@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/{chunk-5R3ERCDH.js → chunk-XGDAPN6M.js}

@@ -1,11 +1,11 @@
 import {
   hasExportCapability,
   hasImportCapability
-} from "./chunk-WWGT2MDV.js";
+} from "./chunk-J4LPNIGK.js";
 import {
   ExportCapabilityError,
   ImportCapabilityError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/port/with/capabilities.ts
 function assertCanExport(keyring, tier, format) {
@@ -185,18 +185,23 @@ var ServiceBus = class {
       this.#depth--;
     }
   }
-  /** Register a write-gating handler. A throw from the handler ABORTS the write. Returns an unsubscribe fn. */
-  registerGate(point, handler) {
+  /**
+   * Register a write-gating handler. A throw from the handler ABORTS the
+   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+   * the `needsPrior` prior-read declaration (#267).
+   */
+  registerGate(point, handler, opts) {
     let arr = this.#gateHandlers.get(point);
     if (!arr) {
       arr = [];
       this.#gateHandlers.set(point, arr);
     }
-    arr.push(handler);
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    arr.push(entry);
     return () => {
       const a = this.#gateHandlers.get(point);
       if (!a) return;
-      const i = a.indexOf(handler);
+      const i = a.indexOf(entry);
       if (i >= 0) a.splice(i, 1);
     };
   }
@@ -205,6 +210,17 @@ var ServiceBus = class {
     const a = this.#gateHandlers.get(point);
     return a !== void 0 && a.length > 0;
   }
+  /**
+   * True when at least one gate handler at `point` needs the prior record
+   * (the default). False when the point has no handlers or every handler
+   * registered with `needsPrior: false` — the write path then skips the
+   * prior-read before dispatching (#267 prior-read elision).
+   */
+  gateNeedsPrior(point) {
+    const a = this.#gateHandlers.get(point);
+    if (!a) return false;
+    return a.some((e) => e.needsPrior);
+  }
   /**
    * Run gate handlers in registration order, awaited. Unlike `dispatch`
    * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
@@ -220,8 +236,8 @@ var ServiceBus = class {
   async dispatchGate(point, event) {
     const a = this.#gateHandlers.get(point);
     if (!a || a.length === 0) return;
-    for (const h of a.slice()) {
-      await h(event);
+    for (const e of a.slice()) {
+      await e.fn(event);
     }
   }
 };
@@ -236,4 +252,4 @@ export {
   ServiceBus,
   SubsystemBus
 };
-//# sourceMappingURL=chunk-5R3ERCDH.js.map
+//# sourceMappingURL=chunk-XGDAPN6M.js.map

package/dist/{chunk-5R3ERCDH.js.map → chunk-XGDAPN6M.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/port/with/capabilities.ts","../src/port/with/write-hooks.ts","../src/port/with/service-bus.ts"],"sourcesContent":["/**\n * Export/import capability gating.\n *\n * Pure predicates over a keyring's `exportCapability` / `importCapability`: the\n * `assert*` variants throw {@link ExportCapabilityError} / {@link ImportCapabilityError}\n * when the invoking keyring is not authorised; the `can*` variants return a\n * boolean for UI affordances. They wrap the role-default resolution in\n * {@link hasExportCapability} / {@link hasImportCapability}. Behaviour is\n * byte-identical to the inline `Vault` methods they replaced — every dependency\n * is the unlocked keyring, passed in. `Vault` keeps the typed (overloaded)\n * public methods and delegates here.\n *\n * Internal — reached through `vault.assertCanExport(...)` etc.\n */\nimport { ExportCapabilityError, ImportCapabilityError } from '../../kernel/errors.js'\nimport { hasExportCapability, hasImportCapability } from '../../with-party/team/keyring.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { ExportFormat } from '../../kernel/types.js'\n\n/**\n * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.\n * Throws `ExportCapabilityError` if the keyring is not authorised.\n *\n * - plaintext tier requires a `format`; defaults to empty for every role.\n * - bundle tier defaults to on for owner/admin, off for others.\n */\nexport function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void {\n  if (tier === 'plaintext') {\n    if (format === undefined) {\n      throw new Error('vault.assertCanExport: plaintext tier requires a format')\n    }\n    if (!hasExportCapability(keyring, 'plaintext', format)) {\n      throw new ExportCapabilityError({\n        tier: 'plaintext',\n        userId: keyring.userId,\n        format,\n      })\n    }\n    return\n  }\n  if (!hasExportCapability(keyring, 'bundle')) {\n    throw new ExportCapabilityError({\n      tier: 'bundle',\n      userId: keyring.userId,\n    })\n  }\n}\n\n/**\n * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.\n * Throws `ImportCapabilityError` if the keyring is not authorised.\n *\n * - plaintext tier requires a `format`; default-closed for every role.\n * - bundle tier is default-closed for every role, including owner — import is\n *   more dangerous than export (corrupts vs leaks).\n */\nexport function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void {\n  if (tier === 'plaintext') {\n    if (format === undefined) {\n      throw new Error('vault.assertCanImport: plaintext tier requires a format')\n    }\n    if (!hasImportCapability(keyring, 'plaintext', format)) {\n      throw new ImportCapabilityError({\n        tier: 'plaintext',\n        userId: keyring.userId,\n        format,\n      })\n    }\n    return\n  }\n  if (!hasImportCapability(keyring, 'bundle')) {\n    throw new ImportCapabilityError({\n      tier: 'bundle',\n      userId: keyring.userId,\n    })\n  }\n}\n\n/**\n * Read-only accessor for the keyring's export capability, with role-based\n * defaults resolved. Useful for UI affordances (grey out the export button if\n * no capability) without throwing.\n */\nexport function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean {\n  if (tier === 'plaintext') {\n    if (format === undefined) return false\n    return hasExportCapability(keyring, 'plaintext', format)\n  }\n  return hasExportCapability(keyring, 'bundle')\n}\n\n/**\n * Read-only accessor for the keyring's import capability. UI affordance —\n * returns false in every default-closed case (every role with no explicit\n * `importCapability` grant).\n */\nexport function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean {\n  if (tier === 'plaintext') {\n    if (format === undefined) return false\n    return hasImportCapability(keyring, 'plaintext', format)\n  }\n  return hasImportCapability(keyring, 'bundle')\n}\n","/**\n * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);\n * `onAfterWrite` is awaited and its errors are warned, not thrown. A\n * re-entrancy flag suppresses nested firing so a handler that writes can't\n * loop. Held on the Noydb instance, threaded into every Collection.\n */\nexport interface WriteEvent {\n  readonly op: 'create' | 'update' | 'delete'\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // decrypted prior record; null on 'create'\n  readonly after: unknown // the record written; null on 'delete'\n  readonly baseVersion: number // version the writer started from (0 on create)\n  readonly version: number // version the writer wrote (baseVersion + 1)\n  readonly userId: string\n  readonly timestamp: number\n  readonly txId: string\n}\n\nexport type WriteHook = (event: WriteEvent) => void | Promise<void>\nexport type Unsubscribe = () => void\n\nexport class WriteHookRegistry {\n  readonly #before: WriteHook[] = []\n  readonly #after: WriteHook[] = []\n  #suppressed = false\n\n  /** True while handlers are running — used by the write path to skip nested firing. */\n  get suppressed(): boolean { return this.#suppressed }\n\n  /** True when any hook is registered (cheap gate for the write path). */\n  get hasHandlers(): boolean { return this.#before.length > 0 || this.#after.length > 0 }\n\n  onBeforeWrite(handler: WriteHook): Unsubscribe {\n    this.#before.push(handler)\n    return () => { const i = this.#before.indexOf(handler); if (i >= 0) this.#before.splice(i, 1) }\n  }\n\n  onAfterWrite(handler: WriteHook): Unsubscribe {\n    this.#after.push(handler)\n    return () => { const i = this.#after.indexOf(handler); if (i >= 0) this.#after.splice(i, 1) }\n  }\n\n  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */\n  async runBefore(event: WriteEvent): Promise<void> {\n    if (this.#before.length === 0) return\n    this.#suppressed = true\n    try {\n      for (const h of this.#before.slice()) await h(event)\n    } finally {\n      this.#suppressed = false\n    }\n  }\n\n  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */\n  async runAfter(event: WriteEvent): Promise<void> {\n    if (this.#after.length === 0) return\n    this.#suppressed = true\n    try {\n      for (const h of this.#after.slice()) {\n        try {\n          await h(event)\n        } catch (err) {\n          console.warn(\n            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` +\n            (err instanceof Error ? err.message : String(err)),\n          )\n        }\n      }\n    } finally {\n      this.#suppressed = false\n    }\n  }\n}\n","/**\n * Generic per-instance **observe** bus. Observe-class\n * services (devtools inspector, audit, sync-dirty notification) register\n * handlers against named lifecycle points instead of the kernel naming each\n * service. Mirrors the registry pattern of {@link WriteHookRegistry} but is\n * internal and keyed by lifecycle point.\n *\n * OBSERVE SEMANTICS: handlers react to a write that already happened. A\n * handler throw is warned, not propagated — it can never abort a write. Write-\n * *gating* services (guards, periods) need a throw-propagating gate bus.\n * Add observe points by extending {@link LifecycleEventMap}. Write-*gating*\n * services use the sibling gate API on this same class\n * (`registerGate`/`dispatchGate`, throw-propagating); see {@link GateEventMap}.\n *\n * @module\n */\nimport type { WriteEvent } from './write-hooks.js'\nimport type { Role } from '../../kernel/types.js'\n\n/** Typed map of OBSERVE lifecycle point → event payload. Extend by adding keys. */\nexport interface LifecycleEventMap {\n  afterPut: WriteEvent\n  afterDelete: WriteEvent\n}\n\nexport type LifecyclePoint = keyof LifecycleEventMap\nexport type BusHandler<P extends LifecyclePoint> = (event: LifecycleEventMap[P]) => void | Promise<void>\nexport type Unsubscribe = () => void\n\ntype AnyHandler = (event: unknown) => void | Promise<void>\n\n/** Payload for a `beforePut` gate — carries the data guards and periods need to validate or reject a write. */\nexport interface GatePutEvent {\n  readonly op: 'create' | 'update'\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  /**\n   * The record about to be written (pre schema-validation). Money fields\n   * are presented in their canonical decoded form — equal on both\n   * sides for an unchanged value, regardless of how the caller wrote them.\n   */\n  readonly incoming: unknown\n  /**\n   * Decrypted prior record, or null on create / when prior is unreadable.\n   * Money fields are decoded to the canonical decimal `get()` shape, NOT\n   * the stored scaled-int — `incoming[f] === existing[f]` holds\n   * for an unchanged money field.\n   */\n  readonly existing: unknown\n  /** Prior envelope version, or 0 when none. */\n  readonly existingVersion: number\n  /** Prior envelope timestamp (`_ts` ISO string), or undefined when none — periods compares against this. */\n  readonly existingTs: string | undefined\n  readonly userId: string\n  readonly role: Role\n  /**\n   * Names of fields whose values are schema-owned computed fields for this\n   * collection. Gate handlers (e.g. `frozenFields`) must skip these: the\n   * incoming record is the raw user input (computed fields not yet evaluated),\n   * so comparing `existing[computedField]` vs `incoming[computedField]`\n   * would always see a change even when the computed result is unchanged.\n   */\n  readonly computedFieldNames?: ReadonlySet<string>\n}\n\n/** Payload for a `beforeDelete` gate. Like {@link GatePutEvent} without `incoming`. */\nexport interface GateDeleteEvent {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  /** True for system-internal (housekeeping) deletes — handlers branch on this. */\n  readonly internal: boolean\n  /** Decrypted prior record; money fields decoded to the canonical `get()` shape. */\n  readonly existing: unknown\n  readonly existingVersion: number\n  readonly existingTs: string | undefined\n  readonly userId: string\n  readonly role: Role\n}\n\n/** Typed map of GATE lifecycle point → event payload. Extend by adding keys. */\nexport interface GateEventMap {\n  beforePut: GatePutEvent\n  beforeDelete: GateDeleteEvent\n}\n\nexport type GatePoint = keyof GateEventMap\nexport type GateHandler<P extends GatePoint> = (event: GateEventMap[P]) => void | Promise<void>\n\nexport class ServiceBus {\n  readonly #handlers = new Map<LifecyclePoint, AnyHandler[]>()\n  readonly #gateHandlers = new Map<GatePoint, AnyHandler[]>()\n  #depth = 0\n\n  /** Register a handler for an observe point. Returns an unsubscribe fn. */\n  register<P extends LifecyclePoint>(point: P, handler: BusHandler<P>): Unsubscribe {\n    let arr = this.#handlers.get(point)\n    if (!arr) { arr = []; this.#handlers.set(point, arr) }\n    arr.push(handler as AnyHandler)\n    return () => {\n      const a = this.#handlers.get(point)\n      if (!a) return\n      const i = a.indexOf(handler as AnyHandler)\n      if (i >= 0) a.splice(i, 1)\n    }\n  }\n\n  /** Cheap gate for the write path — true when any handler is registered for the point. */\n  hasHandlers(point: LifecyclePoint): boolean {\n    const a = this.#handlers.get(point)\n    return a !== undefined && a.length > 0\n  }\n\n  /**\n   * True while one or more dispatches are in flight. Backed by a depth counter\n   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`\n   * each captured `busAfterPut=true` at their respective put() tops while depth\n   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,\n   * so any nested write attempted by a handler still sees `dispatching === true`\n   * and is suppressed by the write-path gate in `collection.ts`\n   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy\n   * suppression lives exclusively on that write-path gate; concurrent independent\n   * dispatches must not drop each other's events.\n   */\n  get dispatching(): boolean { return this.#depth > 0 }\n\n  /**\n   * Dispatch in registration order, awaited. Per-handler errors are warned, not\n   * thrown — an observe handler must never abort a completed write. A\n   * re-entrancy guard suppresses nested firing so a handler that itself writes\n   * cannot loop (same rationale as WriteHookRegistry.#suppressed).\n   */\n  async dispatch<P extends LifecyclePoint>(point: P, event: LifecycleEventMap[P]): Promise<void> {\n    const a = this.#handlers.get(point)\n    if (!a || a.length === 0) return\n    this.#depth++\n    try {\n      for (const h of a.slice()) {\n        try {\n          await h(event)\n        } catch (err) {\n          console.warn(\n            `[noy-db] service observe handler failed at ${point}: ` +\n            (err instanceof Error ? err.message : String(err)),\n          )\n        }\n      }\n    } finally {\n      this.#depth--\n    }\n  }\n\n  /** Register a write-gating handler. A throw from the handler ABORTS the write. Returns an unsubscribe fn. */\n  registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>): Unsubscribe {\n    let arr = this.#gateHandlers.get(point)\n    if (!arr) { arr = []; this.#gateHandlers.set(point, arr) }\n    arr.push(handler as AnyHandler)\n    return () => {\n      const a = this.#gateHandlers.get(point)\n      if (!a) return\n      const i = a.indexOf(handler as AnyHandler)\n      if (i >= 0) a.splice(i, 1)\n    }\n  }\n\n  /** Cheap gate for the write path — true when any gate handler is registered for the point. */\n  hasGateHandlers(point: GatePoint): boolean {\n    const a = this.#gateHandlers.get(point)\n    return a !== undefined && a.length > 0\n  }\n\n  /**\n   * Run gate handlers in registration order, awaited. Unlike `dispatch`\n   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the\n   * write before it reaches the store. The first throw stops the remaining\n   * handlers (fail-fast). This is the seam guards/periods migrate onto.\n   *\n   * Note: gate handlers are validators that read, not write. A gate handler\n   * that writes back into the same collection would re-enter the write path\n   * and re-dispatch this point; loop-suppression for that case is deferred to\n   * the migration slice (contract: gate handlers must not perform writes that\n   * re-trigger their own point).\n   */\n  async dispatchGate<P extends GatePoint>(point: P, event: GateEventMap[P]): Promise<void> {\n    const a = this.#gateHandlers.get(point)\n    if (!a || a.length === 0) return\n    for (const h of a.slice()) {\n      await h(event) // throw propagates → aborts the write\n    }\n  }\n}\n\n/** @deprecated Use ServiceBus. */\nexport const SubsystemBus = ServiceBus\n/** @deprecated Use ServiceBus. */\nexport type SubsystemBus = ServiceBus\n"],"mappings":";;;;;;;;;;AA0BO,SAAS,gBAAgB,SAA0B,MAA8B,QAA6B;AACnH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI,CAAC,oBAAoB,SAAS,aAAa,MAAM,GAAG;AACtD,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,SAAS,QAAQ,GAAG;AAC3C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAUO,SAAS,gBAAgB,SAA0B,MAA8B,QAA6B;AACnH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI,CAAC,oBAAoB,SAAS,aAAa,MAAM,GAAG;AACtD,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,SAAS,QAAQ,GAAG;AAC3C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAOO,SAAS,UAAU,SAA0B,MAA8B,QAAgC;AAChH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,oBAAoB,SAAS,aAAa,MAAM;AAAA,EACzD;AACA,SAAO,oBAAoB,SAAS,QAAQ;AAC9C;AAOO,SAAS,UAAU,SAA0B,MAA8B,QAAgC;AAChH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,oBAAoB,SAAS,aAAa,MAAM;AAAA,EACzD;AACA,SAAO,oBAAoB,SAAS,QAAQ;AAC9C;;;AC/EO,IAAM,oBAAN,MAAwB;AAAA,EACpB,UAAuB,CAAC;AAAA,EACxB,SAAsB,CAAC;AAAA,EAChC,cAAc;AAAA;AAAA,EAGd,IAAI,aAAsB;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA;AAAA,EAGpD,IAAI,cAAuB;AAAE,WAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS;AAAA,EAAE;AAAA,EAEtF,cAAc,SAAiC;AAC7C,SAAK,QAAQ,KAAK,OAAO;AACzB,WAAO,MAAM;AAAE,YAAM,IAAI,KAAK,QAAQ,QAAQ,OAAO;AAAG,UAAI,KAAK,EAAG,MAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,IAAE;AAAA,EAChG;AAAA,EAEA,aAAa,SAAiC;AAC5C,SAAK,OAAO,KAAK,OAAO;AACxB,WAAO,MAAM;AAAE,YAAM,IAAI,KAAK,OAAO,QAAQ,OAAO;AAAG,UAAI,KAAK,EAAG,MAAK,OAAO,OAAO,GAAG,CAAC;AAAA,IAAE;AAAA,EAC9F;AAAA;AAAA,EAGA,MAAM,UAAU,OAAkC;AAChD,QAAI,KAAK,QAAQ,WAAW,EAAG;AAC/B,SAAK,cAAc;AACnB,QAAI;AACF,iBAAW,KAAK,KAAK,QAAQ,MAAM,EAAG,OAAM,EAAE,KAAK;AAAA,IACrD,UAAE;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,OAAkC;AAC/C,QAAI,KAAK,OAAO,WAAW,EAAG;AAC9B,SAAK,cAAc;AACnB,QAAI;AACF,iBAAW,KAAK,KAAK,OAAO,MAAM,GAAG;AACnC,YAAI;AACF,gBAAM,EAAE,KAAK;AAAA,QACf,SAAS,KAAK;AACZ,kBAAQ;AAAA,YACN,4CAA4C,MAAM,UAAU,IAAI,MAAM,KAAK,QAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UAClD;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AACF;;;ACgBO,IAAM,aAAN,MAAiB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,gBAAgB,oBAAI,IAA6B;AAAA,EAC1D,SAAS;AAAA;AAAA,EAGT,SAAmC,OAAU,SAAqC;AAChF,QAAI,MAAM,KAAK,UAAU,IAAI,KAAK;AAClC,QAAI,CAAC,KAAK;AAAE,YAAM,CAAC;AAAG,WAAK,UAAU,IAAI,OAAO,GAAG;AAAA,IAAE;AACrD,QAAI,KAAK,OAAqB;AAC9B,WAAO,MAAM;AACX,YAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,UAAI,CAAC,EAAG;AACR,YAAM,IAAI,EAAE,QAAQ,OAAqB;AACzC,UAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGA,YAAY,OAAgC;AAC1C,UAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,WAAO,MAAM,UAAa,EAAE,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,cAAuB;AAAE,WAAO,KAAK,SAAS;AAAA,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpD,MAAM,SAAmC,OAAU,OAA4C;AAC7F,UAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,QAAI,CAAC,KAAK,EAAE,WAAW,EAAG;AAC1B,SAAK;AACL,QAAI;AACF,iBAAW,KAAK,EAAE,MAAM,GAAG;AACzB,YAAI;AACF,gBAAM,EAAE,KAAK;AAAA,QACf,SAAS,KAAK;AACZ,kBAAQ;AAAA,YACN,8CAA8C,KAAK,QAClD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UAClD;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,aAAkC,OAAU,SAAsC;AAChF,QAAI,MAAM,KAAK,cAAc,IAAI,KAAK;AACtC,QAAI,CAAC,KAAK;AAAE,YAAM,CAAC;AAAG,WAAK,cAAc,IAAI,OAAO,GAAG;AAAA,IAAE;AACzD,QAAI,KAAK,OAAqB;AAC9B,WAAO,MAAM;AACX,YAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,UAAI,CAAC,EAAG;AACR,YAAM,IAAI,EAAE,QAAQ,OAAqB;AACzC,UAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGA,gBAAgB,OAA2B;AACzC,UAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,WAAO,MAAM,UAAa,EAAE,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,aAAkC,OAAU,OAAuC;AACvF,UAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,QAAI,CAAC,KAAK,EAAE,WAAW,EAAG;AAC1B,eAAW,KAAK,EAAE,MAAM,GAAG;AACzB,YAAM,EAAE,KAAK;AAAA,IACf;AAAA,EACF;AACF;AAGO,IAAM,eAAe;","names":[]}
+{"version":3,"sources":["../src/port/with/capabilities.ts","../src/port/with/write-hooks.ts","../src/port/with/service-bus.ts"],"sourcesContent":["/**\n * Export/import capability gating.\n *\n * Pure predicates over a keyring's `exportCapability` / `importCapability`: the\n * `assert*` variants throw {@link ExportCapabilityError} / {@link ImportCapabilityError}\n * when the invoking keyring is not authorised; the `can*` variants return a\n * boolean for UI affordances. They wrap the role-default resolution in\n * {@link hasExportCapability} / {@link hasImportCapability}. Behaviour is\n * byte-identical to the inline `Vault` methods they replaced — every dependency\n * is the unlocked keyring, passed in. `Vault` keeps the typed (overloaded)\n * public methods and delegates here.\n *\n * Internal — reached through `vault.assertCanExport(...)` etc.\n */\nimport { ExportCapabilityError, ImportCapabilityError } from '../../kernel/errors.js'\nimport { hasExportCapability, hasImportCapability } from '../../with-party/team/keyring.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { ExportFormat } from '../../kernel/types.js'\n\n/**\n * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.\n * Throws `ExportCapabilityError` if the keyring is not authorised.\n *\n * - plaintext tier requires a `format`; defaults to empty for every role.\n * - bundle tier defaults to on for owner/admin, off for others.\n */\nexport function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void {\n  if (tier === 'plaintext') {\n    if (format === undefined) {\n      throw new Error('vault.assertCanExport: plaintext tier requires a format')\n    }\n    if (!hasExportCapability(keyring, 'plaintext', format)) {\n      throw new ExportCapabilityError({\n        tier: 'plaintext',\n        userId: keyring.userId,\n        format,\n      })\n    }\n    return\n  }\n  if (!hasExportCapability(keyring, 'bundle')) {\n    throw new ExportCapabilityError({\n      tier: 'bundle',\n      userId: keyring.userId,\n    })\n  }\n}\n\n/**\n * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.\n * Throws `ImportCapabilityError` if the keyring is not authorised.\n *\n * - plaintext tier requires a `format`; default-closed for every role.\n * - bundle tier is default-closed for every role, including owner — import is\n *   more dangerous than export (corrupts vs leaks).\n */\nexport function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void {\n  if (tier === 'plaintext') {\n    if (format === undefined) {\n      throw new Error('vault.assertCanImport: plaintext tier requires a format')\n    }\n    if (!hasImportCapability(keyring, 'plaintext', format)) {\n      throw new ImportCapabilityError({\n        tier: 'plaintext',\n        userId: keyring.userId,\n        format,\n      })\n    }\n    return\n  }\n  if (!hasImportCapability(keyring, 'bundle')) {\n    throw new ImportCapabilityError({\n      tier: 'bundle',\n      userId: keyring.userId,\n    })\n  }\n}\n\n/**\n * Read-only accessor for the keyring's export capability, with role-based\n * defaults resolved. Useful for UI affordances (grey out the export button if\n * no capability) without throwing.\n */\nexport function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean {\n  if (tier === 'plaintext') {\n    if (format === undefined) return false\n    return hasExportCapability(keyring, 'plaintext', format)\n  }\n  return hasExportCapability(keyring, 'bundle')\n}\n\n/**\n * Read-only accessor for the keyring's import capability. UI affordance —\n * returns false in every default-closed case (every role with no explicit\n * `importCapability` grant).\n */\nexport function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean {\n  if (tier === 'plaintext') {\n    if (format === undefined) return false\n    return hasImportCapability(keyring, 'plaintext', format)\n  }\n  return hasImportCapability(keyring, 'bundle')\n}\n","/**\n * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);\n * `onAfterWrite` is awaited and its errors are warned, not thrown. A\n * re-entrancy flag suppresses nested firing so a handler that writes can't\n * loop. Held on the Noydb instance, threaded into every Collection.\n */\nexport interface WriteEvent {\n  readonly op: 'create' | 'update' | 'delete'\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // decrypted prior record; null on 'create'\n  readonly after: unknown // the record written; null on 'delete'\n  readonly baseVersion: number // version the writer started from (0 on create)\n  readonly version: number // version the writer wrote (baseVersion + 1)\n  readonly userId: string\n  readonly timestamp: number\n  readonly txId: string\n}\n\nexport type WriteHook = (event: WriteEvent) => void | Promise<void>\nexport type Unsubscribe = () => void\n\nexport class WriteHookRegistry {\n  readonly #before: WriteHook[] = []\n  readonly #after: WriteHook[] = []\n  #suppressed = false\n\n  /** True while handlers are running — used by the write path to skip nested firing. */\n  get suppressed(): boolean { return this.#suppressed }\n\n  /** True when any hook is registered (cheap gate for the write path). */\n  get hasHandlers(): boolean { return this.#before.length > 0 || this.#after.length > 0 }\n\n  onBeforeWrite(handler: WriteHook): Unsubscribe {\n    this.#before.push(handler)\n    return () => { const i = this.#before.indexOf(handler); if (i >= 0) this.#before.splice(i, 1) }\n  }\n\n  onAfterWrite(handler: WriteHook): Unsubscribe {\n    this.#after.push(handler)\n    return () => { const i = this.#after.indexOf(handler); if (i >= 0) this.#after.splice(i, 1) }\n  }\n\n  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */\n  async runBefore(event: WriteEvent): Promise<void> {\n    if (this.#before.length === 0) return\n    this.#suppressed = true\n    try {\n      for (const h of this.#before.slice()) await h(event)\n    } finally {\n      this.#suppressed = false\n    }\n  }\n\n  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */\n  async runAfter(event: WriteEvent): Promise<void> {\n    if (this.#after.length === 0) return\n    this.#suppressed = true\n    try {\n      for (const h of this.#after.slice()) {\n        try {\n          await h(event)\n        } catch (err) {\n          console.warn(\n            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` +\n            (err instanceof Error ? err.message : String(err)),\n          )\n        }\n      }\n    } finally {\n      this.#suppressed = false\n    }\n  }\n}\n","/**\n * Generic per-instance **observe** bus. Observe-class\n * services (devtools inspector, audit, sync-dirty notification) register\n * handlers against named lifecycle points instead of the kernel naming each\n * service. Mirrors the registry pattern of {@link WriteHookRegistry} but is\n * internal and keyed by lifecycle point.\n *\n * OBSERVE SEMANTICS: handlers react to a write that already happened. A\n * handler throw is warned, not propagated — it can never abort a write. Write-\n * *gating* services (guards, periods) need a throw-propagating gate bus.\n * Add observe points by extending {@link LifecycleEventMap}. Write-*gating*\n * services use the sibling gate API on this same class\n * (`registerGate`/`dispatchGate`, throw-propagating); see {@link GateEventMap}.\n *\n * @module\n */\nimport type { WriteEvent } from './write-hooks.js'\nimport type { Role } from '../../kernel/types.js'\n\n/** Typed map of OBSERVE lifecycle point → event payload. Extend by adding keys. */\nexport interface LifecycleEventMap {\n  afterPut: WriteEvent\n  afterDelete: WriteEvent\n}\n\nexport type LifecyclePoint = keyof LifecycleEventMap\nexport type BusHandler<P extends LifecyclePoint> = (event: LifecycleEventMap[P]) => void | Promise<void>\nexport type Unsubscribe = () => void\n\ntype AnyHandler = (event: unknown) => void | Promise<void>\n\n/** Payload for a `beforePut` gate — carries the data guards and periods need to validate or reject a write. */\nexport interface GatePutEvent {\n  readonly op: 'create' | 'update'\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  /**\n   * The record about to be written (pre schema-validation). Money fields\n   * are presented in their canonical decoded form — equal on both\n   * sides for an unchanged value, regardless of how the caller wrote them.\n   */\n  readonly incoming: unknown\n  /**\n   * Decrypted prior record, or null on create / when prior is unreadable.\n   * Money fields are decoded to the canonical decimal `get()` shape, NOT\n   * the stored scaled-int — `incoming[f] === existing[f]` holds\n   * for an unchanged money field.\n   */\n  readonly existing: unknown\n  /** Prior envelope version, or 0 when none. */\n  readonly existingVersion: number\n  /** Prior envelope timestamp (`_ts` ISO string), or undefined when none — periods compares against this. */\n  readonly existingTs: string | undefined\n  readonly userId: string\n  readonly role: Role\n  /**\n   * Names of fields whose values are schema-owned computed fields for this\n   * collection. Gate handlers (e.g. `frozenFields`) must skip these: the\n   * incoming record is the raw user input (computed fields not yet evaluated),\n   * so comparing `existing[computedField]` vs `incoming[computedField]`\n   * would always see a change even when the computed result is unchanged.\n   */\n  readonly computedFieldNames?: ReadonlySet<string>\n}\n\n/** Payload for a `beforeDelete` gate. Like {@link GatePutEvent} without `incoming`. */\nexport interface GateDeleteEvent {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  /** True for system-internal (housekeeping) deletes — handlers branch on this. */\n  readonly internal: boolean\n  /** Decrypted prior record; money fields decoded to the canonical `get()` shape. */\n  readonly existing: unknown\n  readonly existingVersion: number\n  readonly existingTs: string | undefined\n  readonly userId: string\n  readonly role: Role\n}\n\n/** Typed map of GATE lifecycle point → event payload. Extend by adding keys. */\nexport interface GateEventMap {\n  beforePut: GatePutEvent\n  beforeDelete: GateDeleteEvent\n}\n\nexport type GatePoint = keyof GateEventMap\nexport type GateHandler<P extends GatePoint> = (event: GateEventMap[P]) => void | Promise<void>\n\n/**\n * Registration options for a gate handler.\n *\n * `needsPrior` (default `true`) declares whether the handler reads the\n * prior-derived event fields — `existing`, `existingVersion`, `existingTs`,\n * and (on `beforePut`) `op`. When EVERY handler registered at a point set\n * `needsPrior: false`, the write path skips the prior-read (store get +\n * decrypt) entirely and dispatches the event with `existing: null`,\n * `existingVersion: 0`, `existingTs: undefined` (and `op: 'create'` on\n * `beforePut`; a `beforeDelete` gate then also fires for delete-of-absent).\n * A handler that opts out MUST NOT rely on those fields. (#267 prior-read\n * elision — pure perf; one prior-needing handler restores the old behavior\n * for the whole point.)\n */\nexport interface GateRegisterOptions {\n  readonly needsPrior?: boolean\n}\n\ntype GateEntry = { readonly fn: AnyHandler; readonly needsPrior: boolean }\n\nexport class ServiceBus {\n  readonly #handlers = new Map<LifecyclePoint, AnyHandler[]>()\n  readonly #gateHandlers = new Map<GatePoint, GateEntry[]>()\n  #depth = 0\n\n  /** Register a handler for an observe point. Returns an unsubscribe fn. */\n  register<P extends LifecyclePoint>(point: P, handler: BusHandler<P>): Unsubscribe {\n    let arr = this.#handlers.get(point)\n    if (!arr) { arr = []; this.#handlers.set(point, arr) }\n    arr.push(handler as AnyHandler)\n    return () => {\n      const a = this.#handlers.get(point)\n      if (!a) return\n      const i = a.indexOf(handler as AnyHandler)\n      if (i >= 0) a.splice(i, 1)\n    }\n  }\n\n  /** Cheap gate for the write path — true when any handler is registered for the point. */\n  hasHandlers(point: LifecyclePoint): boolean {\n    const a = this.#handlers.get(point)\n    return a !== undefined && a.length > 0\n  }\n\n  /**\n   * True while one or more dispatches are in flight. Backed by a depth counter\n   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`\n   * each captured `busAfterPut=true` at their respective put() tops while depth\n   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,\n   * so any nested write attempted by a handler still sees `dispatching === true`\n   * and is suppressed by the write-path gate in `collection.ts`\n   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy\n   * suppression lives exclusively on that write-path gate; concurrent independent\n   * dispatches must not drop each other's events.\n   */\n  get dispatching(): boolean { return this.#depth > 0 }\n\n  /**\n   * Dispatch in registration order, awaited. Per-handler errors are warned, not\n   * thrown — an observe handler must never abort a completed write. A\n   * re-entrancy guard suppresses nested firing so a handler that itself writes\n   * cannot loop (same rationale as WriteHookRegistry.#suppressed).\n   */\n  async dispatch<P extends LifecyclePoint>(point: P, event: LifecycleEventMap[P]): Promise<void> {\n    const a = this.#handlers.get(point)\n    if (!a || a.length === 0) return\n    this.#depth++\n    try {\n      for (const h of a.slice()) {\n        try {\n          await h(event)\n        } catch (err) {\n          console.warn(\n            `[noy-db] service observe handler failed at ${point}: ` +\n            (err instanceof Error ? err.message : String(err)),\n          )\n        }\n      }\n    } finally {\n      this.#depth--\n    }\n  }\n\n  /**\n   * Register a write-gating handler. A throw from the handler ABORTS the\n   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for\n   * the `needsPrior` prior-read declaration (#267).\n   */\n  registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>, opts?: GateRegisterOptions): Unsubscribe {\n    let arr = this.#gateHandlers.get(point)\n    if (!arr) { arr = []; this.#gateHandlers.set(point, arr) }\n    const entry: GateEntry = { fn: handler as AnyHandler, needsPrior: opts?.needsPrior !== false }\n    arr.push(entry)\n    return () => {\n      const a = this.#gateHandlers.get(point)\n      if (!a) return\n      const i = a.indexOf(entry)\n      if (i >= 0) a.splice(i, 1)\n    }\n  }\n\n  /** Cheap gate for the write path — true when any gate handler is registered for the point. */\n  hasGateHandlers(point: GatePoint): boolean {\n    const a = this.#gateHandlers.get(point)\n    return a !== undefined && a.length > 0\n  }\n\n  /**\n   * True when at least one gate handler at `point` needs the prior record\n   * (the default). False when the point has no handlers or every handler\n   * registered with `needsPrior: false` — the write path then skips the\n   * prior-read before dispatching (#267 prior-read elision).\n   */\n  gateNeedsPrior(point: GatePoint): boolean {\n    const a = this.#gateHandlers.get(point)\n    if (!a) return false\n    return a.some((e) => e.needsPrior)\n  }\n\n  /**\n   * Run gate handlers in registration order, awaited. Unlike `dispatch`\n   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the\n   * write before it reaches the store. The first throw stops the remaining\n   * handlers (fail-fast). This is the seam guards/periods migrate onto.\n   *\n   * Note: gate handlers are validators that read, not write. A gate handler\n   * that writes back into the same collection would re-enter the write path\n   * and re-dispatch this point; loop-suppression for that case is deferred to\n   * the migration slice (contract: gate handlers must not perform writes that\n   * re-trigger their own point).\n   */\n  async dispatchGate<P extends GatePoint>(point: P, event: GateEventMap[P]): Promise<void> {\n    const a = this.#gateHandlers.get(point)\n    if (!a || a.length === 0) return\n    for (const e of a.slice()) {\n      await e.fn(event) // throw propagates → aborts the write\n    }\n  }\n}\n\n/** @deprecated Use ServiceBus. */\nexport const SubsystemBus = ServiceBus\n/** @deprecated Use ServiceBus. */\nexport type SubsystemBus = ServiceBus\n"],"mappings":";;;;;;;;;;AA0BO,SAAS,gBAAgB,SAA0B,MAA8B,QAA6B;AACnH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI,CAAC,oBAAoB,SAAS,aAAa,MAAM,GAAG;AACtD,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,SAAS,QAAQ,GAAG;AAC3C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAUO,SAAS,gBAAgB,SAA0B,MAA8B,QAA6B;AACnH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI,CAAC,oBAAoB,SAAS,aAAa,MAAM,GAAG;AACtD,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,SAAS,QAAQ,GAAG;AAC3C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAOO,SAAS,UAAU,SAA0B,MAA8B,QAAgC;AAChH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,oBAAoB,SAAS,aAAa,MAAM;AAAA,EACzD;AACA,SAAO,oBAAoB,SAAS,QAAQ;AAC9C;AAOO,SAAS,UAAU,SAA0B,MAA8B,QAAgC;AAChH,MAAI,SAAS,aAAa;AACxB,QAAI,WAAW,OAAW,QAAO;AACjC,WAAO,oBAAoB,SAAS,aAAa,MAAM;AAAA,EACzD;AACA,SAAO,oBAAoB,SAAS,QAAQ;AAC9C;;;AC/EO,IAAM,oBAAN,MAAwB;AAAA,EACpB,UAAuB,CAAC;AAAA,EACxB,SAAsB,CAAC;AAAA,EAChC,cAAc;AAAA;AAAA,EAGd,IAAI,aAAsB;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA;AAAA,EAGpD,IAAI,cAAuB;AAAE,WAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,OAAO,SAAS;AAAA,EAAE;AAAA,EAEtF,cAAc,SAAiC;AAC7C,SAAK,QAAQ,KAAK,OAAO;AACzB,WAAO,MAAM;AAAE,YAAM,IAAI,KAAK,QAAQ,QAAQ,OAAO;AAAG,UAAI,KAAK,EAAG,MAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,IAAE;AAAA,EAChG;AAAA,EAEA,aAAa,SAAiC;AAC5C,SAAK,OAAO,KAAK,OAAO;AACxB,WAAO,MAAM;AAAE,YAAM,IAAI,KAAK,OAAO,QAAQ,OAAO;AAAG,UAAI,KAAK,EAAG,MAAK,OAAO,OAAO,GAAG,CAAC;AAAA,IAAE;AAAA,EAC9F;AAAA;AAAA,EAGA,MAAM,UAAU,OAAkC;AAChD,QAAI,KAAK,QAAQ,WAAW,EAAG;AAC/B,SAAK,cAAc;AACnB,QAAI;AACF,iBAAW,KAAK,KAAK,QAAQ,MAAM,EAAG,OAAM,EAAE,KAAK;AAAA,IACrD,UAAE;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,OAAkC;AAC/C,QAAI,KAAK,OAAO,WAAW,EAAG;AAC9B,SAAK,cAAc;AACnB,QAAI;AACF,iBAAW,KAAK,KAAK,OAAO,MAAM,GAAG;AACnC,YAAI;AACF,gBAAM,EAAE,KAAK;AAAA,QACf,SAAS,KAAK;AACZ,kBAAQ;AAAA,YACN,4CAA4C,MAAM,UAAU,IAAI,MAAM,KAAK,QAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UAClD;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AACF;;;ACoCO,IAAM,aAAN,MAAiB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,gBAAgB,oBAAI,IAA4B;AAAA,EACzD,SAAS;AAAA;AAAA,EAGT,SAAmC,OAAU,SAAqC;AAChF,QAAI,MAAM,KAAK,UAAU,IAAI,KAAK;AAClC,QAAI,CAAC,KAAK;AAAE,YAAM,CAAC;AAAG,WAAK,UAAU,IAAI,OAAO,GAAG;AAAA,IAAE;AACrD,QAAI,KAAK,OAAqB;AAC9B,WAAO,MAAM;AACX,YAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,UAAI,CAAC,EAAG;AACR,YAAM,IAAI,EAAE,QAAQ,OAAqB;AACzC,UAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGA,YAAY,OAAgC;AAC1C,UAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,WAAO,MAAM,UAAa,EAAE,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,cAAuB;AAAE,WAAO,KAAK,SAAS;AAAA,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpD,MAAM,SAAmC,OAAU,OAA4C;AAC7F,UAAM,IAAI,KAAK,UAAU,IAAI,KAAK;AAClC,QAAI,CAAC,KAAK,EAAE,WAAW,EAAG;AAC1B,SAAK;AACL,QAAI;AACF,iBAAW,KAAK,EAAE,MAAM,GAAG;AACzB,YAAI;AACF,gBAAM,EAAE,KAAK;AAAA,QACf,SAAS,KAAK;AACZ,kBAAQ;AAAA,YACN,8CAA8C,KAAK,QAClD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UAClD;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAkC,OAAU,SAAyB,MAAyC;AAC5G,QAAI,MAAM,KAAK,cAAc,IAAI,KAAK;AACtC,QAAI,CAAC,KAAK;AAAE,YAAM,CAAC;AAAG,WAAK,cAAc,IAAI,OAAO,GAAG;AAAA,IAAE;AACzD,UAAM,QAAmB,EAAE,IAAI,SAAuB,YAAY,MAAM,eAAe,MAAM;AAC7F,QAAI,KAAK,KAAK;AACd,WAAO,MAAM;AACX,YAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,UAAI,CAAC,EAAG;AACR,YAAM,IAAI,EAAE,QAAQ,KAAK;AACzB,UAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGA,gBAAgB,OAA2B;AACzC,UAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,WAAO,MAAM,UAAa,EAAE,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,OAA2B;AACxC,UAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,QAAI,CAAC,EAAG,QAAO;AACf,WAAO,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,aAAkC,OAAU,OAAuC;AACvF,UAAM,IAAI,KAAK,cAAc,IAAI,KAAK;AACtC,QAAI,CAAC,KAAK,EAAE,WAAW,EAAG;AAC1B,eAAW,KAAK,EAAE,MAAM,GAAG;AACzB,YAAM,EAAE,GAAG,KAAK;AAAA,IAClB;AAAA,EACF;AACF;AAGO,IAAM,eAAe;","names":[]}

package/dist/{chunk-DFEMTNPJ.js → chunk-XH7XP3OL.js}

@@ -1,3 +1,6 @@
+import {
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -6,18 +9,17 @@ import {
   encryptBytesWithAAD,
   generateDEK,
   hmacSha256Hex,
-  openEnvelopeJson,
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-3OPY6MK2.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-YN5IAHN6.js";
 import {
   ConflictError,
   NotFoundError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-shape/blobs/mime-magic.ts
 function hex(s) {
@@ -1153,7 +1155,7 @@ var BlobSet = class {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-UL5LW66V.js");
+    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-NHORSWSF.js");
     const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const body = new ReadableStream({
@@ -1216,4 +1218,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-DFEMTNPJ.js.map
+//# sourceMappingURL=chunk-XH7XP3OL.js.map