@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/chunk-XUBPSPKD.js

@@ -0,0 +1,164 @@
+import {
+  ViaGraph
+} from "./chunk-FUOE7UUV.js";
+import {
+  sha256Hex
+} from "./chunk-3OPY6MK2.js";
+import {
+  DerivationCycleError
+} from "./chunk-S7VFUQM2.js";
+
+// src/with-formula/derivations/strategy-hash.ts
+async function computeStrategyHash(source, outputKeys, derive, sources) {
+  const canonical = JSON.stringify({
+    source,
+    outputs: [...outputKeys].sort(),
+    derive: derive.toString(),
+    // Declared sibling sources — adding/removing a trigger
+    // collection invalidates cached derived records. Omitted when empty
+    // so strategies without siblings keep their existing hash.
+    ...sources?.length ? { sources: [...sources].sort() } : {}
+  });
+  const bytes = new TextEncoder().encode(canonical);
+  return sha256Hex(bytes);
+}
+
+// src/with-formula/derivations/registry.ts
+var WHOLE_RECORD = "*";
+function stripArtifactSuffix(displayId) {
+  const suffix = `.${WHOLE_RECORD}`;
+  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId;
+}
+var DerivationRegistry = class {
+  _bySource = /* @__PURE__ */ new Map();
+  _byOutput = /* @__PURE__ */ new Map();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async register(spec) {
+    const outputKeys = Object.keys(spec.outputs);
+    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources);
+    const reg = { spec, strategyHash };
+    const fromSource = this._bySource.get(spec.source);
+    if (fromSource) fromSource.push(reg);
+    else this._bySource.set(spec.source, [reg]);
+    for (const extra of spec.sources ?? []) {
+      const fromExtra = this._bySource.get(extra);
+      if (fromExtra) fromExtra.push(reg);
+      else this._bySource.set(extra, [reg]);
+    }
+    for (const t of spec.triggerBy ?? []) {
+      const fromTrigger = this._bySource.get(t.collection);
+      if (fromTrigger) fromTrigger.push(reg);
+      else this._bySource.set(t.collection, [reg]);
+    }
+    if (spec.rollup) {
+      const fromRollup = this._bySource.get(spec.rollup.from);
+      if (fromRollup) fromRollup.push(reg);
+      else this._bySource.set(spec.rollup.from, [reg]);
+    }
+    for (const key of outputKeys) {
+      const output = spec.outputs[key];
+      if (!output) continue;
+      const outputCollection = output.collection;
+      const arr = this._byOutput.get(outputCollection);
+      if (arr) arr.push(reg);
+      else this._byOutput.set(outputCollection, [reg]);
+    }
+  }
+  strategiesForSource(source) {
+    return this._bySource.get(source) ?? [];
+  }
+  strategiesProducingOutput(collection) {
+    return this._byOutput.get(collection) ?? [];
+  }
+  /**
+   * All registered strategies as a flat, deduplicated array.
+   * Each strategy is indexed once per source (not once per output key),
+   * so iterating `_bySource.values()` naturally yields each strategy
+   * exactly once per source — deduplication is handled by flattening
+   * the per-source arrays and collecting into a Set by identity.
+   *
+   * Used by `dumpSchema()` / `describeDerivations()` in the introspection
+   * walker to populate the derivations map.
+   */
+  all() {
+    const seen = /* @__PURE__ */ new Set();
+    for (const strategies of this._bySource.values()) {
+      for (const s of strategies) seen.add(s);
+    }
+    return [...seen];
+  }
+  /**
+   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per
+   * (non-self-write) output key — target = the output collection (a
+   * `WHOLE_RECORD` artifact node), sources = every collection that can
+   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,
+   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys
+   * `register()` indexes under `_bySource`. The self-write reverse-denorm
+   * output (`output.collection === source` with `denorm` declared) is
+   * skipped — the SAME condition the old local DFS used; it is not a cycle
+   * (see the comment `validate()` used to carry, now on this skip).
+   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge
+   * targeting the real `rollup.field` on the parent (`source`) — the
+   * self-write output above only covers the cycle-DFS skip, not
+   * dispatch/taint (Tasks 3/4/6), which need the real field.
+   */
+  edges() {
+    const out = [];
+    for (const reg of this.all()) {
+      const spec = reg.spec;
+      const triggerCollections = [
+        spec.source,
+        ...spec.sources ?? [],
+        ...(spec.triggerBy ?? []).map((t) => t.collection),
+        ...spec.rollup ? [spec.rollup.from] : []
+      ];
+      const sources = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }));
+      for (const key of Object.keys(spec.outputs)) {
+        const output = spec.outputs[key];
+        if (!output) continue;
+        if (output.shape === "record" && output.collection === spec.source && output.denorm !== void 0) continue;
+        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: "derivation", grain: "record" });
+      }
+      if (spec.rollup) {
+        out.push({
+          target: { collection: spec.source, field: spec.rollup.field },
+          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],
+          kind: "rollup",
+          grain: "aggregate"
+        });
+      }
+    }
+    return out;
+  }
+  /**
+   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —
+   * retires the local DFS). Call after all `register()` calls complete (i.e.
+   * at vault open). Throws `DerivationCycleError` on the first cycle found —
+   * SAME class/timing as before; the message/path is byte-identical to the
+   * pre-#638 shape for a pure record-shape derivation cycle (the
+   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection
+   * name before re-throwing).
+   *
+   * `graph` is the caller's shared per-vault graph, ALREADY carrying this
+   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)
+   * — omit it (e.g. this registry's own unit tests) to validate this
+   * registry's edges in isolation against a throwaway graph.
+   */
+  validate(graph) {
+    const g = graph ?? new ViaGraph();
+    if (!graph) {
+      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain);
+    }
+    try {
+      g.assertAcyclic();
+    } catch (e) {
+      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix));
+      throw e;
+    }
+  }
+};
+
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=chunk-XUBPSPKD.js.map

package/dist/chunk-XUBPSPKD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/strategy-hash.ts","../src/with-formula/derivations/registry.ts"],"sourcesContent":["/**\n * Deterministic hash of a derivation strategy's \"shape\": source\n * collection, declared sibling sources, output keys, derive function\n * source. Used to detect\n * strategy drift: a record whose `_derivedFrom.strategyHash` doesn't\n * match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeStrategyHash(\n  source: string,\n  outputKeys: readonly string[],\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  derive: (...args: any[]) => any,\n  sources?: ReadonlyArray<string>,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    source,\n    outputs: [...outputKeys].sort(),\n    derive: derive.toString(),\n    // Declared sibling sources — adding/removing a trigger\n    // collection invalidates cached derived records. Omitted when empty\n    // so strategies without siblings keep their existing hash.\n    ...(sources?.length ? { sources: [...sources].sort() } : {}),\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n","import { DerivationCycleError } from '../../kernel/errors.js'\nimport { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js'\nimport { computeStrategyHash } from './strategy-hash.js'\nimport type { DerivationStrategy } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2). A derivation's\n * `derive()`/a rollup's `compute()` reads the WHOLE source record — there is\n * no single declared field to point at — so a trigger/output collection is\n * modelled as one artifact node per collection (`kernel/via/graph.ts`'s\n * \"Artifact-grain targets... modelled as a field node whose field is the\n * artifact key\" convention). MUST match `materialized-views/registry.ts`'s\n * and `vault.ts`'s overlay-edge marker so cross-registry edges (a derivation\n * feeding into / out of an MV or overlay collection) resolve to the SAME\n * graph node.\n */\nconst WHOLE_RECORD = '*'\n\n/** Strip this registry's `.${WHOLE_RECORD}` artifact suffix off a graph cycle\n *  path entry, recovering the bare collection name — preserves the exact\n *  pre-#638 `DerivationCycleError` message shape (behavior lock) for a pure\n *  record-shape derivation cycle. A rollup's real-field target (not suffixed\n *  `.${WHOLE_RECORD}`) is left untouched. */\nfunction stripArtifactSuffix(displayId: string): string {\n  const suffix = `.${WHOLE_RECORD}`\n  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId\n}\n\ninterface RegisteredStrategy {\n  // Type-erased to allow the registry to hold heterogeneous strategies.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: DerivationStrategy<any, any>\n  strategyHash: string\n}\n\n/**\n * Vault-internal registry of derivation strategies. Owned by `Vault`;\n * not exported.\n *\n * @internal\n */\nexport class DerivationRegistry {\n  private readonly _bySource = new Map<string, RegisteredStrategy[]>()\n  private readonly _byOutput = new Map<string, RegisteredStrategy[]>()\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async register(spec: DerivationStrategy<any, any>): Promise<void> {\n    const outputKeys = Object.keys(spec.outputs)\n    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources)\n    const reg: RegisteredStrategy = { spec, strategyHash }\n\n    const fromSource = this._bySource.get(spec.source)\n    if (fromSource) fromSource.push(reg)\n    else this._bySource.set(spec.source, [reg])\n\n    // Declared sibling sources index the SAME `reg` under each\n    // extra collection so `strategiesForSource(extra)` returns it and a\n    // sibling write re-fires the derivation. Sibling keys also enter\n    // `_bySource`, so `validate()`'s cycle DFS walks them automatically.\n    for (const extra of spec.sources ?? []) {\n      const fromExtra = this._bySource.get(extra)\n      if (fromExtra) fromExtra.push(reg)\n      else this._bySource.set(extra, [reg])\n    }\n\n    // FK triggers index the SAME `reg` under each parent collection so\n    // a parent write re-fires the derivation (fanned out to matching source\n    // records in `dispatchDerivations`). Like sources[], these keys enter\n    // `_bySource` so the cycle DFS walks the trigger→output edge.\n    for (const t of spec.triggerBy ?? []) {\n      const fromTrigger = this._bySource.get(t.collection)\n      if (fromTrigger) fromTrigger.push(reg)\n      else this._bySource.set(t.collection, [reg])\n    }\n\n    // Rollup: a write to the child `from` collection recomputes\n    // the parent (= spec.source = into) at id child[key]. Index under `from`\n    // so a child write fires it; spec.source (into) is already indexed above,\n    // so a parent write also recomputes its own aggregate (covers the\n    // parent-created-after-children case). The from→into edge enters the cycle\n    // DFS automatically.\n    if (spec.rollup) {\n      const fromRollup = this._bySource.get(spec.rollup.from)\n      if (fromRollup) fromRollup.push(reg)\n      else this._bySource.set(spec.rollup.from, [reg])\n    }\n\n    for (const key of outputKeys) {\n      const output = spec.outputs[key]\n      if (!output) continue\n      const outputCollection = output.collection\n      const arr = this._byOutput.get(outputCollection)\n      if (arr) arr.push(reg)\n      else this._byOutput.set(outputCollection, [reg])\n    }\n  }\n\n  strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy> {\n    return this._bySource.get(source) ?? []\n  }\n\n  strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy> {\n    return this._byOutput.get(collection) ?? []\n  }\n\n  /**\n   * All registered strategies as a flat, deduplicated array.\n   * Each strategy is indexed once per source (not once per output key),\n   * so iterating `_bySource.values()` naturally yields each strategy\n   * exactly once per source — deduplication is handled by flattening\n   * the per-source arrays and collecting into a Set by identity.\n   *\n   * Used by `dumpSchema()` / `describeDerivations()` in the introspection\n   * walker to populate the derivations map.\n   */\n  all(): ReadonlyArray<RegisteredStrategy> {\n    const seen = new Set<RegisteredStrategy>()\n    for (const strategies of this._bySource.values()) {\n      for (const s of strategies) seen.add(s)\n    }\n    return [...seen]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per\n   * (non-self-write) output key — target = the output collection (a\n   * `WHOLE_RECORD` artifact node), sources = every collection that can\n   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,\n   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys\n   * `register()` indexes under `_bySource`. The self-write reverse-denorm\n   * output (`output.collection === source` with `denorm` declared) is\n   * skipped — the SAME condition the old local DFS used; it is not a cycle\n   * (see the comment `validate()` used to carry, now on this skip).\n   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge\n   * targeting the real `rollup.field` on the parent (`source`) — the\n   * self-write output above only covers the cycle-DFS skip, not\n   * dispatch/taint (Tasks 3/4/6), which need the real field.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this.all()) {\n      const spec = reg.spec\n      const triggerCollections = [\n        spec.source,\n        ...(spec.sources ?? []),\n        ...(spec.triggerBy ?? []).map((t) => t.collection),\n        ...(spec.rollup ? [spec.rollup.from] : []),\n      ]\n      const sources: FieldRef[] = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }))\n      for (const key of Object.keys(spec.outputs)) {\n        const output = spec.outputs[key]\n        if (!output) continue\n        if (output.shape === 'record' && output.collection === spec.source && output.denorm !== undefined) continue\n        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: 'derivation', grain: 'record' })\n      }\n      if (spec.rollup) {\n        out.push({\n          target: { collection: spec.source, field: spec.rollup.field },\n          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],\n          kind: 'rollup',\n          grain: 'aggregate',\n        })\n      }\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). Call after all `register()` calls complete (i.e.\n   * at vault open). Throws `DerivationCycleError` on the first cycle found —\n   * SAME class/timing as before; the message/path is byte-identical to the\n   * pre-#638 shape for a pure record-shape derivation cycle (the\n   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection\n   * name before re-throwing).\n   *\n   * `graph` is the caller's shared per-vault graph, ALREADY carrying this\n   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)\n   * — omit it (e.g. this registry's own unit tests) to validate this\n   * registry's edges in isolation against a throwaway graph.\n   */\n  validate(graph?: ViaGraph): void {\n    const g = graph ?? new ViaGraph()\n    if (!graph) {\n      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain)\n    }\n    try {\n      g.assertAcyclic()\n    } catch (e) {\n      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix))\n      throw e\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAWA,eAAsB,oBACpB,QACA,YAEA,QACA,SACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK;AAAA,IAC9B,QAAQ,OAAO,SAAS;AAAA;AAAA;AAAA;AAAA,IAIxB,GAAI,SAAS,SAAS,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;;;ACbA,IAAM,eAAe;AAOrB,SAAS,oBAAoB,WAA2B;AACtD,QAAM,SAAS,IAAI,YAAY;AAC/B,SAAO,UAAU,SAAS,MAAM,IAAI,UAAU,MAAM,GAAG,CAAC,OAAO,MAAM,IAAI;AAC3E;AAeO,IAAM,qBAAN,MAAyB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,YAAY,oBAAI,IAAkC;AAAA;AAAA,EAGnE,MAAM,SAAS,MAAmD;AAChE,UAAM,aAAa,OAAO,KAAK,KAAK,OAAO;AAC3C,UAAM,eAAe,MAAM,oBAAoB,KAAK,QAAQ,YAAY,KAAK,QAAQ,KAAK,OAAO;AACjG,UAAM,MAA0B,EAAE,MAAM,aAAa;AAErD,UAAM,aAAa,KAAK,UAAU,IAAI,KAAK,MAAM;AACjD,QAAI,WAAY,YAAW,KAAK,GAAG;AAAA,QAC9B,MAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC;AAM1C,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,YAAY,KAAK,UAAU,IAAI,KAAK;AAC1C,UAAI,UAAW,WAAU,KAAK,GAAG;AAAA,UAC5B,MAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,IACtC;AAMA,eAAW,KAAK,KAAK,aAAa,CAAC,GAAG;AACpC,YAAM,cAAc,KAAK,UAAU,IAAI,EAAE,UAAU;AACnD,UAAI,YAAa,aAAY,KAAK,GAAG;AAAA,UAChC,MAAK,UAAU,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;AAAA,IAC7C;AAQA,QAAI,KAAK,QAAQ;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI;AACtD,UAAI,WAAY,YAAW,KAAK,GAAG;AAAA,UAC9B,MAAK,UAAU,IAAI,KAAK,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,IACjD;AAEA,eAAW,OAAO,YAAY;AAC5B,YAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAI,CAAC,OAAQ;AACb,YAAM,mBAAmB,OAAO;AAChC,YAAM,MAAM,KAAK,UAAU,IAAI,gBAAgB;AAC/C,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,oBAAoB,QAAmD;AACrE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA,EAEA,0BAA0B,YAAuD;AAC/E,WAAO,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAyC;AACvC,UAAM,OAAO,oBAAI,IAAwB;AACzC,eAAW,cAAc,KAAK,UAAU,OAAO,GAAG;AAChD,iBAAW,KAAK,WAAY,MAAK,IAAI,CAAC;AAAA,IACxC;AACA,WAAO,CAAC,GAAG,IAAI;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,IAAI,GAAG;AAC5B,YAAM,OAAO,IAAI;AACjB,YAAM,qBAAqB;AAAA,QACzB,KAAK;AAAA,QACL,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,IAAI,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU;AAAA,QACjD,GAAI,KAAK,SAAS,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,MAC1C;AACA,YAAM,UAAsB,mBAAmB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,aAAa,EAAE;AAClG,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,YAAI,CAAC,OAAQ;AACb,YAAI,OAAO,UAAU,YAAY,OAAO,eAAe,KAAK,UAAU,OAAO,WAAW,OAAW;AACnG,YAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,OAAO,YAAY,OAAO,aAAa,GAAG,SAAS,MAAM,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3H;AACA,UAAI,KAAK,QAAQ;AACf,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE,YAAY,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM;AAAA,UAC5D,SAAS,CAAC,EAAE,YAAY,KAAK,OAAO,MAAM,OAAO,aAAa,CAAC;AAAA,UAC/D,MAAM;AAAA,UACN,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAwB;AAC/B,UAAM,IAAI,SAAS,IAAI,SAAS;AAChC,QAAI,CAAC,OAAO;AACV,iBAAW,QAAQ,KAAK,MAAM,EAAG,GAAE,gBAAgB,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,KAAK;AAAA,IACrG;AACA,QAAI;AACF,QAAE,cAAc;AAAA,IAClB,SAAS,GAAG;AACV,UAAI,aAAa,qBAAsB,OAAM,IAAI,qBAAqB,EAAE,KAAK,IAAI,mBAAmB,CAAC;AACrG,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-Y3A5CB5G.js

@@ -0,0 +1,247 @@
+// src/via/classified/validators.ts
+function luhnCheck(pan) {
+  const digits = pan.replace(/[\s-]/g, "");
+  if (!/^\d{12,19}$/.test(digits)) return false;
+  let sum = 0;
+  for (let i = 0; i < digits.length; i++) {
+    let d = Number(digits[digits.length - 1 - i]);
+    if (i % 2 === 1) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+  }
+  return sum % 10 === 0;
+}
+
+// src/via/classified/presets.ts
+var digitsOf = (v) => String(v).replace(/\D/g, "");
+function panSpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.pan",
+    storage: "recoverable",
+    sensitivity: "secret",
+    list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022 ${last4}" },
+    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },
+    validate: (v) => typeof v === "string" && luhnCheck(v) ? null : "not a Luhn-valid card number"
+  };
+}
+function expirySpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.expiry",
+    storage: "recoverable",
+    sensitivity: "pii",
+    list: { kind: "mask", pattern: "\u2022\u2022/\u2022\u2022" },
+    validate: (v) => typeof v === "string" && /^(0[1-9]|1[0-2])\/\d{2}$/.test(v) ? null : "expected MM/YY"
+  };
+}
+function cvcSpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.cvc",
+    storage: "never",
+    sensitivity: "secret",
+    list: { kind: "omit" },
+    validate: (v) => typeof v === "string" && /^\d{3,4}$/.test(v) ? null : "expected 3-4 digits"
+  };
+}
+var classified = {
+  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
+  creditCard(fields) {
+    const members = { [fields.pan]: panSpec() };
+    if (fields.expiry !== void 0) members[fields.expiry] = expirySpec();
+    if (fields.cvc !== void 0) members[fields.cvc] = cvcSpec();
+    return { _noydbClassifiedGroup: true, _viaBrand: "classified", preset: "creditCard", members };
+  },
+  birthDate() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "birthDate",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "${yob}-\u2022\u2022-\u2022\u2022" },
+      riders: { yob: (v) => String(v).slice(0, 4) },
+      validate: (v) => {
+        if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(v)) return "expected ISO yyyy-mm-dd";
+        const parts = v.split("-").map(Number);
+        const year = parts[0], month = parts[1], day = parts[2];
+        if (month < 1 || month > 12) return "not a valid calendar date";
+        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+        const isLeapYear = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1];
+        if (day < 1 || day > maxDay) return "not a valid calendar date";
+        return null;
+      }
+    };
+  },
+  email() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "email",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "\u2022\u2022\u2022@${domain}" },
+      riders: { domain: (v) => String(v).split("@")[1] ?? "" },
+      validate: (v) => typeof v === "string" && v.includes("@") ? null : "expected an email address"
+    };
+  },
+  phone() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "phone",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022\u2022${last2}" },
+      riders: { last2: (v) => digitsOf(v).slice(-2) },
+      validate: (v) => digitsOf(v).length >= 5 ? null : "expected at least 5 digits"
+    };
+  },
+  /** Digest-only password: verify-without-reveal; never listed, never revealed.
+   *  Enumeration math is on the caller for low-entropy values — see the
+   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
+   *
+   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+   *  `findByDigest`). Cost band you are accepting:
+   *
+   *  equal values produce equal store-visible tags: anyone with store access
+   *  learns which records share this secret and how many share each value —
+   *  never the value itself. A collection-DEK holder can additionally test
+   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+   *  answers) offline recovery of the equality partition is seconds-to-hours, not
+   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+   *  hardest primitive available; the iteration count raises the price but does
+   *  not make a low-entropy field safe. The real control for low-entropy fields
+   *  is the DOOR — do not enable `equatable` for them unless the partition being
+   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+   *  tags. */
+  password(opts = {}) {
+    const minLength = opts.minLength ?? 10;
+    const notLastN = opts.notLastN ?? 0;
+    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {
+      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented), got ${notLastN}`);
+    }
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "password",
+      storage: "digest-only",
+      sensitivity: "secret",
+      list: { kind: "omit" },
+      verifyNormalize: "password",
+      ...opts.rotateDays !== void 0 ? { rotateDays: opts.rotateDays } : {},
+      ...notLastN > 0 ? { notLastN } : {},
+      ...opts.equatable === true ? { equatable: true } : {},
+      validate: (v) => typeof v === "string" && v.normalize("NFC").length >= minLength ? null : `password must be at least ${minLength} characters`
+    };
+  },
+  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
+   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
+   *  enumeration math to your users; add app-side rate limiting.
+   *
+   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+   *  `findByDigest`). Cost band you are accepting:
+   *
+   *  equal values produce equal store-visible tags: anyone with store access
+   *  learns which records share this secret and how many share each value —
+   *  never the value itself. A collection-DEK holder can additionally test
+   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+   *  answers) offline recovery of the equality partition is seconds-to-hours, not
+   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+   *  hardest primitive available; the iteration count raises the price but does
+   *  not make a low-entropy field safe. The real control for low-entropy fields
+   *  is the DOOR — do not enable `equatable` for them unless the partition being
+   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+   *  tags. */
+  secretAnswer(opts = {}) {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "secretAnswer",
+      storage: "digest-only",
+      sensitivity: "secret",
+      list: { kind: "omit" },
+      verifyNormalize: "secret-answer",
+      verifyGroupMember: true,
+      ...opts.equatable === true ? { equatable: true } : {},
+      validate: (v) => typeof v === "string" && v.normalize("NFC").toLowerCase().trim().replace(/\s+/g, " ").length > 0 ? null : "secret answer must be non-empty after normalization"
+    };
+  }
+};
+
+// src/via/classified/active.ts
+function policyOf(spec) {
+  return {
+    normalize: spec.verifyNormalize ?? "password",
+    notLastN: spec.notLastN ?? 0,
+    equatable: spec.equatable === true,
+    ...spec.rotateDays !== void 0 ? { rotateDays: spec.rotateDays } : {}
+  };
+}
+var engineCtx = (ctx) => ({
+  collection: ctx.collection,
+  getEnvelope: ctx.getEnvelope,
+  resolveCek: ctx.resolveCek,
+  getDEK: ctx.getDEK,
+  now: ctx.now
+});
+function withClassified() {
+  return {
+    async reveal(ctx, id, field) {
+      const { revealSealedField } = await import("./reveal-R3JLHMUF.js");
+      const value = await revealSealedField({
+        collection: ctx.collection,
+        encrypted: ctx.encrypted,
+        getEnvelope: ctx.getEnvelope,
+        resolveCek: ctx.resolveCek,
+        getDEK: ctx.getDEK
+      }, id, field);
+      await ctx.onAccess?.("reveal", id);
+      return value;
+    },
+    async verify(ctx, id, field, candidate) {
+      const { verifyDigestField } = await import("./verify-JPF2YR5E.js");
+      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
+      await ctx.onAccess?.("verify", id);
+      return verdict;
+    },
+    async verifyText(ctx, id, field, candidate) {
+      const { verifyTextField } = await import("./verify-JPF2YR5E.js");
+      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
+      await ctx.onAccess?.("verify", id);
+      return verdict;
+    },
+    async matchGroup(ctx, id, answers, opts) {
+      const { matchGroupFields } = await import("./verify-JPF2YR5E.js");
+      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
+      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
+      await ctx.onAccess?.("verify", id);
+      return result;
+    },
+    async computeTarget(ctx, field, candidate, costByte) {
+      const { computeBidxTarget } = await import("./find-BNGBJNKP.js");
+      const dek = await ctx.getDEK();
+      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
+    }
+  };
+}
+
+export {
+  luhnCheck,
+  classified,
+  withClassified
+};
+//# sourceMappingURL=chunk-Y3A5CB5G.js.map

package/dist/chunk-Y3A5CB5G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/validators.ts","../src/via/classified/presets.ts","../src/via/classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../kernel/enclave/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../kernel/enclave/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../kernel/enclave/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;AClJA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAyC;AAClF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAAyC;AACnF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAAuC;AAClF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-ZCGAHGUS.js → chunk-YCXCR7VG.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-YN5IAHN6.js";
 
 // src/with-party/team/managed-passphrase.ts
 var MemorySealingKeyProvider = class {
@@ -227,4 +227,4 @@ export {
   loadSealedPassphrase,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-ZCGAHGUS.js.map
+//# sourceMappingURL=chunk-YCXCR7VG.js.map

package/dist/{chunk-76722EBH.js → chunk-YMVQD5Q5.js}

@@ -1,17 +1,17 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-26LGBE4T.js";
+} from "./chunk-T7WSLRAU.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-DFEMTNPJ.js";
+} from "./chunk-XH7XP3OL.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-FISN7WE4.js";
+} from "./chunk-QSFOZUYL.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -22,7 +22,10 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-AIWULCUO.js";
+} from "./chunk-UF362QVH.js";
+import {
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
 import {
   bufferToBase64,
   decrypt,
@@ -30,17 +33,16 @@ import {
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
-  openEnvelopeJson,
   unwrapCek,
   wrapCek
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-3OPY6MK2.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-YN5IAHN6.js";
 import {
   PartitionExtractionError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-S7VFUQM2.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -448,4 +450,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-76722EBH.js.map
+//# sourceMappingURL=chunk-YMVQD5Q5.js.map