@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.2

package/dist/dev-unlock-BIoEFbwm.d.cts

@@ -1,263 +0,0 @@
-import { b0 as Role, b1 as UnlockedKeyring } from './types-DyXYr8rE.cjs';
-
-/**
- * Session tokens —
- *
- * After a vault is unlocked (via passphrase, WebAuthn, OIDC, or magic-
- * link), the caller can call `createSession()` to get a session token that
- * allows re-establishing the KEK for the session lifetime without re-running
- * PBKDF2 or any interactive auth challenge.
- *
- * Security model
- * ──────────────
- * A session consists of two pieces that must both be present to recover the
- * KEK:
- *
- *   1. The **session key** — a non-extractable AES-256-GCM CryptoKey that
- *      exists only in memory. "Non-extractable" is enforced by the WebCrypto
- *      API: the key object cannot be serialized, exported, or sent over
- *      postMessage. When the JS context is GC'd (tab close, navigation away,
- *      worker termination) the key becomes unrecoverable.
- *
- *   2. The **session token** — a JSON object that carries the KEK wrapped
- *      with the session key (AES-256-GCM, fresh IV per session), plus
- *      unencrypted session metadata (sessionId, userId, vault, role,
- *      expiresAt). The token can be serialized to JSON and stored in
- *      sessionStorage or passed across callsites within the same tab, but
- *      it is useless without the session key.
- *
- * The session key is kept in a module-level Map indexed by sessionId. Callers
- * that need to re-use a session must hold on to the sessionId returned from
- * `createSession()`; the key is looked up automatically by `resolveSession()`.
- *
- * Revocation: `revokeSession()` removes the entry from the Map. Because the
- * key is non-extractable, removal is sufficient — no one holds a serializable
- * copy of the key.
- *
- * Tab-scoped lifetime: the module-level Map lives only as long as the JS
- * module. Tab close → module unloaded → Map GC'd → all session keys gone.
- * This is the zero-effort logout: closing the tab is always a secure logout.
- *
- * Expiry: `createSession()` accepts a `ttlMs` option. `resolveSession()`
- * checks `expiresAt` and throws `SessionExpiredError` if the token is stale,
- * even if the session key is still in the Map.
- */
-
-/** The serializable part of a session token. Safe to store in sessionStorage. */
-interface SessionToken {
-    readonly _noydb_session: 1;
-    /** Unique session identifier (ULID). Use this as the handle for resolve/revoke. */
-    readonly sessionId: string;
-    readonly userId: string;
-    readonly vault: string;
-    readonly role: Role;
-    /** ISO timestamp — resolveSession() rejects this token after this time. */
-    readonly expiresAt: string;
-    /** KEK wrapped with the session key (AES-256-GCM). Base64. */
-    readonly wrappedKek: string;
-    /** IV used for the wrapping operation. Base64. */
-    readonly kekIv: string;
-}
-/** Result returned from `createSession()`. */
-interface CreateSessionResult {
-    /** Serializable token — store in sessionStorage or pass to `resolveSession()`. */
-    token: SessionToken;
-    /** The sessionId — use this handle for `resolveSession()` and `revokeSession()`. */
-    sessionId: string;
-}
-/** Options for `createSession()`. */
-interface CreateSessionOptions {
-    /**
-     * Session lifetime in milliseconds. Defaults to 60 minutes.
-     * After this duration, `resolveSession()` throws `SessionExpiredError`.
-     */
-    ttlMs?: number;
-}
-/**
- * Create a session for an already-unlocked keyring.
- *
- * Call this after any successful unlock (passphrase, WebAuthn, OIDC,
- * magic-link). The returned `sessionId` is the handle for later
- * `resolveSession()` and `revokeSession()` calls.
- *
- * The session key is generated fresh (non-extractable) and stored in the
- * module-level Map. The KEK from `keyring.kek` is exported (it must be
- * extractable — it was derived by `deriveKey()` which sets extractable: false,
- * but it's unwrapped from the keyring which sets extractable: true) and then
- * re-wrapped with the session key.
- *
- * @param keyring - An already-unlocked keyring whose `kek` is available.
- * @param vault - The vault name this session is scoped to.
- * @param options - Optional session configuration.
- */
-declare function createSession(keyring: UnlockedKeyring, vault: string, options?: CreateSessionOptions): Promise<CreateSessionResult>;
-/**
- * Resolve a session token back into an UnlockedKeyring.
- *
- * Looks up the session key by `sessionId`, checks the token is not expired,
- * then decrypts the payload to reconstruct the keyring's DEK set.
- *
- * Throws `SessionExpiredError` if the token's `expiresAt` is in the past.
- * Throws `SessionNotFoundError` if the session key is not in the store
- * (tab was reloaded, session was revoked, or the sessionId is wrong).
- *
- * @param token - The SessionToken from `createSession()`.
- */
-declare function resolveSession(token: SessionToken): Promise<UnlockedKeyring>;
-/**
- * Revoke a session by removing its key from the store.
- *
- * After revocation, `resolveSession()` will throw `SessionNotFoundError`
- * for this sessionId. The session token (if held by the caller) becomes
- * permanently useless. This is the explicit logout path.
- *
- * No-op if the session was already expired or does not exist.
- */
-declare function revokeSession(sessionId: string): void;
-/**
- * Check if a session is still alive (key in store + not expired).
- * Does not decrypt anything — purely a metadata check.
- */
-declare function isSessionAlive(token: SessionToken): boolean;
-/**
- * Revoke all active sessions. Used by `Noydb.close()` to ensure that
- * closing the instance destroys all session state, not just the keyring
- * cache.
- */
-declare function revokeAllSessions(): void;
-/**
- * Return the number of active sessions currently in the store.
- * Useful for diagnostics and tests.
- */
-declare function activeSessionCount(): number;
-
-/**
- * Dev-mode persistent unlock —
- *
- * Solves the developer inner-loop friction: hot-reload destroys the session
- * (page navigation semantics), forcing a passphrase re-entry every refresh.
- *
- * This module provides an opt-in, deliberately-named escape hatch that lets
- * developers store the keyring payload in sessionStorage or localStorage so
- * the vault auto-unlocks on every page load — without a passphrase,
- * without a biometric prompt, without any OIDC flow.
- *
- * ⚠️ WARNING — this is a loaded footgun ⚠️
- * ─────────────────────────────────────────
- * The keyring payload stored by this module contains the DEKs. Whoever has
- * access to sessionStorage/localStorage has access to the DEKs. On a shared
- * development machine, a compromised browser extension, or a mis-configured
- * origin, this is a complete key exposure.
- *
- * This module is ONLY safe for local development. It must NEVER be active
- * in production builds.
- *
- * Guardrails (all enforced by the module, not by the caller)
- * ──────────────────────────────────────────────────────────
- * 1. **Production guard:** `enableDevUnlock()` throws immediately if
- *    `process.env.NODE_ENV === 'production'` or if `import.meta.env?.PROD === true`
- *    (Vite convention). Also throws if the hostname is NOT localhost or 127.0.0.1.
- *
- * 2. **Explicit acknowledgement string:** the caller must pass
- *    `acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'` or the call
- *    throws. This string appears in every grep for `devUnlock` in the codebase,
- *    making it impossible to enable this feature accidentally.
- *
- * 3. **Scope is vault + userId:** the storage key includes both the
- *    vault name and the userId, so dev-unlock for vault-A does
- *    NOT auto-unlock vault-B.
- *
- * 4. **Storage scope:** default is `sessionStorage` (cleared on tab close).
- *    `localStorage` is opt-in and requires an additional
- *    `persistAcrossTabs: true` flag in the options.
- *
- * 5. **Clear method:** `clearDevUnlock()` removes the stored payload. Wire
- *    this to a dev toolbar button or `Ctrl+Shift+L` so clearing is one action.
- *
- * 6. **Console banner:** on first enable, a highly visible console warning
- *    fires. Cannot be suppressed.
- *
- * Usage
- * ─────
- * ```ts
- * // In your dev entry point only (guarded by import.meta.env.DEV):
- * if (import.meta.env.DEV) {
- *   const { enableDevUnlock, loadDevUnlock } = await import('@noy-db/hub')
- *   enableDevUnlock('my-compartment', 'alice', keyring, {
- *     acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY',
- *   })
- * }
- *
- * // On page load:
- * if (import.meta.env.DEV) {
- *   const keyring = await loadDevUnlock('my-compartment', 'alice')
- *   if (keyring) {
- *     // Skip unlock prompt, use keyring directly
- *   }
- * }
- * ```
- */
-
-interface DevUnlockOptions {
-    /**
-     * Required: the exact string 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'.
-     * Any other value causes `enableDevUnlock()` to throw.
-     */
-    acknowledge: string;
-    /**
-     * If `true`, stores in localStorage (persists across tabs and browser restarts).
-     * If `false` (default), stores in sessionStorage (cleared on tab close).
-     */
-    persistAcrossTabs?: boolean;
-}
-/**
- * Serialize and store a keyring to browser storage for dev-mode auto-unlock.
- *
- * Throws immediately if:
- *   - The acknowledge string is wrong.
- *   - Running in a production environment (NODE_ENV=production).
- *   - Running on a non-localhost hostname.
- *
- * Emits a highly visible console warning that cannot be suppressed.
- *
- * @param vault - The vault name.
- * @param userId - The user ID.
- * @param keyring - The unlocked keyring to persist.
- * @param options - Options including the required acknowledge string.
- */
-declare function enableDevUnlock(vault: string, userId: string, keyring: UnlockedKeyring, options: DevUnlockOptions): Promise<void>;
-/**
- * Load a dev-mode keyring from browser storage.
- *
- * Returns `null` if no dev-unlock state is stored for this vault + user,
- * or if the stored payload is malformed.
- *
- * Does NOT perform the production environment check — it's safe to CALL
- * `loadDevUnlock` in production (it will simply return `null` because no
- * dev-unlock state was ever written). The guard only fires on `enableDevUnlock`.
- *
- * @param vault - The vault name.
- * @param userId - The user ID.
- * @param options - Optional storage override.
- */
-declare function loadDevUnlock(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): Promise<UnlockedKeyring | null>;
-/**
- * Remove dev-unlock state from browser storage.
- *
- * Safe to call in production (no-op if no dev state exists).
- */
-declare function clearDevUnlock(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): void;
-/**
- * Check if dev-unlock state exists for this vault + user.
- *
- * Safe to call in production (returns false if nothing is stored).
- */
-declare function isDevUnlockActive(vault: string, userId: string, options?: {
-    persistAcrossTabs?: boolean;
-}): boolean;
-
-export { type CreateSessionOptions as C, type DevUnlockOptions as D, type SessionToken as S, type CreateSessionResult as a, activeSessionCount as b, clearDevUnlock as c, createSession as d, enableDevUnlock as e, isSessionAlive as f, revokeAllSessions as g, revokeSession as h, isDevUnlockActive as i, loadDevUnlock as l, resolveSession as r };

package/dist/executor-5PNY7LGW.js

@@ -1,8 +0,0 @@
-import {
-  GuardExecutor
-} from "./chunk-NONAAENK.js";
-import "./chunk-B6PB7JLN.js";
-export {
-  GuardExecutor
-};
-//# sourceMappingURL=executor-5PNY7LGW.js.map

package/dist/executor-B4QIYGZX.js

@@ -1,8 +0,0 @@
-import {
-  DerivationExecutor
-} from "./chunk-DO7C2TOG.js";
-import "./chunk-B6PB7JLN.js";
-export {
-  DerivationExecutor
-};
-//# sourceMappingURL=executor-B4QIYGZX.js.map

package/dist/executor-BWXXDQ7K.js

@@ -1,11 +0,0 @@
-import {
-  MaterializedViewExecutor
-} from "./chunk-O3VZPBZG.js";
-import "./chunk-T7JEBOGN.js";
-import "./chunk-5XHKQ56N.js";
-import "./chunk-TV3YZ35S.js";
-import "./chunk-B6PB7JLN.js";
-export {
-  MaterializedViewExecutor
-};
-//# sourceMappingURL=executor-BWXXDQ7K.js.map

package/dist/fanout-sidecar-OKPMMPLG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * Stored as plain JSON with AES-GCM bypassed (same pattern as\n * `_meta/policy`, `_meta/recovery-paper`, `_meta/sealed-passphrase`,\n * etc.): the sidecar is system metadata, not user data, and the\n * derived outputs themselves carry their own encryption envelopes.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../types.js'\nimport { NOYDB_FORMAT_VERSION } from '../types.js'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/** Read the sidecar; returns empty if absent. */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as FanoutSidecar\n    if (parsed._noydb_fanout !== 1) return undefined\n    if (!Array.isArray(parsed.keys)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/** Persist (insert/replace) the sidecar with a fresh key set. */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    // AES-GCM bypassed — sidecar is system metadata, no user data inside.\n    _iv: '',\n    _data: JSON.stringify(doc),\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;AAgDA,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAGA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,QAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,kBACpB,OACA,OACA,SAOe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA,IAE5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/guards/index.cjs

@@ -1,322 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/guards/index.ts
-var guards_exports = {};
-__export(guards_exports, {
-  AmendmentForbiddenError: () => AmendmentForbiddenError,
-  FieldFrozenError: () => FieldFrozenError,
-  GuardExecutor: () => GuardExecutor,
-  GuardRegistry: () => GuardRegistry,
-  InvariantError: () => InvariantError,
-  ReadOnlyVaultFacade: () => ReadOnlyVaultFacade,
-  RecordLockedError: () => RecordLockedError,
-  withGuard: () => withGuard
-});
-module.exports = __toCommonJS(guards_exports);
-
-// src/errors.ts
-var NoydbError = class extends Error {
-  /** Machine-readable error code. Stable across library versions. */
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "NoydbError";
-    this.code = code;
-  }
-};
-var RecordLockedError = class extends NoydbError {
-  collection;
-  id;
-  reason;
-  constructor(collection, id, reason) {
-    super(
-      "RECORD_LOCKED",
-      `Cannot modify ${collection}/${id} \u2014 locked by guard: ${reason}. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
-    );
-    this.name = "RecordLockedError";
-    this.collection = collection;
-    this.id = id;
-    this.reason = reason;
-  }
-};
-var FieldFrozenError = class extends NoydbError {
-  collection;
-  id;
-  fields;
-  constructor(collection, id, fields) {
-    super(
-      "FIELD_FROZEN",
-      `Cannot change frozen field(s) on ${collection}/${id}: ${fields.join(", ")}. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
-    );
-    this.name = "FieldFrozenError";
-    this.collection = collection;
-    this.id = id;
-    this.fields = fields;
-  }
-};
-var InvariantError = class extends NoydbError {
-  constructor(message) {
-    super("INVARIANT_VIOLATED", message);
-    this.name = "InvariantError";
-  }
-};
-var AmendmentForbiddenError = class extends NoydbError {
-  userId;
-  role;
-  constructor(userId, role) {
-    super(
-      "AMENDMENT_FORBIDDEN",
-      `User "${userId}" with role "${role}" cannot open an amendment transaction. Amendments require admin or owner role.`
-    );
-    this.name = "AmendmentForbiddenError";
-    this.userId = userId;
-    this.role = role;
-  }
-};
-var ValidationError = class extends NoydbError {
-  constructor(message = "Validation error") {
-    super("VALIDATION_ERROR", message);
-    this.name = "ValidationError";
-  }
-};
-
-// src/guards/with-guard.ts
-function withGuard(strategy) {
-  if (!strategy.collection || strategy.collection.length === 0) {
-    throw new ValidationError("withGuard: collection name is required");
-  }
-  return {
-    __noydb_strategy: "guard",
-    spec: strategy
-  };
-}
-
-// src/guards/registry.ts
-var GuardRegistry = class {
-  _byCollection = /* @__PURE__ */ new Map();
-  _amendmentChanges = null;
-  _amendmentMeta = null;
-  /** Register a guard. Multiple guards per collection are allowed. */
-  register(spec) {
-    const existing = this._byCollection.get(spec.collection);
-    if (existing) existing.push(spec);
-    else this._byCollection.set(spec.collection, [spec]);
-  }
-  /** All guards registered against `collection` in registration order. */
-  guardsFor(collection) {
-    return this._byCollection.get(collection) ?? [];
-  }
-  /** Per-collection guard counts, for introspection. */
-  summary() {
-    return [...this._byCollection.entries()].map(([collection, guards]) => ({
-      collection,
-      count: guards.length
-    }));
-  }
-  /**
-   * Run every guard's `check` for this collection. First throw wins —
-   * remaining guards are not invoked. Guards without a `check` skip.
-   */
-  async runChecks(collection, incoming, ctx) {
-    const guards = this._byCollection.get(collection);
-    if (!guards) return;
-    for (const g of guards) {
-      if (g.check) {
-        await g.check(
-          incoming,
-          ctx
-        );
-      }
-    }
-  }
-  /**
-   * Run every guard's `onDelete` for this collection. First throw wins —
-   * remaining guards are not invoked. Guards without an `onDelete` skip.
-   * Mirrors {@link runChecks} but for the delete path.
-   */
-  async runOnDelete(collection, existing, ctx) {
-    const guards = this._byCollection.get(collection);
-    if (!guards) return;
-    for (const g of guards) {
-      if (g.onDelete) {
-        await g.onDelete(
-          existing,
-          ctx
-        );
-      }
-    }
-  }
-  /** True if any guard for `collection` declares an `amendment` block. */
-  hasAmendment(collection) {
-    const guards = this._byCollection.get(collection);
-    if (!guards) return false;
-    return guards.some((g) => g.amendment !== void 0);
-  }
-  /** Open a new amendment change-collection window. */
-  beginAmendment() {
-    this._amendmentChanges = /* @__PURE__ */ new Map();
-    this._amendmentMeta = /* @__PURE__ */ new Map();
-  }
-  /** True iff we're currently inside an amendment transaction. */
-  isAmendmentActive() {
-    return this._amendmentChanges !== null;
-  }
-  /**
-   * Record a {before, after} pair for the active amendment. `vBefore`
-   * and `vAfter` are stored in a parallel meta structure so the public
-   * {@link GuardChange} shape handed to invariant callbacks stays
-   * `{ before, after }` only — the audit ledger reads version metadata
-   * via {@link consumeMeta}.
-   */
-  collectChange(collection, id, before, after, vBefore = 0, vAfter = 0) {
-    if (this._amendmentChanges === null || this._amendmentMeta === null) {
-      throw new Error("GuardRegistry.collectChange called outside an amendment");
-    }
-    const list = this._amendmentChanges.get(collection);
-    const entry = { before, after };
-    if (list) list.push(entry);
-    else this._amendmentChanges.set(collection, [entry]);
-    const metaList = this._amendmentMeta.get(collection);
-    const metaEntry = { id, vBefore, vAfter };
-    if (metaList) metaList.push(metaEntry);
-    else this._amendmentMeta.set(collection, [metaEntry]);
-  }
-  /**
-   * Drain the change-set and close the amendment window. The caller
-   * (transaction commit) feeds these to each affected guard's invariant.
-   */
-  consumeChanges() {
-    const out = this._amendmentChanges ?? /* @__PURE__ */ new Map();
-    this._amendmentChanges = null;
-    return out;
-  }
-  /**
-   * Drain the parallel id/version metadata captured during the
-   * amendment. Returned as a flat list with `collection` denormalised
-   * so the audit ledger can emit one `{ collection, id, vBefore,
-   * vAfter }` tuple per record. Must be called AFTER
-   * {@link consumeChanges} (or independently) — calling it closes the
-   * meta window in the same way.
-   */
-  consumeMeta() {
-    const out = [];
-    if (this._amendmentMeta) {
-      for (const [collection, list] of this._amendmentMeta) {
-        for (const m of list) {
-          out.push({ collection, id: m.id, vBefore: m.vBefore, vAfter: m.vAfter });
-        }
-      }
-    }
-    this._amendmentMeta = null;
-    return out;
-  }
-};
-
-// src/guards/executor.ts
-var GuardExecutor = {
-  /**
-   * Compare existing vs incoming for each `frozenFields.fields` entry
-   * when `frozenFields.when(existing)` is true. Throws
-   * `FieldFrozenError` listing every changed frozen field.
-   */
-  async checkFrozenFields(guard, id, existing, incoming) {
-    const ff = guard.frozenFields;
-    if (!ff) return;
-    if (existing === null) return;
-    if (!ff.when(existing)) return;
-    const changed = [];
-    for (const f of ff.fields) {
-      if (existing[f] !== incoming[f]) {
-        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
-      }
-    }
-    if (changed.length > 0) {
-      throw new FieldFrozenError(guard.collection, id, changed);
-    }
-  },
-  /**
-   * Run a single guard's invariant over its slice of the change-set.
-   * Any throw is converted to `InvariantError` unless it already is one.
-   */
-  async runInvariant(guard, changes, ctx) {
-    const amendment = guard.amendment;
-    if (!amendment) return;
-    try {
-      await amendment.invariant(changes, ctx);
-    } catch (err) {
-      if (err instanceof InvariantError) throw err;
-      throw new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-};
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return a === b;
-  if (typeof a !== typeof b) return false;
-  if (typeof a !== "object") return a === b;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a)) {
-    const aa = a;
-    const bb = b;
-    if (aa.length !== bb.length) return false;
-    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const ak = Object.keys(ao);
-  const bk = Object.keys(bo);
-  if (ak.length !== bk.length) return false;
-  for (const k of ak) {
-    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-    if (!deepEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-
-// src/guards/read-only-facade.ts
-var ReadOnlyVaultFacade = class {
-  _vault;
-  constructor(vault) {
-    this._vault = vault;
-  }
-  collection(name) {
-    const c = this._vault.collection(name);
-    return {
-      get: (id) => c.get(id),
-      list: () => c.list(),
-      query: () => c.query()
-    };
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  AmendmentForbiddenError,
-  FieldFrozenError,
-  GuardExecutor,
-  GuardRegistry,
-  InvariantError,
-  ReadOnlyVaultFacade,
-  RecordLockedError,
-  withGuard
-});
-//# sourceMappingURL=index.cjs.map