@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/{chunk-VFQGRQIH.js → chunk-DV4HUP5G.js}

@@ -1,18 +1,20 @@
 import {
   dekKey
-} from "./chunk-IO6GRPT6.js";
+} from "./chunk-7BWJHO2A.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
 import {
   encrypt,
-  openEnvelopeJson,
   unwrapKey,
   wrapKey
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-3OPY6MK2.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -94,4 +96,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-VFQGRQIH.js.map
+//# sourceMappingURL=chunk-DV4HUP5G.js.map

package/dist/{chunk-VFQGRQIH.js.map → chunk-DV4HUP5G.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const { iv, data } = await encrypt(plaintext, delegationsDek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: 1,\n    _v: 1,\n    _ts: token.createdAt,\n    _iv: iv,\n    _data: data,\n    _by: grantor.userId,\n  }\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson(env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,cAAc;AAC5D,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,KAAK,cAAc;AAC5D,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const { iv, data } = await encrypt(plaintext, delegationsDek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: 1,\n    _v: 1,\n    _ts: token.createdAt,\n    _iv: iv,\n    _data: data,\n    _by: grantor.userId,\n  }\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson(env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,cAAc;AAC5D,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,KAAK,cAAc;AAC5D,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/{chunk-5LUY7UTV.js → chunk-EOXAAJTY.js}

@@ -1,10 +1,89 @@
+import {
+  installViaBinder
+} from "./chunk-VEAVKDDB.js";
 import {
   LocaleNotSpecifiedError,
   MissingTranslationError,
-  ScriptViolationError
-} from "./chunk-ZYUC53LT.js";
+  ScriptViolationError,
+  TranslatorNotConfiguredError
+} from "./chunk-S7VFUQM2.js";
+
+// src/port/with/i18n-strategy.ts
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the i18n strategy. Import \`{ withI18n }\` from "@noy-db/hub/i18n" and pass it to \`createNoydb({ i18nStrategy: withI18n() })\`.`
+  );
+}
+var NO_I18N = {
+  applyI18nLocale(record) {
+    return record;
+  },
+  validateI18nTextValue() {
+    throw notEnabled("i18nText field validation");
+  },
+  enforceScript(value) {
+    return { value, warnings: [] };
+  },
+  computeExemptFills() {
+    return /* @__PURE__ */ new Map();
+  },
+  densify() {
+  },
+  buildDictionaryHandle() {
+    throw notEnabled("vault.dictionary()");
+  }
+};
+function isDictCollectionName(name) {
+  return name.startsWith("_dict_");
+}
+function isStaticDictDescriptor(x) {
+  return typeof x === "object" && x !== null && x._noydbStaticDict === true;
+}
+function isI18nTextDescriptor(x) {
+  return typeof x === "object" && x !== null && x._noydbI18nText === true;
+}
+function isDictKeyDescriptor(x) {
+  return typeof x === "object" && x !== null && x._noydbDictKey === true;
+}
 
-// src/with-shape/i18n/policy.ts
+// src/kernel/paths.ts
+function getAtPath(obj, path) {
+  const arrayIdx = path.indexOf("[].");
+  if (arrayIdx !== -1) {
+    const arrayKey = path.slice(0, arrayIdx);
+    const restPath = path.slice(arrayIdx + 3);
+    const arr = obj[arrayKey];
+    if (!Array.isArray(arr)) return [];
+    return arr.flatMap((item) => {
+      if (!item || typeof item !== "object" || Array.isArray(item)) return [];
+      return getAtPath(item, restPath);
+    });
+  }
+  const dotIdx = path.indexOf(".");
+  if (dotIdx !== -1) {
+    const head = path.slice(0, dotIdx);
+    const rest = path.slice(dotIdx + 1);
+    const nested = obj[head];
+    if (!nested || typeof nested !== "object" || Array.isArray(nested)) return [];
+    return getAtPath(nested, rest);
+  }
+  const val = obj[path];
+  return val !== void 0 ? [val] : [];
+}
+function setAtPathInPlace(obj, path, value) {
+  const dotIdx = path.indexOf(".");
+  if (dotIdx !== -1) {
+    const head = path.slice(0, dotIdx);
+    const rest = path.slice(dotIdx + 1);
+    const nested = obj[head];
+    if (!nested || typeof nested !== "object" || Array.isArray(nested)) return;
+    setAtPathInPlace(nested, rest, value);
+    return;
+  }
+  obj[path] = value;
+}
+
+// src/via/i18n/policy.ts
 function resolvePolicy(onMissing, layer) {
   const explicit = onMissing && typeof onMissing === "object" ? onMissing[layer] : void 0;
   const scalar = typeof onMissing === "string" ? onMissing : void 0;
@@ -12,7 +91,7 @@ function resolvePolicy(onMissing, layer) {
   return explicit ?? layerDefault ?? scalar ?? "throw";
 }
 
-// src/with-shape/i18n/script.ts
+// src/via/i18n/script.ts
 var LATIN_BASE = /* @__PURE__ */ new Set([
   "en",
   "fr",
@@ -143,23 +222,211 @@ function enforceScript(value, field, descriptor, exempt) {
   return { value: out, warnings };
 }
 
-// src/with-shape/i18n/core.ts
+// src/via/i18n/binding.ts
+async function runI18nAutoTranslate(record, i18nFields, cfg) {
+  for (const [field, descriptor] of Object.entries(i18nFields)) {
+    if (!descriptor.options.autoTranslate) continue;
+    const leafValues = getAtPath(record, field);
+    if (leafValues.length !== 1) continue;
+    const value = leafValues[0];
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const map = value;
+    const { languages, required } = descriptor.options;
+    const missing = languages.filter(
+      (lang) => !(lang in map) || map[lang] === ""
+    );
+    if (missing.length === 0) continue;
+    const sourceLocale = languages.find((l) => l in map && map[l] !== "");
+    if (!sourceLocale) continue;
+    if (!cfg.autoTranslateHook) {
+      throw new TranslatorNotConfiguredError(field, cfg.collectionName);
+    }
+    const toTranslate = required === "any" ? [] : required === "all" ? missing : missing.filter((l) => required.includes(l));
+    const translated = { ...map };
+    for (const targetLocale of toTranslate) {
+      translated[targetLocale] = await cfg.autoTranslateHook(
+        map[sourceLocale],
+        sourceLocale,
+        targetLocale,
+        field,
+        cfg.collectionName
+      );
+    }
+    setAtPathInPlace(record, field, translated);
+  }
+}
+function runI18nScriptEnforcement(record, i18nFields, strategy, exemptFills, ctx, cfg) {
+  for (const [field, descriptor] of Object.entries(i18nFields)) {
+    if (!descriptor.options.script) continue;
+    for (const leaf of getAtPath(record, field)) {
+      if (!leaf || typeof leaf !== "object" || Array.isArray(leaf)) continue;
+      const leafMap = leaf;
+      const { value: cleaned, warnings } = strategy.enforceScript(
+        leafMap,
+        field,
+        descriptor,
+        exemptFills?.get(field)
+      );
+      if (cleaned !== leafMap) Object.assign(leafMap, cleaned);
+      const mode = descriptor.options.onScriptViolation;
+      if (mode === "warn" || mode === "filter") {
+        for (const w of warnings) {
+          ctx.emit("i18n:script-violation", {
+            vault: ctx.vault,
+            collection: cfg.collectionName,
+            id: ctx.id,
+            mode,
+            warning: w
+          });
+        }
+      }
+    }
+  }
+}
+async function runI18nWriteStages(record, ctx, cfg) {
+  const i18nFields = cfg.i18nFields;
+  const i18nDensifyFields = cfg.i18nDensifyFields;
+  const strategy = cfg.strategy;
+  if (i18nFields) {
+    await runI18nAutoTranslate(record, i18nFields, cfg);
+  }
+  let densifyPrior;
+  let exemptFills;
+  if (i18nDensifyFields) {
+    densifyPrior = await ctx.prior() ?? void 0;
+    exemptFills = strategy.computeExemptFills(densifyPrior, record, i18nDensifyFields);
+  }
+  if (i18nFields) {
+    runI18nScriptEnforcement(record, i18nFields, strategy, exemptFills, ctx, cfg);
+  }
+  cfg.i18nPutValidator?.(record);
+  if (i18nDensifyFields) {
+    strategy.densify(record, densifyPrior, i18nDensifyFields);
+  }
+  return record;
+}
+async function runI18nPresent(record, ctx, cfg) {
+  const i18nFields = cfg.i18nFields;
+  const dictKeyFields = cfg.dictKeyFields;
+  const strategy = cfg.strategy;
+  const hasI18n = i18nFields !== void 0 && Object.keys(i18nFields).length > 0;
+  const hasDict = dictKeyFields !== void 0 && Object.keys(dictKeyFields).length > 0;
+  if (!hasI18n && !hasDict) return record;
+  const locale = typeof ctx.locale === "string" ? ctx.locale : void 0;
+  const fallback = ctx.fallback;
+  const layer = ctx.layer;
+  let result = record;
+  const hasStaticDisplay = hasDict && dictKeyFields !== void 0 && Object.values(dictKeyFields).some(
+    (d) => isStaticDictDescriptor(d) && d.displayLocale !== void 0
+  );
+  if (!locale && !hasStaticDisplay) return stripI18nFilled(result);
+  if (locale && hasI18n && i18nFields) {
+    result = strategy.applyI18nLocale(result, i18nFields, locale, fallback, layer);
+  }
+  if (hasDict && dictKeyFields && cfg.dictLabelResolver && locale !== "raw") {
+    const withLabels = { ...result };
+    const resolver = cfg.dictLabelResolver;
+    for (const [field, desc] of Object.entries(dictKeyFields)) {
+      const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : "null";
+      const fieldFallback = policy === "substitute" ? fallback ?? desc.substitute : fallback;
+      const effLocale = locale ?? (isStaticDictDescriptor(desc) ? desc.displayLocale : void 0);
+      const resolveKey = async (key) => {
+        if (!effLocale) {
+          if (policy === "throw") {
+            throw new LocaleNotSpecifiedError(
+              field,
+              `dictKey "${field}": no locale active to resolve key "${key}".`
+            );
+          }
+          return null;
+        }
+        const label = await resolver(desc.name, key, effLocale, fieldFallback);
+        if (label === void 0) {
+          if (policy === "throw") {
+            throw new LocaleNotSpecifiedError(
+              field,
+              `dictKey "${field}": no label for key "${key}" in locale "${effLocale}".`
+            );
+          }
+          return null;
+        }
+        return label;
+      };
+      if (field.includes("[].")) {
+        const parts = field.split("[].");
+        const arrayKey = parts[0];
+        const leaf = parts[1];
+        if (!leaf || leaf.includes(".")) continue;
+        const arr = withLabels[arrayKey];
+        if (!Array.isArray(arr)) continue;
+        const labelKey = `${leaf}Label`;
+        withLabels[arrayKey] = await Promise.all(
+          arr.map(async (el) => {
+            if (!el || typeof el !== "object" || Array.isArray(el)) return el;
+            const k = el[leaf];
+            if (typeof k !== "string") return el;
+            return { ...el, [labelKey]: await resolveKey(k) };
+          })
+        );
+        continue;
+      }
+      const val = result[field];
+      if (Array.isArray(val)) {
+        withLabels[`${field}Label`] = await Promise.all(
+          val.map(async (k) => ({
+            key: k,
+            label: typeof k === "string" ? await resolveKey(k) : null
+          }))
+        );
+      } else if (typeof val === "string") {
+        const label = await resolveKey(val);
+        if (label !== null) withLabels[`${field}Label`] = label;
+      }
+    }
+    result = withLabels;
+  }
+  return stripI18nFilled(result);
+}
+function buildI18nDescribeFragment(cfg) {
+  return {
+    i18nFields: cfg.i18nFields ? Object.keys(cfg.i18nFields) : [],
+    dictKeyFields: cfg.dictKeyFields ? Object.keys(cfg.dictKeyFields) : [],
+    ...cfg.defaultLocale !== void 0 ? { defaultLocale: cfg.defaultLocale } : {}
+  };
+}
+function i18nBinding(cfg) {
+  return {
+    brand: "i18n",
+    posture: { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: true },
+    // DictionaryHandle's `_dict_*` reserved collections (#629 Task 4) — the
+    // codec boundary's `reservedEnvelopes` door may address any collection
+    // name under this prefix.
+    reservedPrefixes: ["_dict_"],
+    covers: (field) => cfg.i18nFields !== void 0 && field in cfg.i18nFields || cfg.dictKeyFields !== void 0 && field in cfg.dictKeyFields,
+    encodeWrite: async (record, ctx) => runI18nWriteStages(record, ctx, cfg),
+    present: async (record, ctx) => runI18nPresent(record, ctx, cfg),
+    describeFragment: () => buildI18nDescribeFragment(cfg)
+  };
+}
+function linkI18nVia() {
+  installViaBinder("i18n", (c) => i18nBinding(c));
+}
+
+// src/via/i18n/core.ts
 function i18nText(options) {
+  linkI18nVia();
   if (options.densifyOnWrite === true && hasThrowPolicy(options.onMissing)) {
     throw new Error(
       `i18nText: densifyOnWrite cannot be combined with an explicit onMissing 'throw' policy \u2014 densify fills every empty slot, so a 'throw' would be unreachable. Remove the 'throw' policy or disable densifyOnWrite.`
     );
   }
-  return { _noydbI18nText: true, options };
+  return { _noydbI18nText: true, _viaBrand: "i18n", options };
 }
 function hasThrowPolicy(onMissing) {
   if (onMissing === void 0) return false;
   if (typeof onMissing === "string") return onMissing === "throw";
   return Object.values(onMissing).includes("throw");
 }
-function isI18nTextDescriptor(x) {
-  return typeof x === "object" && x !== null && x._noydbI18nText === true;
-}
 function validateI18nTextValue(value, field, descriptor) {
   const { options } = descriptor;
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -272,41 +539,6 @@ function pickNearestScript(value, target) {
   }
   return best?.v;
 }
-function getAtPath(obj, path) {
-  const arrayIdx = path.indexOf("[].");
-  if (arrayIdx !== -1) {
-    const arrayKey = path.slice(0, arrayIdx);
-    const restPath = path.slice(arrayIdx + 3);
-    const arr = obj[arrayKey];
-    if (!Array.isArray(arr)) return [];
-    return arr.flatMap((item) => {
-      if (!item || typeof item !== "object" || Array.isArray(item)) return [];
-      return getAtPath(item, restPath);
-    });
-  }
-  const dotIdx = path.indexOf(".");
-  if (dotIdx !== -1) {
-    const head = path.slice(0, dotIdx);
-    const rest = path.slice(dotIdx + 1);
-    const nested = obj[head];
-    if (!nested || typeof nested !== "object" || Array.isArray(nested)) return [];
-    return getAtPath(nested, rest);
-  }
-  const val = obj[path];
-  return val !== void 0 ? [val] : [];
-}
-function setAtPathInPlace(obj, path, value) {
-  const dotIdx = path.indexOf(".");
-  if (dotIdx !== -1) {
-    const head = path.slice(0, dotIdx);
-    const rest = path.slice(dotIdx + 1);
-    const nested = obj[head];
-    if (!nested || typeof nested !== "object" || Array.isArray(nested)) return;
-    setAtPathInPlace(nested, rest, value);
-    return;
-  }
-  obj[path] = value;
-}
 function applyAtPath(obj, path, locale, fallback, opts) {
   const arrayIdx = path.indexOf("[].");
   if (arrayIdx !== -1) {
@@ -357,6 +589,9 @@ function applyI18nLocale(record, i18nFields, locale, fallback, layer = "read") {
   result = stripI18nFilled(result);
   return result;
 }
+function presentI18nForJoin(record, i18nFields, locale) {
+  return applyI18nLocale(record, i18nFields, locale, void 0, "join");
+}
 function stripI18nFilled(record) {
   if (!Object.prototype.hasOwnProperty.call(record, "_i18nFilled")) return record;
   const rest = { ...record };
@@ -365,16 +600,22 @@ function stripI18nFilled(record) {
 }
 
 export {
+  NO_I18N,
+  isDictCollectionName,
+  isStaticDictDescriptor,
+  isI18nTextDescriptor,
+  isDictKeyDescriptor,
+  getAtPath,
+  setAtPathInPlace,
   resolvePolicy,
   inferScripts,
   enforceScript,
+  linkI18nVia,
   i18nText,
-  isI18nTextDescriptor,
   validateI18nTextValue,
   resolveI18nText,
-  getAtPath,
-  setAtPathInPlace,
   applyI18nLocale,
+  presentI18nForJoin,
   stripI18nFilled
 };
-//# sourceMappingURL=chunk-5LUY7UTV.js.map
+//# sourceMappingURL=chunk-EOXAAJTY.js.map