@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-DMFNPHCX.js

@@ -0,0 +1,247 @@
+// src/via/classified/validators.ts
+function luhnCheck(pan) {
+  const digits = pan.replace(/[\s-]/g, "");
+  if (!/^\d{12,19}$/.test(digits)) return false;
+  let sum = 0;
+  for (let i = 0; i < digits.length; i++) {
+    let d = Number(digits[digits.length - 1 - i]);
+    if (i % 2 === 1) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+  }
+  return sum % 10 === 0;
+}
+
+// src/via/classified/presets.ts
+var digitsOf = (v) => String(v).replace(/\D/g, "");
+function panSpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.pan",
+    storage: "recoverable",
+    sensitivity: "secret",
+    list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022 ${last4}" },
+    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },
+    validate: (v) => typeof v === "string" && luhnCheck(v) ? null : "not a Luhn-valid card number"
+  };
+}
+function expirySpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.expiry",
+    storage: "recoverable",
+    sensitivity: "pii",
+    list: { kind: "mask", pattern: "\u2022\u2022/\u2022\u2022" },
+    validate: (v) => typeof v === "string" && /^(0[1-9]|1[0-2])\/\d{2}$/.test(v) ? null : "expected MM/YY"
+  };
+}
+function cvcSpec() {
+  return {
+    _noydbClassified: true,
+    _viaBrand: "classified",
+    preset: "creditCard.cvc",
+    storage: "never",
+    sensitivity: "secret",
+    list: { kind: "omit" },
+    validate: (v) => typeof v === "string" && /^\d{3,4}$/.test(v) ? null : "expected 3-4 digits"
+  };
+}
+var classified = {
+  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
+  creditCard(fields) {
+    const members = { [fields.pan]: panSpec() };
+    if (fields.expiry !== void 0) members[fields.expiry] = expirySpec();
+    if (fields.cvc !== void 0) members[fields.cvc] = cvcSpec();
+    return { _noydbClassifiedGroup: true, _viaBrand: "classified", preset: "creditCard", members };
+  },
+  birthDate() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "birthDate",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "${yob}-\u2022\u2022-\u2022\u2022" },
+      riders: { yob: (v) => String(v).slice(0, 4) },
+      validate: (v) => {
+        if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(v)) return "expected ISO yyyy-mm-dd";
+        const parts = v.split("-").map(Number);
+        const year = parts[0], month = parts[1], day = parts[2];
+        if (month < 1 || month > 12) return "not a valid calendar date";
+        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+        const isLeapYear = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1];
+        if (day < 1 || day > maxDay) return "not a valid calendar date";
+        return null;
+      }
+    };
+  },
+  email() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "email",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "\u2022\u2022\u2022@${domain}" },
+      riders: { domain: (v) => String(v).split("@")[1] ?? "" },
+      validate: (v) => typeof v === "string" && v.includes("@") ? null : "expected an email address"
+    };
+  },
+  phone() {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "phone",
+      storage: "recoverable",
+      sensitivity: "pii",
+      list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022\u2022${last2}" },
+      riders: { last2: (v) => digitsOf(v).slice(-2) },
+      validate: (v) => digitsOf(v).length >= 5 ? null : "expected at least 5 digits"
+    };
+  },
+  /** Digest-only password: verify-without-reveal; never listed, never revealed.
+   *  Enumeration math is on the caller for low-entropy values — see the
+   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
+   *
+   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+   *  `findByDigest`). Cost band you are accepting:
+   *
+   *  equal values produce equal store-visible tags: anyone with store access
+   *  learns which records share this secret and how many share each value —
+   *  never the value itself. A collection-DEK holder can additionally test
+   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+   *  answers) offline recovery of the equality partition is seconds-to-hours, not
+   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+   *  hardest primitive available; the iteration count raises the price but does
+   *  not make a low-entropy field safe. The real control for low-entropy fields
+   *  is the DOOR — do not enable `equatable` for them unless the partition being
+   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+   *  tags. */
+  password(opts = {}) {
+    const minLength = opts.minLength ?? 10;
+    const notLastN = opts.notLastN ?? 0;
+    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {
+      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented), got ${notLastN}`);
+    }
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "password",
+      storage: "digest-only",
+      sensitivity: "secret",
+      list: { kind: "omit" },
+      verifyNormalize: "password",
+      ...opts.rotateDays !== void 0 ? { rotateDays: opts.rotateDays } : {},
+      ...notLastN > 0 ? { notLastN } : {},
+      ...opts.equatable === true ? { equatable: true } : {},
+      validate: (v) => typeof v === "string" && v.normalize("NFC").length >= minLength ? null : `password must be at least ${minLength} characters`
+    };
+  },
+  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
+   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
+   *  enumeration math to your users; add app-side rate limiting.
+   *
+   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+   *  `findByDigest`). Cost band you are accepting:
+   *
+   *  equal values produce equal store-visible tags: anyone with store access
+   *  learns which records share this secret and how many share each value —
+   *  never the value itself. A collection-DEK holder can additionally test
+   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+   *  answers) offline recovery of the equality partition is seconds-to-hours, not
+   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+   *  hardest primitive available; the iteration count raises the price but does
+   *  not make a low-entropy field safe. The real control for low-entropy fields
+   *  is the DOOR — do not enable `equatable` for them unless the partition being
+   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+   *  tags. */
+  secretAnswer(opts = {}) {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "secretAnswer",
+      storage: "digest-only",
+      sensitivity: "secret",
+      list: { kind: "omit" },
+      verifyNormalize: "secret-answer",
+      verifyGroupMember: true,
+      ...opts.equatable === true ? { equatable: true } : {},
+      validate: (v) => typeof v === "string" && v.normalize("NFC").toLowerCase().trim().replace(/\s+/g, " ").length > 0 ? null : "secret answer must be non-empty after normalization"
+    };
+  }
+};
+
+// src/via/classified/active.ts
+function policyOf(spec) {
+  return {
+    normalize: spec.verifyNormalize ?? "password",
+    notLastN: spec.notLastN ?? 0,
+    equatable: spec.equatable === true,
+    ...spec.rotateDays !== void 0 ? { rotateDays: spec.rotateDays } : {}
+  };
+}
+var engineCtx = (ctx) => ({
+  collection: ctx.collection,
+  getEnvelope: ctx.getEnvelope,
+  resolveCek: ctx.resolveCek,
+  getDEK: ctx.getDEK,
+  now: ctx.now
+});
+function withClassified() {
+  return {
+    async reveal(ctx, id, field) {
+      const { revealSealedField } = await import("./reveal-BOY7XYFH.js");
+      const value = await revealSealedField({
+        collection: ctx.collection,
+        encrypted: ctx.encrypted,
+        getEnvelope: ctx.getEnvelope,
+        resolveCek: ctx.resolveCek,
+        getDEK: ctx.getDEK
+      }, id, field);
+      await ctx.onAccess?.("reveal", id);
+      return value;
+    },
+    async verify(ctx, id, field, candidate) {
+      const { verifyDigestField } = await import("./verify-66RHOW7N.js");
+      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
+      await ctx.onAccess?.("verify", id);
+      return verdict;
+    },
+    async verifyText(ctx, id, field, candidate) {
+      const { verifyTextField } = await import("./verify-66RHOW7N.js");
+      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
+      await ctx.onAccess?.("verify", id);
+      return verdict;
+    },
+    async matchGroup(ctx, id, answers, opts) {
+      const { matchGroupFields } = await import("./verify-66RHOW7N.js");
+      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
+      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
+      await ctx.onAccess?.("verify", id);
+      return result;
+    },
+    async computeTarget(ctx, field, candidate, costByte) {
+      const { computeBidxTarget } = await import("./find-XRGCNGNN.js");
+      const dek = await ctx.getDEK();
+      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
+    }
+  };
+}
+
+export {
+  luhnCheck,
+  classified,
+  withClassified
+};
+//# sourceMappingURL=chunk-DMFNPHCX.js.map

package/dist/chunk-DMFNPHCX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/validators.ts","../src/via/classified/presets.ts","../src/via/classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../kernel/enclave/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../kernel/enclave/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../kernel/enclave/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;AClJA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAyC;AAClF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAAyC;AACnF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAAuC;AAClF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-ELNBMFOS.js

@@ -0,0 +1,392 @@
+import {
+  envelopePayloadHash
+} from "./chunk-25NDNMQ7.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  DictKeyMissingError,
+  PermissionDeniedError
+} from "./chunk-FH542DDY.js";
+
+// src/via/lookup/handle.ts
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
+}
+var DICT_COLLECTION_PREFIX = "_dict_";
+function dictCollectionName(dictionaryName) {
+  return `${DICT_COLLECTION_PREFIX}${dictionaryName}`;
+}
+var LookupHandle = class {
+  constructor(adapter, compartmentName, dictionaryName, keyring, reservedEnvelopes, encrypted, ledger, options, findAndUpdateReferences, emitter, buildDeleteMarker, onDirty, onRecordMutated, checkReferencesOnDelete) {
+    this.adapter = adapter;
+    this.compartmentName = compartmentName;
+    this.dictionaryName = dictionaryName;
+    this.keyring = keyring;
+    this.reservedEnvelopes = reservedEnvelopes;
+    this.encrypted = encrypted;
+    this.ledger = ledger;
+    this.options = options;
+    this.findAndUpdateReferences = findAndUpdateReferences;
+    this.emitter = emitter;
+    this.buildDeleteMarker = buildDeleteMarker;
+    this.onDirty = onDirty;
+    this.onRecordMutated = onRecordMutated;
+    this.checkReferencesOnDelete = checkReferencesOnDelete;
+    this.collName = dictCollectionName(dictionaryName);
+  }
+  adapter;
+  compartmentName;
+  dictionaryName;
+  keyring;
+  reservedEnvelopes;
+  encrypted;
+  ledger;
+  options;
+  findAndUpdateReferences;
+  emitter;
+  buildDeleteMarker;
+  onDirty;
+  onRecordMutated;
+  checkReferencesOnDelete;
+  collName;
+  /**
+   * Synchronous write-through cache for dict-join support.
+   * Populated on every `put()`, `delete()`, and `rename()`. The snapshot
+   * is built from this cache by `snapshotEntries()` — the query executor
+   * calls this synchronously inside `.toArray()`.
+   *
+   * `null` means "not yet initialized" — callers should use `list()`
+   * to warm the cache before using dict joins on pre-existing data.
+   */
+  _syncCache = /* @__PURE__ */ new Map();
+  /**
+   * Return all cached entries as `{ key, labels, ...labels }` records —
+   * usable synchronously by the join executor's `snapshot()` call.
+   * Returns an empty array when the cache has never been populated.
+   */
+  snapshotEntries() {
+    return Array.from(this._syncCache.values()).map((e) => ({
+      key: e.key,
+      labels: e.labels,
+      ...e.labels
+    }));
+  }
+  // ─── Access checks ────────────────────────────────────────────────
+  requireWriteAccess() {
+    const minRole = this.options.writableBy ?? "admin";
+    const roleRank = {
+      client: 1,
+      viewer: 2,
+      operator: 3,
+      admin: 4,
+      owner: 5
+    };
+    const callerRank = roleRank[this.keyring.role] ?? 0;
+    const requiredRank = roleRank[minRole] ?? 4;
+    if (callerRank < requiredRank) {
+      throw new PermissionDeniedError(
+        `Dictionary "${this.dictionaryName}" writes require "${minRole}" role or above. Current role: "${this.keyring.role}".`
+      );
+    }
+  }
+  // ─── Internal helpers ─────────────────────────────────────────────
+  async encryptEntry(entry, version) {
+    if (!this.encrypted) {
+      return {
+        _noydb: NOYDB_FORMAT_VERSION,
+        _v: version,
+        _ts: (/* @__PURE__ */ new Date()).toISOString(),
+        _iv: "",
+        _data: JSON.stringify(entry),
+        _by: this.keyring.userId
+      };
+    }
+    const envelope = await this.reservedEnvelopes.encrypt(this.collName, JSON.stringify(entry), version);
+    return { ...envelope, _by: this.keyring.userId };
+  }
+  async decryptEntry(envelope) {
+    if (!this.encrypted) {
+      return JSON.parse(envelope._data);
+    }
+    const json = await this.reservedEnvelopes.decrypt(this.collName, envelope);
+    return JSON.parse(json);
+  }
+  /** @internal #650 Task 4 — re-read `key`'s CURRENT adapter truth into `_syncCache` (delete the
+   *  cache entry when the key is now gone). Called by `Vault._invalidateSyncApplied` after a
+   *  reserved-lookup row applies via sync, so an already-warmed snapshot/membership/altIndex read
+   *  never sees a stale verdict for a pulled vocabulary edit — the same invalidation a local
+   *  put()/delete()/rename() already triggers via `_syncCache.set`/`delete` above. */
+  async _refreshSyncCache(key) {
+    const envelope = await this.adapter.get(this.compartmentName, this.collName, key);
+    if (!envelope || isDeleteMarker(envelope)) {
+      this._syncCache.delete(key);
+      return;
+    }
+    this._syncCache.set(key, await this.decryptEntry(envelope));
+  }
+  // ─── Public API ───────────────────────────────────────────────────
+  /**
+   * Add or overwrite a single dictionary entry.
+   *
+   * @param key    The stable key to store (e.g. `'paid'`).
+   * @param labels Locale → label map (e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`).
+   */
+  async put(key, labels) {
+    this.requireWriteAccess();
+    const entry = { key, labels };
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    const version = existing ? existing._v + 1 : 1;
+    const envelope = await this.encryptEntry(entry, version);
+    await this.adapter.put(
+      this.compartmentName,
+      this.collName,
+      key,
+      envelope,
+      existing ? existing._v : void 0
+    );
+    this._syncCache.set(key, entry);
+    await this.onDirty?.(this.collName, key, "put", version);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: key,
+      action: "put"
+    });
+    await this.onRecordMutated?.(this.collName, key, "put", version);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "put",
+        collection: this.collName,
+        id: key,
+        version,
+        actor: this.keyring.userId,
+        //  — must be the real envelope hash so
+        // vault.verifyBackupIntegrity()'s data-cross-check matches.
+        payloadHash: await envelopePayloadHash(envelope)
+      });
+    }
+  }
+  /**
+   * Batch-add or overwrite multiple dictionary entries in one call.
+   *
+   * @param entries  `{ key: { locale: label } }` map.
+   */
+  async putAll(entries) {
+    this.requireWriteAccess();
+    for (const [key, labels] of Object.entries(entries)) {
+      await this.put(key, labels);
+    }
+  }
+  /**
+   * Load the label map for a single key.
+   *
+   * @returns The label map, or `null` if the key doesn't exist.
+   */
+  async get(key) {
+    const envelope = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    if (!envelope || isDeleteMarker(envelope)) return null;
+    const entry = await this.decryptEntry(envelope);
+    return entry.labels;
+  }
+  /**
+   * Delete a dictionary key.
+   *
+   * Default mode is `'strict'` — throws `DictKeyInUseError` if any
+   * registered collection has a record referencing this key. Pass
+   * `{ mode: 'warn' }` to skip the check (dev-mode cleanup only).
+   *
+   * Under sync, deletion writes a version-ordered delete-marker row rather than removing the
+   * adapter key outright (#647 fix wave 1) — markers accumulate over time; GC is future work,
+   * acceptable for vocabulary-scale data.
+   */
+  async delete(key, opts = {}) {
+    this.requireWriteAccess();
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      key
+    );
+    if (!existing || isDeleteMarker(existing)) {
+      throw new DictKeyMissingError(this.dictionaryName, key);
+    }
+    const mode = opts.mode ?? "strict";
+    if (mode === "strict") {
+      await this.checkReferencesOnDelete?.(key);
+    }
+    const nextVersion = existing._v + 1;
+    if (this.onDirty) {
+      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker(nextVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.compartmentName, this.collName, key);
+    }
+    this._syncCache.delete(key);
+    await this.onDirty?.(this.collName, key, "put", nextVersion);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: key,
+      action: "delete"
+    });
+    await this.onRecordMutated?.(this.collName, key, "delete", nextVersion);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "delete",
+        collection: this.collName,
+        id: key,
+        version: existing._v,
+        actor: this.keyring.userId,
+        //  — for delete the prior envelope is what was just
+        // removed; we hash it so the chain captures intent. The
+        // verifyBackupIntegrity data-cross-check skips delete
+        // entries entirely (the live record is gone), but the
+        // chain still benefits from a stable non-empty hash.
+        payloadHash: await envelopePayloadHash(existing)
+      });
+    }
+  }
+  /**
+   * Rename a dictionary key — the only sanctioned mass-mutation path.
+   *
+   * Atomically:
+   * 1. Adds the new key with the same labels as the old key.
+   * 2. Updates every registered record that stores the old key to
+   *    store the new key instead.
+   * 3. Deletes the old key.
+   * 4. Appends a single ledger entry recording the rename.
+   *
+   * Respects ACL: throws `PermissionDeniedError` before any mutation
+   * if the caller can't write. The cascade is best-effort atomic
+   * within this call — no two-phase commit across adapter calls.
+   *
+   * Cascade-on-delete is NOT supported. Use `rename()` when you need
+   * to change a key that records reference.
+   */
+  async rename(oldKey, newKey) {
+    this.requireWriteAccess();
+    const existing = await this.adapter.get(
+      this.compartmentName,
+      this.collName,
+      oldKey
+    );
+    if (!existing || isDeleteMarker(existing)) {
+      throw new DictKeyMissingError(this.dictionaryName, oldKey);
+    }
+    const oldEntry = await this.decryptEntry(existing);
+    const newEntry = { key: newKey, labels: oldEntry.labels };
+    const newEnvelope = await this.encryptEntry(newEntry, 1);
+    await this.adapter.put(
+      this.compartmentName,
+      this.collName,
+      newKey,
+      newEnvelope
+    );
+    this._syncCache.set(newKey, newEntry);
+    if (this.findAndUpdateReferences) {
+      await this.findAndUpdateReferences(this.dictionaryName, oldKey, newKey);
+    }
+    const oldKeyNextVersion = existing._v + 1;
+    if (this.onDirty) {
+      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker(oldKeyNextVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.compartmentName, this.collName, oldKey);
+    }
+    this._syncCache.delete(oldKey);
+    await this.onDirty?.(this.collName, oldKey, "put", oldKeyNextVersion);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: oldKey,
+      action: "delete"
+    });
+    await this.onRecordMutated?.(this.collName, oldKey, "delete", oldKeyNextVersion);
+    await this.onDirty?.(this.collName, newKey, "put", 1);
+    this.emitter.emit("change", {
+      vault: this.compartmentName,
+      collection: this.collName,
+      id: newKey,
+      action: "put"
+    });
+    await this.onRecordMutated?.(this.collName, newKey, "put", 1);
+    if (this.ledger) {
+      await this.ledger.append({
+        op: "delete",
+        collection: this.collName,
+        id: oldKey,
+        version: existing._v,
+        actor: this.keyring.userId,
+        payloadHash: await envelopePayloadHash(existing)
+      });
+      await this.ledger.append({
+        op: "put",
+        collection: this.collName,
+        id: newKey,
+        version: 1,
+        actor: this.keyring.userId,
+        payloadHash: await envelopePayloadHash(newEnvelope)
+      });
+    }
+  }
+  /**
+   * List all entries in this dictionary.
+   *
+   * @returns Array of `{ key, labels }` objects.
+   */
+  async list() {
+    const keys = await this.adapter.list(this.compartmentName, this.collName);
+    const entries = [];
+    for (const key of keys) {
+      const envelope = await this.adapter.get(
+        this.compartmentName,
+        this.collName,
+        key
+      );
+      if (!envelope || isDeleteMarker(envelope)) {
+        this._syncCache.delete(key);
+        continue;
+      }
+      const entry = await this.decryptEntry(envelope);
+      entries.push(entry);
+      this._syncCache.set(key, entry);
+    }
+    return entries;
+  }
+  /**
+   * Resolve a key to its label for the given locale.
+   *
+   * Used by the collection's locale-aware read path to populate
+   * `<field>Label` virtual fields. Returns `undefined` when the
+   * key doesn't exist or has no label for the requested locale
+   * (after exhausting the fallback chain).
+   */
+  async resolveLabel(key, locale, fallback) {
+    const labels = await this.get(key);
+    if (!labels) return void 0;
+    if (labels[locale] !== void 0) return labels[locale];
+    const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
+    for (const fb of chain) {
+      if (fb === "any") {
+        const any = Object.values(labels)[0];
+        if (any !== void 0) return any;
+      } else if (labels[fb] !== void 0) {
+        return labels[fb];
+      }
+    }
+    return void 0;
+  }
+};
+
+export {
+  DICT_COLLECTION_PREFIX,
+  dictCollectionName,
+  LookupHandle
+};
+//# sourceMappingURL=chunk-ELNBMFOS.js.map