@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-W5D62AQD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/presence.ts","../src/with-party/team/sync.ts","../src/with-party/team/sync-transaction.ts"],"sourcesContent":["/**\n * Presence handle — real-time awareness of who is viewing/editing a collection.\n * encrypted ephemeral channel keyed by collection DEK via HKDF.\n *\n * The presence key is derived from the collection DEK so:\n *  - The adapter never learns user identities from presence payloads.\n *  - Presence rotates automatically when the DEK rotates (revoked users\n *    can no longer participate after a DEK rotation).\n *\n * Two transport strategies:\n *  1. **Pub/sub** (real-time): used when the adapter implements\n *     `presencePublish` and `presenceSubscribe`.\n *  2. **Storage-poll** (fallback): presence records are written to a\n *     reserved `_presence_<collection>` collection on the sync adapter\n *     (if available) or local adapter, and polled periodically.\n */\n\nimport type { NoydbStore, PresencePeer } from '../../kernel/types.js'\nimport { encrypt, decrypt, generateIV, bufferToBase64, derivePresenceKey, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n/** Options for constructing a PresenceHandle. @internal */\nexport interface PresenceHandleOpts {\n  /** Local adapter for storage-poll fallback. */\n  adapter: NoydbStore\n  /** Remote (sync) adapter — preferred for broadcasting presence if available. */\n  syncAdapter?: NoydbStore\n  /** Vault name — used as part of the channel and storage key. */\n  vault: string\n  /** Collection name — used as HKDF `info` and channel suffix. */\n  collectionName: string\n  /** Calling user's ID, embedded unencrypted in storage records. */\n  userId: string\n  /** Whether encryption is active. When false, presence payloads are stored as JSON. */\n  encrypted: boolean\n  /** Callback that resolves the collection DEK (used to derive the presence key). */\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  /** How long (ms) before a peer's presence is considered stale. Default: 30_000. */\n  staleMs?: number\n  /** Poll interval (ms) for the storage-poll fallback. Default: 5_000. */\n  pollIntervalMs?: number\n}\n\n/**\n * Internal storage envelope for the storage-poll fallback.\n * Written to `_presence_<collection>` as `{ userId, lastSeen, iv, data }`.\n */\ninterface StoragePresenceRecord {\n  userId: string\n  lastSeen: string\n  iv: string    // base64 AES-GCM IV (empty when not encrypted)\n  data: string  // base64 ciphertext or JSON string when not encrypted\n}\n\n/** Presence handle for a single collection. */\nexport class PresenceHandle<P> {\n  private readonly adapter: NoydbStore\n  private readonly syncAdapter: NoydbStore | undefined\n  private readonly vault: string\n  private readonly collectionName: string\n  private readonly userId: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly staleMs: number\n  private readonly pollIntervalMs: number\n  private readonly channel: string\n  private readonly storageCollection: string\n\n  private presenceKey: EnclaveKey | null = null\n  private subscribers: Array<(peers: PresencePeer<P>[]) => void> = []\n  private unsubscribePubSub: (() => void) | null = null\n  private pollTimer: ReturnType<typeof setInterval> | null = null\n  private stopped = false\n\n  constructor(opts: PresenceHandleOpts) {\n    this.adapter = opts.adapter\n    this.syncAdapter = opts.syncAdapter\n    this.vault = opts.vault\n    this.collectionName = opts.collectionName\n    this.userId = opts.userId\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.staleMs = opts.staleMs ?? 30_000\n    this.pollIntervalMs = opts.pollIntervalMs ?? 5_000\n    // Channel used by pub/sub adapters — vault-scoped so two collections\n    // in the same vault don't bleed into each other's presence channels.\n    this.channel = `${opts.vault}:${opts.collectionName}:presence`\n    // Reserved collection name for the storage-poll fallback.\n    this.storageCollection = `_presence_${opts.collectionName}`\n  }\n\n  /**\n   * Announce yourself (or update your cursor/status).\n   * Encrypts `payload` with the presence key and publishes it.\n   */\n  async update(payload: P): Promise<void> {\n    if (this.stopped) return\n\n    const key = await this.getPresenceKey()\n    const now = new Date().toISOString()\n    const plaintext = JSON.stringify({ userId: this.userId, lastSeen: now, payload })\n    let encryptedPayload: string\n\n    if (this.encrypted && key) {\n      const iv = generateIV()\n      const ivB64 = bufferToBase64(iv)\n      const { data } = await encrypt(plaintext, key)\n      encryptedPayload = JSON.stringify({ iv: ivB64, data })\n    } else {\n      encryptedPayload = plaintext\n    }\n\n    // Pub/sub path — publish to any adapter that supports it\n    const pubAdapter = this.getPubSubAdapter()\n    if (pubAdapter?.presencePublish) {\n      await pubAdapter.presencePublish(this.channel, encryptedPayload)\n    }\n\n    // Storage-poll path — write a record to the storage adapter\n    await this.writeStorageRecord(payload, now)\n  }\n\n  /**\n   * Subscribe to presence updates. The callback receives a filtered, decrypted\n   * list of all currently-active peers (excluding yourself, excluding stale).\n   *\n   * Returns an unsubscribe function. Also call `stop()` to release all resources.\n   */\n  subscribe(cb: (peers: PresencePeer<P>[]) => void): () => void {\n    if (this.stopped) return () => {}\n\n    this.subscribers.push(cb)\n\n    // Start pub/sub listener on first subscriber\n    if (this.subscribers.length === 1) {\n      this.startListening()\n    }\n\n    return () => {\n      this.subscribers = this.subscribers.filter(s => s !== cb)\n      if (this.subscribers.length === 0) this.stopListening()\n    }\n  }\n\n  /** Stop all listening and clear resources. */\n  stop(): void {\n    this.stopped = true\n    this.stopListening()\n    this.subscribers = []\n  }\n\n  // ─── Private ────────────────────────────────────────────────────────\n\n  private async getPresenceKey(): Promise<EnclaveKey | null> {\n    if (!this.encrypted) return null\n    if (!this.presenceKey) {\n      try {\n        const dek = await this.getDEK(this.collectionName)\n        this.presenceKey = await derivePresenceKey(dek, this.collectionName)\n      } catch {\n        // no-op — presence degrades gracefully if crypto fails\n      }\n    }\n    return this.presenceKey\n  }\n\n  private getPubSubAdapter(): NoydbStore | undefined {\n    // Prefer the sync adapter (it broadcasts to other devices)\n    if (this.syncAdapter?.presencePublish) return this.syncAdapter\n    if (this.adapter.presencePublish) return this.adapter\n    return undefined\n  }\n\n  private startListening(): void {\n    const pubAdapter = this.getPubSubAdapter()\n\n    if (pubAdapter?.presenceSubscribe) {\n      // Real-time pub/sub path\n      this.unsubscribePubSub = pubAdapter.presenceSubscribe(\n        this.channel,\n        (encryptedPayload) => { void this.handlePubSubMessage(encryptedPayload) },\n      )\n    } else {\n      // Storage-poll fallback\n      this.pollTimer = setInterval(\n        () => { void this.pollStoragePresence() },\n        this.pollIntervalMs,\n      )\n      // Kick off an immediate poll\n      void this.pollStoragePresence()\n    }\n  }\n\n  private stopListening(): void {\n    if (this.unsubscribePubSub) {\n      this.unsubscribePubSub()\n      this.unsubscribePubSub = null\n    }\n    if (this.pollTimer) {\n      clearInterval(this.pollTimer)\n      this.pollTimer = null\n    }\n  }\n\n  private async handlePubSubMessage(encryptedPayload: string): Promise<void> {\n    try {\n      const peer = await this.decryptPresencePayload(encryptedPayload)\n      if (!peer || peer.userId === this.userId) return\n\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      if (peer.lastSeen < cutoff) return\n\n      // Deliver only this new peer to subscribers; a full snapshot poll follows\n      // on next interval. For pub/sub, we could maintain a map of active peers,\n      // but for simplicity: emit a snapshot read from storage.\n      await this.pollStoragePresence()\n    } catch {\n      // Decrypt failure — stale key or tampered payload, ignore\n    }\n  }\n\n  private async decryptPresencePayload(\n    encryptedPayload: string,\n  ): Promise<{ userId: string; lastSeen: string; payload: P } | null> {\n    const key = await this.getPresenceKey()\n\n    if (!this.encrypted || !key) {\n      return JSON.parse(encryptedPayload) as { userId: string; lastSeen: string; payload: P }\n    }\n\n    const { iv: ivB64, data } = JSON.parse(encryptedPayload) as { iv: string; data: string }\n    const plaintext = await decrypt(ivB64, data, key)\n    return JSON.parse(plaintext) as { userId: string; lastSeen: string; payload: P }\n  }\n\n  private async writeStorageRecord(payload: P, now: string): Promise<void> {\n    const key = await this.getPresenceKey()\n    const plaintext = JSON.stringify(payload)\n    let iv = ''\n    let data: string\n\n    if (this.encrypted && key) {\n      const ivBytes = generateIV()\n      iv = bufferToBase64(ivBytes)\n      const result = await encrypt(plaintext, key)\n      data = result.data\n    } else {\n      data = plaintext\n    }\n\n    const record: StoragePresenceRecord = { userId: this.userId, lastSeen: now, iv, data }\n    const json = JSON.stringify(record)\n\n    // Use the sync adapter if available (so other devices can read it);\n    // fall back to local adapter.\n    const storeAdapter = this.syncAdapter ?? this.adapter\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: now,\n      _iv: '',\n      _data: json,\n    }\n    try {\n      await storeAdapter.put(\n        this.vault,\n        this.storageCollection,\n        this.userId,\n        envelope,\n      )\n    } catch {\n      // Presence write failure is non-fatal — the user is still present locally\n    }\n  }\n\n  private async pollStoragePresence(): Promise<void> {\n    if (this.stopped || this.subscribers.length === 0) return\n\n    try {\n      const storeAdapter = this.syncAdapter ?? this.adapter\n      const ids = await storeAdapter.list(this.vault, this.storageCollection)\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      const peers: PresencePeer<P>[] = []\n\n      for (const id of ids) {\n        if (id === this.userId) continue // skip ourselves\n        const envelope = await storeAdapter.get(this.vault, this.storageCollection, id)\n        if (!envelope) continue\n\n        const record = JSON.parse(envelope._data) as StoragePresenceRecord\n        if (record.lastSeen < cutoff) continue\n\n        let peerPayload: P\n        if (this.encrypted && this.presenceKey && record.iv) {\n          const plaintext = await decrypt(record.iv, record.data, this.presenceKey)\n          peerPayload = JSON.parse(plaintext) as P\n        } else {\n          peerPayload = JSON.parse(record.data) as P\n        }\n\n        peers.push({ userId: record.userId, payload: peerPayload, lastSeen: record.lastSeen })\n      }\n\n      for (const cb of this.subscribers) {\n        cb(peers)\n      }\n    } catch {\n      // Poll failure is non-fatal\n    }\n  }\n}\n","import type {\n  NoydbStore,\n  DirtyEntry,\n  Conflict,\n  ConflictStrategy,\n  CollectionConflictResolver,\n  PushOptions,\n  PullOptions,\n  PushResult,\n  PullResult,\n  SyncStatus,\n  EncryptedEnvelope,\n  SyncMetadata,\n  SyncTargetRole,\n  ErasureEnforcement,\n} from '../../kernel/types.js'\nimport { NOYDB_SYNC_VERSION } from '../../kernel/types.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport type { SyncPolicy } from '../../kernel/sync-policy.js'\nimport { SyncScheduler } from '../../kernel/sync-policy.js'\nimport { isTombstoneShape, isDeleteMarker } from '../../kernel/enclave/index.js'\n\n/** #650 Task 4 (#647) — the declared reserved-lookup (`_dict_*`/`_lookup_*`) collection-name\n *  registry a `SyncEngine` enumerates on pull. Explicit, not a blanket underscore-glob — other\n *  `_`-prefixed namespaces keep their `loadAll`-skip semantics untouched. */\nexport interface ReservedLookupSource {\n  /** Declared reserved-lookup collection names to enumerate on pull. */\n  collections(): readonly string[]\n}\n\n/** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */\nexport class SyncEngine {\n  private readonly local: NoydbStore\n  private readonly remote: NoydbStore\n  private readonly strategy: ConflictStrategy\n  private readonly emitter: NoydbEventEmitter\n  private readonly vault: string\n  readonly role: SyncTargetRole\n  readonly label: string | undefined\n\n  private dirty: DirtyEntry[] = []\n  private lastPush: string | null = null\n  private lastPull: string | null = null\n  private loaded = false\n  private autoSyncInterval: ReturnType<typeof setInterval> | null = null\n  private isOnline = true\n\n  /** Sync scheduler. Manages push/pull timing. */\n  readonly scheduler: SyncScheduler | null\n\n  /** Per-collection conflict resolvers registered by Collection instances. */\n  private readonly conflictResolvers = new Map<string, CollectionConflictResolver>()\n\n  /**\n   * Expands a collection-name filter to include its satellite pair partner(s)\n   * (spec #591 convergence rule 5b) — wired from vault satellite declaration\n   * via `setPairExpander`. `undefined` when no satellite has ever been\n   * declared for this vault: identity behavior, zero change for non-satellite\n   * users.\n   */\n  private pairExpander?: (names: readonly string[]) => readonly string[]\n\n  /** #598: refreshes Collection in-memory views after a sync-applied local write. Wired by the\n   *  vault at open. `action` (#640): `'delete'` for a pulled tombstone/delete-marker, `'put'`\n   *  otherwise — classified at `applyRemote`, the one choke point that holds the envelope. */\n  private cacheInvalidator?: (collection: string, id: string, action: 'put' | 'delete') => Promise<void>\n\n  /** Wire the Collection-cache invalidation hook (#598). Same injection pattern as `setPairExpander`. */\n  setCacheInvalidator(fn: (collection: string, id: string, action: 'put' | 'delete') => Promise<void>): void {\n    this.cacheInvalidator = fn\n  }\n\n  /** #638 Task 4: opens/flushes the vault's graph-dispatch touch batch around a whole `pull()`/\n   *  `push()` call, so N `applyRemote`d records feeding the same derivation/rollup/MV target\n   *  recompute once. Wired by the vault at open, mirroring `cacheInvalidator`. */\n  private graphBatchController?: { begin(): void; flush(): Promise<void> }\n\n  /** Wire the graph-dispatch batch controller (#638 Task 4). Same injection pattern as `setCacheInvalidator`. */\n  setGraphBatchController(controller: { begin(): void; flush(): Promise<void> }): void {\n    this.graphBatchController = controller\n  }\n\n  /** #650 Task 4 (#647): declared reserved-lookup collections `pull()` enumerates explicitly (the\n   *  store's `list()` does not skip `_`-prefixed names, unlike `loadAll()`). Wired by the vault at\n   *  open, same injection pattern as `setCacheInvalidator`/`setGraphBatchController`. */\n  private reservedLookup?: ReservedLookupSource\n\n  /** Wire the reserved-lookup source (#650 Task 4). */\n  setReservedLookupSource(source: ReservedLookupSource): void {\n    this.reservedLookup = source\n  }\n\n  constructor(opts: {\n    local: NoydbStore\n    remote: NoydbStore\n    vault: string\n    strategy: ConflictStrategy\n    emitter: NoydbEventEmitter\n    syncPolicy?: SyncPolicy\n    role?: SyncTargetRole\n    label?: string\n  }) {\n    this.local = opts.local\n    this.remote = opts.remote\n    this.vault = opts.vault\n    this.strategy = opts.strategy\n    this.emitter = opts.emitter\n    this.role = opts.role ?? 'sync-peer'\n    this.label = opts.label\n\n    // Create scheduler if a policy is provided\n    const policy = opts.syncPolicy\n    if (policy && policy.push.mode !== 'manual') {\n      this.scheduler = new SyncScheduler(policy, {\n        push: () => this.push().then(() => {}),\n        pull: () => this.pull().then(() => {}),\n        getDirtyCount: () => this.dirty.length,\n      })\n    } else {\n      this.scheduler = null\n    }\n  }\n\n  /** Start the sync scheduler. Called after vault is fully opened. */\n  startScheduler(): void {\n    this.scheduler?.start()\n  }\n\n  /** Stop the sync scheduler. Called on close. */\n  stopScheduler(): void {\n    this.scheduler?.stop()\n  }\n\n  /**\n   * Register a per-collection conflict resolver.\n   * Called by Collection when `conflictPolicy` is set.\n   *\n   * Pair-coupled (#591 rule 5b): registering for one satellite-pair member\n   * registers the same resolver for both — the pair converges under one\n   * resolution policy. Expands with whatever the pair-expander knows *at this\n   * call*; resolvers registered before their pair existed are covered by\n   * `remirrorPairResolvers` at pair-registration time.\n   */\n  registerConflictResolver(collection: string, resolver: CollectionConflictResolver): void {\n    for (const n of this.pairExpander?.([collection]) ?? [collection]) this.conflictResolvers.set(n, resolver)\n  }\n\n  /**\n   * Wire a satellite pair-expansion function (vault registration, #591 Task 11).\n   * The closure re-reads the live `SatelliteRegistry` on every call, so pairs\n   * declared after this is set are still picked up by `push`/`pull` filters.\n   */\n  setPairExpander(expander: (names: readonly string[]) => readonly string[]): void {\n    this.pairExpander = expander\n  }\n\n  /**\n   * Retroactively mirror per-collection conflict resolvers across a newly\n   * registered satellite pair (#591 rule 5b) — covers the NORMAL declaration\n   * order, where the base's `conflictPolicy` resolver was registered before\n   * the satellite was declared (so the call-time expansion in\n   * `registerConflictResolver` saw no pair yet). Tie-break: when BOTH members\n   * already carry (different) resolvers, the FIRST name in `names` wins —\n   * callers pass `[base, satellite]`, so the base's resolver is canonical.\n   * Idempotent; a later explicit registration on either member still\n   * overwrites both (last-wins, via the call-time expansion above).\n   */\n  remirrorPairResolvers(names: readonly string[]): void {\n    const canonical = names.map(n => this.conflictResolvers.get(n)).find(r => r !== undefined)\n    if (!canonical) return\n    for (const n of names) this.conflictResolvers.set(n, canonical)\n  }\n\n  /** Record a local change for later push. */\n  async trackChange(collection: string, id: string, action: 'put' | 'delete', version: number): Promise<void> {\n    await this.ensureLoaded()\n\n    // Deduplicate: if same collection+id already in dirty, update it\n    const idx = this.dirty.findIndex(d => d.collection === collection && d.id === id)\n    const entry: DirtyEntry = {\n      vault: this.vault,\n      collection,\n      id,\n      action,\n      version,\n      timestamp: new Date().toISOString(),\n    }\n\n    if (idx >= 0) {\n      this.dirty[idx] = entry\n    } else {\n      this.dirty.push(entry)\n    }\n\n    await this.persistMeta()\n\n    // Notify scheduler of the write (triggers on-change or debounce)\n    this.scheduler?.notifyChange()\n  }\n\n  /** Remove a dirty entry (satellite fan-out revert cleanup — spec #591). */\n  async removeDirty(collection: string, id: string): Promise<void> {\n    const before = this.dirty.length\n    this.dirty = this.dirty.filter(d => !(d.collection === collection && d.id === id))\n    if (this.dirty.length !== before) await this.persistMeta()\n  }\n\n  /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */\n  async push(options?: PushOptions): Promise<PushResult> {\n    await this.ensureLoaded()\n    this.graphBatchController?.begin() // #638 Task 4\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b)\n    const filter = options?.collections ? new Set(this.pairExpander?.(options.collections) ?? options.collections) : null\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n\n      // Partial sync: skip collections not in the filter\n      if (filter && !filter.has(entry.collection)) {\n        continue\n      }\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            // Record was deleted locally after being marked dirty\n            completed.push(i)\n            continue\n          }\n\n          if (isTombstoneShape(envelope)) {\n            // #590: a tombstone push is an erasure assertion — unconditional,\n            // no CAS, no conflict resolution. Erasure always wins.\n            await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n            completed.push(i)\n            pushed++\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (err instanceof ConflictError) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                if (isTombstoneShape(remoteEnvelope)) {\n                  // #590: remote already shredded this record — enforce locally,\n                  // never resolve. Resolvers must not overrule an erasure.\n                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                  erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, 'push'))\n                  completed.push(i)\n                } else if (\n                  remoteEnvelope._v === envelope._v &&\n                  isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) &&\n                  !this.conflictResolvers.get(entry.collection)\n                ) {\n                  // #589: a same-_v delete-vs-edit tie on the push channel. handleConflict's db-level\n                  // 'version' default would resolve it to local-wins; the tie rule consults ONLY the\n                  // per-collection resolver, else delete-wins. (When a per-collection resolver IS set,\n                  // fall through to handleConflict, which already honors it — incl. the merged case.)\n                  if (isDeleteMarker(remoteEnvelope)) {\n                    // remote already deleted → converge locally, drop our (edit) push\n                    await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                    completed.push(i)\n                  } else {\n                    // our local is the marker → force the delete onto the remote (unconditional put)\n                    await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n                    completed.push(i)\n                    pushed++\n                  }\n                } else {\n                  const { handled, conflict } = await this.handleConflict(\n                    entry.collection,\n                    entry.id,\n                    envelope,\n                    remoteEnvelope,\n                    'push',\n                  )\n                  conflicts.push(conflict)\n                  if (handled === 'local') {\n                    await this.remote.put(this.vault, entry.collection, entry.id, conflict.local)\n                    completed.push(i)\n                    pushed++\n                  } else if (handled === 'remote') {\n                    await this.applyRemote(entry.collection, entry.id, conflict.remote)\n                    completed.push(i)\n                  } else if (handled === 'merged' && conflict.local !== envelope) {\n                    // Merged envelope is stored in conflict.local (the winner)\n                    const merged = conflict.local\n                    await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                    await this.applyRemote(entry.collection, entry.id, merged)\n                    completed.push(i)\n                    pushed++\n                  }\n                  // handled === 'deferred': leave in dirty log\n                }\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    // Remove completed entries from dirty log (reverse order to preserve indices)\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    try {\n      await this.persistMeta()\n    } finally {\n      // #644 item 1: flush (which clears `_graphBatch` unconditionally, vault.ts:1316-1320) must\n      // run even if `persistMeta()` throws — else a throw here leaves the batch open, corrupting\n      // the NEXT pull()/push() call's wave with THIS call's stale touches.\n      await this.graphBatchController?.flush() // #638 Task 4\n    }\n\n    const result: PushResult = { pushed, conflicts, errors, erasures }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Pull remote records to local adapter. Accepts optional `PullOptions` for partial sync. */\n  async pull(options?: PullOptions): Promise<PullResult> {\n    await this.ensureLoaded()\n    this.graphBatchController?.begin() // #638 Task 4\n\n    let pulled = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b)\n    const filter = options?.collections ? new Set(this.pairExpander?.(options.collections) ?? options.collections) : null\n\n    try {\n      const remoteSnapshot = await this.remote.loadAll(this.vault)\n\n      for (const [collName, records] of Object.entries(remoteSnapshot)) {\n        // Partial sync: skip collections not in the filter\n        if (filter && !filter.has(collName)) {\n          continue\n        }\n\n        for (const [id, remoteEnvelope] of Object.entries(records)) {\n          // Partial sync: modifiedSince filter — arriving tombstones are exempt (#590):\n          // an erasure must never be skipped by partial sync.\n          if (\n            options?.modifiedSince &&\n            remoteEnvelope._ts <= options.modifiedSince &&\n            !isTombstoneShape(remoteEnvelope) &&\n            !isDeleteMarker(remoteEnvelope)\n          ) {\n            continue\n          }\n\n          try {\n            const localEnvelope = await this.local.get(this.vault, collName, id)\n            const remoteIsTombstone = isTombstoneShape(remoteEnvelope)\n\n            if (!localEnvelope) {\n              // New record from remote (tombstones included — durable erasure evidence)\n              await this.applyRemote(collName, id, remoteEnvelope)\n              pulled++\n            } else if (isTombstoneShape(localEnvelope)) {\n              if (remoteIsTombstone) {\n                // Both shredded — keep the higher version counter\n                if (remoteEnvelope._v > localEnvelope._v) await this.applyRemote(collName, id, remoteEnvelope)\n              } else {\n                // Terminal rule (#590): a tombstone is never overwritten by a live\n                // envelope, regardless of _v. Re-assert the shred outward instead.\n                erasures.push(await this.reassertTombstone(collName, id, localEnvelope, remoteEnvelope))\n              }\n            } else if (remoteIsTombstone) {\n              // Terminal rule (#590): an arriving tombstone wins over any local live\n              // envelope — even a newer, dirty one. Resolvers are never consulted.\n              const wasDirty = this.dirty.some(d => d.collection === collName && d.id === id)\n              await this.applyRemote(collName, id, remoteEnvelope)\n              this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n              pulled++\n              if (wasDirty) erasures.push(this.reportErasure(collName, id, remoteEnvelope, localEnvelope, 'pull'))\n            } else if (\n              remoteEnvelope._v === localEnvelope._v &&\n              isDeleteMarker(remoteEnvelope) !== isDeleteMarker(localEnvelope)\n            ) {\n              // #589: true concurrent delete-vs-edit at the SAME version. Version order\n              // can't break the tie. A per-collection resolver decides if one is set;\n              // otherwise DELETE wins (the db-level 'version' default is deliberately NOT\n              // consulted — it would resolve a tie to local-wins).\n              const resolver = this.conflictResolvers.get(collName)\n              if (resolver) {\n                const winner = await resolver(id, localEnvelope, remoteEnvelope)\n                if (winner !== localEnvelope && winner !== null) {\n                  // #589 (review): a novel/merged winner (neither side verbatim) must also be\n                  // pushed to remote — mirrors handleConflict's 'merged' handling — so both\n                  // sides converge instead of local applying it while remote keeps its old copy.\n                  if (winner !== remoteEnvelope) {\n                    await this.remote.put(this.vault, collName, id, winner)\n                  }\n                  await this.applyRemote(collName, id, winner)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                }\n                // winner === localEnvelope or null → keep local (its dirty entry, if any, pushes out)\n              } else if (isDeleteMarker(remoteEnvelope)) {\n                // no resolver → delete wins; the incoming marker is the delete\n                await this.applyRemote(collName, id, remoteEnvelope)\n                this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                pulled++\n              }\n              // no resolver and LOCAL is the marker → keep local marker; its dirty 'put' pushes it outward\n            } else if (remoteEnvelope._v > localEnvelope._v) {\n              // Remote is newer — check if we have a dirty entry for this\n              const isDirty = this.dirty.some(d => d.collection === collName && d.id === id)\n              if (isDirty) {\n                // Both changed — conflict\n                const { handled, conflict } = await this.handleConflict(\n                  collName,\n                  id,\n                  localEnvelope,\n                  remoteEnvelope,\n                  'pull',\n                )\n                conflicts.push(conflict)\n                if (handled === 'remote') {\n                  await this.applyRemote(collName, id, conflict.remote)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                } else if (handled === 'merged' && conflict.local !== localEnvelope) {\n                  const merged = conflict.local\n                  await this.applyRemote(collName, id, merged)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                }\n                // 'local' or 'deferred': push handles it\n              } else {\n                // Remote is newer, no local changes — update\n                await this.applyRemote(collName, id, remoteEnvelope)\n                pulled++\n              }\n            }\n            // Same version or local is newer — skip (push will handle)\n          } catch (err) {\n            errors.push(err instanceof Error ? err : new Error(String(err)))\n          }\n        }\n      }\n\n      // #650 Task 4 (#647) — reserved lookup collections (`_dict_*`/`_lookup_*`) are invisible to\n      // `remote.loadAll()` above (the store contract skips `_`-prefixed names) but DO sync via\n      // this EXPLICIT, declared registry — not a blanket underscore-glob; other `_` namespaces\n      // keep their `loadAll`-skip semantics untouched. Applied through the SAME `applyRemote` path,\n      // still inside this try block, BEFORE `persistMeta`/`flush` below — so a pulled vocabulary\n      // row lands before the wave (flushed at the end of `pull()`) recomputes any dependent.\n      //\n      // #647 fix wave 1: `LookupHandle.delete()`/`rename()` now write a version-ordered\n      // delete-marker row (mirroring #589) instead of a raw adapter delete, so a removed key is\n      // a normal row here too — reachable via `remote.list()` like any other id, applied by\n      // version like any other write. The only reserved-tier-specific rule is the same-version\n      // tie-break below: reserved lookups have no per-collection conflict-resolver concept\n      // (dictionaries are admin-edited, not multi-actor-negotiated), so a converging delete\n      // unconditionally wins over a same-version live edit.\n      for (const collName of this.reservedLookup?.collections() ?? []) {\n        if (filter && !filter.has(collName)) continue\n        for (const id of await this.remote.list(this.vault, collName)) {\n          try {\n            const remoteEnvelope = await this.remote.get(this.vault, collName, id)\n            if (!remoteEnvelope) continue\n\n            // Partial sync: modifiedSince filter — a delete marker is exempt, mirroring the\n            // main loop's tombstone/marker exemption above: a deletion must never be silently\n            // skipped by a time-window partial pull.\n            if (\n              options?.modifiedSince &&\n              remoteEnvelope._ts <= options.modifiedSince &&\n              !isDeleteMarker(remoteEnvelope)\n            ) {\n              continue\n            }\n\n            const localEnvelope = await this.local.get(this.vault, collName, id)\n            if (!localEnvelope) {\n              await this.applyRemote(collName, id, remoteEnvelope)\n              pulled++\n            } else if (\n              remoteEnvelope._v === localEnvelope._v &&\n              isDeleteMarker(remoteEnvelope) !== isDeleteMarker(localEnvelope)\n            ) {\n              // Same-version delete-vs-edit tie (#589's rule, reserved-tier default: no\n              // resolver concept here, so delete always wins).\n              if (isDeleteMarker(remoteEnvelope)) {\n                await this.applyRemote(collName, id, remoteEnvelope)\n                this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                pulled++\n              }\n              // else: local already holds the marker (a local delete not yet observed\n              // remotely) — keep it; push re-asserts it.\n            } else if (remoteEnvelope._v > localEnvelope._v) {\n              await this.applyRemote(collName, id, remoteEnvelope)\n              // Drop any now-superseded local dirty entry so a subsequent push doesn't\n              // redundantly re-fight a CAS conflict over content pull just overwrote.\n              this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n              pulled++\n            }\n          } catch (err) {\n            errors.push(err instanceof Error ? err : new Error(String(err)))\n          }\n        }\n      }\n    } catch (err) {\n      errors.push(err instanceof Error ? err : new Error(String(err)))\n    }\n\n    this.lastPull = new Date().toISOString()\n    try {\n      await this.persistMeta()\n    } finally {\n      // #644 item 1: flush must run even if `persistMeta()` throws (see push()'s identical guard).\n      await this.graphBatchController?.flush() // #638 Task 4\n    }\n\n    const result: PullResult = { pulled, conflicts, errors, erasures }\n    this.emitter.emit('sync:pull', result)\n    return result\n  }\n\n  /** Bidirectional sync: pull then push. */\n  async sync(options?: { push?: PushOptions; pull?: PullOptions }): Promise<{ pull: PullResult; push: PushResult }> {\n    const pullResult = await this.pull(options?.pull)\n    const pushResult = await this.push(options?.push)\n    return { pull: pullResult, push: pushResult }\n  }\n\n  /**\n   * Push a specific subset of dirty entries (for sync transactions, ).\n   * Entries are matched by collection+id from the dirty log; matched entries\n   * are removed from the dirty log on success.\n   */\n  async pushFiltered(predicate: (entry: DirtyEntry) => boolean): Promise<PushResult> {\n    await this.ensureLoaded()\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n      if (!predicate(entry)) continue\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            completed.push(i)\n            continue\n          }\n\n          if (isTombstoneShape(envelope)) {\n            // #590: a tombstone push is an erasure assertion — unconditional,\n            // no CAS, no conflict resolution. Erasure always wins.\n            await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n            completed.push(i)\n            pushed++\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (err instanceof ConflictError) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                if (isTombstoneShape(remoteEnvelope)) {\n                  // #590: remote already shredded this record — enforce locally,\n                  // never resolve. Resolvers must not overrule an erasure.\n                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                  erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, 'push'))\n                  completed.push(i)\n                } else if (\n                  remoteEnvelope._v === envelope._v &&\n                  isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) &&\n                  !this.conflictResolvers.get(entry.collection)\n                ) {\n                  // #589: a same-_v delete-vs-edit tie on the push channel. handleConflict's db-level\n                  // 'version' default would resolve it to local-wins; the tie rule consults ONLY the\n                  // per-collection resolver, else delete-wins. (When a per-collection resolver IS set,\n                  // fall through to handleConflict, which already honors it — incl. the merged case.)\n                  if (isDeleteMarker(remoteEnvelope)) {\n                    // remote already deleted → converge locally, drop our (edit) push\n                    await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                    completed.push(i)\n                  } else {\n                    // our local is the marker → force the delete onto the remote (unconditional put)\n                    await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n                    completed.push(i)\n                    pushed++\n                  }\n                } else {\n                  const { handled, conflict } = await this.handleConflict(\n                    entry.collection,\n                    entry.id,\n                    envelope,\n                    remoteEnvelope,\n                    'push',\n                  )\n                  conflicts.push(conflict)\n                  if (handled === 'local') {\n                    await this.remote.put(this.vault, entry.collection, entry.id, conflict.local)\n                    completed.push(i)\n                    pushed++\n                  } else if (handled === 'remote') {\n                    await this.applyRemote(entry.collection, entry.id, conflict.remote)\n                    completed.push(i)\n                  } else if (handled === 'merged' && conflict.local !== envelope) {\n                    const merged = conflict.local\n                    await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                    await this.applyRemote(entry.collection, entry.id, merged)\n                    completed.push(i)\n                    pushed++\n                  }\n                }\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    await this.persistMeta()\n\n    const result: PushResult = { pushed, conflicts, errors, erasures }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Get current sync status. */\n  status(): SyncStatus {\n    return {\n      dirty: this.dirty.length,\n      lastPush: this.lastPush,\n      lastPull: this.lastPull,\n      online: this.isOnline,\n    }\n  }\n\n  // ─── Auto-Sync ───────────────────────────────────────────────────\n\n  /** Start auto-sync: listen for online/offline events, optional periodic sync. */\n  startAutoSync(intervalMs?: number): void {\n    // Online/offline detection\n    if (typeof globalThis.addEventListener === 'function') {\n      globalThis.addEventListener('online', this.handleOnline)\n      globalThis.addEventListener('offline', this.handleOffline)\n    }\n\n    // Periodic sync\n    if (intervalMs && intervalMs > 0) {\n      this.autoSyncInterval = setInterval(() => {\n        if (this.isOnline) {\n          void this.sync()\n        }\n      }, intervalMs)\n    }\n  }\n\n  /** Stop auto-sync and scheduler. */\n  stopAutoSync(): void {\n    this.stopScheduler()\n    if (typeof globalThis.removeEventListener === 'function') {\n      globalThis.removeEventListener('online', this.handleOnline)\n      globalThis.removeEventListener('offline', this.handleOffline)\n    }\n    if (this.autoSyncInterval) {\n      clearInterval(this.autoSyncInterval)\n      this.autoSyncInterval = null\n    }\n  }\n\n  private handleOnline = (): void => {\n    this.isOnline = true\n    this.emitter.emit('sync:online', undefined as never)\n    void this.sync()\n  }\n\n  private handleOffline = (): void => {\n    this.isOnline = false\n    this.emitter.emit('sync:offline', undefined as never)\n  }\n\n  /** Apply an envelope to the local store and refresh in-memory views (#598). `action` (#640):\n   *  classified HERE — the one choke point that still holds the envelope — so the\n   *  cacheInvalidator seam (and, downstream, the dispatch wave) can tell a pulled delete from an\n   *  ordinary put. `isTombstoneShape` covers a forgotten-elsewhere record arriving as a shred;\n   *  `isDeleteMarker` covers an ordinary (#589) delete — both route to the SAME 'delete' action\n   *  (sync delete ≠ forget: freshness only, no shred/residue channel on the receiving side). */\n  private async applyRemote(collection: string, id: string, envelope: EncryptedEnvelope): Promise<void> {\n    await this.local.put(this.vault, collection, id, envelope)\n    const action: 'put' | 'delete' = isTombstoneShape(envelope) || isDeleteMarker(envelope) ? 'delete' : 'put'\n    await this.cacheInvalidator?.(collection, id, action)\n  }\n\n  /** Record + emit a tombstone enforcement (#590). */\n  private reportErasure(\n    collection: string, id: string,\n    tombstone: EncryptedEnvelope, suppressed: EncryptedEnvelope,\n    direction: 'pull' | 'push',\n  ): ErasureEnforcement {\n    const enforcement: ErasureEnforcement = { vault: this.vault, collection, id, tombstone, suppressed, direction }\n    this.emitter.emit('sync:erasure', enforcement)\n    return enforcement\n  }\n\n  /**\n   * Re-assert a local tombstone over a live remote envelope (#590): the shred\n   * wins in both directions, regardless of `_v`. Bumps the tombstone to the\n   * suppressed envelope's `_v` when higher so per-key version counters stay\n   * monotonic on every store; `_by` (the shredding actor) is preserved.\n   */\n  private async reassertTombstone(\n    collection: string, id: string,\n    tombstone: EncryptedEnvelope, suppressedRemote: EncryptedEnvelope,\n  ): Promise<ErasureEnforcement> {\n    let winner = tombstone\n    if (suppressedRemote._v > tombstone._v) {\n      winner = { ...tombstone, _v: suppressedRemote._v, _ts: new Date().toISOString() }\n      await this.applyRemote(collection, id, winner)\n    }\n    await this.remote.put(this.vault, collection, id, winner)\n    // The re-assert already delivered the tombstone remotely — drop any dirty\n    // entry so the following push doesn't redundantly re-put it.\n    this.dirty = this.dirty.filter(d => !(d.collection === collection && d.id === id))\n    return this.reportErasure(collection, id, winner, suppressedRemote, 'pull')\n  }\n\n  /**\n   * Resolve a conflict, checking per-collection resolvers first,\n   * then falling back to the db-level `ConflictStrategy`.\n   *\n   * Returns the resolved `Conflict` object (possibly with `resolve` set for\n   * manual mode) and a `handled` discriminant:\n   * - `'local'` — keep the local envelope; push it to remote.\n   * - `'remote'` — keep the remote envelope; update local.\n   * - `'merged'` — a custom merge fn produced a new envelope stored as `conflict.local`.\n   * - `'deferred'` — manual mode, resolve was not called synchronously.\n   */\n  private async handleConflict(\n    collection: string,\n    id: string,\n    local: EncryptedEnvelope,\n    remote: EncryptedEnvelope,\n    _phase: 'push' | 'pull',\n  ): Promise<{ handled: 'local' | 'remote' | 'merged' | 'deferred'; conflict: Conflict }> {\n    const resolver = this.conflictResolvers.get(collection)\n\n    if (resolver) {\n      // Per-collection resolver is responsible for emitting sync:conflict\n      // (manual policy emits with a resolve callback; LWW/FWW/custom are silent).\n      const winner = await resolver(id, local, remote)\n      const base: Conflict = {\n        vault: this.vault,\n        collection,\n        id,\n        local,\n        remote,\n        localVersion: local._v,\n        remoteVersion: remote._v,\n      }\n      if (winner === null) return { handled: 'deferred', conflict: base }\n      if (winner === local) return { handled: 'local', conflict: base }\n      if (winner === remote) return { handled: 'remote', conflict: base }\n      // Custom merge fn produced a new envelope — store as conflict.local for the caller\n      return {\n        handled: 'merged',\n        conflict: { ...base, local: winner, localVersion: winner._v },\n      }\n    }\n\n    // Fall back to db-level strategy — emit once\n    const baseConflict: Conflict = {\n      vault: this.vault,\n      collection,\n      id,\n      local,\n      remote,\n      localVersion: local._v,\n      remoteVersion: remote._v,\n    }\n    this.emitter.emit('sync:conflict', baseConflict)\n    const side = this.legacyResolve(baseConflict)\n    return { handled: side, conflict: baseConflict }\n  }\n\n  /** DB-level ConflictStrategy resolution (legacy, kept for backward compat). */\n  private legacyResolve(conflict: Conflict): 'local' | 'remote' {\n    if (typeof this.strategy === 'function') {\n      return this.strategy(conflict)\n    }\n    switch (this.strategy) {\n      case 'local-wins': return 'local'\n      case 'remote-wins': return 'remote'\n      case 'version':\n      default:\n        return conflict.localVersion >= conflict.remoteVersion ? 'local' : 'remote'\n    }\n  }\n\n  // ─── Persistence ─────────────────────────────────────────────────\n\n  private async ensureLoaded(): Promise<void> {\n    if (this.loaded) return\n\n    const envelope = await this.local.get(this.vault, '_sync', 'meta')\n    if (envelope) {\n      const meta = JSON.parse(envelope._data) as SyncMetadata\n      this.dirty = [...meta.dirty]\n      this.lastPush = meta.last_push\n      this.lastPull = meta.last_pull\n    }\n\n    this.loaded = true\n  }\n\n  private async persistMeta(): Promise<void> {\n    const meta: SyncMetadata = {\n      _noydb_sync: NOYDB_SYNC_VERSION,\n      last_push: this.lastPush,\n      last_pull: this.lastPull,\n      dirty: this.dirty,\n    }\n\n    const envelope: EncryptedEnvelope = {\n      _noydb: 1,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(meta),\n    }\n\n    await this.local.put(this.vault, '_sync', 'meta', envelope)\n  }\n}\n","import type { SyncTransactionResult } from '../../kernel/types.js'\nimport type { SyncEngine } from './sync.js'\nimport type { Vault } from '../../kernel/vault.js'\n\ninterface TxOp {\n  readonly type: 'put' | 'delete'\n  readonly collection: string\n  readonly id: string\n  readonly record?: unknown\n}\n\n/**\n * Sync transaction.\n *\n * Stages local writes and then pushes only those records to remote in a\n * single batch. If any record conflicts during the push, the result\n * carries `status: 'conflict'` — no automatic rollback is performed;\n * the caller handles conflict resolution.\n *\n * Obtain via `db.transaction(compartmentName)`.\n */\nexport class SyncTransaction {\n  private readonly comp: Vault\n  private readonly engine: SyncEngine\n  private readonly ops: TxOp[] = []\n\n  /** @internal — constructed by `Noydb.transaction()` */\n  constructor(comp: Vault, engine: SyncEngine) {\n    this.comp = comp\n    this.engine = engine\n  }\n\n  /** Stage a record write. Does not write to any adapter until `commit()`. */\n  put(collection: string, id: string, record: unknown): this {\n    this.ops.push({ type: 'put', collection, id, record })\n    return this\n  }\n\n  /** Stage a record delete. Does not write to any adapter until `commit()`. */\n  delete(collection: string, id: string): this {\n    this.ops.push({ type: 'delete', collection, id })\n    return this\n  }\n\n  /**\n   * Commit the transaction.\n   *\n   * Phase 1 — writes all staged operations to the local adapter via the\n   * collection layer (encryption + dirty-log tracking).\n   *\n   * Phase 2 — pushes only the records that were written in this\n   * transaction to the remote adapter. Existing dirty entries from\n   * outside this transaction are not affected.\n   *\n   * If any record conflicts during the push, `status` is `'conflict'`\n   * and `conflicts` lists the affected records. No automatic rollback is\n   * performed.\n   */\n  async commit(): Promise<SyncTransactionResult> {\n    // Phase 1: write all staged ops to local via collection layer\n    for (const op of this.ops) {\n      if (op.type === 'put') {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        await (this.comp.collection<any>(op.collection)).put(op.id, op.record as any)\n      } else {\n        await this.comp.collection(op.collection).delete(op.id)\n      }\n    }\n\n    // Phase 2: push only the records from this transaction\n    const opSet = new Set<string>()\n    for (const op of this.ops) {\n      opSet.add(`${op.collection}::${op.id}`)\n    }\n\n    const pushResult = await this.engine.pushFiltered(\n      (entry) => opSet.has(`${entry.collection}::${entry.id}`),\n    )\n\n    return {\n      status: pushResult.conflicts.length > 0 ? 'conflict' : 'committed',\n      pushed: pushResult.pushed,\n      conflicts: pushResult.conflicts,\n      ...(pushResult.erasures?.length ? { erasures: pushResult.erasures } : {}),\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsDO,IAAM,iBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,cAAiC;AAAA,EACjC,cAAyD,CAAC;AAAA,EAC1D,oBAAyC;AAAA,EACzC,YAAmD;AAAA,EACnD,UAAU;AAAA,EAElB,YAAY,MAA0B;AACpC,SAAK,UAAU,KAAK;AACpB,SAAK,cAAc,KAAK;AACxB,SAAK,QAAQ,KAAK;AAClB,SAAK,iBAAiB,KAAK;AAC3B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,iBAAiB,KAAK,kBAAkB;AAG7C,SAAK,UAAU,GAAG,KAAK,KAAK,IAAI,KAAK,cAAc;AAEnD,SAAK,oBAAoB,aAAa,KAAK,cAAc;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAA2B;AACtC,QAAI,KAAK,QAAS;AAElB,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,YAAY,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,QAAQ,CAAC;AAChF,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AACzB,YAAM,KAAK,WAAW;AACtB,YAAM,QAAQ,eAAe,EAAE;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,WAAW,GAAG;AAC7C,yBAAmB,KAAK,UAAU,EAAE,IAAI,OAAO,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,yBAAmB;AAAA,IACrB;AAGA,UAAM,aAAa,KAAK,iBAAiB;AACzC,QAAI,YAAY,iBAAiB;AAC/B,YAAM,WAAW,gBAAgB,KAAK,SAAS,gBAAgB;AAAA,IACjE;AAGA,UAAM,KAAK,mBAAmB,SAAS,GAAG;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,IAAoD;AAC5D,QAAI,KAAK,QAAS,QAAO,MAAM;AAAA,IAAC;AAEhC,SAAK,YAAY,KAAK,EAAE;AAGxB,QAAI,KAAK,YAAY,WAAW,GAAG;AACjC,WAAK,eAAe;AAAA,IACtB;AAEA,WAAO,MAAM;AACX,WAAK,cAAc,KAAK,YAAY,OAAO,OAAK,MAAM,EAAE;AACxD,UAAI,KAAK,YAAY,WAAW,EAAG,MAAK,cAAc;AAAA,IACxD;AAAA,EACF;AAAA;AAAA,EAGA,OAAa;AACX,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,cAAc,CAAC;AAAA,EACtB;AAAA;AAAA,EAIA,MAAc,iBAA6C;AACzD,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,QAAI,CAAC,KAAK,aAAa;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,cAAc;AACjD,aAAK,cAAc,MAAM,kBAAkB,KAAK,KAAK,cAAc;AAAA,MACrE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,mBAA2C;AAEjD,QAAI,KAAK,aAAa,gBAAiB,QAAO,KAAK;AACnD,QAAI,KAAK,QAAQ,gBAAiB,QAAO,KAAK;AAC9C,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAuB;AAC7B,UAAM,aAAa,KAAK,iBAAiB;AAEzC,QAAI,YAAY,mBAAmB;AAEjC,WAAK,oBAAoB,WAAW;AAAA,QAClC,KAAK;AAAA,QACL,CAAC,qBAAqB;AAAE,eAAK,KAAK,oBAAoB,gBAAgB;AAAA,QAAE;AAAA,MAC1E;AAAA,IACF,OAAO;AAEL,WAAK,YAAY;AAAA,QACf,MAAM;AAAE,eAAK,KAAK,oBAAoB;AAAA,QAAE;AAAA,QACxC,KAAK;AAAA,MACP;AAEA,WAAK,KAAK,oBAAoB;AAAA,IAChC;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,QAAI,KAAK,mBAAmB;AAC1B,WAAK,kBAAkB;AACvB,WAAK,oBAAoB;AAAA,IAC3B;AACA,QAAI,KAAK,WAAW;AAClB,oBAAc,KAAK,SAAS;AAC5B,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,kBAAyC;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,uBAAuB,gBAAgB;AAC/D,UAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,OAAQ;AAE1C,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,UAAI,KAAK,WAAW,OAAQ;AAK5B,YAAM,KAAK,oBAAoB;AAAA,IACjC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,uBACZ,kBACkE;AAClE,UAAM,MAAM,MAAM,KAAK,eAAe;AAEtC,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK;AAC3B,aAAO,KAAK,MAAM,gBAAgB;AAAA,IACpC;AAEA,UAAM,EAAE,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,gBAAgB;AACvD,UAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChD,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAc,mBAAmB,SAAY,KAA4B;AACvE,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,UAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAI,KAAK;AACT,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AACzB,YAAM,UAAU,WAAW;AAC3B,WAAK,eAAe,OAAO;AAC3B,YAAM,SAAS,MAAM,QAAQ,WAAW,GAAG;AAC3C,aAAO,OAAO;AAAA,IAChB,OAAO;AACL,aAAO;AAAA,IACT;AAEA,UAAM,SAAgC,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,IAAI,KAAK;AACrF,UAAM,OAAO,KAAK,UAAU,MAAM;AAIlC,UAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,aAAa;AAAA,QACjB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,sBAAqC;AACjD,QAAI,KAAK,WAAW,KAAK,YAAY,WAAW,EAAG;AAEnD,QAAI;AACF,YAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,YAAM,MAAM,MAAM,aAAa,KAAK,KAAK,OAAO,KAAK,iBAAiB;AACtE,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,YAAM,QAA2B,CAAC;AAElC,iBAAW,MAAM,KAAK;AACpB,YAAI,OAAO,KAAK,OAAQ;AACxB,cAAM,WAAW,MAAM,aAAa,IAAI,KAAK,OAAO,KAAK,mBAAmB,EAAE;AAC9E,YAAI,CAAC,SAAU;AAEf,cAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,YAAI,OAAO,WAAW,OAAQ;AAE9B,YAAI;AACJ,YAAI,KAAK,aAAa,KAAK,eAAe,OAAO,IAAI;AACnD,gBAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;AACxE,wBAAc,KAAK,MAAM,SAAS;AAAA,QACpC,OAAO;AACL,wBAAc,KAAK,MAAM,OAAO,IAAI;AAAA,QACtC;AAEA,cAAM,KAAK,EAAE,QAAQ,OAAO,QAAQ,SAAS,aAAa,UAAU,OAAO,SAAS,CAAC;AAAA,MACvF;AAEA,iBAAW,MAAM,KAAK,aAAa;AACjC,WAAG,KAAK;AAAA,MACV;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ACrRO,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACR;AAAA,EACA;AAAA,EAED,QAAsB,CAAC;AAAA,EACvB,WAA0B;AAAA,EAC1B,WAA0B;AAAA,EAC1B,SAAS;AAAA,EACT,mBAA0D;AAAA,EAC1D,WAAW;AAAA;AAAA,EAGV;AAAA;AAAA,EAGQ,oBAAoB,oBAAI,IAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzE;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAGR,oBAAoB,IAAuF;AACzG,SAAK,mBAAmB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKQ;AAAA;AAAA,EAGR,wBAAwB,YAA6D;AACnF,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAKQ;AAAA;AAAA,EAGR,wBAAwB,QAAoC;AAC1D,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,YAAY,MAST;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,UAAU,KAAK;AACpB,SAAK,OAAO,KAAK,QAAQ;AACzB,SAAK,QAAQ,KAAK;AAGlB,UAAM,SAAS,KAAK;AACpB,QAAI,UAAU,OAAO,KAAK,SAAS,UAAU;AAC3C,WAAK,YAAY,IAAI,cAAc,QAAQ;AAAA,QACzC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,QAAC,CAAC;AAAA,QACrC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,QAAC,CAAC;AAAA,QACrC,eAAe,MAAM,KAAK,MAAM;AAAA,MAClC,CAAC;AAAA,IACH,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA;AAAA,EAGA,iBAAuB;AACrB,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA;AAAA,EAGA,gBAAsB;AACpB,SAAK,WAAW,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,yBAAyB,YAAoB,UAA4C;AACvF,eAAW,KAAK,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAG,MAAK,kBAAkB,IAAI,GAAG,QAAQ;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,UAAiE;AAC/E,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,sBAAsB,OAAgC;AACpD,UAAM,YAAY,MAAM,IAAI,OAAK,KAAK,kBAAkB,IAAI,CAAC,CAAC,EAAE,KAAK,OAAK,MAAM,MAAS;AACzF,QAAI,CAAC,UAAW;AAChB,eAAW,KAAK,MAAO,MAAK,kBAAkB,IAAI,GAAG,SAAS;AAAA,EAChE;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAAY,QAA0B,SAAgC;AAC1G,UAAM,KAAK,aAAa;AAGxB,UAAM,MAAM,KAAK,MAAM,UAAU,OAAK,EAAE,eAAe,cAAc,EAAE,OAAO,EAAE;AAChF,UAAM,QAAoB;AAAA,MACxB,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAEA,QAAI,OAAO,GAAG;AACZ,WAAK,MAAM,GAAG,IAAI;AAAA,IACpB,OAAO;AACL,WAAK,MAAM,KAAK,KAAK;AAAA,IACvB;AAEA,UAAM,KAAK,YAAY;AAGvB,SAAK,WAAW,aAAa;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAA2B;AAC/D,UAAM,SAAS,KAAK,MAAM;AAC1B,SAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG;AACjF,QAAI,KAAK,MAAM,WAAW,OAAQ,OAAM,KAAK,YAAY;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AACxB,SAAK,sBAAsB,MAAM;AAEjC,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAG7B,UAAM,SAAS,SAAS,cAAc,IAAI,IAAI,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,WAAW,IAAI;AAEjH,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAG1B,UAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,GAAG;AAC3C;AAAA,MACF;AAEA,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AAEb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI,iBAAiB,QAAQ,GAAG;AAG9B,kBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,sBAAU,KAAK,CAAC;AAChB;AACA;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,eAAe,eAAe;AAChC,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,oBAAI,iBAAiB,cAAc,GAAG;AAGpC,wBAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,2BAAS,KAAK,KAAK,cAAc,MAAM,YAAY,MAAM,IAAI,gBAAgB,UAAU,MAAM,CAAC;AAC9F,4BAAU,KAAK,CAAC;AAAA,gBAClB,WACE,eAAe,OAAO,SAAS,MAC/B,eAAe,cAAc,MAAM,eAAe,QAAQ,KAC1D,CAAC,KAAK,kBAAkB,IAAI,MAAM,UAAU,GAC5C;AAKA,sBAAI,eAAe,cAAc,GAAG;AAElC,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,8BAAU,KAAK,CAAC;AAAA,kBAClB,OAAO;AAEL,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF,OAAO;AACL,wBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,oBACvC,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AACA,4BAAU,KAAK,QAAQ;AACvB,sBAAI,YAAY,SAAS;AACvB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,KAAK;AAC5E,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF,WAAW,YAAY,UAAU;AAC/B,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAClE,8BAAU,KAAK,CAAC;AAAA,kBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAE9D,0BAAM,SAAS,SAAS;AACxB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACzD,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBAEF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAGA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,UAAE;AAIA,YAAM,KAAK,sBAAsB,MAAM;AAAA,IACzC;AAEA,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,SAAS;AACjE,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AACxB,SAAK,sBAAsB,MAAM;AAEjC,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AAGzB,UAAM,SAAS,SAAS,cAAc,IAAI,IAAI,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,WAAW,IAAI;AAEjH,QAAI;AACF,YAAM,iBAAiB,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK;AAE3D,iBAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,cAAc,GAAG;AAEhE,YAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,GAAG;AACnC;AAAA,QACF;AAEA,mBAAW,CAAC,IAAI,cAAc,KAAK,OAAO,QAAQ,OAAO,GAAG;AAG1D,cACE,SAAS,iBACT,eAAe,OAAO,QAAQ,iBAC9B,CAAC,iBAAiB,cAAc,KAChC,CAAC,eAAe,cAAc,GAC9B;AACA;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AACnE,kBAAM,oBAAoB,iBAAiB,cAAc;AAEzD,gBAAI,CAAC,eAAe;AAElB,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,YACF,WAAW,iBAAiB,aAAa,GAAG;AAC1C,kBAAI,mBAAmB;AAErB,oBAAI,eAAe,KAAK,cAAc,GAAI,OAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AAAA,cAC/F,OAAO;AAGL,yBAAS,KAAK,MAAM,KAAK,kBAAkB,UAAU,IAAI,eAAe,cAAc,CAAC;AAAA,cACzF;AAAA,YACF,WAAW,mBAAmB;AAG5B,oBAAM,WAAW,KAAK,MAAM,KAAK,OAAK,EAAE,eAAe,YAAY,EAAE,OAAO,EAAE;AAC9E,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,mBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AACA,kBAAI,SAAU,UAAS,KAAK,KAAK,cAAc,UAAU,IAAI,gBAAgB,eAAe,MAAM,CAAC;AAAA,YACrG,WACE,eAAe,OAAO,cAAc,MACpC,eAAe,cAAc,MAAM,eAAe,aAAa,GAC/D;AAKA,oBAAM,WAAW,KAAK,kBAAkB,IAAI,QAAQ;AACpD,kBAAI,UAAU;AACZ,sBAAM,SAAS,MAAM,SAAS,IAAI,eAAe,cAAc;AAC/D,oBAAI,WAAW,iBAAiB,WAAW,MAAM;AAI/C,sBAAI,WAAW,gBAAgB;AAC7B,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,UAAU,IAAI,MAAM;AAAA,kBACxD;AACA,wBAAM,KAAK,YAAY,UAAU,IAAI,MAAM;AAC3C,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF;AAAA,cAEF,WAAW,eAAe,cAAc,GAAG;AAEzC,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,qBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,cACF;AAAA,YAEF,WAAW,eAAe,KAAK,cAAc,IAAI;AAE/C,oBAAM,UAAU,KAAK,MAAM,KAAK,OAAK,EAAE,eAAe,YAAY,EAAE,OAAO,EAAE;AAC7E,kBAAI,SAAS;AAEX,sBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,kBACvC;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,0BAAU,KAAK,QAAQ;AACvB,oBAAI,YAAY,UAAU;AACxB,wBAAM,KAAK,YAAY,UAAU,IAAI,SAAS,MAAM;AACpD,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF,WAAW,YAAY,YAAY,SAAS,UAAU,eAAe;AACnE,wBAAM,SAAS,SAAS;AACxB,wBAAM,KAAK,YAAY,UAAU,IAAI,MAAM;AAC3C,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF;AAAA,cAEF,OAAO;AAEL,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,cACF;AAAA,YACF;AAAA,UAEF,SAAS,KAAK;AACZ,mBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAgBA,iBAAW,YAAY,KAAK,gBAAgB,YAAY,KAAK,CAAC,GAAG;AAC/D,YAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,EAAG;AACrC,mBAAW,MAAM,MAAM,KAAK,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC7D,cAAI;AACF,kBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,UAAU,EAAE;AACrE,gBAAI,CAAC,eAAgB;AAKrB,gBACE,SAAS,iBACT,eAAe,OAAO,QAAQ,iBAC9B,CAAC,eAAe,cAAc,GAC9B;AACA;AAAA,YACF;AAEA,kBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AACnE,gBAAI,CAAC,eAAe;AAClB,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,YACF,WACE,eAAe,OAAO,cAAc,MACpC,eAAe,cAAc,MAAM,eAAe,aAAa,GAC/D;AAGA,kBAAI,eAAe,cAAc,GAAG;AAClC,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,qBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,cACF;AAAA,YAGF,WAAW,eAAe,KAAK,cAAc,IAAI;AAC/C,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AAGnD,mBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,YACF;AAAA,UACF,SAAS,KAAK;AACZ,mBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,IACjE;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,UAAE;AAEA,YAAM,KAAK,sBAAsB,MAAM;AAAA,IACzC;AAEA,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,SAAS;AACjE,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAAuG;AAChH,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,WAAO,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,WAAgE;AACjF,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAE7B,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAC1B,UAAI,CAAC,UAAU,KAAK,EAAG;AAEvB,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AACb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI,iBAAiB,QAAQ,GAAG;AAG9B,kBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,sBAAU,KAAK,CAAC;AAChB;AACA;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,eAAe,eAAe;AAChC,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,oBAAI,iBAAiB,cAAc,GAAG;AAGpC,wBAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,2BAAS,KAAK,KAAK,cAAc,MAAM,YAAY,MAAM,IAAI,gBAAgB,UAAU,MAAM,CAAC;AAC9F,4BAAU,KAAK,CAAC;AAAA,gBAClB,WACE,eAAe,OAAO,SAAS,MAC/B,eAAe,cAAc,MAAM,eAAe,QAAQ,KAC1D,CAAC,KAAK,kBAAkB,IAAI,MAAM,UAAU,GAC5C;AAKA,sBAAI,eAAe,cAAc,GAAG;AAElC,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,8BAAU,KAAK,CAAC;AAAA,kBAClB,OAAO;AAEL,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF,OAAO;AACL,wBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,oBACvC,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AACA,4BAAU,KAAK,QAAQ;AACvB,sBAAI,YAAY,SAAS;AACvB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,SAAS,KAAK;AAC5E,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF,WAAW,YAAY,UAAU;AAC/B,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAClE,8BAAU,KAAK,CAAC;AAAA,kBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAC9D,0BAAM,SAAS,SAAS;AACxB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACzD,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAEA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,UAAM,KAAK,YAAY;AAEvB,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,SAAS;AACjE,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,SAAqB;AACnB,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,cAAc,YAA2B;AAEvC,QAAI,OAAO,WAAW,qBAAqB,YAAY;AACrD,iBAAW,iBAAiB,UAAU,KAAK,YAAY;AACvD,iBAAW,iBAAiB,WAAW,KAAK,aAAa;AAAA,IAC3D;AAGA,QAAI,cAAc,aAAa,GAAG;AAChC,WAAK,mBAAmB,YAAY,MAAM;AACxC,YAAI,KAAK,UAAU;AACjB,eAAK,KAAK,KAAK;AAAA,QACjB;AAAA,MACF,GAAG,UAAU;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,cAAc;AACnB,QAAI,OAAO,WAAW,wBAAwB,YAAY;AACxD,iBAAW,oBAAoB,UAAU,KAAK,YAAY;AAC1D,iBAAW,oBAAoB,WAAW,KAAK,aAAa;AAAA,IAC9D;AACA,QAAI,KAAK,kBAAkB;AACzB,oBAAc,KAAK,gBAAgB;AACnC,WAAK,mBAAmB;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,eAAe,MAAY;AACjC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,eAAe,MAAkB;AACnD,SAAK,KAAK,KAAK;AAAA,EACjB;AAAA,EAEQ,gBAAgB,MAAY;AAClC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,gBAAgB,MAAkB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,YAAY,YAAoB,IAAY,UAA4C;AACpG,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,YAAY,IAAI,QAAQ;AACzD,UAAM,SAA2B,iBAAiB,QAAQ,KAAK,eAAe,QAAQ,IAAI,WAAW;AACrG,UAAM,KAAK,mBAAmB,YAAY,IAAI,MAAM;AAAA,EACtD;AAAA;AAAA,EAGQ,cACN,YAAoB,IACpB,WAA8B,YAC9B,WACoB;AACpB,UAAM,cAAkC,EAAE,OAAO,KAAK,OAAO,YAAY,IAAI,WAAW,YAAY,UAAU;AAC9G,SAAK,QAAQ,KAAK,gBAAgB,WAAW;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,kBACZ,YAAoB,IACpB,WAA8B,kBACD;AAC7B,QAAI,SAAS;AACb,QAAI,iBAAiB,KAAK,UAAU,IAAI;AACtC,eAAS,EAAE,GAAG,WAAW,IAAI,iBAAiB,IAAI,MAAK,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChF,YAAM,KAAK,YAAY,YAAY,IAAI,MAAM;AAAA,IAC/C;AACA,UAAM,KAAK,OAAO,IAAI,KAAK,OAAO,YAAY,IAAI,MAAM;AAGxD,SAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG;AACjF,WAAO,KAAK,cAAc,YAAY,IAAI,QAAQ,kBAAkB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,eACZ,YACA,IACA,OACA,QACA,QACsF;AACtF,UAAM,WAAW,KAAK,kBAAkB,IAAI,UAAU;AAEtD,QAAI,UAAU;AAGZ,YAAM,SAAS,MAAM,SAAS,IAAI,OAAO,MAAM;AAC/C,YAAM,OAAiB;AAAA,QACrB,OAAO,KAAK;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB;AACA,UAAI,WAAW,KAAM,QAAO,EAAE,SAAS,YAAY,UAAU,KAAK;AAClE,UAAI,WAAW,MAAO,QAAO,EAAE,SAAS,SAAS,UAAU,KAAK;AAChE,UAAI,WAAW,OAAQ,QAAO,EAAE,SAAS,UAAU,UAAU,KAAK;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU,EAAE,GAAG,MAAM,OAAO,QAAQ,cAAc,OAAO,GAAG;AAAA,MAC9D;AAAA,IACF;AAGA,UAAM,eAAyB;AAAA,MAC7B,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,eAAe,OAAO;AAAA,IACxB;AACA,SAAK,QAAQ,KAAK,iBAAiB,YAAY;AAC/C,UAAM,OAAO,KAAK,cAAc,YAAY;AAC5C,WAAO,EAAE,SAAS,MAAM,UAAU,aAAa;AAAA,EACjD;AAAA;AAAA,EAGQ,cAAc,UAAwC;AAC5D,QAAI,OAAO,KAAK,aAAa,YAAY;AACvC,aAAO,KAAK,SAAS,QAAQ;AAAA,IAC/B;AACA,YAAQ,KAAK,UAAU;AAAA,MACrB,KAAK;AAAc,eAAO;AAAA,MAC1B,KAAK;AAAe,eAAO;AAAA,MAC3B,KAAK;AAAA,MACL;AACE,eAAO,SAAS,gBAAgB,SAAS,gBAAgB,UAAU;AAAA,IACvE;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,eAA8B;AAC1C,QAAI,KAAK,OAAQ;AAEjB,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,MAAM;AACjE,QAAI,UAAU;AACZ,YAAM,OAAO,KAAK,MAAM,SAAS,KAAK;AACtC,WAAK,QAAQ,CAAC,GAAG,KAAK,KAAK;AAC3B,WAAK,WAAW,KAAK;AACrB,WAAK,WAAW,KAAK;AAAA,IACvB;AAEA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,OAAqB;AAAA,MACzB,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,IACd;AAEA,UAAM,WAA8B;AAAA,MAClC,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC5D;AACF;;;ACp2BO,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA,MAAc,CAAC;AAAA;AAAA,EAGhC,YAAY,MAAa,QAAoB;AAC3C,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,YAAoB,IAAY,QAAuB;AACzD,SAAK,IAAI,KAAK,EAAE,MAAM,OAAO,YAAY,IAAI,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAO,YAAoB,IAAkB;AAC3C,SAAK,IAAI,KAAK,EAAE,MAAM,UAAU,YAAY,GAAG,CAAC;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,SAAyC;AAE7C,eAAW,MAAM,KAAK,KAAK;AACzB,UAAI,GAAG,SAAS,OAAO;AAErB,cAAO,KAAK,KAAK,WAAgB,GAAG,UAAU,EAAG,IAAI,GAAG,IAAI,GAAG,MAAa;AAAA,MAC9E,OAAO;AACL,cAAM,KAAK,KAAK,WAAW,GAAG,UAAU,EAAE,OAAO,GAAG,EAAE;AAAA,MACxD;AAAA,IACF;AAGA,UAAM,QAAQ,oBAAI,IAAY;AAC9B,eAAW,MAAM,KAAK,KAAK;AACzB,YAAM,IAAI,GAAG,GAAG,UAAU,KAAK,GAAG,EAAE,EAAE;AAAA,IACxC;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO;AAAA,MACnC,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,UAAU,KAAK,MAAM,EAAE,EAAE;AAAA,IACzD;AAEA,WAAO;AAAA,MACL,QAAQ,WAAW,UAAU,SAAS,IAAI,aAAa;AAAA,MACvD,QAAQ,WAAW;AAAA,MACnB,WAAW,WAAW;AAAA,MACtB,GAAI,WAAW,UAAU,SAAS,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,IACzE;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-WGV4CUZT.js

@@ -0,0 +1,167 @@
+import {
+  canonicalize,
+  derivePersistedSchema
+} from "./chunk-QLLKLFE2.js";
+import {
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-C7NTK5I3.js";
+import {
+  ConflictError
+} from "./chunk-FH542DDY.js";
+
+// src/with-shape/schema-update/delta.ts
+function computeSchemaDelta(stored, fresh, collection) {
+  const a = stored;
+  const b = fresh;
+  const aProps = a.properties ?? {};
+  const bProps = b.properties ?? {};
+  const aReq = new Set(a.required ?? []);
+  const bReq = new Set(b.required ?? []);
+  const aKeys = Object.keys(aProps);
+  const bKeys = Object.keys(bProps);
+  const added = bKeys.filter((k) => !(k in aProps));
+  const removed = aKeys.filter((k) => !(k in bProps));
+  const changed = [];
+  for (const k of bKeys) {
+    if (!(k in aProps)) continue;
+    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
+    const requiredChanged = aReq.has(k) !== bReq.has(k);
+    if (shapeChanged || requiredChanged) {
+      changed.push({ field: k, requiredChanged, shapeChanged });
+    }
+  }
+  let kind;
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    kind = "none";
+  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
+    kind = "additive";
+  } else {
+    kind = "non-additive";
+  }
+  return { collection, kind, added, removed, changed };
+}
+
+// src/with-shape/schema-update/dispatch.ts
+async function evaluateStrategies(delta, strategies, ctx) {
+  for (const strategy of strategies) {
+    const decision = await strategy.onSchemaDelta(delta, ctx);
+    if (decision.action !== "allow") return decision;
+  }
+  return { action: "allow" };
+}
+
+// src/with-shape/persisted-schemas/register.ts
+var MAX_SCHEMA_CAS_RETRIES = 5;
+async function persistSchemaIfNeeded(opts) {
+  const fresh = await derivePersistedSchema(opts.validator);
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored && isEquivalent(stored, fresh)) {
+      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
+    }
+    let decision = { action: "allow" };
+    const strategies = opts.strategies ?? [];
+    if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
+      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
+      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
+    }
+    if (decision.action !== "allow") {
+      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
+    }
+    let toSave = fresh;
+    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
+    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
+      return { written: true, skipped: false, envelope: toSave, decision };
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistClassifiedMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      classified: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistSatelliteMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      satellite: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+function satelliteMarkersEqual(a, b) {
+  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
+}
+function markersEqual(a, b) {
+  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
+}
+function sameSet(a, b) {
+  if (a.length !== b.length) return false;
+  const s = new Set(a);
+  return b.every((x) => s.has(x));
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isEquivalent(a, b) {
+  if (a.kind !== b.kind) return false;
+  if (a.hash && b.hash) return a.hash === b.hash;
+  if (a.hash === null && b.hash === null) return true;
+  return false;
+}
+
+export {
+  persistSchemaIfNeeded,
+  persistClassifiedMarker,
+  persistSatelliteMarker
+};
+//# sourceMappingURL=chunk-WGV4CUZT.js.map

package/dist/chunk-WGV4CUZT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}

package/dist/chunk-WTUNZACT.js

@@ -0,0 +1,30 @@
+import {
+  BrokerNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/port/with/broker-strategy.ts
+var NO_BROKER = {
+  async enroll() {
+    throw new BrokerNotEnabledError();
+  },
+  async rotate() {
+    throw new BrokerNotEnabledError();
+  },
+  credentialSource() {
+    throw new BrokerNotEnabledError();
+  }
+};
+function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
+  const ctx = () => ({ store, vault, keyring: getKeyring() });
+  return {
+    enroll: () => strategy.enroll(ctx()),
+    rotate: () => strategy.rotate(ctx()),
+    credentialSource: (profile) => strategy.credentialSource(ctx(), profile)
+  };
+}
+
+export {
+  NO_BROKER,
+  buildCredentialBrokerHandle
+};
+//# sourceMappingURL=chunk-WTUNZACT.js.map

package/dist/chunk-WTUNZACT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAkFO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AACzD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/chunk-X6CMGUAG.js

@@ -0,0 +1,69 @@
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  bufferToBase64
+} from "./chunk-HUS3J5WM.js";
+
+// src/kernel/enclave/classify/bidx.ts
+var subtle = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/kernel/enclave/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-X6CMGUAG.js.map

package/dist/chunk-X6CMGUAG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/bidx.ts","../src/kernel/enclave/classify/find.ts"],"sourcesContent":["/**\n * Blind-index slow-tag primitive for classified `equatable` fields (stage 2).\n *\n * `mintBidxTag` mints a deterministic, key-and-cost-gated tag —\n * `COST_BYTE ‖ HMAC-SHA256(K_idx, PBKDF2-SHA256(normalized, salt_cf))` — that\n * lets `find.ts` do blind equality lookup over an otherwise-opaque field\n * without ever storing the plaintext or a fast dictionary-crackable digest.\n *\n * Rationale (M-2/I3, spec §4/Crypto #1):\n *  - The outer HMAC is **keyed** by `K_idx`, a DEK-derived key never seen by\n *    the store. A key-less adversary (store access only) cannot mint a\n *    candidate tag to test against the index at all — the HMAC blocks the\n *    classic \"key-less dictionary attack\" a plain digest would invite.\n *  - The inner `pbkdf2VerifyDigest` (stage-2, `digest.ts`) reuses the\n *    existing 600K-iteration cost floor, so even a **DEK holder** who can\n *    compute `K_idx` still pays the PBKDF2 cost per guess — minting is not\n *    free just because you crossed the door.\n *  - Neither control is the real security boundary: the DOOR (who is ever\n *    handed the DEK to begin with) is. These two costs only shape the\n *    economics for whoever is already inside; they do not substitute for\n *    access control.\n *\n * `K_idx` and `salt_cf` are separate HKDF derivations off the same DEK\n * (L-1, #554 precedent: dedicated keys from day one, no shared/legacy form) —\n * sign-key hygiene, not `HMAC(K_idx, const)`. Both derivations are\n * domain-separated per `(collection, field)` so a tag cannot be replayed\n * across fields or collections (join-attack separation).\n *\n * `CURRENT_COST_BYTE` is a 1-byte discriminator prefixed onto every tag so a\n * future iteration-tier bump can mint new tags while old ones still parse:\n * an unknown discriminator is a cheap, immediate non-match instead of a\n * PBKDF2 run at the wrong iteration count.\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { bufferToBase64 } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the `K_idx` (blind-index HMAC key) derivation. */\nexport const CLASSIFY_INDEX_KEY_DOMAIN = 'noydb-classify-index-v1'\n\n/** HKDF salt domain for the `salt_cf` (per collection/field PBKDF2 salt) derivation. */\nexport const CLASSIFY_INDEX_SALT_DOMAIN = 'noydb-classify-index-salt-v1'\n\n/** Cost-byte discriminator: version 1, iteration-tier 600K. */\nexport const COST_BYTE_V1 = 0x01\n/** The cost byte new tags are minted at. */\nexport const CURRENT_COST_BYTE = COST_BYTE_V1\n\n/**\n * Map a tag's cost-byte discriminator to its PBKDF2 iteration count.\n * An unrecognized discriminator returns `null` — a mismatched/legacy byte\n * is a cheap non-match, never a PBKDF2 run at the wrong tier.\n */\nexport function iterationsForCostByte(b: number): number | null {\n  if (b === COST_BYTE_V1) return VDIG_ITERATIONS\n  return null\n}\n\n/**\n * Derive the collection+field's dedicated blind-index HMAC key `K_idx` from\n * the DEK via HKDF-SHA256. Non-extractable, `sign`-only — it never leaves\n * this module in usable form.\n */\nexport async function deriveClassifyIndexKey(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<EnclaveKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * Derive the collection+field's dedicated PBKDF2 salt `salt_cf` from the DEK\n * via a SEPARATE HKDF-deriveBits (distinct from {@link deriveClassifyIndexKey}\n * — sign-key hygiene, not `HMAC(K_idx, const)`). 32 raw bytes.\n */\nexport async function deriveClassifyIndexSalt(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<Uint8Array> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Mint a blind-index tag at a given cost byte:\n * `tag = base64(COST_BYTE ‖ HMAC(K_idx, PBKDF2(normalized, salt_cf, iterations-for(COST_BYTE))))`.\n * Factored out of {@link mintBidxTag} so `find.ts`'s `computeBidxTarget` can\n * reuse the same crypto at a caller-chosen cost byte (e.g. to evaluate a\n * legacy tier) without duplicating the derivation/digest/MAC pipeline.\n */\nexport async function mintAt(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte: number,\n): Promise<string> {\n  const iterations = iterationsForCostByte(costByte)\n  if (iterations == null) {\n    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`)\n  }\n  const saltCf = await deriveClassifyIndexSalt(dek, collection, field)\n  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations)\n  const kIdx = await deriveClassifyIndexKey(dek, collection, field)\n  const mac = await subtle.sign('HMAC', kIdx, inner as BufferSource)\n  const tag = new Uint8Array(1 + 32)\n  tag[0] = costByte\n  tag.set(new Uint8Array(mac), 1)\n  return bufferToBase64(tag)\n}\n\n/**\n * Mint a blind-index tag for an already-normalized value at\n * {@link CURRENT_COST_BYTE}. The caller normalizes once via\n * `normalizeForVerify` (the shared pipeline with `mintVdigSlot`) —\n * `mintBidxTag` never re-normalizes.\n */\nexport async function mintBidxTag(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<string> {\n  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE)\n}\n","/**\n * Query-side blind-index target derivation for classified `equatable`\n * fields (stage 2). `computeBidxTarget` normalizes a caller-supplied\n * candidate and mints it into the same 33-byte `_bidx` tag shape produced by\n * `mintBidxTag` (`bidx.ts`), so a caller can string-compare the result\n * against a stored tag to answer \"does this candidate match?\" without ever\n * decrypting or dictionary-attacking the field.\n *\n * Discriminator-scan contract (Oracle #4): a scanning caller reads each\n * stored tag's leading cost-byte discriminator and derives the target tag\n * **once per distinct discriminator present** — never per-record. `find.ts`\n * itself only computes a single target for a single requested `costByte`;\n * the batching-by-discriminator behavior belongs to the scanner\n * (`findByDigest`, a later task), which calls this function once per\n * distinct discriminator it encounters at step 2 of its scan.\n *\n * An unrecognized `costByte` (unknown or legacy tier not yet supported) is a\n * cheap `null` non-match — `computeBidxTarget` never runs PBKDF2 at a wrong\n * iteration tier just to produce a target that could not possibly match.\n * A legacy tag of a KNOWN older tier remains matchable today by passing that\n * tier's `costByte` explicitly (v1-only today: `CURRENT_COST_BYTE` is the\n * only recognized tier, so this is a future-proofing hook, not live behavior\n * yet).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { mintAt, iterationsForCostByte, CURRENT_COST_BYTE } from './bidx.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\n\n/**\n * Normalize `candidate` and mint it into a blind-index target tag at\n * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison\n * against a stored `_bidx` tag. Returns `null` when `costByte` is not a\n * recognized discriminator — no PBKDF2 is attempted at an unknown/wrong\n * tier (Oracle #4).\n */\nexport async function computeBidxTarget(\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte?: number,\n): Promise<string | null> {\n  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE\n  const iters = iterationsForCostByte(resolvedCostByte)\n  if (iters === null) return null\n  const normalized = normalizeForVerify(normalize, candidate)\n  return mintAt(normalized, dek, collection, field, resolvedCostByte)\n}\n"],"mappings":";;;;;;;;;;AAuCA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,eAAe;AAErB,IAAM,oBAAoB;AAO1B,SAAS,sBAAsB,GAA0B;AAC9D,MAAI,MAAM,aAAc,QAAO;AAC/B,SAAO;AACT;AAOA,eAAsB,uBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,yBAAyB;AAC/D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,2BAA2B,YAAY,KAAK,CAAC,CAAC;AACpG,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAOA,eAAsB,wBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,0BAA0B;AAChE,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,4BAA4B,YAAY,KAAK,CAAC,CAAC;AACrG,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AASA,eAAsB,OACpB,YACA,KACA,YACA,OACA,UACiB;AACjB,QAAM,aAAa,sBAAsB,QAAQ;AACjD,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,MAAM,6BAA6B,SAAS,SAAS,EAAE,CAAC,EAAE;AAAA,EACtE;AACA,QAAM,SAAS,MAAM,wBAAwB,KAAK,YAAY,KAAK;AACnE,QAAM,QAAQ,MAAM,mBAAmB,YAAY,QAAQ,UAAU;AACrE,QAAM,OAAO,MAAM,uBAAuB,KAAK,YAAY,KAAK;AAChE,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM,KAAqB;AACjE,QAAM,MAAM,IAAI,WAAW,IAAI,EAAE;AACjC,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC;AAC9B,SAAO,eAAe,GAAG;AAC3B;AAQA,eAAsB,YACpB,YACA,KACA,YACA,OACiB;AACjB,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,iBAAiB;AACrE;;;ACtGA,eAAsB,kBACpB,WACA,WACA,KACA,YACA,OACA,UACwB;AACxB,QAAM,mBAAmB,YAAY;AACrC,QAAM,QAAQ,sBAAsB,gBAAgB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,aAAa,mBAAmB,WAAW,SAAS;AAC1D,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,gBAAgB;AACpE;","names":[]}

package/dist/chunk-XFXUTFWQ.js

@@ -0,0 +1,85 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  loadOrCreateSigner
+} from "./chunk-D3EFFFOL.js";
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  AttestationError,
+  ConflictError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/attestation/revoke.ts
+import { signRevocationList } from "@noy-db/attestation";
+function requireOwner(ctx, op) {
+  if (ctx.role !== "owner") {
+    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`);
+  }
+}
+async function readSet(store, vault, dek) {
+  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID);
+  if (!env) return { docIds: /* @__PURE__ */ new Set(), version: void 0 };
+  const set = JSON.parse(await openEnvelopeJson(env, dek));
+  return { docIds: new Set(set.docIds), version: env._v };
+}
+async function mutateSet(ctx, mutate) {
+  const dek = await ctx.getDEK();
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek);
+    mutate(docIds);
+    const payload = { docIds: [...docIds].sort(), updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const { iv, data } = await encrypt(JSON.stringify(payload), dek);
+    const expectedVersion = version ?? 0;
+    const env = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: expectedVersion + 1,
+      _ts: payload.updatedAt,
+      _iv: iv,
+      _data: data
+    };
+    try {
+      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion);
+      return;
+    } catch (e) {
+      if (e instanceof ConflictError && attempt === 0) continue;
+      throw e;
+    }
+  }
+}
+async function revokeDocCore(ctx, docId) {
+  requireOwner(ctx, "revokeAttestation");
+  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId);
+  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`);
+  await mutateSet(ctx, (ids) => ids.add(docId));
+}
+async function unrevokeDocCore(ctx, docId) {
+  requireOwner(ctx, "unrevokeAttestation");
+  await mutateSet(ctx, (ids) => ids.delete(docId));
+}
+async function getRevokedDocIdsCore(ctx) {
+  const dek = await ctx.getDEK();
+  const { docIds } = await readSet(ctx.store, ctx.vault, dek);
+  return [...docIds].sort();
+}
+async function publishRevocationListCore(ctx) {
+  requireOwner(ctx, "publishRevocationList");
+  const docIds = await getRevokedDocIdsCore(ctx);
+  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK());
+  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64);
+}
+
+export {
+  revokeDocCore,
+  unrevokeDocCore,
+  getRevokedDocIdsCore,
+  publishRevocationListCore
+};
+//# sourceMappingURL=chunk-XFXUTFWQ.js.map

package/dist/chunk-XFXUTFWQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/revoke.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { AttestationError, ConflictError } from '../../kernel/errors.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID } from './signer.js'\nimport { signRevocationList, type RevocationList } from '@noy-db/attestation'\n\n/** Everything the revoke core needs from the Vault, injected for testability. */\nexport interface RevokeContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK. */\n  getDEK(): Promise<EnclaveKey>\n}\n\ninterface RevokedSet {\n  docIds: string[]\n  updatedAt: string\n}\n\nfunction requireOwner(ctx: RevokeContext, op: string): void {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`)\n  }\n}\n\nasync function readSet(store: NoydbStore, vault: string, dek: EnclaveKey): Promise<{ docIds: Set<string>; version: number | undefined }> {\n  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID)\n  if (!env) return { docIds: new Set<string>(), version: undefined }\n  const set = JSON.parse(await openEnvelopeJson(env, dek)) as RevokedSet\n  return { docIds: new Set(set.docIds), version: env._v }\n}\n\n/** Read-modify-write the _revoked set with optimistic concurrency + one retry. */\nasync function mutateSet(ctx: RevokeContext, mutate: (ids: Set<string>) => void): Promise<void> {\n  const dek = await ctx.getDEK()\n  for (let attempt = 0; attempt < 2; attempt++) {\n    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek)\n    mutate(docIds)\n    const payload: RevokedSet = { docIds: [...docIds].sort(), updatedAt: new Date().toISOString() }\n    const { iv, data } = await encrypt(JSON.stringify(payload), dek)\n    const expectedVersion = version ?? 0\n    const env: EncryptedEnvelope = {\n      _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: payload.updatedAt, _iv: iv, _data: data,\n    }\n    try {\n      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion)\n      return\n    } catch (e) {\n      if (e instanceof ConflictError && attempt === 0) continue\n      throw e\n    }\n  }\n}\n\nexport async function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'revokeAttestation')\n  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId)\n  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`)\n  await mutateSet(ctx, (ids) => ids.add(docId))\n}\n\nexport async function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'unrevokeAttestation')\n  await mutateSet(ctx, (ids) => ids.delete(docId))\n}\n\nexport async function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]> {\n  const dek = await ctx.getDEK()\n  const { docIds } = await readSet(ctx.store, ctx.vault, dek)\n  return [...docIds].sort()\n}\n\nexport async function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList> {\n  requireOwner(ctx, 'publishRevocationList')\n  const docIds = await getRevokedDocIdsCore(ctx)\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK())\n  return signRevocationList(docIds, new Date().toISOString(), signer.keyId, signer.privateKeyPkcs8B64)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,SAAS,0BAA+C;AAgBxD,SAAS,aAAa,KAAoB,IAAkB;AAC1D,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,GAAG,EAAE,0CAA0C,IAAI,IAAI,iDAAiD;AAAA,EACrI;AACF;AAEA,eAAe,QAAQ,OAAmB,OAAe,KAAgF;AACvI,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,yBAAyB,iBAAiB;AAC7E,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,SAAS,OAAU;AACjE,QAAM,MAAM,KAAK,MAAM,MAAM,iBAAiB,KAAK,GAAG,CAAC;AACvD,SAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,IAAI,GAAG;AACxD;AAGA,eAAe,UAAU,KAAoB,QAAmD;AAC9F,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AACnE,WAAO,MAAM;AACb,UAAM,UAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC9F,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,GAAG;AAC/D,UAAM,kBAAkB,WAAW;AACnC,UAAM,MAAyB;AAAA,MAC7B,QAAQ;AAAA,MAAsB,IAAI,kBAAkB;AAAA,MAAG,KAAK,QAAQ;AAAA,MAAW,KAAK;AAAA,MAAI,OAAO;AAAA,IACjG;AACA,QAAI;AACF,YAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,mBAAmB,KAAK,eAAe;AAC/F;AAAA,IACF,SAAS,GAAG;AACV,UAAI,aAAa,iBAAiB,YAAY,EAAG;AACjD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,KAAoB,OAA8B;AACpF,eAAa,KAAK,mBAAmB;AACrC,QAAM,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,KAAK;AAC5E,MAAI,CAAC,OAAQ,OAAM,IAAI,iBAAiB,mCAAmC,KAAK,6CAA6C;AAC7H,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;AAC9C;AAEA,eAAsB,gBAAgB,KAAoB,OAA8B;AACtF,eAAa,KAAK,qBAAqB;AACvC,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC;AACjD;AAEA,eAAsB,qBAAqB,KAAuC;AAChF,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AAC1D,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK;AAC1B;AAEA,eAAsB,0BAA0B,KAA6C;AAC3F,eAAa,KAAK,uBAAuB;AACzC,QAAM,SAAS,MAAM,qBAAqB,GAAG;AAC7C,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,IAAI,OAAO,CAAC;AAChF,SAAO,mBAAmB,SAAQ,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,kBAAkB;AACrG;","names":[]}