@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-WGV4CUZT.js

@@ -0,0 +1,167 @@
+import {
+  canonicalize,
+  derivePersistedSchema
+} from "./chunk-QLLKLFE2.js";
+import {
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-C7NTK5I3.js";
+import {
+  ConflictError
+} from "./chunk-FH542DDY.js";
+
+// src/with-shape/schema-update/delta.ts
+function computeSchemaDelta(stored, fresh, collection) {
+  const a = stored;
+  const b = fresh;
+  const aProps = a.properties ?? {};
+  const bProps = b.properties ?? {};
+  const aReq = new Set(a.required ?? []);
+  const bReq = new Set(b.required ?? []);
+  const aKeys = Object.keys(aProps);
+  const bKeys = Object.keys(bProps);
+  const added = bKeys.filter((k) => !(k in aProps));
+  const removed = aKeys.filter((k) => !(k in bProps));
+  const changed = [];
+  for (const k of bKeys) {
+    if (!(k in aProps)) continue;
+    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
+    const requiredChanged = aReq.has(k) !== bReq.has(k);
+    if (shapeChanged || requiredChanged) {
+      changed.push({ field: k, requiredChanged, shapeChanged });
+    }
+  }
+  let kind;
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    kind = "none";
+  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
+    kind = "additive";
+  } else {
+    kind = "non-additive";
+  }
+  return { collection, kind, added, removed, changed };
+}
+
+// src/with-shape/schema-update/dispatch.ts
+async function evaluateStrategies(delta, strategies, ctx) {
+  for (const strategy of strategies) {
+    const decision = await strategy.onSchemaDelta(delta, ctx);
+    if (decision.action !== "allow") return decision;
+  }
+  return { action: "allow" };
+}
+
+// src/with-shape/persisted-schemas/register.ts
+var MAX_SCHEMA_CAS_RETRIES = 5;
+async function persistSchemaIfNeeded(opts) {
+  const fresh = await derivePersistedSchema(opts.validator);
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored && isEquivalent(stored, fresh)) {
+      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
+    }
+    let decision = { action: "allow" };
+    const strategies = opts.strategies ?? [];
+    if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
+      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
+      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
+    }
+    if (decision.action !== "allow") {
+      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
+    }
+    let toSave = fresh;
+    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
+    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
+      return { written: true, skipped: false, envelope: toSave, decision };
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistClassifiedMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      classified: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistSatelliteMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      satellite: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+function satelliteMarkersEqual(a, b) {
+  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
+}
+function markersEqual(a, b) {
+  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
+}
+function sameSet(a, b) {
+  if (a.length !== b.length) return false;
+  const s = new Set(a);
+  return b.every((x) => s.has(x));
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isEquivalent(a, b) {
+  if (a.kind !== b.kind) return false;
+  if (a.hash && b.hash) return a.hash === b.hash;
+  if (a.hash === null && b.hash === null) return true;
+  return false;
+}
+
+export {
+  persistSchemaIfNeeded,
+  persistClassifiedMarker,
+  persistSatelliteMarker
+};
+//# sourceMappingURL=chunk-WGV4CUZT.js.map

package/dist/chunk-WTUNZACT.js

@@ -0,0 +1,30 @@
+import {
+  BrokerNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/port/with/broker-strategy.ts
+var NO_BROKER = {
+  async enroll() {
+    throw new BrokerNotEnabledError();
+  },
+  async rotate() {
+    throw new BrokerNotEnabledError();
+  },
+  credentialSource() {
+    throw new BrokerNotEnabledError();
+  }
+};
+function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
+  const ctx = () => ({ store, vault, keyring: getKeyring() });
+  return {
+    enroll: () => strategy.enroll(ctx()),
+    rotate: () => strategy.rotate(ctx()),
+    credentialSource: (profile) => strategy.credentialSource(ctx(), profile)
+  };
+}
+
+export {
+  NO_BROKER,
+  buildCredentialBrokerHandle
+};
+//# sourceMappingURL=chunk-WTUNZACT.js.map

package/dist/chunk-WTUNZACT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAkFO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AACzD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/chunk-X6CMGUAG.js

@@ -0,0 +1,69 @@
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  bufferToBase64
+} from "./chunk-HUS3J5WM.js";
+
+// src/kernel/enclave/classify/bidx.ts
+var subtle = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/kernel/enclave/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-X6CMGUAG.js.map

package/dist/chunk-XFXUTFWQ.js

@@ -0,0 +1,85 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  loadOrCreateSigner
+} from "./chunk-D3EFFFOL.js";
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  AttestationError,
+  ConflictError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/attestation/revoke.ts
+import { signRevocationList } from "@noy-db/attestation";
+function requireOwner(ctx, op) {
+  if (ctx.role !== "owner") {
+    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`);
+  }
+}
+async function readSet(store, vault, dek) {
+  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID);
+  if (!env) return { docIds: /* @__PURE__ */ new Set(), version: void 0 };
+  const set = JSON.parse(await openEnvelopeJson(env, dek));
+  return { docIds: new Set(set.docIds), version: env._v };
+}
+async function mutateSet(ctx, mutate) {
+  const dek = await ctx.getDEK();
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek);
+    mutate(docIds);
+    const payload = { docIds: [...docIds].sort(), updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const { iv, data } = await encrypt(JSON.stringify(payload), dek);
+    const expectedVersion = version ?? 0;
+    const env = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: expectedVersion + 1,
+      _ts: payload.updatedAt,
+      _iv: iv,
+      _data: data
+    };
+    try {
+      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion);
+      return;
+    } catch (e) {
+      if (e instanceof ConflictError && attempt === 0) continue;
+      throw e;
+    }
+  }
+}
+async function revokeDocCore(ctx, docId) {
+  requireOwner(ctx, "revokeAttestation");
+  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId);
+  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`);
+  await mutateSet(ctx, (ids) => ids.add(docId));
+}
+async function unrevokeDocCore(ctx, docId) {
+  requireOwner(ctx, "unrevokeAttestation");
+  await mutateSet(ctx, (ids) => ids.delete(docId));
+}
+async function getRevokedDocIdsCore(ctx) {
+  const dek = await ctx.getDEK();
+  const { docIds } = await readSet(ctx.store, ctx.vault, dek);
+  return [...docIds].sort();
+}
+async function publishRevocationListCore(ctx) {
+  requireOwner(ctx, "publishRevocationList");
+  const docIds = await getRevokedDocIdsCore(ctx);
+  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK());
+  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64);
+}
+
+export {
+  revokeDocCore,
+  unrevokeDocCore,
+  getRevokedDocIdsCore,
+  publishRevocationListCore
+};
+//# sourceMappingURL=chunk-XFXUTFWQ.js.map

package/dist/chunk-XHV25KBM.js

@@ -0,0 +1,30 @@
+import {
+  AttestationNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/attestation/strategy.ts
+var NO_ATTESTATION = {
+  async issueAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async getDocumentSigningPublicKey() {
+    throw new AttestationNotEnabledError();
+  },
+  async revokeAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async unrevokeAttestation() {
+    throw new AttestationNotEnabledError();
+  },
+  async getRevokedDocIds() {
+    throw new AttestationNotEnabledError();
+  },
+  async publishRevocationList() {
+    throw new AttestationNotEnabledError();
+  }
+};
+
+export {
+  NO_ATTESTATION
+};
+//# sourceMappingURL=chunk-XHV25KBM.js.map

package/dist/chunk-YSXEFGND.js

@@ -0,0 +1,124 @@
+import {
+  DerivationCapExceededError,
+  DerivationOutputShapeError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/derivations/executor.ts
+var DerivationExecutor = {
+  /**
+   * Run `derive` once, validate output shape against the spec, stamp
+   * `_derivedFrom` onto every output. Returns per-output success or
+   * failure; throws only for shape mismatches (a contract violation).
+   */
+  async run(strategy, source, sourceVersion, strategyHash, ctx) {
+    const outputs = {};
+    let derived;
+    try {
+      derived = await Promise.resolve(strategy.derive(source, ctx));
+    } catch (err) {
+      for (const key of Object.keys(strategy.outputs)) {
+        outputs[key] = {
+          kind: "failed",
+          value: {},
+          ok: false,
+          error: err instanceof Error ? err : new Error(String(err))
+        };
+      }
+      return { outputs, failed: true };
+    }
+    const meta = {
+      source: strategy.source,
+      sourceId: source.id,
+      sourceVersion,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      strategyHash
+    };
+    for (const key of Object.keys(strategy.outputs)) {
+      const outSpec = strategy.outputs[key];
+      if (!outSpec) continue;
+      const value = derived[key];
+      if (outSpec.shape === "array") {
+        if (value === void 0 || value === null) {
+          outputs[key] = { kind: "array", ok: true, entries: [] };
+          continue;
+        }
+        if (!Array.isArray(value)) {
+          throw new DerivationOutputShapeError(
+            key,
+            `shape 'array' expects an array, got ${typeof value}`
+          );
+        }
+        const maxFanout = outSpec.maxFanout ?? 64;
+        if (value.length > maxFanout) {
+          throw new DerivationCapExceededError(key, value.length, maxFanout);
+        }
+        const entries = [];
+        const seenKeys = /* @__PURE__ */ new Set();
+        for (let i = 0; i < value.length; i++) {
+          const row = value[i];
+          if (row === null || typeof row !== "object") {
+            throw new DerivationOutputShapeError(
+              key,
+              `array member at index ${i} must be a non-null object (got ${row === null ? "null" : typeof row})`
+            );
+          }
+          let derivedKey;
+          try {
+            derivedKey = outSpec.key(row);
+          } catch (err) {
+            throw new DerivationOutputShapeError(
+              key,
+              `key extractor threw on array member at index ${i}: ` + (err instanceof Error ? err.message : String(err))
+            );
+          }
+          if (typeof derivedKey !== "string" || derivedKey.length === 0) {
+            throw new DerivationOutputShapeError(
+              key,
+              `key extractor returned ${typeof derivedKey === "string" ? "empty string" : typeof derivedKey} at index ${i}; expected non-empty string`
+            );
+          }
+          if (seenKeys.has(derivedKey)) {
+            throw new DerivationOutputShapeError(
+              key,
+              `duplicate key "${derivedKey}" in array output (index ${i}); each derived row must have a unique key within a single derive() invocation`
+            );
+          }
+          seenKeys.add(derivedKey);
+          entries.push({
+            key: derivedKey,
+            value: { ...row, _derivedFrom: meta }
+          });
+        }
+        outputs[key] = { kind: "array", ok: true, entries };
+        continue;
+      }
+      if (value === void 0 || value === null) {
+        if (outSpec.optional === true) {
+          outputs[key] = { kind: "record", value: {}, ok: true, skipped: true };
+          continue;
+        }
+        throw new DerivationOutputShapeError(
+          key,
+          `expected object, got ${value === void 0 ? "undefined" : "null"}`
+        );
+      }
+      if (typeof value !== "object") {
+        throw new DerivationOutputShapeError(
+          key,
+          `expected object, got ${typeof value}`
+        );
+      }
+      outputs[key] = {
+        kind: "record",
+        value: { ...value, _derivedFrom: meta },
+        ok: true
+      };
+    }
+    return { outputs, failed: false };
+  }
+};
+
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=chunk-YSXEFGND.js.map

package/dist/chunk-YXOUQ2H7.js

@@ -0,0 +1,36 @@
+import {
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-formula/overlay-views/with-overlayed-view.ts
+function withOverlayedView(spec) {
+  if (!spec.name || spec.name.length === 0) {
+    throw new ValidationError("withOverlayedView: name is required");
+  }
+  if (!spec.base || spec.base.length === 0) {
+    throw new ValidationError("withOverlayedView: base is required");
+  }
+  if (!spec.overlay || spec.overlay.length === 0) {
+    throw new ValidationError("withOverlayedView: overlay is required");
+  }
+  if (spec.base === spec.overlay) {
+    throw new ValidationError("withOverlayedView: base and overlay must be different collections");
+  }
+  if (spec.base === spec.name || spec.overlay === spec.name) {
+    throw new ValidationError(
+      "withOverlayedView: virtual name must differ from both base and overlay collection names"
+    );
+  }
+  if (!spec.shadowField || spec.shadowField.length === 0) {
+    throw new ValidationError("withOverlayedView: shadowField is required");
+  }
+  return {
+    __noydb_strategy: "overlayed-view",
+    spec
+  };
+}
+
+export {
+  withOverlayedView
+};
+//# sourceMappingURL=chunk-YXOUQ2H7.js.map

package/dist/chunk-ZP5PL65C.js

@@ -0,0 +1,80 @@
+import {
+  FieldFrozenError,
+  InvariantError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/guards/executor.ts
+var GuardExecutor = {
+  /**
+   * Compare existing vs incoming for each `frozenFields.fields` entry
+   * when `frozenFields.when(existing)` is true. Throws
+   * `FieldFrozenError` listing every changed frozen field.
+   *
+   * @param skipFields — field names that are schema-owned computed fields.
+   *   These are excluded from the comparison because `incoming` carries the
+   *   raw user input (computed fields not yet evaluated), so comparing
+   *   `existing[field]` vs `incoming[field]` would always look like a
+   *   change even when the computed result is unchanged.
+   */
+  async checkFrozenFields(guard, id, existing, incoming, skipFields) {
+    const ff = guard.frozenFields;
+    if (!ff) return;
+    if (existing === null) return;
+    if (!ff.when(existing)) return;
+    const changed = [];
+    for (const f of ff.fields) {
+      if (skipFields?.has(String(f))) continue;
+      if (existing[f] !== incoming[f]) {
+        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
+      }
+    }
+    if (changed.length > 0) {
+      throw new FieldFrozenError(guard.collection, id, changed);
+    }
+  },
+  /**
+   * Run a single guard's invariant over its slice of the change-set.
+   * Any throw is converted to `InvariantError` unless it already is one.
+   */
+  async runInvariant(guard, changes, ctx) {
+    const amendment = guard.amendment;
+    if (!amendment) return;
+    try {
+      await amendment.invariant(changes, ctx);
+    } catch (err) {
+      if (err instanceof InvariantError) throw err;
+      throw new InvariantError(
+        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
+      );
+    }
+  }
+};
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object") return a === b;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    const aa = a;
+    const bb = b;
+    if (aa.length !== bb.length) return false;
+    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const ak = Object.keys(ao);
+  const bk = Object.keys(bo);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+    if (!deepEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=chunk-ZP5PL65C.js.map

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-Y3A5CB5G.js";
+} from "../chunk-DMFNPHCX.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-VWM3DAVB.js";
-import "../chunk-YN5IAHN6.js";
-import "../chunk-VEAVKDDB.js";
+} from "../chunk-PR5LC5YX.js";
+import "../chunk-ARSAMO24.js";
+import "../chunk-CKZW6P5V.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-S7VFUQM2.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,