@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-7QIXUSDQ.js

@@ -0,0 +1,341 @@
+import {
+  DerivationCycleError,
+  MaterializedViewCycleError
+} from "./chunk-FH542DDY.js";
+
+// src/kernel/via/graph.ts
+var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
+var QUERYABLE_RANK = {
+  none: 0,
+  "det-exact": 1,
+  ordered: 2,
+  full: 3
+};
+function foldPosture(a, b) {
+  return {
+    encryptedAtRest: a.encryptedAtRest === "sealed" || b.encryptedAtRest === "sealed" ? "sealed" : "envelope",
+    queryable: QUERYABLE_RANK[a.queryable] <= QUERYABLE_RANK[b.queryable] ? a.queryable : b.queryable,
+    exportable: a.exportable && b.exportable,
+    forgettable: a.forgettable || b.forgettable
+  };
+}
+function foldWildcardSecurity(base, contributor) {
+  return {
+    encryptedAtRest: base.encryptedAtRest === "sealed" || contributor.encryptedAtRest === "sealed" ? "sealed" : "envelope",
+    queryable: base.queryable,
+    exportable: base.exportable && contributor.exportable,
+    forgettable: base.forgettable || contributor.forgettable
+  };
+}
+var FOLDED_KINDS = /* @__PURE__ */ new Set(["derivation", "rollup", "mv", "overlay"]);
+function isDefaultPosture(p) {
+  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable && p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable;
+}
+var SEP = "\0";
+var EMPTY_SET = /* @__PURE__ */ new Set();
+function nodeId(ref) {
+  return `${ref.collection}${SEP}${ref.field}`;
+}
+function displayNodeId(id) {
+  const sep = id.indexOf(SEP);
+  return `${id.slice(0, sep)}.${id.slice(sep + 1)}`;
+}
+var ViaGraph = class {
+  /** Declared source-field postures (registerField), keyed by node id. */
+  _posture = /* @__PURE__ */ new Map();
+  /** Every derived target's registration, keyed by the target's node id. */
+  _in = /* @__PURE__ */ new Map();
+  /** source node id -> derived targets that depend on it (dispatch/erasure). */
+  _out = /* @__PURE__ */ new Map();
+  /** Memoized effective posture per derived target node id. */
+  _effectiveCache = /* @__PURE__ */ new Map();
+  /** Memoized whole-collection security-axes fold for `'*'` wildcard LEAF nodes (#642),
+   *  keyed by collection name — see {@link _wildcardContribution}. Cleared alongside
+   *  `_effectiveCache` on every `registerField`/`registerDerived` (a later-registered
+   *  field must re-fold on the next read — registration ordering is free). */
+  _wildcardCache = /* @__PURE__ */ new Map();
+  /** Collections with at least one classified field (#638 Task 2 fix wave 2,
+   *  Finding I1 — the reconcile path's combined-state leak guard memory). */
+  _classifiedCollections = /* @__PURE__ */ new Set();
+  /** Computed field names declared with no `deps` entry, per collection
+   *  (Finding I1 — such a field registers no edge when no classified field is
+   *  present yet, so a LATER, separate reconcile call attaching classifiedFields
+   *  still needs to see it regardless of declaration order). */
+  _depslessComputed = /* @__PURE__ */ new Map();
+  /** Declare a source field's posture (money/i18n/classified/plain). Plain fields
+   *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */
+  registerField(collection, field, posture) {
+    const id = nodeId({ collection, field });
+    if (this._posture.has(id)) return;
+    this._posture.set(id, posture);
+    this._effectiveCache.clear();
+    this._wildcardCache.clear();
+  }
+  /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`
+   *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same
+   *  target replaces `_in` but does not prune stale `_out` edges — callers must
+   *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)
+   *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */
+  registerDerived(target, sources, kind, grain, onDelete, keyField) {
+    const id = nodeId(target);
+    this._in.set(id, {
+      target,
+      sources,
+      kind,
+      grain,
+      ...onDelete !== void 0 ? { onDelete } : {},
+      ...keyField !== void 0 ? { keyField } : {}
+    });
+    for (const source of sources) {
+      const sourceId = nodeId(source);
+      const dependents = this._out.get(sourceId);
+      if (dependents) dependents.push(target);
+      else this._out.set(sourceId, [target]);
+    }
+    this._effectiveCache.clear();
+    this._wildcardCache.clear();
+  }
+  /** Whether `target` already has a registered in-edge — lets a caller skip
+   *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:
+   *  `registerDerived`'s at-most-once contract must hold across repeated
+   *  identical `vault.collection()` calls, not just within a single one). */
+  hasDerived(target) {
+    return this._in.has(nodeId(target));
+  }
+  /** Mark/query a collection as having declared at least one classified field. */
+  markClassified(collection) {
+    this._classifiedCollections.add(collection);
+  }
+  isClassified(collection) {
+    return this._classifiedCollections.has(collection);
+  }
+  /** Mark/query a collection's depsless (no declared `deps`) computed
+   *  field names — see `_depslessComputed`'s doc comment above. */
+  markDepslessComputed(collection, field) {
+    let set = this._depslessComputed.get(collection);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this._depslessComputed.set(collection, set);
+    }
+    set.add(field);
+  }
+  depslessComputedFields(collection) {
+    return this._depslessComputed.get(collection) ?? EMPTY_SET;
+  }
+  /** Every field name the graph already has memory of for `collection` — from an
+   *  EARLIER, separate `vault.collection()` call (registered postures, derived
+   *  targets, depsless-computed names) — regardless of which via feature declared
+   *  it. #645 — `via/graph-wiring.ts`'s reconcile-path `knownFields` universe
+   *  (`collectKnownFieldNames`) is scoped to THIS call's own options only, so a
+   *  computed field attached in a LATER call whose `deps` correctly names a field
+   *  declared in an EARLIER call was spuriously refused as "unknown"; this method
+   *  lets that call site union in the graph's cross-call memory. Excludes the `'*'`
+   *  wildcard target (an overlay/derivation whole-record fold node, never a real
+   *  record field — see {@link registerDerived}'s doc comment). */
+  knownFieldNames(collection) {
+    const out = /* @__PURE__ */ new Set();
+    const prefix = `${collection}${SEP}`;
+    for (const id of this._posture.keys()) {
+      if (id.startsWith(prefix)) out.add(id.slice(prefix.length));
+    }
+    for (const edge of this._in.values()) {
+      if (edge.target.collection === collection && edge.target.field !== "*") out.add(edge.target.field);
+    }
+    const depsless = this._depslessComputed.get(collection);
+    if (depsless) for (const field of depsless) out.add(field);
+    return out;
+  }
+  /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a
+   *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —
+   *  same classes + message shape the registries throw today (behavior lock). */
+  assertAcyclic() {
+    const visited = /* @__PURE__ */ new Set();
+    const stack = [];
+    const notRefEdge = (t) => this._in.get(nodeId(t))?.kind !== "ref";
+    const neighboursOf = (id) => {
+      const own = (this._out.get(id) ?? []).filter(notRefEdge);
+      const sep = id.indexOf(SEP);
+      if (id.slice(sep + 1) === "*") return own;
+      const wildcard = (this._out.get(`${id.slice(0, sep)}${SEP}*`) ?? []).filter(notRefEdge);
+      if (wildcard.length === 0) return own;
+      return [...own, ...wildcard];
+    };
+    const visit = (id) => {
+      const idx = stack.indexOf(id);
+      if (idx !== -1) {
+        const cycle = stack.slice(idx).concat(id);
+        const isMv = cycle.some((cycleId) => this._in.get(cycleId)?.kind === "mv");
+        const path = cycle.map(displayNodeId);
+        if (isMv) throw new MaterializedViewCycleError(path);
+        throw new DerivationCycleError(path);
+      }
+      if (visited.has(id)) return;
+      stack.push(id);
+      for (const dependent of neighboursOf(id)) visit(nodeId(dependent));
+      stack.pop();
+      visited.add(id);
+    };
+    for (const id of this._out.keys()) visit(id);
+  }
+  /** A leaf (non-derived) node's own posture contribution: its declared posture,
+   *  or `DEFAULT_POSTURE` if never declared via `registerField`. */
+  _declaredPosture(id) {
+    return this._posture.get(id) ?? DEFAULT_POSTURE;
+  }
+  /** A node's posture contribution when folded into a dependent: recurse if it is itself
+   *  derived; else its declared/default posture — UNLESS it is a `'*'` LEAF node consumed
+   *  by a folded formula kind (#642, `derivation|rollup|mv|overlay`), in which case it
+   *  contributes its collection's whole-record security fold ({@link _wildcardContribution}).
+   *  `kind` is the CONSUMING edge's kind, threaded from {@link _computeEffective}. `'ref'`
+   *  edges (and the provenance-only untyped call, `kind` left `undefined`) keep `'*'` =
+   *  identity — the phase-D lookup reliance (`via/lookup/registry.ts:392-397`) that a
+   *  referencing field must not seal just because its dimension collection has a classified
+   *  column. */
+  _contribution(id, kind) {
+    const edge = this._in.get(id);
+    if (edge) return this._computeEffective(id, edge);
+    if (kind !== void 0 && FOLDED_KINDS.has(kind) && id.endsWith(`${SEP}*`)) {
+      return this._wildcardContribution(id.slice(0, -2));
+    }
+    return this._declaredPosture(id);
+  }
+  /** Lazy fold (#642) of a collection's REGISTERED field postures on the security axes only
+   *  ({@link foldWildcardSecurity} — sealed-wins encryptedAtRest, AND exportable, OR
+   *  forgettable; queryable stays at DEFAULT_POSTURE's 'full', never folded), seeded at
+   *  DEFAULT_POSTURE. This is the collection-level posture a `'*'` LEAF node contributes to a
+   *  folded-kind formula edge (derivation/rollup/mv/overlay) — see {@link _contribution}. A
+   *  plain (unregistered) field contributes nothing (the identity), so the fold is strictly
+   *  more conservative than deps-based taint and never hits the KNOWN-LIMIT wall (it names no
+   *  fields — seam map §1d). Memoized per collection in `_wildcardCache`. */
+  _wildcardContribution(collection) {
+    const cached = this._wildcardCache.get(collection);
+    if (cached) return cached;
+    let result = DEFAULT_POSTURE;
+    const prefix = `${collection}${SEP}`;
+    for (const [id, posture] of this._posture) {
+      if (!id.startsWith(prefix) || id === `${prefix}*`) continue;
+      result = foldWildcardSecurity(result, posture);
+    }
+    this._wildcardCache.set(collection, result);
+    return result;
+  }
+  _computeEffective(id, edge) {
+    const cached = this._effectiveCache.get(id);
+    if (cached) return cached;
+    let result = DEFAULT_POSTURE;
+    for (const source of edge.sources) {
+      result = foldPosture(result, this._contribution(nodeId(source), edge.kind));
+    }
+    if (edge.grain === "virtual" && result.queryable !== "none") {
+      result = { ...result, queryable: "none" };
+    }
+    this._effectiveCache.set(id, result);
+    return result;
+  }
+  /** Strictest source posture on every axis, per §2. `undefined` when `target` has no
+   *  in-edges (not a derived field). Transitive: folds through chained derivations. */
+  effectivePosture(target) {
+    const id = nodeId(target);
+    const edge = this._in.get(id);
+    if (!edge) return void 0;
+    return this._computeEffective(id, edge);
+  }
+  /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */
+  taintedPostures(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      out.set(edge.target.field, this._computeEffective(nodeId(edge.target), edge));
+    }
+    return out;
+  }
+  /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective
+   *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7
+   *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`
+   *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/
+   *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`
+   *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in
+   *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and
+   *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */
+  taintSealedFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection || edge.grain === "virtual") continue;
+      const posture = this._computeEffective(nodeId(edge.target), edge);
+      if (posture.encryptedAtRest === "sealed") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —
+   *  `via/graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`
+   *  postures to know which virtual fields need PRESENT-TIME (not just export-time)
+   *  redaction, since a virtual field's value is only ever materialized inside `present()`. */
+  virtualFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection === collection && edge.grain === "virtual") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Per-collection { field → immediate source field names that forced its
+   *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s
+   *  provenance (Task 3). Only the DIRECT declared sources are named (not the
+   *  ultimate origin several hops up a transitive chain); a source absent
+   *  from the result contributed nothing restrictive. */
+  taintProvenance(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      const forcedBy = edge.sources.filter((source) => !isDefaultPosture(this._contribution(nodeId(source)))).map((source) => source.field);
+      if (forcedBy.length > 0) out.set(edge.target.field, forcedBy);
+    }
+    return out;
+  }
+  _targetsDependingOn(collection) {
+    const out = [];
+    for (const edge of this._in.values()) {
+      if (edge.sources.some((source) => source.collection === collection)) {
+        out.push({ target: edge.target, kind: edge.kind, grain: edge.grain });
+      }
+    }
+    return out;
+  }
+  /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes
+   *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the
+   *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the
+   *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that
+   *  wave's zero-cost early-continue, costing every write to a referenced backing collection an
+   *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure
+   *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */
+  dependentsOf(collection) {
+    return this._targetsDependingOn(collection).filter((edge) => edge.kind !== "ref");
+  }
+  /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */
+  derivedArtifactsOf(collection) {
+    return this._targetsDependingOn(collection);
+  }
+  /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/
+   *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the
+   *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source
+   *  already uses), NEVER a scan across collections or records. `backing` is the collection name
+   *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/
+   *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */
+  referencingEdgesOf(backing) {
+    const targets = this._out.get(nodeId({ collection: backing, field: "*" }));
+    if (!targets) return [];
+    const out = [];
+    for (const target of targets) {
+      const edge = this._in.get(nodeId(target));
+      if (edge?.kind === "ref" && edge.onDelete !== void 0) {
+        out.push({ referencing: target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
+      }
+    }
+    return out;
+  }
+};
+
+export {
+  DEFAULT_POSTURE,
+  ViaGraph
+};
+//# sourceMappingURL=chunk-7QIXUSDQ.js.map

package/dist/chunk-7VSGW5KJ.js

@@ -0,0 +1,74 @@
+import {
+  linkI18nVia
+} from "./chunk-BE7N3AXA.js";
+
+// src/via/i18n/dictionary.ts
+function dictKey(name, keysOrMap, opts) {
+  linkI18nVia();
+  let keys;
+  let labels;
+  if (Array.isArray(keysOrMap)) {
+    keys = keysOrMap;
+    labels = opts?.labels;
+  } else if (keysOrMap && typeof keysOrMap === "object") {
+    keys = Object.keys(keysOrMap);
+    labels = keysOrMap;
+  } else {
+    keys = void 0;
+    labels = opts?.labels;
+  }
+  const equiv = {
+    _viaBrand: "lookup",
+    dimension: name,
+    key: "id",
+    vocabulary: "open",
+    backing: "reserved",
+    onDelete: "restrict",
+    ...keys !== void 0 ? { keys } : {},
+    ...opts?.onMissing !== void 0 ? { onMissing: opts.onMissing } : {},
+    ...opts?.substitute !== void 0 ? { substitute: opts.substitute } : {},
+    ...labels !== void 0 ? { labels } : {}
+  };
+  return {
+    _noydbDictKey: true,
+    _viaBrand: "i18n",
+    name: equiv.dimension,
+    keys: equiv.keys,
+    ...equiv.onMissing !== void 0 ? { onMissing: equiv.onMissing } : {},
+    ...equiv.substitute !== void 0 ? { substitute: equiv.substitute } : {},
+    ...equiv.labels !== void 0 ? { labels: equiv.labels } : {}
+  };
+}
+function staticDict(name, table, opts) {
+  linkI18nVia();
+  const equiv = {
+    _viaBrand: "lookup",
+    dimension: name,
+    key: "id",
+    vocabulary: "closed",
+    backing: "static",
+    onDelete: "restrict",
+    table,
+    keys: Object.keys(table),
+    ...opts?.displayLocale !== void 0 ? { displayLocale: opts.displayLocale } : {},
+    ...opts?.onMissing !== void 0 ? { onMissing: opts.onMissing } : {},
+    ...opts?.substitute !== void 0 ? { substitute: opts.substitute } : {}
+  };
+  return {
+    _noydbStaticDict: true,
+    _viaBrand: "i18n",
+    name: equiv.dimension,
+    table: equiv.table,
+    keys: equiv.keys,
+    ...equiv.displayLocale !== void 0 ? { displayLocale: equiv.displayLocale } : {},
+    ...equiv.onMissing !== void 0 ? { onMissing: equiv.onMissing } : {},
+    ...equiv.substitute !== void 0 ? { substitute: equiv.substitute } : {},
+    ...opts?.validateCodes !== void 0 ? { validateCodes: opts.validateCodes } : {}
+  };
+}
+
+export {
+  dictKey,
+  staticDict
+};
+//# sourceMappingURL=chunk-7VSGW5KJ.js.map