@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-XHV25KBM.js

@@ -0,0 +1,30 @@
+import {
+  AttestationNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/attestation/strategy.ts
+var NO_ATTESTATION = {
+  async issueAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async getDocumentSigningPublicKey() {
+    throw new AttestationNotEnabledError();
+  },
+  async revokeAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async unrevokeAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async getRevokedDocIds() {
+    throw new AttestationNotEnabledError();
+  },
+  async publishRevocationList() {
+    throw new AttestationNotEnabledError();
+  }
+};
+
+export {
+  NO_ATTESTATION
+};
+//# sourceMappingURL=chunk-XHV25KBM.js.map

package/dist/chunk-YSXEFGND.js

@@ -0,0 +1,124 @@
+import {
+  DerivationCapExceededError,
+  DerivationOutputShapeError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/derivations/executor.ts
+var DerivationExecutor = {
+  /**
+   * Run `derive` once, validate output shape against the spec, stamp
+   * `_derivedFrom` onto every output. Returns per-output success or
+   * failure; throws only for shape mismatches (a contract violation).
+   */
+  async run(strategy, source, sourceVersion, strategyHash, ctx) {
+    const outputs = {};
+    let derived;
+    try {
+      derived = await Promise.resolve(strategy.derive(source, ctx));
+    } catch (err) {
+      for (const key of Object.keys(strategy.outputs)) {
+        outputs[key] = {
+          kind: "failed",
+          value: {},
+          ok: false,
+          error: err instanceof Error ? err : new Error(String(err))
+        };
+      }
+      return { outputs, failed: true };
+    }
+    const meta = {
+      source: strategy.source,
+      sourceId: source.id,
+      sourceVersion,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      strategyHash
+    };
+    for (const key of Object.keys(strategy.outputs)) {
+      const outSpec = strategy.outputs[key];
+      if (!outSpec) continue;
+      const value = derived[key];
+      if (outSpec.shape === "array") {
+        if (value === void 0 || value === null) {
+          outputs[key] = { kind: "array", ok: true, entries: [] };
+          continue;
+        }
+        if (!Array.isArray(value)) {
+          throw new DerivationOutputShapeError(
+            key,
+            `shape 'array' expects an array, got ${typeof value}`
+          );
+        }
+        const maxFanout = outSpec.maxFanout ?? 64;
+        if (value.length > maxFanout) {
+          throw new DerivationCapExceededError(key, value.length, maxFanout);
+        }
+        const entries = [];
+        const seenKeys = /* @__PURE__ */ new Set();
+        for (let i = 0; i < value.length; i++) {
+          const row = value[i];
+          if (row === null || typeof row !== "object") {
+            throw new DerivationOutputShapeError(
+              key,
+              `array member at index ${i} must be a non-null object (got ${row === null ? "null" : typeof row})`
+            );
+          }
+          let derivedKey;
+          try {
+            derivedKey = outSpec.key(row);
+          } catch (err) {
+            throw new DerivationOutputShapeError(
+              key,
+              `key extractor threw on array member at index ${i}: ` + (err instanceof Error ? err.message : String(err))
+            );
+          }
+          if (typeof derivedKey !== "string" || derivedKey.length === 0) {
+            throw new DerivationOutputShapeError(
+              key,
+              `key extractor returned ${typeof derivedKey === "string" ? "empty string" : typeof derivedKey} at index ${i}; expected non-empty string`
+            );
+          }
+          if (seenKeys.has(derivedKey)) {
+            throw new DerivationOutputShapeError(
+              key,
+              `duplicate key "${derivedKey}" in array output (index ${i}); each derived row must have a unique key within a single derive() invocation`
+            );
+          }
+          seenKeys.add(derivedKey);
+          entries.push({
+            key: derivedKey,
+            value: { ...row, _derivedFrom: meta }
+          });
+        }
+        outputs[key] = { kind: "array", ok: true, entries };
+        continue;
+      }
+      if (value === void 0 || value === null) {
+        if (outSpec.optional === true) {
+          outputs[key] = { kind: "record", value: {}, ok: true, skipped: true };
+          continue;
+        }
+        throw new DerivationOutputShapeError(
+          key,
+          `expected object, got ${value === void 0 ? "undefined" : "null"}`
+        );
+      }
+      if (typeof value !== "object") {
+        throw new DerivationOutputShapeError(
+          key,
+          `expected object, got ${typeof value}`
+        );
+      }
+      outputs[key] = {
+        kind: "record",
+        value: { ...value, _derivedFrom: meta },
+        ok: true
+      };
+    }
+    return { outputs, failed: false };
+  }
+};
+
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=chunk-YSXEFGND.js.map

package/dist/chunk-YXOUQ2H7.js

@@ -0,0 +1,36 @@
+import {
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/overlay-views/with-overlayed-view.ts
+function withOverlayedView(spec) {
+  if (!spec.name || spec.name.length === 0) {
+    throw new ValidationError("withOverlayedView: name is required");
+  }
+  if (!spec.base || spec.base.length === 0) {
+    throw new ValidationError("withOverlayedView: base is required");
+  }
+  if (!spec.overlay || spec.overlay.length === 0) {
+    throw new ValidationError("withOverlayedView: overlay is required");
+  }
+  if (spec.base === spec.overlay) {
+    throw new ValidationError("withOverlayedView: base and overlay must be different collections");
+  }
+  if (spec.base === spec.name || spec.overlay === spec.name) {
+    throw new ValidationError(
+      "withOverlayedView: virtual name must differ from both base and overlay collection names"
+    );
+  }
+  if (!spec.shadowField || spec.shadowField.length === 0) {
+    throw new ValidationError("withOverlayedView: shadowField is required");
+  }
+  return {
+    __noydb_strategy: "overlayed-view",
+    spec
+  };
+}
+
+export {
+  withOverlayedView
+};
+//# sourceMappingURL=chunk-YXOUQ2H7.js.map

package/dist/chunk-ZP5PL65C.js

@@ -0,0 +1,80 @@
+import {
+  FieldFrozenError,
+  InvariantError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/guards/executor.ts
+var GuardExecutor = {
+  /**
+   * Compare existing vs incoming for each `frozenFields.fields` entry
+   * when `frozenFields.when(existing)` is true. Throws
+   * `FieldFrozenError` listing every changed frozen field.
+   *
+   * @param skipFields — field names that are schema-owned computed fields.
+   *   These are excluded from the comparison because `incoming` carries the
+   *   raw user input (computed fields not yet evaluated), so comparing
+   *   `existing[field]` vs `incoming[field]` would always look like a
+   *   change even when the computed result is unchanged.
+   */
+  async checkFrozenFields(guard, id, existing, incoming, skipFields) {
+    const ff = guard.frozenFields;
+    if (!ff) return;
+    if (existing === null) return;
+    if (!ff.when(existing)) return;
+    const changed = [];
+    for (const f of ff.fields) {
+      if (skipFields?.has(String(f))) continue;
+      if (existing[f] !== incoming[f]) {
+        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
+      }
+    }
+    if (changed.length > 0) {
+      throw new FieldFrozenError(guard.collection, id, changed);
+    }
+  },
+  /**
+   * Run a single guard's invariant over its slice of the change-set.
+   * Any throw is converted to `InvariantError` unless it already is one.
+   */
+  async runInvariant(guard, changes, ctx) {
+    const amendment = guard.amendment;
+    if (!amendment) return;
+    try {
+      await amendment.invariant(changes, ctx);
+    } catch (err) {
+      if (err instanceof InvariantError) throw err;
+      throw new InvariantError(
+        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
+      );
+    }
+  }
+};
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object") return a === b;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    const aa = a;
+    const bb = b;
+    if (aa.length !== bb.length) return false;
+    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const ak = Object.keys(ao);
+  const bk = Object.keys(bo);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+    if (!deepEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=chunk-ZP5PL65C.js.map

package/dist/classified/index.js

@@ -0,0 +1,40 @@
+import {
+  classified,
+  luhnCheck,
+  withClassified
+} from "../chunk-DMFNPHCX.js";
+import {
+  ClassifiedNeverStoredError,
+  ClassifiedValidationError,
+  NO_CLASSIFIED,
+  enforceClassifiedWrite,
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  resolveClassifiedFields
+} from "../chunk-PR5LC5YX.js";
+import "../chunk-ARSAMO24.js";
+import "../chunk-CKZW6P5V.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedRevealError,
+  ClassifiedRotationError,
+  ClassifiedVerifyError
+} from "../chunk-FH542DDY.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  ClassifiedConfigError,
+  ClassifiedNeverStoredError,
+  ClassifiedRevealError,
+  ClassifiedRotationError,
+  ClassifiedValidationError,
+  ClassifiedVerifyError,
+  NO_CLASSIFIED,
+  classified,
+  enforceClassifiedWrite,
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  luhnCheck,
+  resolveClassifiedFields,
+  withClassified
+};
+//# sourceMappingURL=index.js.map

package/dist/classified-marker-LQWWQNIJ.js

@@ -0,0 +1,24 @@
+import "./chunk-PZ5AY32C.js";
+
+// src/via/classified/config-drift.ts
+function markerForFields(vdigFields) {
+  if (vdigFields === null || vdigFields.size === 0) return null;
+  const digestOnly = [...vdigFields.keys()];
+  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) };
+}
+async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
+  const marker = markerForFields(vdigFields);
+  if (marker === null) return;
+  const { persistClassifiedMarker } = await import("./register-VCKOBWKT.js");
+  await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
+}
+async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
+  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
+  return persisted?.classified?.digestOnly ?? [];
+}
+export {
+  persistClassifiedMarkerForFields,
+  readClassifiedMarkerDigestOnly
+};
+//# sourceMappingURL=classified-marker-LQWWQNIJ.js.map

package/dist/classified-marker-LQWWQNIJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `via/classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/** Build the marker for a handle's digest-only field map, or null when it declares none. */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";;;AAwBA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO,EAAE,YAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI,EAAE;AAClG;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}

package/dist/collection-facade-YE2O4J4O.js

@@ -0,0 +1,39 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+} from "./chunk-P5RY4ZWD.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-7VSGW5KJ.js";
+import "./chunk-ELNBMFOS.js";
+import "./chunk-BE7N3AXA.js";
+import "./chunk-ARSAMO24.js";
+import "./chunk-25NDNMQ7.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-YE2O4J4O.js.map

package/dist/computed-W6MVAMWZ.js

@@ -0,0 +1,11 @@
+import {
+  ComputedFieldError,
+  evalComputedFields
+} from "./chunk-45ZZLTFH.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ComputedFieldError,
+  evalComputedFields
+};
+//# sourceMappingURL=computed-W6MVAMWZ.js.map

package/dist/consent/index.js

@@ -2,11 +2,17 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-MTMJVJ5W.js";
+} from "../chunk-C3YH34IL.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
+import "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/crdt/index.js

@@ -3,7 +3,7 @@ import {
   buildRgaState,
   mergeCrdtStates,
   resolveCrdtSnapshot
-} from "../chunk-6S7T6WC4.js";
+} from "../chunk-4GPE63GU.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/crdt/active.ts

package/dist/dead-filter-4KXZEB3X.js

@@ -0,0 +1,28 @@
+import {
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/dead-filter.ts
+async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
+  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const out = /* @__PURE__ */ new Map();
+  for (const name of collectionNames) {
+    if (name.startsWith("_")) continue;
+    let dek;
+    try {
+      dek = await getDEK(name);
+    } catch {
+      continue;
+    }
+    const persisted = await loadPersistedSchema(store, vaultName, name, dek);
+    const marker = persisted?.satellite;
+    if (!marker) continue;
+    out.set(name, await liveBaseIdSet(store, vaultName, marker.base));
+  }
+  return out;
+}
+export {
+  liveBaseIdSetsForBundle
+};
+//# sourceMappingURL=dead-filter-4KXZEB3X.js.map

package/dist/dead-filter-4KXZEB3X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/delegation-OPUU3R2E.js

@@ -0,0 +1,25 @@
+import {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+} from "./chunk-IDIV5NVH.js";
+import "./chunk-4R4Q64W5.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=delegation-OPUU3R2E.js.map

package/dist/derivations/index.js

@@ -1,22 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-LMTH2RM6.js";
+} from "../chunk-CB25ONKC.js";
 import {
   DerivationRegistry
-} from "../chunk-Q7SS3IME.js";
+} from "../chunk-BEIRE5K4.js";
+import "../chunk-7QIXUSDQ.js";
 import {
   DerivationExecutor
-} from "../chunk-PKHL44ER.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-YSXEFGND.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-BGUHU663.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-QLLKLFE2.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-BGUHU663.js.map