@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-VR24ILCR.js

@@ -0,0 +1,367 @@
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  base64ToBuffer,
+  bufferToBase64
+} from "./chunk-HUS3J5WM.js";
+import {
+  SessionExpiredError,
+  SessionNotFoundError,
+  SessionPolicyError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/session/session.ts
+var subtle = globalThis.crypto.subtle;
+var DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var sessionKeyStore = /* @__PURE__ */ new Map();
+async function createSession(keyring, vault, options = {}) {
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  const sessionId = generateULID();
+  const expiresAt = new Date(Date.now() + ttlMs).toISOString();
+  const sessionKey = await subtle.generateKey(
+    { name: "AES-GCM", length: 256 },
+    false,
+    // non-extractable — this is the tab-scope security invariant
+    ["encrypt", "decrypt"]
+  );
+  const dekMap = {};
+  for (const [collName, dek] of keyring.deks) {
+    const raw = await subtle.exportKey("raw", dek);
+    dekMap[collName] = bufferToBase64(raw);
+  }
+  const payload = JSON.stringify({
+    userId: keyring.userId,
+    displayName: keyring.displayName,
+    role: keyring.role,
+    permissions: keyring.permissions,
+    deks: dekMap,
+    salt: bufferToBase64(keyring.salt)
+  });
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const encrypted = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    sessionKey,
+    new TextEncoder().encode(payload)
+  );
+  const token = {
+    _noydb_session: 1,
+    sessionId,
+    userId: keyring.userId,
+    vault,
+    role: keyring.role,
+    expiresAt,
+    wrappedKek: bufferToBase64(encrypted),
+    kekIv: bufferToBase64(iv)
+  };
+  sessionKeyStore.set(sessionId, sessionKey);
+  return { token, sessionId };
+}
+async function resolveSession(token) {
+  if (Date.now() > new Date(token.expiresAt).getTime()) {
+    sessionKeyStore.delete(token.sessionId);
+    throw new SessionExpiredError(token.sessionId);
+  }
+  const sessionKey = sessionKeyStore.get(token.sessionId);
+  if (!sessionKey) {
+    throw new SessionNotFoundError(token.sessionId);
+  }
+  const iv = base64ToBuffer(token.kekIv);
+  const ciphertext = base64ToBuffer(token.wrappedKek);
+  let plaintext;
+  try {
+    plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      sessionKey,
+      ciphertext
+    );
+  } catch {
+    throw new SessionNotFoundError(token.sessionId);
+  }
+  const payload = JSON.parse(new TextDecoder().decode(plaintext));
+  const deks = /* @__PURE__ */ new Map();
+  for (const [collName, rawBase64] of Object.entries(payload.deks)) {
+    const dek = await subtle.importKey(
+      "raw",
+      base64ToBuffer(rawBase64),
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(collName, dek);
+  }
+  return {
+    userId: payload.userId,
+    displayName: payload.displayName,
+    role: payload.role,
+    permissions: payload.permissions,
+    deks,
+    kek: null,
+    // KEK not available in session context
+    salt: base64ToBuffer(payload.salt),
+    authenticators: []
+  };
+}
+function revokeSession(sessionId) {
+  sessionKeyStore.delete(sessionId);
+}
+function isSessionAlive(token) {
+  if (Date.now() > new Date(token.expiresAt).getTime()) return false;
+  return sessionKeyStore.has(token.sessionId);
+}
+function revokeAllSessions() {
+  sessionKeyStore.clear();
+}
+function activeSessionCount() {
+  return sessionKeyStore.size;
+}
+
+// src/with-party/session/session-policy.ts
+var PolicyEnforcer = class {
+  policy;
+  sessionId;
+  onRevoke;
+  createdAt;
+  lastActivityAt;
+  idleTimer = null;
+  absoluteTimer = null;
+  visibilityHandler = null;
+  constructor(opts) {
+    this.policy = opts.policy;
+    this.sessionId = opts.sessionId;
+    this.onRevoke = opts.onRevoke;
+    this.createdAt = Date.now();
+    this.lastActivityAt = Date.now();
+    this.scheduleIdleTimer();
+    this.scheduleAbsoluteTimer();
+    this.registerBackgroundLock();
+  }
+  /**
+   * Record an activity timestamp and reset the idle timer.
+   * Call this at the top of every Noydb public method.
+   */
+  touch() {
+    this.lastActivityAt = Date.now();
+    this.scheduleIdleTimer();
+  }
+  /**
+   * Check whether the given operation is allowed under the active policy.
+   * Throws `SessionPolicyError` if the operation requires re-authentication.
+   * Throws `SessionExpiredError` if the absolute timeout has been exceeded
+   * (defensive check in case the timer fired before the call arrived).
+   *
+   * This is a synchronous check — callers don't await it.
+   */
+  checkOperation(op) {
+    const { absoluteTimeoutMs } = this.policy;
+    if (absoluteTimeoutMs !== void 0 && Date.now() - this.createdAt >= absoluteTimeoutMs) {
+      this.expire("absolute");
+      throw new SessionExpiredError(this.sessionId);
+    }
+    const required = this.policy.requireReAuthFor ?? [];
+    if (required.includes(op)) {
+      throw new SessionPolicyError(op);
+    }
+  }
+  /**
+   * Tear down timers and background-lock listener. Call from `Noydb.close()`
+   * and whenever the session is revoked externally.
+   */
+  destroy() {
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    if (this.absoluteTimer) {
+      clearTimeout(this.absoluteTimer);
+      this.absoluteTimer = null;
+    }
+    if (this.visibilityHandler && typeof document !== "undefined") {
+      document.removeEventListener("visibilitychange", this.visibilityHandler);
+      this.visibilityHandler = null;
+    }
+  }
+  /** How long since the last activity, in ms. */
+  get idleMs() {
+    return Date.now() - this.lastActivityAt;
+  }
+  /** How long since session creation, in ms. */
+  get ageMs() {
+    return Date.now() - this.createdAt;
+  }
+  // ── Private ──────────────────────────────────────────────────────────
+  scheduleIdleTimer() {
+    const { idleTimeoutMs } = this.policy;
+    if (!idleTimeoutMs) return;
+    if (this.idleTimer) clearTimeout(this.idleTimer);
+    this.idleTimer = setTimeout(() => {
+      this.expire("idle");
+    }, idleTimeoutMs);
+  }
+  scheduleAbsoluteTimer() {
+    const { absoluteTimeoutMs } = this.policy;
+    if (!absoluteTimeoutMs) return;
+    if (this.absoluteTimer) clearTimeout(this.absoluteTimer);
+    this.absoluteTimer = setTimeout(() => {
+      this.expire("absolute");
+    }, absoluteTimeoutMs);
+  }
+  registerBackgroundLock() {
+    if (!this.policy.lockOnBackground) return;
+    if (typeof document === "undefined") return;
+    this.visibilityHandler = () => {
+      if (document.hidden) {
+        this.expire("background");
+      }
+    };
+    document.addEventListener("visibilitychange", this.visibilityHandler);
+  }
+  expire(reason) {
+    this.destroy();
+    revokeSession(this.sessionId);
+    this.onRevoke(reason);
+  }
+};
+function createEnforcer(opts) {
+  return new PolicyEnforcer(opts);
+}
+function validateSessionPolicy(policy) {
+  const { idleTimeoutMs, absoluteTimeoutMs } = policy;
+  if (idleTimeoutMs !== void 0 && (typeof idleTimeoutMs !== "number" || idleTimeoutMs <= 0)) {
+    throw new Error(`SessionPolicy.idleTimeoutMs must be a positive number, got ${idleTimeoutMs}`);
+  }
+  if (absoluteTimeoutMs !== void 0 && (typeof absoluteTimeoutMs !== "number" || absoluteTimeoutMs <= 0)) {
+    throw new Error(`SessionPolicy.absoluteTimeoutMs must be a positive number, got ${absoluteTimeoutMs}`);
+  }
+  if (idleTimeoutMs !== void 0 && absoluteTimeoutMs !== void 0 && idleTimeoutMs >= absoluteTimeoutMs) {
+    throw new Error(
+      `SessionPolicy.idleTimeoutMs (${idleTimeoutMs}ms) must be less than absoluteTimeoutMs (${absoluteTimeoutMs}ms)`
+    );
+  }
+}
+
+// src/with-party/session/dev-unlock.ts
+var REQUIRED_ACKNOWLEDGE = "I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY";
+var STORAGE_PREFIX = "noydb:dev-unlock:";
+function assertDevEnvironment() {
+  if (typeof process !== "undefined" && process.env.NODE_ENV === "production") {
+    throw new ValidationError(
+      'devUnlock is not available in production builds. process.env.NODE_ENV is "production".'
+    );
+  }
+  if (typeof globalThis !== "undefined" && globalThis.__vite_is_production__ === true) {
+    throw new ValidationError("devUnlock is not available in production builds.");
+  }
+  if (typeof window !== "undefined" && typeof window.location !== "undefined") {
+    const host = window.location.hostname;
+    if (host !== "localhost" && host !== "127.0.0.1" && host !== "::1" && !host.endsWith(".local")) {
+      throw new ValidationError(
+        `devUnlock is only available on localhost. Current hostname: "${host}". Set NODE_ENV=development and run on localhost to use dev unlock.`
+      );
+    }
+  }
+}
+function storageKey(vault, userId) {
+  return `${STORAGE_PREFIX}${vault}:${userId}`;
+}
+function resolveStorage(persistAcrossTabs) {
+  if (typeof window === "undefined") {
+    throw new ValidationError("devUnlock requires a browser environment (window.sessionStorage / window.localStorage).");
+  }
+  return persistAcrossTabs ? window.localStorage : window.sessionStorage;
+}
+async function enableDevUnlock(vault, userId, keyring, options) {
+  if (options.acknowledge !== REQUIRED_ACKNOWLEDGE) {
+    throw new ValidationError(
+      `devUnlock requires acknowledge: '${REQUIRED_ACKNOWLEDGE}'. Got: '${options.acknowledge}'. This is intentional \u2014 the full string must appear in your source.`
+    );
+  }
+  assertDevEnvironment();
+  const storage = resolveStorage(options.persistAcrossTabs);
+  const dekMap = {};
+  for (const [collName, dek] of keyring.deks) {
+    const raw = await globalThis.crypto.subtle.exportKey("raw", dek);
+    dekMap[collName] = bufferToBase64(raw);
+  }
+  const payload = JSON.stringify({
+    _noydb_dev_unlock: 1,
+    userId: keyring.userId,
+    displayName: keyring.displayName,
+    role: keyring.role,
+    permissions: keyring.permissions,
+    deks: dekMap,
+    salt: bufferToBase64(keyring.salt)
+  });
+  storage.setItem(storageKey(vault, userId), payload);
+  console.warn(
+    "%c\u26A0\uFE0F NOYDB DEV UNLOCK ACTIVE \u26A0\uFE0F",
+    "color: red; font-size: 16px; font-weight: bold",
+    `
+
+Vault "${vault}" user "${userId}" is stored in ${options.persistAcrossTabs ? "localStorage" : "sessionStorage"} in PLAINTEXT DEKs.
+This is ONLY safe for local development. Never use in production.
+Call clearDevUnlock() to remove.`
+  );
+}
+async function loadDevUnlock(vault, userId, options = {}) {
+  if (typeof window === "undefined") return null;
+  const storage = resolveStorage(options.persistAcrossTabs);
+  const raw = storage.getItem(storageKey(vault, userId));
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (parsed._noydb_dev_unlock !== 1) return null;
+  const deks = /* @__PURE__ */ new Map();
+  for (const [collName, rawBase64] of Object.entries(parsed.deks)) {
+    const dek = await globalThis.crypto.subtle.importKey(
+      "raw",
+      base64ToBuffer(rawBase64),
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(collName, dek);
+  }
+  return {
+    userId: parsed.userId,
+    displayName: parsed.displayName,
+    role: parsed.role,
+    permissions: parsed.permissions,
+    deks,
+    kek: null,
+    salt: base64ToBuffer(parsed.salt),
+    authenticators: []
+  };
+}
+function clearDevUnlock(vault, userId, options = {}) {
+  if (typeof window === "undefined") return;
+  const storage = resolveStorage(options.persistAcrossTabs);
+  storage.removeItem(storageKey(vault, userId));
+}
+function isDevUnlockActive(vault, userId, options = {}) {
+  if (typeof window === "undefined") return false;
+  const storage = resolveStorage(options.persistAcrossTabs);
+  return storage.getItem(storageKey(vault, userId)) !== null;
+}
+
+export {
+  createSession,
+  resolveSession,
+  revokeSession,
+  isSessionAlive,
+  revokeAllSessions,
+  activeSessionCount,
+  PolicyEnforcer,
+  createEnforcer,
+  validateSessionPolicy,
+  enableDevUnlock,
+  loadDevUnlock,
+  clearDevUnlock,
+  isDevUnlockActive
+};
+//# sourceMappingURL=chunk-VR24ILCR.js.map

package/dist/chunk-VYYM3MEN.js

@@ -0,0 +1,98 @@
+// src/with-shape/introspection/fields.ts
+function jsonSchemaType(node) {
+  if (Array.isArray(node.type)) {
+    const non = node.type.filter((t) => t !== "null");
+    return non[0] ?? "opaque";
+  }
+  if (node.enum && Array.isArray(node.enum)) return "enum";
+  if (node.const !== void 0) return "enum";
+  if (typeof node.type === "string") return node.type;
+  return "opaque";
+}
+function isIntSentinel(node, value) {
+  return node.type === "integer" && Math.abs(value) === Number.MAX_SAFE_INTEGER;
+}
+function constraintsFor(node) {
+  const out = {};
+  if (node.enum) out.values = node.enum;
+  if (node.const !== void 0) out.values = [node.const];
+  if (node.minLength !== void 0) out.minLength = node.minLength;
+  if (node.maxLength !== void 0) out.maxLength = node.maxLength;
+  if (node.pattern !== void 0) out.pattern = node.pattern;
+  if (node.format !== void 0) out.format = node.format;
+  if (node.minimum !== void 0 && !isIntSentinel(node, node.minimum)) out.minimum = node.minimum;
+  if (node.maximum !== void 0 && !isIntSentinel(node, node.maximum)) out.maximum = node.maximum;
+  if (node.exclusiveMinimum !== void 0) out.gt = node.exclusiveMinimum;
+  if (node.exclusiveMaximum !== void 0) out.lt = node.exclusiveMaximum;
+  return Object.keys(out).length === 0 ? void 0 : out;
+}
+function extractObjectFields(obj, source, refs) {
+  const required = new Set(Array.isArray(obj.required) ? obj.required : []);
+  const fields = {};
+  if (!obj.properties || typeof obj.properties !== "object") return { fields, required };
+  for (const [name, node] of Object.entries(obj.properties)) {
+    const descriptor = {
+      type: jsonSchemaType(node),
+      source,
+      ...required.has(name) ? {} : { optional: true },
+      ...refs?.[name] ? { references: `${refs[name].target}.id` } : {}
+    };
+    const constraints = constraintsFor(node);
+    if (constraints) descriptor.constraints = constraints;
+    fields[name] = descriptor;
+  }
+  return { fields, required };
+}
+function mergeUnionMembers(members, source, refs) {
+  if (members.length === 0) return {};
+  const extracted = members.filter((m) => m.properties && typeof m.properties === "object").map((m) => extractObjectFields(m, source, refs));
+  if (extracted.length === 0) return {};
+  const allNames = /* @__PURE__ */ new Set();
+  for (const { fields } of extracted) {
+    for (const name of Object.keys(fields)) allNames.add(name);
+  }
+  const memberCount = extracted.length;
+  const out = {};
+  for (const name of allNames) {
+    const presentIn = extracted.filter(({ fields }) => name in fields);
+    const requiredInAll = presentIn.length === memberCount && presentIn.every(({ required }) => required.has(name));
+    const base = presentIn[0].fields[name];
+    const allValues = [];
+    for (const { fields } of presentIn) {
+      const fd = fields[name];
+      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {
+        for (const v of fd.constraints.values) {
+          if (!allValues.includes(v)) allValues.push(v);
+        }
+      }
+    }
+    const mergedConstraints = allValues.length > 0 ? { ...base.constraints ?? {}, values: allValues } : base.constraints;
+    const descriptor = {
+      type: base.type,
+      source,
+      ...requiredInAll ? {} : { optional: true },
+      ...base.references ? { references: base.references } : {}
+    };
+    if (mergedConstraints) {
+      descriptor.constraints = mergedConstraints;
+    }
+    out[name] = descriptor;
+  }
+  return out;
+}
+function jsonSchemaToFields(jsonSchema, source, refs) {
+  if (!jsonSchema || typeof jsonSchema !== "object") return {};
+  const root = jsonSchema;
+  const unionMembers = root.anyOf ?? root.oneOf;
+  if (Array.isArray(unionMembers) && unionMembers.length > 0) {
+    return mergeUnionMembers(unionMembers, source, refs);
+  }
+  if (!root.properties || typeof root.properties !== "object") return {};
+  const { fields } = extractObjectFields(root, source, refs);
+  return fields;
+}
+
+export {
+  jsonSchemaToFields
+};
+//# sourceMappingURL=chunk-VYYM3MEN.js.map

package/dist/chunk-VYYM3MEN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/fields.ts"],"sourcesContent":["/**\n * Map a JSON Schema (Draft 2020-12 produced by `zod-to-json-schema`) into\n * the {@link FieldDescriptor} map consumed by {@link VaultSchemaSnapshot}.\n *\n * Used by both the persisted-schema path (decrypted envelope body) and the\n * live-validator path (in-process derivation).\n *\n * @module\n */\n\nimport type { FieldDescriptor, FieldSource } from './types.js'\n\ninterface JsonSchemaShape {\n  type?: string | string[]\n  properties?: Record<string, JsonSchemaShape>\n  required?: string[]\n  enum?: unknown[]\n  const?: unknown\n  minLength?: number\n  maxLength?: number\n  pattern?: string\n  minimum?: number\n  maximum?: number\n  exclusiveMinimum?: number\n  exclusiveMaximum?: number\n  format?: string\n  items?: JsonSchemaShape\n  oneOf?: JsonSchemaShape[]\n  anyOf?: JsonSchemaShape[]\n}\n\nfunction jsonSchemaType(node: JsonSchemaShape): string {\n  if (Array.isArray(node.type)) {\n    const non = node.type.filter((t) => t !== 'null')\n    return non[0] ?? 'opaque'\n  }\n  if (node.enum && Array.isArray(node.enum)) return 'enum'\n  // JSON Schema `const` is used by zod-to-json-schema for z.literal(...)\n  if (node.const !== undefined) return 'enum'\n  if (typeof node.type === 'string') return node.type\n  return 'opaque'\n}\n\n// #657 — zod v4's native `toJSONSchema()` injects a ±Number.MAX_SAFE_INTEGER\n// bound on every `.int()` field (a JS-safe-integer representability fact,\n// not authored validation intent — `type: 'integer'` already carries it).\n// Empirically verified: `z.number().int()` → `{type:'integer', minimum:\n// -9007199254740991, maximum:9007199254740991}`, and — critically — zod\n// emits NO metadata distinguishing that derived bound from an authored one\n// at the exact same value (`z.number().min(-9007199254740991)\n// .max(9007199254740991)` on a plain, non-int number produces a\n// byte-identical minimum/maximum). Without that distinguishing signal, a\n// value-based filter gated on `type === 'integer'` is the pragmatic call:\n// it never touches a non-int field's authored bound (whatever its value),\n// and an authored `.int().min(Number.MAX_SAFE_INTEGER)` is pathological\n// either way, so folding it into the same omission is an acceptable trade.\nfunction isIntSentinel(node: JsonSchemaShape, value: number): boolean {\n  return node.type === 'integer' && Math.abs(value) === Number.MAX_SAFE_INTEGER\n}\n\nfunction constraintsFor(node: JsonSchemaShape): Record<string, unknown> | undefined {\n  const out: Record<string, unknown> = {}\n  if (node.enum) out.values = node.enum\n  // JSON Schema `const` (used by zod-to-json-schema for z.literal) — treat like a single-value enum\n  if (node.const !== undefined) out.values = [node.const]\n  if (node.minLength !== undefined) out.minLength = node.minLength\n  if (node.maxLength !== undefined) out.maxLength = node.maxLength\n  if (node.pattern !== undefined) out.pattern = node.pattern\n  if (node.format !== undefined) out.format = node.format\n  if (node.minimum !== undefined && !isIntSentinel(node, node.minimum)) out.minimum = node.minimum\n  if (node.maximum !== undefined && !isIntSentinel(node, node.maximum)) out.maximum = node.maximum\n  if (node.exclusiveMinimum !== undefined) out.gt = node.exclusiveMinimum\n  if (node.exclusiveMaximum !== undefined) out.lt = node.exclusiveMaximum\n  return Object.keys(out).length === 0 ? undefined : out\n}\n\n/**\n * Extract fields from a single JSON Schema object node (must have `properties`).\n * Used by both the plain-object path and the per-member extraction in the union path.\n */\nfunction extractObjectFields(\n  obj: JsonSchemaShape,\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): { fields: Record<string, FieldDescriptor>; required: Set<string> } {\n  const required = new Set(Array.isArray(obj.required) ? obj.required : [])\n  const fields: Record<string, FieldDescriptor> = {}\n  if (!obj.properties || typeof obj.properties !== 'object') return { fields, required }\n\n  for (const [name, node] of Object.entries(obj.properties)) {\n    const descriptor: FieldDescriptor = {\n      type: jsonSchemaType(node),\n      source,\n      ...(required.has(name) ? {} : { optional: true }),\n      ...(refs?.[name] ? { references: `${refs[name].target}.id` } : {}),\n    }\n    const constraints = constraintsFor(node)\n    if (constraints) (descriptor as { constraints?: Record<string, unknown> }).constraints = constraints\n    fields[name] = descriptor\n  }\n\n  return { fields, required }\n}\n\n/**\n * Merge field descriptors from multiple union members.\n *\n * Merge rules:\n * - Emit the UNION of all field names so no member's fields are hidden.\n * - A field is required (optional=false/absent) only when it is required in\n *   EVERY member; otherwise it is marked optional=true.\n * - For the discriminator field (appears in every member with a `const` value),\n *   collect the const values from all members and surface them as constraints.values\n *   so the caller can see the full literal set.\n * - For conflicting types across members, first-seen wins.\n */\nfunction mergeUnionMembers(\n  members: JsonSchemaShape[],\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): Record<string, FieldDescriptor> {\n  if (members.length === 0) return {}\n\n  // Extract per-member fields + required sets\n  const extracted = members\n    .filter((m) => m.properties && typeof m.properties === 'object')\n    .map((m) => extractObjectFields(m, source, refs))\n\n  if (extracted.length === 0) return {}\n\n  // Collect all field names across all members\n  const allNames = new Set<string>()\n  for (const { fields } of extracted) {\n    for (const name of Object.keys(fields)) allNames.add(name)\n  }\n\n  const memberCount = extracted.length\n  const out: Record<string, FieldDescriptor> = {}\n\n  for (const name of allNames) {\n    // Which members contain this field?\n    const presentIn = extracted.filter(({ fields }) => name in fields)\n    const requiredInAll = presentIn.length === memberCount\n      && presentIn.every(({ required }) => required.has(name))\n\n    // Use first-seen descriptor as the base (presentIn is always non-empty here since\n    // we iterate names that appeared in at least one member's fields)\n    const base = presentIn[0]!.fields[name]!\n\n    // For discriminator-like fields: collect const/enum values across all members\n    // to surface the full literal set in constraints.values\n    const allValues: unknown[] = []\n    for (const { fields } of presentIn) {\n      const fd = fields[name]\n      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {\n        for (const v of fd.constraints.values) {\n          if (!allValues.includes(v)) allValues.push(v)\n        }\n      }\n    }\n\n    const mergedConstraints: Record<string, unknown> | undefined =\n      allValues.length > 0\n        ? { ...(base.constraints ?? {}), values: allValues }\n        : base.constraints\n\n    const descriptor: FieldDescriptor = {\n      type: base.type,\n      source,\n      ...(requiredInAll ? {} : { optional: true }),\n      ...(base.references ? { references: base.references } : {}),\n    }\n    if (mergedConstraints) {\n      (descriptor as { constraints?: Record<string, unknown> }).constraints = mergedConstraints\n    }\n    out[name] = descriptor\n  }\n\n  return out\n}\n\nexport function jsonSchemaToFields(\n  jsonSchema: unknown,\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): Record<string, FieldDescriptor> {\n  if (!jsonSchema || typeof jsonSchema !== 'object') return {}\n  const root = jsonSchema as JsonSchemaShape\n\n  // Handle discriminated unions: zod-to-json-schema emits anyOf/oneOf for z.discriminatedUnion\n  const unionMembers = root.anyOf ?? root.oneOf\n  if (Array.isArray(unionMembers) && unionMembers.length > 0) {\n    return mergeUnionMembers(unionMembers, source, refs)\n  }\n\n  if (!root.properties || typeof root.properties !== 'object') return {}\n\n  const { fields } = extractObjectFields(root, source, refs)\n  return fields\n}\n"],"mappings":";AA+BA,SAAS,eAAe,MAA+B;AACrD,MAAI,MAAM,QAAQ,KAAK,IAAI,GAAG;AAC5B,UAAM,MAAM,KAAK,KAAK,OAAO,CAAC,MAAM,MAAM,MAAM;AAChD,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB;AACA,MAAI,KAAK,QAAQ,MAAM,QAAQ,KAAK,IAAI,EAAG,QAAO;AAElD,MAAI,KAAK,UAAU,OAAW,QAAO;AACrC,MAAI,OAAO,KAAK,SAAS,SAAU,QAAO,KAAK;AAC/C,SAAO;AACT;AAeA,SAAS,cAAc,MAAuB,OAAwB;AACpE,SAAO,KAAK,SAAS,aAAa,KAAK,IAAI,KAAK,MAAM,OAAO;AAC/D;AAEA,SAAS,eAAe,MAA4D;AAClF,QAAM,MAA+B,CAAC;AACtC,MAAI,KAAK,KAAM,KAAI,SAAS,KAAK;AAEjC,MAAI,KAAK,UAAU,OAAW,KAAI,SAAS,CAAC,KAAK,KAAK;AACtD,MAAI,KAAK,cAAc,OAAW,KAAI,YAAY,KAAK;AACvD,MAAI,KAAK,cAAc,OAAW,KAAI,YAAY,KAAK;AACvD,MAAI,KAAK,YAAY,OAAW,KAAI,UAAU,KAAK;AACnD,MAAI,KAAK,WAAW,OAAW,KAAI,SAAS,KAAK;AACjD,MAAI,KAAK,YAAY,UAAa,CAAC,cAAc,MAAM,KAAK,OAAO,EAAG,KAAI,UAAU,KAAK;AACzF,MAAI,KAAK,YAAY,UAAa,CAAC,cAAc,MAAM,KAAK,OAAO,EAAG,KAAI,UAAU,KAAK;AACzF,MAAI,KAAK,qBAAqB,OAAW,KAAI,KAAK,KAAK;AACvD,MAAI,KAAK,qBAAqB,OAAW,KAAI,KAAK,KAAK;AACvD,SAAO,OAAO,KAAK,GAAG,EAAE,WAAW,IAAI,SAAY;AACrD;AAMA,SAAS,oBACP,KACA,QACA,MACoE;AACpE,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC,CAAC;AACxE,QAAM,SAA0C,CAAC;AACjD,MAAI,CAAC,IAAI,cAAc,OAAO,IAAI,eAAe,SAAU,QAAO,EAAE,QAAQ,SAAS;AAErF,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACzD,UAAM,aAA8B;AAAA,MAClC,MAAM,eAAe,IAAI;AAAA,MACzB;AAAA,MACA,GAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC/C,GAAI,OAAO,IAAI,IAAI,EAAE,YAAY,GAAG,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IAClE;AACA,UAAM,cAAc,eAAe,IAAI;AACvC,QAAI,YAAa,CAAC,WAAyD,cAAc;AACzF,WAAO,IAAI,IAAI;AAAA,EACjB;AAEA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAcA,SAAS,kBACP,SACA,QACA,MACiC;AACjC,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAY,QACf,OAAO,CAAC,MAAM,EAAE,cAAc,OAAO,EAAE,eAAe,QAAQ,EAC9D,IAAI,CAAC,MAAM,oBAAoB,GAAG,QAAQ,IAAI,CAAC;AAElD,MAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAGpC,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,EAAE,OAAO,KAAK,WAAW;AAClC,eAAW,QAAQ,OAAO,KAAK,MAAM,EAAG,UAAS,IAAI,IAAI;AAAA,EAC3D;AAEA,QAAM,cAAc,UAAU;AAC9B,QAAM,MAAuC,CAAC;AAE9C,aAAW,QAAQ,UAAU;AAE3B,UAAM,YAAY,UAAU,OAAO,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjE,UAAM,gBAAgB,UAAU,WAAW,eACtC,UAAU,MAAM,CAAC,EAAE,SAAS,MAAM,SAAS,IAAI,IAAI,CAAC;AAIzD,UAAM,OAAO,UAAU,CAAC,EAAG,OAAO,IAAI;AAItC,UAAM,YAAuB,CAAC;AAC9B,eAAW,EAAE,OAAO,KAAK,WAAW;AAClC,YAAM,KAAK,OAAO,IAAI;AACtB,UAAI,IAAI,aAAa,UAAU,MAAM,QAAQ,GAAG,YAAY,MAAM,GAAG;AACnE,mBAAW,KAAK,GAAG,YAAY,QAAQ;AACrC,cAAI,CAAC,UAAU,SAAS,CAAC,EAAG,WAAU,KAAK,CAAC;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBACJ,UAAU,SAAS,IACf,EAAE,GAAI,KAAK,eAAe,CAAC,GAAI,QAAQ,UAAU,IACjD,KAAK;AAEX,UAAM,aAA8B;AAAA,MAClC,MAAM,KAAK;AAAA,MACX;AAAA,MACA,GAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC1C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,mBAAmB;AACrB,MAAC,WAAyD,cAAc;AAAA,IAC1E;AACA,QAAI,IAAI,IAAI;AAAA,EACd;AAEA,SAAO;AACT;AAEO,SAAS,mBACd,YACA,QACA,MACiC;AACjC,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO,CAAC;AAC3D,QAAM,OAAO;AAGb,QAAM,eAAe,KAAK,SAAS,KAAK;AACxC,MAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,WAAO,kBAAkB,cAAc,QAAQ,IAAI;AAAA,EACrD;AAEA,MAAI,CAAC,KAAK,cAAc,OAAO,KAAK,eAAe,SAAU,QAAO,CAAC;AAErE,QAAM,EAAE,OAAO,IAAI,oBAAoB,MAAM,QAAQ,IAAI;AACzD,SAAO;AACT;","names":[]}