@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-SKF73JOP.js

@@ -1,355 +0,0 @@
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  AmendmentForbiddenError,
-  ConflictError,
-  InvariantError,
-  ValidationError
-} from "./chunk-ZYUC53LT.js";
-
-// src/with-commit/tx/transaction.ts
-var TxContext = class {
-  /** Stable id for this transaction; shared by all writes it performs. */
-  txId = generateULID();
-  /** @internal */
-  _ops = [];
-  /**
-   * @internal — write log built up in Phase 2. Each entry records the
-   * envelope captured BEFORE the write so a mid-batch failure can
-   * restore prior state via `revertExecuted`. Side-effect writes (e.g.
-   * recursive derivation outputs fired inside `Collection.put`) are
-   * appended here in execution order so they roll back alongside the
-   * main staged ops.
-   */
-  _executed = [];
-  /** @internal */
-  _db;
-  /**
-   * @internal — true when this TxContext was opened in amendment
-   * mode. Toggles the lazy-`beginAmendment` + role-check path on first
-   * `tx.vault(name)` and unlocks the post-Phase-2 invariant + audit run.
-   */
-  _amendment;
-  /** @internal — vaults that have already had `beginAmendment` called. */
-  _amendmentVaults = /* @__PURE__ */ new Map();
-  /** @internal */
-  constructor(db, amendment = false) {
-    this._db = db;
-    this._amendment = amendment;
-  }
-  /** Scope subsequent `collection()` calls to the named vault. */
-  vault(name) {
-    const v = this._db.vault(name);
-    if (this._amendment && !this._amendmentVaults.has(name)) {
-      const role = v.role;
-      if (role !== "admin" && role !== "owner" && role !== "custodian") {
-        throw new AmendmentForbiddenError(v.userId, role);
-      }
-      const reg = v._getGuardRegistry();
-      if (reg === null) {
-        throw new ValidationError(
-          `Vault "${name}": amendment mode requires at least one guardStrategy registered via createNoydb({ guardStrategies }). Open the vault with guardStrategies before calling db.transaction({ amendment: true }).`
-        );
-      }
-      reg.beginAmendment();
-      this._amendmentVaults.set(name, v);
-    }
-    return new TxVault(this, v);
-  }
-};
-var TxVault = class {
-  /** @internal */
-  _ctx;
-  /** @internal */
-  _vault;
-  /** @internal */
-  constructor(ctx, vault) {
-    this._ctx = ctx;
-    this._vault = vault;
-  }
-  /** Scope subsequent op calls to the named collection. */
-  collection(name) {
-    const c = this._vault.collection(name);
-    return new TxCollection(this._ctx, this._vault, c, name);
-  }
-};
-var TxCollection = class {
-  /** @internal */
-  _ctx;
-  /** @internal */
-  _vault;
-  /** @internal */
-  _coll;
-  /** @internal */
-  _name;
-  /** @internal */
-  constructor(ctx, vault, coll, name) {
-    this._ctx = ctx;
-    this._vault = vault;
-    this._coll = coll;
-    this._name = name;
-  }
-  /**
-   * Read the current committed value, or the most-recently-staged
-   * value from the same transaction if one exists.
-   */
-  async get(id) {
-    for (let i = this._ctx._ops.length - 1; i >= 0; i--) {
-      const op = this._ctx._ops[i];
-      if (op.vaultName === this._vault.name && op.collectionName === this._name && op.id === id) {
-        if (op.type === "delete") return null;
-        return op.record;
-      }
-    }
-    return this._coll.get(id);
-  }
-  /**
-   * Stage a put. Does not write until the transaction body returns.
-   * Supply `{ expectedVersion }` to enforce optimistic concurrency
-   * during the commit pre-flight.
-   */
-  put(id, record, options) {
-    const op = {
-      type: "put",
-      vaultName: this._vault.name,
-      collectionName: this._name,
-      id,
-      record
-    };
-    if (options?.expectedVersion !== void 0) op.expectedVersion = options.expectedVersion;
-    if (options?.reason !== void 0) op.reason = options.reason;
-    this._ctx._ops.push(op);
-  }
-  /**
-   * Stage a delete. Does not write until the transaction body returns.
-   * Supply `{ expectedVersion }` to enforce optimistic concurrency
-   * during the commit pre-flight.
-   */
-  delete(id, options) {
-    const op = {
-      type: "delete",
-      vaultName: this._vault.name,
-      collectionName: this._name,
-      id
-    };
-    if (options?.expectedVersion !== void 0) op.expectedVersion = options.expectedVersion;
-    this._ctx._ops.push(op);
-  }
-};
-async function runTransaction(db, fn, options, txInvariants) {
-  if (options?.amendment) {
-    if (typeof options.reason !== "string" || options.reason.trim().length === 0) {
-      throw new ValidationError(
-        "db.transaction({ amendment: true }) requires a non-empty `reason` string."
-      );
-    }
-  }
-  const ctx = new TxContext(db, options?.amendment === true);
-  const bodyResult = await fn(ctx);
-  if (ctx._ops.length === 0) {
-    if (ctx._amendment) {
-      for (const v of ctx._amendmentVaults.values()) {
-        const reg = v._getGuardRegistry();
-        if (reg !== null) {
-          reg.consumeChanges();
-          reg.consumeMeta();
-        }
-      }
-    }
-    return bodyResult;
-  }
-  const priorEnvelopes = /* @__PURE__ */ new Map();
-  const store = db._store;
-  const invariants = txInvariants ?? [];
-  const watchedScopes = new Set(invariants.map((i) => i.scope));
-  const plainBefore = /* @__PURE__ */ new Map();
-  for (const op of ctx._ops) {
-    const key = keyOf(op);
-    if (!priorEnvelopes.has(key)) {
-      const env = await store.get(op.vaultName, op.collectionName, op.id);
-      priorEnvelopes.set(key, env);
-    }
-    if (watchedScopes.has(op.collectionName) && !plainBefore.has(key)) {
-      const prior = await db.vault(op.vaultName).collection(op.collectionName).get(op.id);
-      plainBefore.set(key, prior ?? null);
-    }
-    if (op.expectedVersion !== void 0) {
-      const env = priorEnvelopes.get(key) ?? null;
-      const actual = env?._v ?? 0;
-      if (actual !== op.expectedVersion) {
-        throw new ConflictError(
-          actual,
-          `Transaction pre-flight: ${op.vaultName}/${op.collectionName}/${op.id} expected v${op.expectedVersion}, found v${actual}`
-        );
-      }
-    }
-  }
-  db._setActiveTxContext(ctx);
-  try {
-    try {
-      for (const op of ctx._ops) {
-        const coll = db.vault(op.vaultName).collection(op.collectionName);
-        const key = keyOf(op);
-        const prior = priorEnvelopes.get(key) ?? null;
-        ctx._executed.push({ op, priorEnvelope: prior });
-        if (op.type === "put") {
-          await coll.put(op.id, op.record, op.reason !== void 0 ? { reason: op.reason } : void 0);
-        } else {
-          await coll.delete(op.id);
-        }
-      }
-    } catch (err) {
-      await revertExecuted(ctx._executed, store, db);
-      if (ctx._amendment) {
-        for (const v of ctx._amendmentVaults.values()) {
-          const reg = v._getGuardRegistry();
-          if (reg !== null) {
-            reg.consumeChanges();
-            reg.consumeMeta();
-          }
-        }
-      }
-      throw err;
-    }
-  } finally {
-    db._clearActiveTxContext(ctx);
-  }
-  if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-QZ7BXICW.js");
-    try {
-      for (const [vaultName, v] of ctx._amendmentVaults) {
-        const registry = v._getGuardRegistry();
-        if (registry === null) continue;
-        const changesByCollection = registry.consumeChanges();
-        const meta = registry.consumeMeta();
-        if (changesByCollection.size === 0) continue;
-        const readOnlyVault = v._getReadOnlyFacade();
-        if (readOnlyVault === null) continue;
-        const invariantsPassed = [];
-        for (const [collection, changes] of changesByCollection) {
-          const guards = registry.guardsFor(collection).filter((g) => g.amendment !== void 0);
-          for (const guard of guards) {
-            await GuardExecutor.runInvariant(guard, changes, {
-              existing: null,
-              vault: readOnlyVault,
-              userId: v.userId,
-              role: v.role
-            });
-          }
-          if (guards.length > 0) invariantsPassed.push(collection);
-        }
-        const ledger = v._getLedgerOrNull();
-        if (ledger) {
-          const role = v.role;
-          const amendment = {
-            reason: options.reason,
-            role,
-            changes: meta,
-            invariantsPassed
-          };
-          await ledger.append({
-            op: "amendment",
-            collection: "",
-            id: "",
-            version: 0,
-            actor: v.userId,
-            // No payload to hash — the per-record entries already
-            // captured `payloadHash` at their own append time. We use
-            // a sha256 of the canonical reason string so the field is
-            // populated with something deterministic and non-empty.
-            payloadHash: "",
-            amendment
-          });
-        }
-        void vaultName;
-      }
-    } catch (err) {
-      await revertExecuted(ctx._executed, store, db);
-      throw err instanceof InvariantError ? err : new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-  if (invariants.length > 0) {
-    const lastOp = /* @__PURE__ */ new Map();
-    const order = [];
-    for (const op of ctx._ops) {
-      const key = keyOf(op);
-      if (!lastOp.has(key)) order.push(key);
-      lastOp.set(key, op);
-    }
-    const changesByScope = /* @__PURE__ */ new Map();
-    const scopeVault = /* @__PURE__ */ new Map();
-    for (const key of order) {
-      const op = lastOp.get(key);
-      if (!watchedScopes.has(op.collectionName)) continue;
-      const before = plainBefore.get(key) ?? null;
-      const after = op.type === "delete" ? null : op.record ?? null;
-      const change = { before, after };
-      const arr = changesByScope.get(op.collectionName);
-      if (arr) arr.push(change);
-      else changesByScope.set(op.collectionName, [change]);
-      scopeVault.set(op.collectionName, op.vaultName);
-    }
-    try {
-      for (const inv of invariants) {
-        const changes = changesByScope.get(inv.scope);
-        if (changes === void 0 || changes.length === 0) continue;
-        const vaultName = scopeVault.get(inv.scope);
-        const v = db.vault(vaultName);
-        const facade = v._getReadOnlyFacade() ?? {
-          collection(name) {
-            const c = v.collection(name);
-            return {
-              get: (id) => c.get(id),
-              list: () => c.list(),
-              query: () => c.query()
-            };
-          }
-        };
-        const ctxForInv = {
-          existing: null,
-          vault: facade,
-          userId: v.userId,
-          role: v.role
-        };
-        await inv.check(changes, ctxForInv);
-      }
-    } catch (err) {
-      await revertExecuted(ctx._executed, store, db);
-      throw err instanceof InvariantError ? err : new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-  return bodyResult;
-}
-async function revertExecuted(executed, store, db) {
-  for (const { op, priorEnvelope } of executed.slice().reverse()) {
-    try {
-      if (priorEnvelope) {
-        await store.put(op.vaultName, op.collectionName, op.id, priorEnvelope);
-      } else {
-        await store.delete(op.vaultName, op.collectionName, op.id);
-      }
-      if (db) {
-        const coll = db.vault(op.vaultName).collection(op.collectionName);
-        await coll._invalidateCacheEntry(op.id);
-      }
-    } catch {
-    }
-  }
-}
-function keyOf(op) {
-  return `${op.vaultName}\0${op.collectionName}\0${op.id}`;
-}
-
-export {
-  TxContext,
-  TxVault,
-  TxCollection,
-  runTransaction,
-  revertExecuted
-};
-//# sourceMappingURL=chunk-SKF73JOP.js.map

package/dist/chunk-SM3AVUHC.js

@@ -1,42 +0,0 @@
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
-
-// src/with-party/policy/storage.ts
-var META_COLLECTION = "_meta";
-var POLICY_RECORD_ID = "policy";
-async function loadVaultPolicy(store, vault) {
-  const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID);
-  if (!envelope) return void 0;
-  try {
-    const parsed = JSON.parse(envelope._data);
-    if (!isVaultPolicy(parsed)) return void 0;
-    return parsed;
-  } catch {
-    return void 0;
-  }
-}
-async function saveVaultPolicy(store, vault, policy) {
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(policy)
-  };
-  await store.put(vault, META_COLLECTION, POLICY_RECORD_ID, envelope);
-}
-function isVaultPolicy(x) {
-  if (x === null || typeof x !== "object") return false;
-  if (!("gates" in x)) return false;
-  const gates = x.gates;
-  return gates !== null && typeof gates === "object";
-}
-
-export {
-  META_COLLECTION,
-  POLICY_RECORD_ID,
-  loadVaultPolicy,
-  saveVaultPolicy
-};
-//# sourceMappingURL=chunk-SM3AVUHC.js.map

package/dist/chunk-SMXWYP24.js

@@ -1,155 +0,0 @@
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
-import {
-  ValidationError
-} from "./chunk-ZYUC53LT.js";
-
-// src/with-party/directory/public-envelope/schema.ts
-var DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+);base64,/;
-function validatePublicEnvelopeInput(input, schema) {
-  const allowed = new Set(schema.fields);
-  for (const key of Object.keys(input)) {
-    const known = key === "name" || key === "description" || key === "icon" || key === "defaultLocale" ? key : void 0;
-    if (!known) {
-      throw new ValidationError(
-        `setPublicEnvelope: unknown field "${key}". Allowed fields: ${[...allowed].join(", ")}.`
-      );
-    }
-    if (!allowed.has(known)) {
-      throw new ValidationError(
-        `setPublicEnvelope: field "${known}" is not enabled in this vault's schema. Allowed fields: ${[...allowed].join(", ")}.`
-      );
-    }
-  }
-  if (input.name !== void 0) {
-    validateText(input.name, "name", schema.maxStringChars);
-  }
-  if (input.description !== void 0) {
-    validateText(input.description, "description", schema.maxStringChars);
-  }
-  if (input.icon !== void 0) {
-    validateIcon(input.icon, schema);
-  }
-  if (input.defaultLocale !== void 0 && typeof input.defaultLocale !== "string") {
-    throw new ValidationError(
-      `setPublicEnvelope: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`
-    );
-  }
-}
-function validateText(value, field, maxChars) {
-  if (typeof value === "string") {
-    if (value.length > maxChars) {
-      throw new ValidationError(
-        `setPublicEnvelope: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`
-      );
-    }
-    return;
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new ValidationError(
-      `setPublicEnvelope: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`
-    );
-  }
-  for (const [locale, str] of Object.entries(value)) {
-    if (typeof str !== "string") {
-      throw new ValidationError(
-        `setPublicEnvelope: ${field}[${locale}] must be a string, got ${typeof str}.`
-      );
-    }
-    if (str.length > maxChars) {
-      throw new ValidationError(
-        `setPublicEnvelope: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`
-      );
-    }
-  }
-}
-function validateIcon(icon, schema) {
-  if (typeof icon !== "string") {
-    throw new ValidationError(
-      `setPublicEnvelope: icon must be a data: URL string, got ${typeof icon}.`
-    );
-  }
-  if (icon.length > schema.maxIconBytes) {
-    throw new ValidationError(
-      `setPublicEnvelope: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`
-    );
-  }
-  const m = DATA_URL_PREFIX.exec(icon);
-  if (!m) {
-    throw new ValidationError(
-      "setPublicEnvelope: icon must be a base64 data URL (`data:image/png;base64,\u2026` or `data:image/svg+xml;base64,\u2026`). External URLs are not supported in v1."
-    );
-  }
-  const mime = m[1];
-  if (!schema.iconMimeTypes.includes(mime)) {
-    throw new ValidationError(
-      `setPublicEnvelope: icon MIME type "${mime}" is not allowed. Permitted types: ${schema.iconMimeTypes.join(", ")}.`
-    );
-  }
-}
-function isPublicEnvelope(x) {
-  if (x === null || typeof x !== "object" || Array.isArray(x)) return false;
-  const obj = x;
-  return obj["_noydb_public"] === 1 && typeof obj["version"] === "number";
-}
-
-// src/with-party/directory/public-envelope/storage.ts
-var PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
-async function loadPublicEnvelope(store, vault) {
-  const envelope = await store.get(vault, "_meta", PUBLIC_ENVELOPE_RECORD_ID);
-  if (!envelope) return void 0;
-  try {
-    const parsed = JSON.parse(envelope._data);
-    if (!isPublicEnvelope(parsed)) return void 0;
-    return parsed;
-  } catch {
-    return void 0;
-  }
-}
-async function savePublicEnvelope(store, vault, envelope) {
-  const wireEnvelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(envelope)
-  };
-  await store.put(vault, "_meta", PUBLIC_ENVELOPE_RECORD_ID, wireEnvelope);
-}
-async function readPublicEnvelope(store, vault, opts = {}) {
-  const raw = await loadPublicEnvelope(store, vault);
-  if (!raw) return void 0;
-  if (opts.locale === void 0) return raw;
-  return resolveLocale(raw, opts.locale);
-}
-function resolveLocale(envelope, locale) {
-  return {
-    ...envelope,
-    ...envelope.name !== void 0 ? { name: pickLocale(envelope.name, locale, envelope.defaultLocale) } : {},
-    ...envelope.description !== void 0 ? { description: pickLocale(envelope.description, locale, envelope.defaultLocale) } : {}
-  };
-}
-function pickLocale(value, locale, defaultLocale) {
-  if (typeof value === "string") return value;
-  if (value[locale] !== void 0 && value[locale] !== "") return value[locale];
-  if (defaultLocale && value[defaultLocale] !== void 0 && value[defaultLocale] !== "") {
-    return value[defaultLocale];
-  }
-  for (const v of Object.values(value)) {
-    if (v !== "") return v;
-  }
-  return "";
-}
-
-export {
-  validatePublicEnvelopeInput,
-  isPublicEnvelope,
-  PUBLIC_ENVELOPE_RECORD_ID,
-  loadPublicEnvelope,
-  savePublicEnvelope,
-  readPublicEnvelope,
-  resolveLocale,
-  pickLocale
-};
-//# sourceMappingURL=chunk-SMXWYP24.js.map

package/dist/chunk-SRB2XEWB.js

@@ -1,148 +0,0 @@
-import {
-  encrypt,
-  hmacSha256Hex,
-  openEnvelopeJson,
-  sha256Hex
-} from "./chunk-5O3AOPDT.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
-
-// src/with-audit/forget/strategy.ts
-var NO_FORGET = { subjects: {} };
-
-// src/with-audit/forget/subject-index.ts
-var SUBJECT_INDEX_COLLECTION = "_subject_index";
-var REF_LIST_BUCKET = 256;
-async function sha256HexString(input) {
-  return sha256Hex(new TextEncoder().encode(input));
-}
-async function subjectKeys(getDEK, encrypted, subjectId) {
-  const legacy = await sha256HexString(subjectId);
-  if (!encrypted) return [legacy];
-  const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId));
-  return keyed === legacy ? [keyed] : [keyed, legacy];
-}
-async function primarySubjectKey(getDEK, encrypted, subjectId) {
-  return (await subjectKeys(getDEK, encrypted, subjectId))[0];
-}
-function parseRefs(json) {
-  const parsed = JSON.parse(json);
-  return Array.isArray(parsed) ? parsed : parsed.r;
-}
-function serializeRefs(refs) {
-  const base = JSON.stringify({ r: refs, p: "" });
-  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length;
-  return JSON.stringify({ r: refs, p: " ".repeat(pad) });
-}
-async function readRefs(adapter, vault, getDEK, encrypted, key) {
-  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key);
-  if (!env || !env._data) return [];
-  if (!encrypted) return parseRefs(env._data);
-  const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-  const json = await openEnvelopeJson(env, dek);
-  return parseRefs(json);
-}
-async function writeRefs(adapter, vault, getDEK, encrypted, key, refs) {
-  let env;
-  if (!encrypted) {
-    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: JSON.stringify(refs) };
-  } else {
-    const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-    const { iv, data } = await encrypt(serializeRefs(refs), dek);
-    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
-  }
-  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env);
-}
-async function addSubjectRef(adapter, vault, getDEK, encrypted, subjectId, ref) {
-  const key = await primarySubjectKey(getDEK, encrypted, subjectId);
-  const refs = await readRefs(adapter, vault, getDEK, encrypted, key);
-  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return;
-  refs.push(ref);
-  await writeRefs(adapter, vault, getDEK, encrypted, key, refs);
-}
-async function removeSubjectRef(adapter, vault, getDEK, encrypted, subjectId, ref) {
-  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {
-    const refs = await readRefs(adapter, vault, getDEK, encrypted, key);
-    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id));
-    if (next.length === refs.length) continue;
-    if (next.length === 0) {
-      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key);
-    } else {
-      await writeRefs(adapter, vault, getDEK, encrypted, key, next);
-    }
-  }
-}
-async function lookupSubject(adapter, vault, getDEK, encrypted, subjectId) {
-  const keys = await subjectKeys(getDEK, encrypted, subjectId);
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const key of keys) {
-    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {
-      const dedup = `${ref.collection}\0${ref.id}`;
-      if (seen.has(dedup)) continue;
-      seen.add(dedup);
-      out.push(ref);
-    }
-  }
-  return out;
-}
-async function rebuildSubjectIndex(adapter, vault, getDEK, encrypted, subjects, decodeRecord) {
-  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION);
-  for (const k of existing) {
-    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k);
-  }
-  const bySubject = /* @__PURE__ */ new Map();
-  for (const [collection, field] of Object.entries(subjects)) {
-    const ids = await adapter.list(vault, collection);
-    for (const id of ids) {
-      if (id.startsWith("_")) continue;
-      const env = await adapter.get(vault, collection, id);
-      if (!env || !env._data) continue;
-      const record = await decodeRecord(collection, id, env);
-      if (record === null) continue;
-      const subjectValue = readDottedPath(record, field);
-      if (subjectValue === void 0 || subjectValue === null) continue;
-      const subjectId = coerceSubjectId(subjectValue);
-      const list = bySubject.get(subjectId) ?? [];
-      list.push({ collection, id });
-      bySubject.set(subjectId, list);
-    }
-  }
-  let entries = 0;
-  for (const [subjectId, refs] of bySubject) {
-    const key = await primarySubjectKey(getDEK, encrypted, subjectId);
-    await writeRefs(adapter, vault, getDEK, encrypted, key, refs);
-    entries++;
-  }
-  return entries;
-}
-function coerceSubjectId(value) {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function readDottedPath(record, field) {
-  if (!field.includes(".")) return record[field];
-  let cursor = record;
-  for (const segment of field.split(".")) {
-    if (cursor === null || cursor === void 0) return void 0;
-    cursor = cursor[segment];
-  }
-  return cursor;
-}
-
-export {
-  NO_FORGET,
-  SUBJECT_INDEX_COLLECTION,
-  addSubjectRef,
-  removeSubjectRef,
-  lookupSubject,
-  rebuildSubjectIndex,
-  coerceSubjectId,
-  readDottedPath
-};
-//# sourceMappingURL=chunk-SRB2XEWB.js.map