@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.2

package/dist/chunk-PSMV73A5.js

@@ -0,0 +1,117 @@
+import {
+  buildAccessibleBundle,
+  resolveAccessibleCollections
+} from "./chunk-HCIPRAGS.js";
+import {
+  sha256Hex
+} from "./chunk-5O3AOPDT.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-5TDJ56JE.js";
+import {
+  ReadOnlyError
+} from "./chunk-ZYUC53LT.js";
+
+// src/with-audit/portability/withdraw-accessible.ts
+var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
+var ENC = new TextEncoder();
+function randomId() {
+  const b = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+}
+async function freezeSnapshotOnly(vault, collections, opts) {
+  const { name: vaultName, adapter } = vault._introspectState();
+  const closure = [];
+  for (const c of collections) {
+    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id });
+  }
+  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`;
+  const snap = {};
+  for (const { collection, id } of closure) {
+    const env = await adapter.get(vaultName, collection, id);
+    if (env) (snap[collection] ??= {})[id] = env;
+  }
+  const frozenAt = (/* @__PURE__ */ new Date()).toISOString();
+  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap });
+  const sha = await sha256Hex(ENC.encode(body));
+  await adapter.put(
+    vaultName,
+    FROZEN_SNAPSHOTS_COLLECTION,
+    withdrawalId,
+    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: "", _data: body, _by: opts.actorUserId },
+    0
+  );
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: opts.actorUserId,
+    payloadHash: "",
+    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`
+  });
+  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt };
+}
+async function freezeAndDeleteClosure(vault, collections, opts) {
+  const snapshot = opts.disposition === "freeze" ? await freezeSnapshotOnly(vault, collections, {
+    actorUserId: opts.actorUserId,
+    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
+  }) : void 0;
+  const { name: vaultName, adapter } = vault._introspectState();
+  for (const c of collections) {
+    for (const id of await adapter.list(vaultName, c)) {
+      await vault.collection(c).delete(id);
+    }
+  }
+  return snapshot;
+}
+async function withdrawAccessibleData(vault, opts) {
+  const { keyring } = vault._introspectState();
+  const disposition = opts.disposition ?? "delete";
+  if (keyring.role === "owner" || keyring.role === "admin") {
+    throw new ReadOnlyError(
+      "unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition"
+    );
+  }
+  if (keyring.role === "custodian") {
+    throw new ReadOnlyError(
+      "a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim"
+    );
+  }
+  if (keyring.role === "client" || keyring.role === "viewer") {
+    throw new ReadOnlyError(
+      "read-only role cannot self-serve a destructive withdrawal \u2014 use requestWithdrawal (two-party)"
+    );
+  }
+  const collections = resolveAccessibleCollections(keyring, opts.scope, true);
+  if (!collections || collections.length === 0) {
+    throw new ReadOnlyError(
+      "unilateralWithdrawal requires rw access on the withdrawn collections \u2014 use requestWithdrawal for read-only scope"
+    );
+  }
+  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey);
+  const snapshot = await freezeAndDeleteClosure(vault, collections, {
+    disposition,
+    actorUserId: keyring.userId,
+    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
+  });
+  await vault._getLedgerOrNull()?.append({
+    op: "lifecycle",
+    collection: "",
+    id: "",
+    version: 0,
+    actor: keyring.userId,
+    payloadHash: "",
+    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`
+  });
+  return snapshot ? { bundle, snapshot } : { bundle };
+}
+
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  randomId,
+  freezeSnapshotOnly,
+  freezeAndDeleteClosure,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=chunk-PSMV73A5.js.map

package/dist/chunk-PSMV73A5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nexport const FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner passphrase. */\n  readonly reKey?: { readonly passphrase: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: '', _data: body, _by: opts.actorUserId },\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBO,IAAM,8BAA8B;AAC3C,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,UAAU,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,YAAY;AAAA,IAClG;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}

package/dist/chunk-PY4KJPYU.js

@@ -0,0 +1,9 @@
+// src/kernel/util/discriminant.ts
+function isDiscriminant(record, key, value) {
+  return record[key] === value;
+}
+
+export {
+  isDiscriminant
+};
+//# sourceMappingURL=chunk-PY4KJPYU.js.map

package/dist/chunk-PY4KJPYU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/util/discriminant.ts"],"sourcesContent":["/**\n * Type-guard helper for narrowing discriminated-union records.\n *\n * `Collection<T>` correctly threads `T` through `get` / `query` / `scan`, but\n * accessing member-specific fields after reading from a `Collection<Union>`\n * still requires a narrowing step in application code. In regular `.ts` files\n * a simple `if (r.kind === 'IV')` block narrows correctly; in vue-tsc /\n * template contexts the inline comparison is sometimes not enough, and the\n * helper below makes the guard portable and avoids `as unknown as …` casts.\n *\n * **Usage with Collection<T>**\n *\n * ```ts\n * import { isDiscriminant } from '@noy-db/hub'\n *\n * type IV = { kind: 'IV'; invoiceNo: string; amount: number }\n * type RE = { kind: 'RE'; receiptNo: string; paidAt: string }\n * type Receipt = IV | RE | ...\n *\n * const receipts = await vault.collection<Receipt>('receipts').query().toArray()\n *\n * // Filter approach — result is IV[], invoiceNo accessible without cast:\n * const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))\n * console.log(ivs[0].invoiceNo)\n *\n * // Branch approach:\n * for (const r of receipts) {\n *   if (isDiscriminant(r, 'kind', 'IV')) {\n *     console.log(r.invoiceNo)  // r: IV here\n *   }\n * }\n * ```\n *\n * @module\n */\n\n/**\n * Type-guard for narrowing a discriminated-union record by its discriminant.\n *\n * Returns `true` when `record[key] === value`, and narrows `record` to\n * `Extract<T, Record<K, V>>` — the exact union member(s) that carry that\n * discriminant value.\n *\n * The discriminant key is a parameter (not hardcoded to `'kind'`), so this\n * works with any field name: `'kind'`, `'type'`, `'tag'`, etc.\n *\n * @example\n *   const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))\n *   // ivs: IV[]  — invoiceNo accessible, no cast needed\n *\n * @typeParam T - The union type of the record (e.g. `Receipt`). Both type-alias\n *   unions and interface-extended unions work; use a `type` alias (`type Receipt = IV | RE`) for best\n *   results.\n * @typeParam K - The discriminant key (must be a key of `T`).\n * @typeParam V - The discriminant value to match. The `const` modifier ensures\n *   TypeScript infers the string literal (e.g. `'IV'`), not the full union\n *   `T[K]`, so the predicate resolves to the exact member type.\n */\nexport function isDiscriminant<\n  T,\n  K extends keyof T,\n  const V extends T[K],\n>(record: T, key: K, value: V): record is Extract<T, Record<K, V>> {\n  return (record as Record<PropertyKey, unknown>)[key as PropertyKey] === value\n}\n"],"mappings":";AA0DO,SAAS,eAId,QAAW,KAAQ,OAA8C;AACjE,SAAQ,OAAwC,GAAkB,MAAM;AAC1E;","names":[]}

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/{chunk-DE6GKS6G.js → chunk-Q7SS3IME.js}

@@ -1,31 +1,52 @@
+import {
+  sha256Hex
+} from "./chunk-5O3AOPDT.js";
 import {
   DerivationCycleError
-} from "./chunk-B6PB7JLN.js";
+} from "./chunk-ZYUC53LT.js";
 
-// src/derivations/strategy-hash.ts
-async function computeStrategyHash(source, outputKeys, derive) {
+// src/with-formula/derivations/strategy-hash.ts
+async function computeStrategyHash(source, outputKeys, derive, sources) {
   const canonical = JSON.stringify({
     source,
     outputs: [...outputKeys].sort(),
-    derive: derive.toString()
+    derive: derive.toString(),
+    // Declared sibling sources — adding/removing a trigger
+    // collection invalidates cached derived records. Omitted when empty
+    // so strategies without siblings keep their existing hash.
+    ...sources?.length ? { sources: [...sources].sort() } : {}
   });
   const bytes = new TextEncoder().encode(canonical);
-  const digest = await crypto.subtle.digest("SHA-256", bytes);
-  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return sha256Hex(bytes);
 }
 
-// src/derivations/registry.ts
+// src/with-formula/derivations/registry.ts
 var DerivationRegistry = class {
   _bySource = /* @__PURE__ */ new Map();
   _byOutput = /* @__PURE__ */ new Map();
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async register(spec) {
     const outputKeys = Object.keys(spec.outputs);
-    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive);
+    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources);
     const reg = { spec, strategyHash };
     const fromSource = this._bySource.get(spec.source);
     if (fromSource) fromSource.push(reg);
     else this._bySource.set(spec.source, [reg]);
+    for (const extra of spec.sources ?? []) {
+      const fromExtra = this._bySource.get(extra);
+      if (fromExtra) fromExtra.push(reg);
+      else this._bySource.set(extra, [reg]);
+    }
+    for (const t of spec.triggerBy ?? []) {
+      const fromTrigger = this._bySource.get(t.collection);
+      if (fromTrigger) fromTrigger.push(reg);
+      else this._bySource.set(t.collection, [reg]);
+    }
+    if (spec.rollup) {
+      const fromRollup = this._bySource.get(spec.rollup.from);
+      if (fromRollup) fromRollup.push(reg);
+      else this._bySource.set(spec.rollup.from, [reg]);
+    }
     for (const key of outputKeys) {
       const output = spec.outputs[key];
       if (!output) continue;
@@ -41,6 +62,23 @@ var DerivationRegistry = class {
   strategiesProducingOutput(collection) {
     return this._byOutput.get(collection) ?? [];
   }
+  /**
+   * All registered strategies as a flat, deduplicated array.
+   * Each strategy is indexed once per source (not once per output key),
+   * so iterating `_bySource.values()` naturally yields each strategy
+   * exactly once per source — deduplication is handled by flattening
+   * the per-source arrays and collecting into a Set by identity.
+   *
+   * Used by `dumpSchema()` / `describeDerivations()` in the introspection
+   * walker to populate the derivations map.
+   */
+  all() {
+    const seen = /* @__PURE__ */ new Set();
+    for (const strategies of this._bySource.values()) {
+      for (const s of strategies) seen.add(s);
+    }
+    return [...seen];
+  }
   /**
    * Cycle detection over the source → output → … graph. Call after all
    * `register()` calls complete (i.e. at vault open). Throws
@@ -62,6 +100,9 @@ var DerivationRegistry = class {
           for (const key of Object.keys(s.spec.outputs)) {
             const output = s.spec.outputs[key];
             if (!output) continue;
+            if (output.shape === "record" && output.collection === s.spec.source && output.denorm !== void 0) {
+              continue;
+            }
             visit(output.collection);
           }
         }
@@ -76,4 +117,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-DE6GKS6G.js.map
+//# sourceMappingURL=chunk-Q7SS3IME.js.map

package/dist/chunk-Q7SS3IME.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/strategy-hash.ts","../src/with-formula/derivations/registry.ts"],"sourcesContent":["/**\n * Deterministic hash of a derivation strategy's \"shape\": source\n * collection, declared sibling sources, output keys, derive function\n * source. Used to detect\n * strategy drift: a record whose `_derivedFrom.strategyHash` doesn't\n * match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeStrategyHash(\n  source: string,\n  outputKeys: readonly string[],\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  derive: (...args: any[]) => any,\n  sources?: ReadonlyArray<string>,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    source,\n    outputs: [...outputKeys].sort(),\n    derive: derive.toString(),\n    // Declared sibling sources — adding/removing a trigger\n    // collection invalidates cached derived records. Omitted when empty\n    // so strategies without siblings keep their existing hash.\n    ...(sources?.length ? { sources: [...sources].sort() } : {}),\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n","import { DerivationCycleError } from '../../kernel/errors.js'\nimport { computeStrategyHash } from './strategy-hash.js'\nimport type { DerivationStrategy } from './types.js'\n\ninterface RegisteredStrategy {\n  // Type-erased to allow the registry to hold heterogeneous strategies.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: DerivationStrategy<any, any>\n  strategyHash: string\n}\n\n/**\n * Vault-internal registry of derivation strategies. Owned by `Vault`;\n * not exported.\n *\n * @internal\n */\nexport class DerivationRegistry {\n  private readonly _bySource = new Map<string, RegisteredStrategy[]>()\n  private readonly _byOutput = new Map<string, RegisteredStrategy[]>()\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async register(spec: DerivationStrategy<any, any>): Promise<void> {\n    const outputKeys = Object.keys(spec.outputs)\n    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources)\n    const reg: RegisteredStrategy = { spec, strategyHash }\n\n    const fromSource = this._bySource.get(spec.source)\n    if (fromSource) fromSource.push(reg)\n    else this._bySource.set(spec.source, [reg])\n\n    // Declared sibling sources index the SAME `reg` under each\n    // extra collection so `strategiesForSource(extra)` returns it and a\n    // sibling write re-fires the derivation. Sibling keys also enter\n    // `_bySource`, so `validate()`'s cycle DFS walks them automatically.\n    for (const extra of spec.sources ?? []) {\n      const fromExtra = this._bySource.get(extra)\n      if (fromExtra) fromExtra.push(reg)\n      else this._bySource.set(extra, [reg])\n    }\n\n    // FK triggers index the SAME `reg` under each parent collection so\n    // a parent write re-fires the derivation (fanned out to matching source\n    // records in `dispatchDerivations`). Like sources[], these keys enter\n    // `_bySource` so the cycle DFS walks the trigger→output edge.\n    for (const t of spec.triggerBy ?? []) {\n      const fromTrigger = this._bySource.get(t.collection)\n      if (fromTrigger) fromTrigger.push(reg)\n      else this._bySource.set(t.collection, [reg])\n    }\n\n    // Rollup: a write to the child `from` collection recomputes\n    // the parent (= spec.source = into) at id child[key]. Index under `from`\n    // so a child write fires it; spec.source (into) is already indexed above,\n    // so a parent write also recomputes its own aggregate (covers the\n    // parent-created-after-children case). The from→into edge enters the cycle\n    // DFS automatically.\n    if (spec.rollup) {\n      const fromRollup = this._bySource.get(spec.rollup.from)\n      if (fromRollup) fromRollup.push(reg)\n      else this._bySource.set(spec.rollup.from, [reg])\n    }\n\n    for (const key of outputKeys) {\n      const output = spec.outputs[key]\n      if (!output) continue\n      const outputCollection = output.collection\n      const arr = this._byOutput.get(outputCollection)\n      if (arr) arr.push(reg)\n      else this._byOutput.set(outputCollection, [reg])\n    }\n  }\n\n  strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy> {\n    return this._bySource.get(source) ?? []\n  }\n\n  strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy> {\n    return this._byOutput.get(collection) ?? []\n  }\n\n  /**\n   * All registered strategies as a flat, deduplicated array.\n   * Each strategy is indexed once per source (not once per output key),\n   * so iterating `_bySource.values()` naturally yields each strategy\n   * exactly once per source — deduplication is handled by flattening\n   * the per-source arrays and collecting into a Set by identity.\n   *\n   * Used by `dumpSchema()` / `describeDerivations()` in the introspection\n   * walker to populate the derivations map.\n   */\n  all(): ReadonlyArray<RegisteredStrategy> {\n    const seen = new Set<RegisteredStrategy>()\n    for (const strategies of this._bySource.values()) {\n      for (const s of strategies) seen.add(s)\n    }\n    return [...seen]\n  }\n\n  /**\n   * Cycle detection over the source → output → … graph. Call after all\n   * `register()` calls complete (i.e. at vault open). Throws\n   * `DerivationCycleError` on the first cycle found.\n   */\n  validate(): void {\n    const visited = new Set<string>()\n    const stack: string[] = []\n\n    const visit = (node: string): void => {\n      if (stack.includes(node)) {\n        const cycle = stack.slice(stack.indexOf(node)).concat(node)\n        throw new DerivationCycleError(cycle)\n      }\n      if (visited.has(node)) return\n      stack.push(node)\n      const strategies = this._bySource.get(node)\n      if (strategies) {\n        for (const s of strategies) {\n          for (const key of Object.keys(s.spec.outputs)) {\n            const output = s.spec.outputs[key]\n            if (!output) continue\n            // Self-write reverse-denorm: an output back to its own\n            // source is intentional, not an infinite cycle — the value-equality\n            // guard in dispatch terminates it. Skip this edge so it isn't\n            // flagged. (Self-write outputs are required to declare `denorm`.)\n            if (\n              output.shape === 'record' &&\n              output.collection === s.spec.source &&\n              output.denorm !== undefined\n            ) {\n              continue\n            }\n            visit(output.collection)\n          }\n        }\n      }\n      stack.pop()\n      visited.add(node)\n    }\n\n    for (const src of this._bySource.keys()) visit(src)\n  }\n}\n"],"mappings":";;;;;;;;AAWA,eAAsB,oBACpB,QACA,YAEA,QACA,SACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK;AAAA,IAC9B,QAAQ,OAAO,SAAS;AAAA;AAAA;AAAA;AAAA,IAIxB,GAAI,SAAS,SAAS,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;;;ACZO,IAAM,qBAAN,MAAyB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,YAAY,oBAAI,IAAkC;AAAA;AAAA,EAGnE,MAAM,SAAS,MAAmD;AAChE,UAAM,aAAa,OAAO,KAAK,KAAK,OAAO;AAC3C,UAAM,eAAe,MAAM,oBAAoB,KAAK,QAAQ,YAAY,KAAK,QAAQ,KAAK,OAAO;AACjG,UAAM,MAA0B,EAAE,MAAM,aAAa;AAErD,UAAM,aAAa,KAAK,UAAU,IAAI,KAAK,MAAM;AACjD,QAAI,WAAY,YAAW,KAAK,GAAG;AAAA,QAC9B,MAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC;AAM1C,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,YAAY,KAAK,UAAU,IAAI,KAAK;AAC1C,UAAI,UAAW,WAAU,KAAK,GAAG;AAAA,UAC5B,MAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,IACtC;AAMA,eAAW,KAAK,KAAK,aAAa,CAAC,GAAG;AACpC,YAAM,cAAc,KAAK,UAAU,IAAI,EAAE,UAAU;AACnD,UAAI,YAAa,aAAY,KAAK,GAAG;AAAA,UAChC,MAAK,UAAU,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;AAAA,IAC7C;AAQA,QAAI,KAAK,QAAQ;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI;AACtD,UAAI,WAAY,YAAW,KAAK,GAAG;AAAA,UAC9B,MAAK,UAAU,IAAI,KAAK,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,IACjD;AAEA,eAAW,OAAO,YAAY;AAC5B,YAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAI,CAAC,OAAQ;AACb,YAAM,mBAAmB,OAAO;AAChC,YAAM,MAAM,KAAK,UAAU,IAAI,gBAAgB;AAC/C,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,oBAAoB,QAAmD;AACrE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA,EAEA,0BAA0B,YAAuD;AAC/E,WAAO,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAyC;AACvC,UAAM,OAAO,oBAAI,IAAwB;AACzC,eAAW,cAAc,KAAK,UAAU,OAAO,GAAG;AAChD,iBAAW,KAAK,WAAY,MAAK,IAAI,CAAC;AAAA,IACxC;AACA,WAAO,CAAC,GAAG,IAAI;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAiB;AACf,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,QAAkB,CAAC;AAEzB,UAAM,QAAQ,CAAC,SAAuB;AACpC,UAAI,MAAM,SAAS,IAAI,GAAG;AACxB,cAAM,QAAQ,MAAM,MAAM,MAAM,QAAQ,IAAI,CAAC,EAAE,OAAO,IAAI;AAC1D,cAAM,IAAI,qBAAqB,KAAK;AAAA,MACtC;AACA,UAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,YAAM,KAAK,IAAI;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,IAAI;AAC1C,UAAI,YAAY;AACd,mBAAW,KAAK,YAAY;AAC1B,qBAAW,OAAO,OAAO,KAAK,EAAE,KAAK,OAAO,GAAG;AAC7C,kBAAM,SAAS,EAAE,KAAK,QAAQ,GAAG;AACjC,gBAAI,CAAC,OAAQ;AAKb,gBACE,OAAO,UAAU,YACjB,OAAO,eAAe,EAAE,KAAK,UAC7B,OAAO,WAAW,QAClB;AACA;AAAA,YACF;AACA,kBAAM,OAAO,UAAU;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI;AACV,cAAQ,IAAI,IAAI;AAAA,IAClB;AAEA,eAAW,OAAO,KAAK,UAAU,KAAK,EAAG,OAAM,GAAG;AAAA,EACpD;AACF;","names":[]}

package/dist/chunk-QHJW5EXU.js

@@ -0,0 +1,54 @@
+import {
+  QuiesceTimeoutError
+} from "./chunk-ZYUC53LT.js";
+
+// src/port/by/types.ts
+function isQuorum(writers, generation, excludeWriterId) {
+  return writers.filter((w) => w.writerId !== excludeWriterId).every((w) => w.quiescedAtVersion === generation);
+}
+async function runDrainBarrier(provider, o, run) {
+  await provider.setFence(o.vault, { currentSchemaVersion: o.generation, fenceState: "draining" });
+  await o.onFlush();
+  const deadline = o.now() + o.quiesceTimeoutMs;
+  const seeded = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
+  if (!isQuorum(seeded, o.generation, o.writerId)) {
+    await new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (fn) => {
+        if (!settled) {
+          settled = true;
+          unsub();
+          fn();
+        }
+      };
+      const unsub = provider.observePresence(o.vault, (writers) => {
+        if (isQuorum(writers, o.generation, o.writerId)) finish(resolve);
+      });
+      const tick = async () => {
+        if (settled) return;
+        if (o.now() >= deadline) {
+          finish(
+            () => reject(
+              new QuiesceTimeoutError(
+                `Cutover of vault "${o.vault}" to generation ${o.generation} timed out after ${o.quiesceTimeoutMs}ms waiting for active writers to quiesce.`
+              )
+            )
+          );
+          return;
+        }
+        if (o.onPoll) await o.onPoll();
+        const w = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
+        if (isQuorum(w, o.generation, o.writerId)) finish(resolve);
+        else setTimeout(() => void tick(), 25);
+      };
+      void tick();
+    });
+  }
+  await run();
+}
+
+export {
+  isQuorum,
+  runDrainBarrier
+};
+//# sourceMappingURL=chunk-QHJW5EXU.js.map

package/dist/chunk-QHJW5EXU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/by/types.ts"],"sourcesContent":["/**\n * Kernel coordination port — the injected `CoordinationProvider` seam for the\n * schema-fence drain-barrier.\n *\n * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement\n * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)\n * drives it through the `Noydb` handle without ever naming a `by-*` package.\n * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.\n *\n * This module carries only the port TYPES plus two pure-ish helpers:\n * {@link isQuorum} (a pure quorum predicate extracted from the legacy\n * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol\n * the migration cutover and klum both call).\n *\n * @module\n */\n\nimport { QuiesceTimeoutError } from '../../kernel/errors.js'\nimport type { Unsubscribe } from '../with/write-hooks.js'\n\n/** Vault fence state (the existing FenceDoc shape). */\nexport interface FenceState {\n  readonly currentSchemaVersion: number\n  readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete'\n}\n\n/** A writer's presence + ack, tagged with the session that owns it. */\nexport interface WriterPresence {\n  /** = today's clientId (one per tab/peer). */\n  readonly writerId: string\n  /** Groups one user's writers across vaults (consolidation is klum's job). */\n  readonly sessionId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n}\n\n/** Session-addressable drain-barrier coordination transport. Per-vault ops. */\nexport interface CoordinationProvider {\n  /** orchestrator → all writers */\n  setFence(vault: string, fence: FenceState): Promise<void>\n  /**\n   * Fresh one-shot fence read for the write-path gate (`assertWritable`).\n   * A direct read (not a cached `observeFence` snapshot) avoids a staleness\n   * window and keeps the timing-sensitive cutover gate exact. The store\n   * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.\n   */\n  readFence(vault: string): Promise<FenceState>\n  /** writer observes fence changes (default: poll-emit; by-*: push) */\n  observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe\n  /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */\n  reportPresence(vault: string, p: WriterPresence): Promise<void>\n  /** orchestrator observes presence changes (default: poll-emit; by-*: push) */\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe\n  /** orchestrator one-shot snapshot of reachable writers (quorum input) */\n  reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]>\n}\n\n/**\n * Pure quorum predicate: true when every writer (other than `excludeWriterId`)\n * has acked at exactly `generation`. An empty set is trivially a quorum.\n *\n * Extracted from the legacy `activeQuiesced` store-polling check so the\n * migration cutover, the store default provider, and `by-*` real-time\n * providers all share one definition of \"everyone has drained\".\n */\nexport function isQuorum(\n  writers: readonly WriterPresence[],\n  generation: number,\n  excludeWriterId?: string,\n): boolean {\n  return writers.filter((w) => w.writerId !== excludeWriterId).every((w) => w.quiescedAtVersion === generation)\n}\n\n/** Inputs for {@link runDrainBarrier}. */\nexport interface DrainBarrierOptions {\n  readonly vault: string\n  readonly generation: number\n  readonly writerId: string\n  readonly onFlush: () => Promise<void>\n  readonly staleMs: number\n  readonly quiesceTimeoutMs: number\n  readonly now: () => number\n  /** Optional seam (mainly for deterministic tests) run before each poll tick. */\n  readonly onPoll?: () => Promise<void>\n}\n\n/**\n * The reusable drain-barrier protocol shared by the migration cutover and klum:\n *\n *   drain self → setFence(draining) → await quorum (presence push + isQuorum,\n *   polling as a fallback, or timeout) → run() → release-by-caller.\n *\n * Resolves once every reachable writer (excluding `writerId`) has quiesced at\n * `generation`, at which point `run` is invoked exactly once. Rejects with\n * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.\n */\nexport async function runDrainBarrier(\n  provider: CoordinationProvider,\n  o: DrainBarrierOptions,\n  run: () => Promise<void>,\n): Promise<void> {\n  await provider.setFence(o.vault, { currentSchemaVersion: o.generation, fenceState: 'draining' })\n  await o.onFlush()\n\n  const deadline = o.now() + o.quiesceTimeoutMs\n  const seeded = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() })\n  if (!isQuorum(seeded, o.generation, o.writerId)) {\n    await new Promise<void>((resolve, reject) => {\n      let settled = false\n      const finish = (fn: () => void) => {\n        if (!settled) {\n          settled = true\n          unsub()\n          fn()\n        }\n      }\n      const unsub = provider.observePresence(o.vault, (writers) => {\n        if (isQuorum(writers, o.generation, o.writerId)) finish(resolve)\n      })\n      const tick = async () => {\n        if (settled) return\n        if (o.now() >= deadline) {\n          finish(() =>\n            reject(\n              new QuiesceTimeoutError(\n                `Cutover of vault \"${o.vault}\" to generation ${o.generation} timed out ` +\n                  `after ${o.quiesceTimeoutMs}ms waiting for active writers to quiesce.`,\n              ),\n            ),\n          )\n          return\n        }\n        if (o.onPoll) await o.onPoll()\n        const w = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() })\n        if (isQuorum(w, o.generation, o.writerId)) finish(resolve)\n        else setTimeout(() => void tick(), 25)\n      }\n      void tick()\n    })\n  }\n  await run()\n}\n"],"mappings":";;;;;AAiEO,SAAS,SACd,SACA,YACA,iBACS;AACT,SAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,aAAa,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,UAAU;AAC9G;AAyBA,eAAsB,gBACpB,UACA,GACA,KACe;AACf,QAAM,SAAS,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,YAAY,YAAY,WAAW,CAAC;AAC/F,QAAM,EAAE,QAAQ;AAEhB,QAAM,WAAW,EAAE,IAAI,IAAI,EAAE;AAC7B,QAAM,SAAS,MAAM,SAAS,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5F,MAAI,CAAC,SAAS,QAAQ,EAAE,YAAY,EAAE,QAAQ,GAAG;AAC/C,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,UAAI,UAAU;AACd,YAAM,SAAS,CAAC,OAAmB;AACjC,YAAI,CAAC,SAAS;AACZ,oBAAU;AACV,gBAAM;AACN,aAAG;AAAA,QACL;AAAA,MACF;AACA,YAAM,QAAQ,SAAS,gBAAgB,EAAE,OAAO,CAAC,YAAY;AAC3D,YAAI,SAAS,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAG,QAAO,OAAO;AAAA,MACjE,CAAC;AACD,YAAM,OAAO,YAAY;AACvB,YAAI,QAAS;AACb,YAAI,EAAE,IAAI,KAAK,UAAU;AACvB;AAAA,YAAO,MACL;AAAA,cACE,IAAI;AAAA,gBACF,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,UAAU,oBAChD,EAAE,gBAAgB;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,EAAE,OAAQ,OAAM,EAAE,OAAO;AAC7B,cAAM,IAAI,MAAM,SAAS,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,IAAI,EAAE,CAAC;AACvF,YAAI,SAAS,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAG,QAAO,OAAO;AAAA,YACpD,YAAW,MAAM,KAAK,KAAK,GAAG,EAAE;AAAA,MACvC;AACA,WAAK,KAAK;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,IAAI;AACZ;","names":[]}

package/dist/chunk-QZISFCVG.js

@@ -0,0 +1,233 @@
+import {
+  resolveManagedSecret
+} from "./chunk-ZCGAHGUS.js";
+import {
+  parseExtractedPartitionBody,
+  readPod,
+  readPodHeader
+} from "./chunk-FISN7WE4.js";
+import {
+  createOwnerKeyring
+} from "./chunk-WWGT2MDV.js";
+import {
+  LedgerStore
+} from "./chunk-LXQT4WMP.js";
+import {
+  LEDGER_COLLECTION
+} from "./chunk-I7FD46FF.js";
+import {
+  base64ToBuffer,
+  openEnvelopeJson,
+  wrapKey
+} from "./chunk-5O3AOPDT.js";
+import {
+  AdoptionStateError,
+  TransferSealError,
+  ValidationError
+} from "./chunk-ZYUC53LT.js";
+
+// src/with-cargo/adopt-partition.ts
+async function unsealDeks(seal, transferKey) {
+  if (transferKey.byteLength !== 32) {
+    throw new TransferSealError(
+      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
+    );
+  }
+  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
+  const raw = base64ToBuffer(seal.payload);
+  let plaintext;
+  try {
+    plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: raw.slice(0, 12) },
+      key,
+      raw.slice(12)
+    );
+  } catch {
+    throw new TransferSealError(
+      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
+    );
+  }
+  let dekMap;
+  try {
+    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
+  }
+  const deks = /* @__PURE__ */ new Map();
+  for (const [collection, b64] of Object.entries(dekMap)) {
+    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
+    deks.set(collection, dek);
+  }
+  return deks;
+}
+async function adoptPartition(bundleBytes, opts) {
+  const { transferKey, destinationStore, vaultName } = opts;
+  const header = readPodHeader(bundleBytes);
+  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
+    throw new ValidationError(
+      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readPod + vault.load."
+    );
+  }
+  const { dumpJson } = await readPod(bundleBytes);
+  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
+  await unsealDeks(seal, transferKey);
+  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
+  if (existing) {
+    const prior = JSON.parse(existing._data);
+    if (prior.sealId === seal.sealId) {
+      throw new AdoptionStateError(
+        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
+      );
+    }
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
+    );
+  }
+  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
+  if (existingKeyring.length > 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
+    );
+  }
+  const backup = JSON.parse(dump);
+  await destinationStore.saveAll(vaultName, backup.collections);
+  if (backup._internal) {
+    for (const [collection, records] of Object.entries(backup._internal)) {
+      for (const [id, envelope] of Object.entries(records)) {
+        await destinationStore.put(vaultName, collection, id, envelope);
+      }
+    }
+  }
+  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
+  await destinationStore.put(vaultName, "_meta", "adoption", {
+    _noydb: 1,
+    _v: 1,
+    _ts: adoptedAt,
+    _iv: "",
+    _data: JSON.stringify(adoption)
+  });
+  return { vaultName, needsOwner: true, sealId: seal.sealId };
+}
+function isManaged(o) {
+  return "passphraseMode" in o && o.passphraseMode === "managed";
+}
+async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
+  const { userId, transferKey } = opts;
+  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
+    throw new AdoptionStateError(
+      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
+    );
+  }
+  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
+  if (!adoptionEnv) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
+    );
+  }
+  const adoption = JSON.parse(adoptionEnv._data);
+  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
+    );
+  }
+  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
+  const existingKeyring = await store.get(vaultName, "_keyring", userId);
+  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
+  if (otherOwners.length > 0) {
+    throw new AdoptionStateError(
+      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
+    );
+  }
+  const partitionCollections = [...partitionDeks.keys()];
+  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
+  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
+  if (!ownerMinted) {
+    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
+    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
+    const env = await store.get(vaultName, "_keyring", userId);
+    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
+    const keyringFile = JSON.parse(env._data);
+    const kek = unlocked.kek;
+    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
+    const mergedDeks = { ...keyringFile.deks };
+    for (const [collection, dek] of partitionDeks) {
+      mergedDeks[collection] = await wrapKey(dek, kek);
+    }
+    const mergedFile = { ...keyringFile, deks: mergedDeks };
+    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
+  }
+  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
+  if (ledgerDek) {
+    const ledger = new LedgerStore({
+      adapter: store,
+      vault: vaultName,
+      encrypted: true,
+      getDEK: async () => ledgerDek,
+      actor: userId
+    });
+    const creationReason = `creation-of-new-owner:${userId}`;
+    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
+    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
+    if (!recordedReasons.has(creationReason)) {
+      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
+    }
+    if (!recordedReasons.has(consumedReason)) {
+      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
+    }
+  }
+  if (isManaged(opts)) {
+    const { createNoydb } = await import("./noydb-LDEBLNHY.js");
+    const db = await createNoydb({
+      store,
+      user: userId,
+      passphraseMode: "managed",
+      sealingKey: opts.sealingKey,
+      shamirRecovery: opts.shamirRecovery
+    });
+    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
+  }
+  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
+  return { vaultName, userId };
+}
+
+// src/with-cargo/decrypt-partition.ts
+async function decryptExtractedPartition(bundleBytes, transferKey) {
+  const header = readPodHeader(bundleBytes);
+  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
+    throw new Error("decryptExtractedPartition: bundle is not an extracted-partition.");
+  }
+  const { dumpJson } = await readPod(bundleBytes);
+  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
+  const deks = await unsealDeks(seal, transferKey);
+  const backup = JSON.parse(dump);
+  const out = {};
+  for (const [collection, byId] of Object.entries(backup.collections)) {
+    const dek = deks.get(collection);
+    if (dek === void 0) continue;
+    const recs = [];
+    for (const [id, env] of Object.entries(byId)) {
+      const plaintext = await openEnvelopeJson(env, dek);
+      const body = JSON.parse(plaintext);
+      recs.push({
+        id,
+        record: { ...body, id },
+        ts: env._ts,
+        version: env._v,
+        ...env._source !== void 0 ? { source: env._source } : {},
+        ...env._sourceTs !== void 0 ? { sourceTs: env._sourceTs } : {}
+      });
+    }
+    out[collection] = recs;
+  }
+  return out;
+}
+
+export {
+  unsealDeks,
+  adoptPartition,
+  createOwnerOnAdoptedPartition,
+  decryptExtractedPartition
+};
+//# sourceMappingURL=chunk-QZISFCVG.js.map