37,16 @@ var OverlayedViewRegistry = class {
   isOverlay(name) {
     return this._byName.has(name);
   }
+  /**
+   * All registered overlay strategies as a flat array.
+   * Each strategy carries `name`, `base`, and `overlay` fields that
+   * `describeOverlays()` in the introspection walker reads directly.
+   *
+   * Used by `dumpSchema()` to populate the `overlayViews` map.
+   */
+  all() {
+    return [...this._byName.values()];
+  }
   /**
    * Resolve the `rowKey` function for an overlay's base MV. Returns
    * `undefined` if the base isn't an MV (raw source collection) or
@@ -58,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-VTKGMEPP.js.map
+//# sourceMappingURL=chunk-6P5XCKSD.js.map

package/dist/chunk-6P5XCKSD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/overlay-views/registry.ts"],"sourcesContent":["import {\n  OverlayBaseIsVirtualError,\n  OverlayCollectionUnavailableError,\n  OverlayNameCollisionError,\n} from '../../kernel/errors.js'\nimport type { MaterializedViewRegistry } from '../materialized-views/registry.js'\nimport type { OverlayedViewStrategy } from './types.js'\n\n/**\n * Vault-internal registry of overlay strategies. Resolves the base\n * MV's `rowKey` lazily so virtual-collection writes can derive ids\n * from the row.\n *\n * @internal\n */\nexport class OverlayedViewRegistry {\n  private readonly _byName = new Map<string, OverlayedViewStrategy>()\n\n  /**\n   * Register an overlay. Validates name uniqueness, base concreteness,\n   * and overlay availability AGAINST the MV registry — overlays\n   * declared without the MV registry context skip cross-registry\n   * checks but still validate self-consistency.\n   */\n  register(\n    spec: OverlayedViewStrategy,\n    options: {\n      isOverlayName?: (name: string) => boolean\n      isMVOutput?: (name: string) => boolean\n      isKnownCollection?: (name: string) => boolean\n    },\n  ): void {\n    const { isOverlayName, isMVOutput, isKnownCollection } = options\n\n    // 1. Virtual name must not collide with an MV output or a concrete\n    //    source collection. Concrete-source detection is best-effort:\n    //    if `isKnownCollection` is supplied, a hit there + no MV match\n    //    is treated as a collision.\n    if (isMVOutput?.(spec.name) || isOverlayName?.(spec.name)) {\n      throw new OverlayNameCollisionError(spec.name)\n    }\n    // (We don't check isKnownCollection for `name` collision because\n    // virtual names are typically NOT pre-existing — they're created\n    // by the overlay declaration itself. Future versions may tighten.)\n\n    // 2. base must be concrete: NOT another overlay's virtual name.\n    if (isOverlayName?.(spec.base)) {\n      throw new OverlayBaseIsVirtualError(spec.name, spec.base)\n    }\n\n    // 3. overlay must be available: a real, vault-known collection\n    //    that is NOT an MV output (since MVs own their outputs).\n    if (isMVOutput?.(spec.overlay)) {\n      throw new OverlayCollectionUnavailableError(spec.name, spec.overlay)\n    }\n    // Best-effort known-collection check — when the vault can answer\n    // it. Unknown collections aren't a hard failure (the overlay may\n    // be implicitly created on first write), so we only throw on the\n    // MV-output case above.\n    void isKnownCollection\n\n    this._byName.set(spec.name, spec)\n  }\n\n  byName(name: string): OverlayedViewStrategy | undefined {\n    return this._byName.get(name)\n  }\n\n  /** All overlay virtual names. */\n  names(): ReadonlySet<string> {\n    return new Set(this._byName.keys())\n  }\n\n  isOverlay(name: string): boolean {\n    return this._byName.has(name)\n  }\n\n  /**\n   * All registered overlay strategies as a flat array.\n   * Each strategy carries `name`, `base`, and `overlay` fields that\n   * `describeOverlays()` in the introspection walker reads directly.\n   *\n   * Used by `dumpSchema()` to populate the `overlayViews` map.\n   */\n  all(): ReadonlyArray<OverlayedViewStrategy> {\n    return [...this._byName.values()]\n  }\n\n  /**\n   * Resolve the `rowKey` function for an overlay's base MV. Returns\n   * `undefined` if the base isn't an MV (raw source collection) or\n   * if the MV registry isn't supplied. Used by the virtual-collection\n   * proxy to derive ids from `put(record)` calls.\n   */\n  resolveBaseRowKey(\n    name: string,\n    mvRegistry: MaterializedViewRegistry | null,\n  ): ((row: Record<string, unknown>) => string) | undefined {\n    const spec = this._byName.get(name)\n    if (!spec || !mvRegistry) return undefined\n    // The base might be an MV's `output.collection` OR the MV's `name`\n    // (when no output.collection is declared). Search by both.\n    for (const reg of mvRegistry.all()) {\n      if (reg.outputCollection === spec.base || reg.spec.name === spec.base) {\n        return (row) => reg.spec.rowKey(row)\n      }\n    }\n    return undefined\n  }\n}\n"],"mappings":";;;;;;;AAeO,IAAM,wBAAN,MAA4B;AAAA,EAChB,UAAU,oBAAI,IAAmC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlE,SACE,MACA,SAKM;AACN,UAAM,EAAE,eAAe,YAAY,kBAAkB,IAAI;AAMzD,QAAI,aAAa,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI,GAAG;AACzD,YAAM,IAAI,0BAA0B,KAAK,IAAI;AAAA,IAC/C;AAMA,QAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,YAAM,IAAI,0BAA0B,KAAK,MAAM,KAAK,IAAI;AAAA,IAC1D;AAIA,QAAI,aAAa,KAAK,OAAO,GAAG;AAC9B,YAAM,IAAI,kCAAkC,KAAK,MAAM,KAAK,OAAO;AAAA,IACrE;AAKA,SAAK;AAEL,SAAK,QAAQ,IAAI,KAAK,MAAM,IAAI;AAAA,EAClC;AAAA,EAEA,OAAO,MAAiD;AACtD,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA,EAGA,QAA6B;AAC3B,WAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,CAAC;AAAA,EACpC;AAAA,EAEA,UAAU,MAAuB;AAC/B,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAA4C;AAC1C,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBACE,MACA,YACwD;AACxD,UAAM,OAAO,KAAK,QAAQ,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ,CAAC,WAAY,QAAO;AAGjC,eAAW,OAAO,WAAW,IAAI,GAAG;AAClC,UAAI,IAAI,qBAAqB,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,MAAM;AACrE,eAAO,CAAC,QAAQ,IAAI,KAAK,OAAO,GAAG;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-J66GRPNH.js → chunk-6S7T6WC4.js}

@@ -1,4 +1,4 @@
-// src/crdt/crdt.ts
+// src/with-commit/crdt/crdt.ts
 function resolveCrdtSnapshot(state) {
   switch (state._crdt) {
     case "lww-map": {
@@ -108,4 +108,4 @@ export {
   buildLwwMapState,
   buildRgaState
 };
-//# sourceMappingURL=chunk-J66GRPNH.js.map
+//# sourceMappingURL=chunk-6S7T6WC4.js.map

package/dist/chunk-6S7T6WC4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/crdt/crdt.ts"],"sourcesContent":["/**\n * CRDT state types, merge logic, and build helpers.\n * per-collection CRDT mode: 'lww-map' | 'rga' | 'yjs'\n *\n * The encrypted envelope wraps the CRDT state (not the resolved snapshot).\n * Adapters only ever see ciphertext. `collection.get(id)` returns the\n * resolved snapshot; `collection.getRaw(id)` returns the full CRDT state.\n */\n\n// Hoisted to kernel/types.ts (C3 — enclave self-containment: record-codec.ts\n// consumes this as a spine-owned contract type). Re-exported here so existing\n// importers of this module are unaffected.\nimport type { CrdtState } from '../../kernel/types.js'\nexport type { CrdtMode, CrdtState } from '../../kernel/types.js'\n\n// ─── State shapes ─────────────────────────────────────────────────────\n\n/**\n * Per-field last-write-wins registers.\n * Each field carries its latest value and the ISO timestamp of the last write.\n * Merge: for each field, keep the entry with the lexicographically higher `ts`.\n */\nexport interface LwwMapState {\n  readonly _crdt: 'lww-map'\n  readonly fields: Record<string, { readonly v: unknown; readonly ts: string }>\n}\n\n/**\n * Simplified Replicated Growable Array.\n * Items are assigned stable NID (noy-db id) strings on first insertion.\n * Deleted items are tracked as tombstones so concurrent removals commute.\n *\n * The resolved snapshot is the ordered list of non-tombstoned `v` values.\n */\nexport interface RgaState {\n  readonly _crdt: 'rga'\n  readonly items: ReadonlyArray<{ readonly nid: string; readonly v: unknown }>\n  readonly tombstones: readonly string[]\n}\n\n/**\n * Yjs binary state marker. `update` is base64(Y.encodeStateAsUpdate()).\n * Core stores and retrieves the blob opaquely. `@noy-db/yjs` is responsible\n * for encoding, decoding, and merging via `Y.mergeUpdates`.\n * Core falls back to last-write-wins (higher `_v`) for conflict resolution.\n */\nexport interface YjsState {\n  readonly _crdt: 'yjs'\n  /** base64-encoded Y.encodeStateAsUpdate() bytes. */\n  readonly update: string\n}\n\n// ─── Snapshot resolution ──────────────────────────────────────────────\n\n/**\n * Resolve a CRDT state into the end-user record snapshot.\n *\n * - `lww-map` → `Record<string, unknown>` (field values extracted from registers)\n * - `rga`     → `unknown[]` (non-tombstoned items in insertion order)\n * - `yjs`     → `string` (base64 update blob; use @noy-db/yjs for a Y.Doc)\n */\nexport function resolveCrdtSnapshot(state: CrdtState): unknown {\n  switch (state._crdt) {\n    case 'lww-map': {\n      const result: Record<string, unknown> = {}\n      for (const [field, reg] of Object.entries(state.fields)) {\n        result[field] = reg.v\n      }\n      return result\n    }\n    case 'rga': {\n      const dead = new Set(state.tombstones)\n      return state.items.filter(i => !dead.has(i.nid)).map(i => i.v)\n    }\n    case 'yjs':\n      return state.update\n  }\n}\n\n// ─── CRDT merge ───────────────────────────────────────────────────────\n\n/**\n * Merge two CRDT states produced by concurrent writes.\n * Called by the collection-level conflict resolver registered with SyncEngine.\n *\n * For `yjs`: core cannot merge Yjs without importing the `yjs` package.\n * The caller must handle that case by falling back to the higher-`_v` envelope.\n */\nexport function mergeCrdtStates(a: CrdtState, b: CrdtState): CrdtState {\n  // Mismatched modes shouldn't happen in practice — same collection, same schema.\n  if (a._crdt !== b._crdt) return a\n\n  switch (a._crdt) {\n    case 'lww-map':\n      return mergeLwwMap(a, b as LwwMapState)\n    case 'rga':\n      return mergeRga(a, b as RgaState)\n    case 'yjs':\n      // Signal to caller that Yjs merge is needed externally\n      return a\n  }\n}\n\nfunction mergeLwwMap(a: LwwMapState, b: LwwMapState): LwwMapState {\n  const merged: Record<string, { v: unknown; ts: string }> = {}\n  const allFields = new Set([...Object.keys(a.fields), ...Object.keys(b.fields)])\n  for (const field of allFields) {\n    const fa = a.fields[field]\n    const fb = b.fields[field]\n    if (!fa) { merged[field] = fb! }\n    else if (!fb) { merged[field] = fa }\n    else { merged[field] = fa.ts >= fb.ts ? fa : fb }\n  }\n  return { _crdt: 'lww-map', fields: merged }\n}\n\nfunction mergeRga(a: RgaState, b: RgaState): RgaState {\n  // Union tombstones from both sides\n  const allTombstones = new Set([...a.tombstones, ...b.tombstones])\n  // Union items by nid: start with a's ordering, append b-only items\n  const seenNids = new Set(a.items.map(i => i.nid))\n  const merged: Array<{ nid: string; v: unknown }> = [\n    ...a.items,\n    ...b.items.filter(i => !seenNids.has(i.nid)),\n  ]\n  return { _crdt: 'rga', items: merged, tombstones: [...allTombstones] }\n}\n\n// ─── Build helpers ────────────────────────────────────────────────────\n\n/**\n * Build (or update) an lww-map state from a new record.\n *\n * All fields in the new record win at timestamp `now`.\n * Fields present in the existing state but absent from the new record\n * are preserved (they were written by another device).\n */\nexport function buildLwwMapState(\n  record: Record<string, unknown>,\n  existing: LwwMapState | undefined,\n  now: string,\n): LwwMapState {\n  const fields: Record<string, { v: unknown; ts: string }> = {}\n\n  // New record fields all get the current timestamp — this device wins for these\n  for (const [field, value] of Object.entries(record)) {\n    fields[field] = { v: value, ts: now }\n  }\n\n  // Preserve fields from the existing state that aren't in the new record\n  if (existing) {\n    for (const [field, reg] of Object.entries(existing.fields)) {\n      if (!(field in fields)) {\n        fields[field] = reg\n      }\n    }\n  }\n\n  return { _crdt: 'lww-map', fields }\n}\n\n/**\n * Build (or update) an RGA state from a new array.\n *\n * Existing items are matched to new elements by deep-equality of their `v`.\n * Unmatched existing items are tombstoned. New elements that have no existing\n * match get a fresh NID via `generateNid()`.\n */\nexport function buildRgaState(\n  arr: unknown[],\n  existing: RgaState | undefined,\n  generateNid: () => string,\n): RgaState {\n  // Build an index from JSON(v) → existing item so we can match by value\n  const existingByValue = new Map<string, { nid: string; v: unknown }>()\n  if (existing) {\n    for (const item of existing.items) {\n      // Only add first occurrence per value to avoid double-matching\n      const key = JSON.stringify(item.v)\n      if (!existingByValue.has(key)) existingByValue.set(key, item)\n    }\n  }\n\n  const usedNids = new Set<string>()\n  const newItems: Array<{ nid: string; v: unknown }> = []\n\n  for (const el of arr) {\n    const key = JSON.stringify(el)\n    const match = existingByValue.get(key)\n    if (match && !usedNids.has(match.nid)) {\n      // Reuse existing NID to preserve cross-device identity\n      newItems.push(match)\n      usedNids.add(match.nid)\n    } else {\n      // New element — assign a fresh NID\n      const nid = generateNid()\n      newItems.push({ nid, v: el })\n      usedNids.add(nid)\n    }\n  }\n\n  // Elements in the existing state that aren't in the new array → tombstone.\n  // Tombstoned items are kept in the items array to preserve ordering for\n  // cross-device merge — the resolved snapshot filters them out.\n  const tombstones: string[] = existing ? [...existing.tombstones] : []\n  const extraItems: Array<{ nid: string; v: unknown }> = []\n  if (existing) {\n    for (const item of existing.items) {\n      if (!usedNids.has(item.nid)) {\n        if (!tombstones.includes(item.nid)) tombstones.push(item.nid)\n        extraItems.push(item) // retain in items for ordering\n      }\n    }\n  }\n\n  // Final items: live items in new order, then tombstoned extras at the end\n  const items = [...newItems, ...extraItems]\n\n  return { _crdt: 'rga', items, tombstones }\n}\n"],"mappings":";AA6DO,SAAS,oBAAoB,OAA2B;AAC7D,UAAQ,MAAM,OAAO;AAAA,IACnB,KAAK,WAAW;AACd,YAAM,SAAkC,CAAC;AACzC,iBAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACvD,eAAO,KAAK,IAAI,IAAI;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,OAAO;AACV,YAAM,OAAO,IAAI,IAAI,MAAM,UAAU;AACrC,aAAO,MAAM,MAAM,OAAO,OAAK,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,OAAK,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,KAAK;AACH,aAAO,MAAM;AAAA,EACjB;AACF;AAWO,SAAS,gBAAgB,GAAc,GAAyB;AAErE,MAAI,EAAE,UAAU,EAAE,MAAO,QAAO;AAEhC,UAAQ,EAAE,OAAO;AAAA,IACf,KAAK;AACH,aAAO,YAAY,GAAG,CAAgB;AAAA,IACxC,KAAK;AACH,aAAO,SAAS,GAAG,CAAa;AAAA,IAClC,KAAK;AAEH,aAAO;AAAA,EACX;AACF;AAEA,SAAS,YAAY,GAAgB,GAA6B;AAChE,QAAM,SAAqD,CAAC;AAC5D,QAAM,YAAY,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9E,aAAW,SAAS,WAAW;AAC7B,UAAM,KAAK,EAAE,OAAO,KAAK;AACzB,UAAM,KAAK,EAAE,OAAO,KAAK;AACzB,QAAI,CAAC,IAAI;AAAE,aAAO,KAAK,IAAI;AAAA,IAAI,WACtB,CAAC,IAAI;AAAE,aAAO,KAAK,IAAI;AAAA,IAAG,OAC9B;AAAE,aAAO,KAAK,IAAI,GAAG,MAAM,GAAG,KAAK,KAAK;AAAA,IAAG;AAAA,EAClD;AACA,SAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;AAC5C;AAEA,SAAS,SAAS,GAAa,GAAuB;AAEpD,QAAM,gBAAgB,oBAAI,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,EAAE,UAAU,CAAC;AAEhE,QAAM,WAAW,IAAI,IAAI,EAAE,MAAM,IAAI,OAAK,EAAE,GAAG,CAAC;AAChD,QAAM,SAA6C;AAAA,IACjD,GAAG,EAAE;AAAA,IACL,GAAG,EAAE,MAAM,OAAO,OAAK,CAAC,SAAS,IAAI,EAAE,GAAG,CAAC;AAAA,EAC7C;AACA,SAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,GAAG,aAAa,EAAE;AACvE;AAWO,SAAS,iBACd,QACA,UACA,KACa;AACb,QAAM,SAAqD,CAAC;AAG5D,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,WAAO,KAAK,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI;AAAA,EACtC;AAGA,MAAI,UAAU;AACZ,eAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAC1D,UAAI,EAAE,SAAS,SAAS;AACtB,eAAO,KAAK,IAAI;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,WAAW,OAAO;AACpC;AASO,SAAS,cACd,KACA,UACA,aACU;AAEV,QAAM,kBAAkB,oBAAI,IAAyC;AACrE,MAAI,UAAU;AACZ,eAAW,QAAQ,SAAS,OAAO;AAEjC,YAAM,MAAM,KAAK,UAAU,KAAK,CAAC;AACjC,UAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,iBAAgB,IAAI,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AAEA,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,WAA+C,CAAC;AAEtD,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,KAAK,UAAU,EAAE;AAC7B,UAAM,QAAQ,gBAAgB,IAAI,GAAG;AACrC,QAAI,SAAS,CAAC,SAAS,IAAI,MAAM,GAAG,GAAG;AAErC,eAAS,KAAK,KAAK;AACnB,eAAS,IAAI,MAAM,GAAG;AAAA,IACxB,OAAO;AAEL,YAAM,MAAM,YAAY;AACxB,eAAS,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC;AAC5B,eAAS,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AAKA,QAAM,aAAuB,WAAW,CAAC,GAAG,SAAS,UAAU,IAAI,CAAC;AACpE,QAAM,aAAiD,CAAC;AACxD,MAAI,UAAU;AACZ,eAAW,QAAQ,SAAS,OAAO;AACjC,UAAI,CAAC,SAAS,IAAI,KAAK,GAAG,GAAG;AAC3B,YAAI,CAAC,WAAW,SAAS,KAAK,GAAG,EAAG,YAAW,KAAK,KAAK,GAAG;AAC5D,mBAAW,KAAK,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,QAAQ,CAAC,GAAG,UAAU,GAAG,UAAU;AAEzC,SAAO,EAAE,OAAO,OAAO,OAAO,WAAW;AAC3C;","names":[]}

package/dist/{chunk-U26HQ6KJ.js → chunk-7BWJHO2A.js}

@@ -1,8 +1,8 @@
 import {
   TierNotGrantedError
-} from "./chunk-B6PB7JLN.js";
+} from "./chunk-S7VFUQM2.js";
 
-// src/team/tiers.ts
+// src/with-party/team/tiers.ts
 function dekKey(collection, tier) {
   if (tier <= 0) return collection;
   return `${collection}#${tier}`;
@@ -20,7 +20,7 @@ function effectiveClearance(keyring, collection) {
 }
 function assertTierAccess(keyring, collection, tier) {
   if (tier <= 0) return;
-  if (keyring.role === "owner" || keyring.role === "admin") return;
+  if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
   if (!keyring.deks.has(dekKey(collection, tier))) {
     throw new TierNotGrantedError(collection, tier);
   }
@@ -31,4 +31,4 @@ export {
   effectiveClearance,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-U26HQ6KJ.js.map
+//# sourceMappingURL=chunk-7BWJHO2A.js.map

package/dist/chunk-7BWJHO2A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/tiers.ts"],"sourcesContent":["/**\n * Hierarchical access — tier-aware keyring helpers.\n *\n * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by\n * collection name. extends the key space:\n *\n *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)\n *   `'invoices#1'`    — tier-1 DEK\n *   `'invoices#2'`    — tier-2 DEK\n *\n * Tier 0 keeps the bare collection name so any keyring written\n * before tiers existed loads without migration. Tiers ≥ 1 use `#N`\n * suffixes that\n * would be invalid as user-supplied collection names (see\n * `ReservedCollectionNameError` — `#` is reserved).\n *\n * @module\n */\n\nimport type { UnlockedKeyring } from './keyring.js'\nimport { TierNotGrantedError } from '../../kernel/errors.js'\n\n/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */\nexport function dekKey(collection: string, tier: number): string {\n  if (tier <= 0) return collection\n  return `${collection}#${tier}`\n}\n\n/**\n * Returns the user's effective clearance for a given collection: the\n * maximum tier for which their keyring holds a DEK. Falls back to 0\n * when the user has only the tier-0 DEK (or none — the getDEK caller\n * will raise separately).\n */\nexport function effectiveClearance(keyring: UnlockedKeyring, collection: string): number {\n  let max = 0\n  const prefix = `${collection}#`\n  for (const key of keyring.deks.keys()) {\n    if (!key.startsWith(prefix)) continue\n    const suffix = key.slice(prefix.length)\n    const n = Number.parseInt(suffix, 10)\n    if (Number.isFinite(n) && n > max) max = n\n  }\n  return max\n}\n\n/**\n * Assert the caller is cleared for the requested tier. Owners and\n * admins always pass (they can mint any new tier DEK on demand);\n * other roles must already hold the tier DEK — via a prior grant or\n * an active delegation — otherwise this throws `TierNotGrantedError`.\n *\n * This gate runs BEFORE `getDEK()` on the mutation path so a\n * non-cleared operator never has the opportunity to silently\n * auto-create a tier DEK they shouldn't have.\n */\nexport function assertTierAccess(\n  keyring: UnlockedKeyring,\n  collection: string,\n  tier: number,\n): void {\n  if (tier <= 0) return\n  // FR-6: custodian operates every collection at every tier (admin-level\n  // operational authority), so it may mint a tier DEK on demand like admin.\n  if (keyring.role === 'owner' || keyring.role === 'admin' || keyring.role === 'custodian') return\n  if (!keyring.deks.has(dekKey(collection, tier))) {\n    throw new TierNotGrantedError(collection, tier)\n  }\n}\n"],"mappings":";;;;;AAuBO,SAAS,OAAO,YAAoB,MAAsB;AAC/D,MAAI,QAAQ,EAAG,QAAO;AACtB,SAAO,GAAG,UAAU,IAAI,IAAI;AAC9B;AAQO,SAAS,mBAAmB,SAA0B,YAA4B;AACvF,MAAI,MAAM;AACV,QAAM,SAAS,GAAG,UAAU;AAC5B,aAAW,OAAO,QAAQ,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAC7B,UAAM,SAAS,IAAI,MAAM,OAAO,MAAM;AACtC,UAAM,IAAI,OAAO,SAAS,QAAQ,EAAE;AACpC,QAAI,OAAO,SAAS,CAAC,KAAK,IAAI,IAAK,OAAM;AAAA,EAC3C;AACA,SAAO;AACT;AAYO,SAAS,iBACd,SACA,YACA,MACM;AACN,MAAI,QAAQ,EAAG;AAGf,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,SAAS,YAAa;AAC1F,MAAI,CAAC,QAAQ,KAAK,IAAI,OAAO,YAAY,IAAI,CAAC,GAAG;AAC/C,UAAM,IAAI,oBAAoB,YAAY,IAAI;AAAA,EAChD;AACF;","names":[]}

package/dist/chunk-7P2SDJG3.js

@@ -0,0 +1,279 @@
+import {
+  assertTierAccess,
+  dekKey
+} from "./chunk-7BWJHO2A.js";
+import {
+  rewrapBodyToDek
+} from "./chunk-MCHVVJIA.js";
+import {
+  decrypt,
+  encrypt,
+  unwrapCek
+} from "./chunk-3OPY6MK2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-YN5IAHN6.js";
+import {
+  TierDemoteDeniedError,
+  TiersNotEnabledError
+} from "./chunk-S7VFUQM2.js";
+
+// src/with-audit/tiers/active.ts
+function withTiers() {
+  return {
+    async putAtTier(ctx, id, record, tier, opts) {
+      const { putAtTier: putAtTier2 } = await import("./tiers/index.js");
+      return putAtTier2(ctx, id, record, tier, opts);
+    },
+    async getAtTier(ctx, id) {
+      const { getAtTier: getAtTier2 } = await import("./tiers/index.js");
+      return getAtTier2(ctx, id);
+    },
+    async listAtTier(ctx) {
+      const { listAtTier: listAtTier2 } = await import("./tiers/index.js");
+      return listAtTier2(ctx);
+    },
+    async elevate(ctx, id, toTier) {
+      const { elevate: elevate2 } = await import("./tiers/index.js");
+      return elevate2(ctx, id, toTier);
+    },
+    async demote(ctx, id, toTier) {
+      const { demote: demote2 } = await import("./tiers/index.js");
+      return demote2(ctx, id, toTier);
+    }
+  };
+}
+
+// src/with-audit/tiers/strategy.ts
+var NO_TIERS = {
+  async putAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async getAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async listAtTier() {
+    throw new TiersNotEnabledError();
+  },
+  async elevate() {
+    throw new TiersNotEnabledError();
+  },
+  async demote() {
+    throw new TiersNotEnabledError();
+  }
+};
+
+// src/with-audit/tiers/index.ts
+function assertTiersEnabled(ctx) {
+  if (!ctx.tiers) {
+    throw new Error(
+      `Collection "${ctx.name}": hierarchical tiers are not enabled. Pass { tiers: [0, 1, 2, \u2026] } to vault.collection() to opt in.`
+    );
+  }
+}
+function assertDeclaredTier(ctx, tier) {
+  if (tier < 0 || !Number.isInteger(tier)) {
+    throw new Error(`Collection "${ctx.name}": tier must be a non-negative integer, got ${tier}`);
+  }
+  if (tier === 0) return;
+  if (!ctx.tiers || !ctx.tiers.has(tier)) {
+    throw new Error(
+      `Collection "${ctx.name}": tier ${tier} is not declared in { tiers: [...] }`
+    );
+  }
+}
+function isElevatorOrOwner(ctx) {
+  return ctx.keyring.role === "owner" || ctx.keyring.role === "admin";
+}
+async function putAtTier(ctx, id, record, tier, opts) {
+  assertTiersEnabled(ctx);
+  assertDeclaredTier(ctx, tier);
+  assertTierAccess(ctx.keyring, ctx.name, tier);
+  const key = dekKey(ctx.name, tier);
+  const dek = await ctx.getDEK(key);
+  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  const version = existing ? existing._v + 1 : 1;
+  const json = JSON.stringify(record);
+  const { iv, data } = await encrypt(json, dek);
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _by: ctx.keyring.userId,
+    ...tier > 0 && { _tier: tier },
+    ...ctx.provenance && opts?.source !== void 0 ? { _source: opts.source, _sourceTs: opts.sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope);
+  if (tier > 0) {
+    ctx.emitCrossTierEvent({
+      actor: ctx.keyring.userId,
+      collection: ctx.name,
+      id,
+      tier,
+      authorization: opts?.elevation ? "elevation" : "inherent",
+      op: "put",
+      ts: envelope._ts,
+      ...opts?.elevation && {
+        reason: opts.elevation.reason,
+        elevatedFrom: opts.elevation.fromTier
+      }
+    });
+  }
+}
+async function getAtTier(ctx, id) {
+  assertTiersEnabled(ctx);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) return null;
+  const tier = envelope._tier ?? 0;
+  if (tier === 0) {
+    return ctx.codec.decryptRecord(envelope, { id });
+  }
+  const key = dekKey(ctx.name, tier);
+  if (!ctx.keyring.deks.has(key)) {
+    if (ctx.tierMode === "ghost") {
+      return { _ghost: true, _tier: tier };
+    }
+    return null;
+  }
+  const dek = await ctx.getDEK(key);
+  let plaintext;
+  let cek;
+  if (envelope._cek !== void 0) {
+    cek = await unwrapCek(envelope._cek, dek);
+    ctx.cekCache?.set(id, cek, 1);
+    plaintext = await decrypt(envelope._iv, envelope._data, cek);
+  } else {
+    plaintext = await decrypt(envelope._iv, envelope._data, dek);
+  }
+  let record = JSON.parse(plaintext);
+  if (envelope._sealed !== void 0) {
+    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id });
+  }
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier,
+    authorization: isElevatorOrOwner(ctx) ? "inherent" : "delegation",
+    op: "get",
+    ts: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return record;
+}
+async function listAtTier(ctx) {
+  assertTiersEnabled(ctx);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  const out = [];
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env) continue;
+    const tier = env._tier ?? 0;
+    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier));
+    if (!readable && ctx.tierMode === "invisibility") continue;
+    out.push({ id, tier, readable });
+  }
+  return out;
+}
+async function elevate(ctx, id, toTier) {
+  assertTiersEnabled(ctx);
+  assertDeclaredTier(ctx, toTier);
+  assertTierAccess(ctx.keyring, ctx.name, toTier);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
+  const fromTier = envelope._tier ?? 0;
+  if (toTier === fromTier) return;
+  if (toTier < fromTier) {
+    throw new Error(`Use demote() to lower the tier of "${id}" from ${fromTier} to ${toTier}`);
+  }
+  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier);
+  const fromKey = dekKey(ctx.name, fromTier);
+  const toKey = dekKey(ctx.name, toTier);
+  const fromDek = await ctx.getDEK(fromKey);
+  const toDek = await ctx.getDEK(toKey);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
+  const next = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: envelope._v + 1,
+    _ts: now,
+    _iv: body._iv,
+    _data: body._data,
+    _by: ctx.keyring.userId,
+    _tier: toTier,
+    _elevatedBy: ctx.keyring.userId,
+    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier: toTier,
+    authorization: "elevation",
+    op: "elevate",
+    ts: now
+  });
+}
+async function demote(ctx, id, toTier) {
+  assertTiersEnabled(ctx);
+  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`);
+  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
+  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
+  const fromTier = envelope._tier ?? 0;
+  if (toTier === fromTier) return;
+  if (toTier > fromTier) {
+    throw new Error(`Use elevate() to raise the tier of "${id}" from ${fromTier} to ${toTier}`);
+  }
+  const isOwner = ctx.keyring.role === "owner";
+  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId;
+  if (!isOwner && !isOriginalElevator) {
+    throw new TierDemoteDeniedError(id, fromTier);
+  }
+  assertTierAccess(ctx.keyring, ctx.name, fromTier);
+  if (toTier > 0) assertDeclaredTier(ctx, toTier);
+  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier));
+  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier));
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
+  const next = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: envelope._v + 1,
+    _ts: now,
+    _iv: body._iv,
+    _data: body._data,
+    _by: ctx.keyring.userId,
+    ...toTier > 0 && { _tier: toTier },
+    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+  };
+  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
+  ctx.emitCrossTierEvent({
+    actor: ctx.keyring.userId,
+    collection: ctx.name,
+    id,
+    tier: fromTier,
+    authorization: "elevation",
+    op: "demote",
+    ts: now
+  });
+}
+function classifySealedShred(ctx, live) {
+  return ctx.codec.classifySealedShred(live);
+}
+
+export {
+  withTiers,
+  NO_TIERS,
+  assertTiersEnabled,
+  assertDeclaredTier,
+  putAtTier,
+  getAtTier,
+  listAtTier,
+  elevate,
+  demote,
+  classifySealedShred
+};
+//# sourceMappingURL=chunk-7P2SDJG3.js.map