@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-VRIYFLBA.js

@@ -1,74 +0,0 @@
-import {
-  ReadOnlyFrameError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-fork/shadow/vault-frame.ts
-var VaultFrame = class {
-  constructor(vault) {
-    this.vault = vault;
-  }
-  vault;
-  /**
-   * Get a read-only view of one collection. The returned
-   * {@link CollectionFrame} delegates all reads to the underlying
-   * live collection — cache, locale handling, and validation all
-   * work identically to the live collection.
-   */
-  collection(name) {
-    return new CollectionFrame(this.vault.collection(name), name);
-  }
-  /** List all collection names visible in the underlying vault. */
-  async collections() {
-    return this.vault.collections();
-  }
-};
-var CollectionFrame = class {
-  constructor(inner, name) {
-    this.inner = inner;
-    this.name = name;
-  }
-  inner;
-  name;
-  // ── reads (delegated) ──────────────────────────────────────────────
-  get(id, locale) {
-    return this.inner.get(id, locale);
-  }
-  list(locale) {
-    return this.inner.list(locale);
-  }
-  query(predicate) {
-    return predicate !== void 0 ? this.inner.query(predicate) : this.inner.query();
-  }
-  /** History reads — allowed (history is read-only by nature). */
-  history(...args) {
-    return this.inner.history(...args);
-  }
-  getVersion(id, version) {
-    return this.inner.getVersion(id, version);
-  }
-  // ── write guards ──────────────────────────────────────────────────
-  async put(_id, _record) {
-    throw new ReadOnlyFrameError("put");
-  }
-  async delete(_id) {
-    throw new ReadOnlyFrameError("delete");
-  }
-  async update(_id, _patch) {
-    throw new ReadOnlyFrameError("update");
-  }
-  async revert(_id, _version) {
-    throw new ReadOnlyFrameError("revert");
-  }
-  async putMany(_entries) {
-    throw new ReadOnlyFrameError("putMany");
-  }
-  async deleteMany(_ids) {
-    throw new ReadOnlyFrameError("deleteMany");
-  }
-};
-
-export {
-  VaultFrame,
-  CollectionFrame
-};
-//# sourceMappingURL=chunk-VRIYFLBA.js.map

package/dist/chunk-VWM3DAVB.js

@@ -1,265 +0,0 @@
-import {
-  SealedHandle
-} from "./chunk-YN5IAHN6.js";
-import {
-  installViaBinder
-} from "./chunk-VEAVKDDB.js";
-import {
-  ClassifiedConfigError,
-  ClassifiedNotEnabledError
-} from "./chunk-S7VFUQM2.js";
-
-// src/via/classified/descriptor.ts
-function isClassifiedFieldSpec(x) {
-  return typeof x === "object" && x !== null && x._noydbClassified === true;
-}
-function isClassifiedGroup(x) {
-  return typeof x === "object" && x !== null && x._noydbClassifiedGroup === true;
-}
-
-// src/via/classified/errors.ts
-var ClassifiedNeverStoredError = class extends Error {
-  constructor(collection, field) {
-    super(`Field "${field}" in collection "${collection}" is classified storage:'never' (e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedNeverStoredError";
-  }
-  collection;
-  field;
-};
-var ClassifiedValidationError = class extends Error {
-  constructor(collection, field, detail) {
-    super(`Classified field "${field}" in collection "${collection}" failed validation: ${detail}`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedValidationError";
-  }
-  collection;
-  field;
-};
-
-// src/via/classified/resolve.ts
-function resolveClassifiedFields(collection, config) {
-  const byField = {};
-  const claim = (field, spec) => {
-    if (byField[field] !== void 0) {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${field}" is claimed twice \u2014 storage forms are mutually exclusive per field (R5): a field is digest-only OR recoverable OR never, exactly one`
-      );
-    }
-    byField[field] = spec;
-  };
-  for (const [key, entry] of Object.entries(config)) {
-    if (isClassifiedGroup(entry)) {
-      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec);
-    } else {
-      claim(key, entry);
-    }
-  }
-  const riderComputed = {};
-  for (const [field, spec] of Object.entries(byField)) {
-    for (const [name, rider] of Object.entries(spec.riders ?? {})) {
-      const companion = `${field}_${name}`;
-      if (byField[companion] !== void 0 || riderComputed[companion] !== void 0) {
-        throw new ClassifiedConfigError(collection, `rider companion "${companion}" collides with a declared field`);
-      }
-      riderComputed[companion] = (record) => record[field] === void 0 ? void 0 : rider(record[field]);
-    }
-  }
-  return { byField, riderComputed };
-}
-
-// src/via/classified/write.ts
-function enforceClassifiedWrite(record, byField, collection) {
-  for (const [field, spec] of Object.entries(byField)) {
-    const value = record[field];
-    if (value === void 0) continue;
-    if (value === null && spec.storage === "digest-only") continue;
-    if (spec.storage === "never") throw new ClassifiedNeverStoredError(collection, field);
-    const problem = spec.validate?.(value) ?? null;
-    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem);
-  }
-}
-
-// src/via/classified/guards.ts
-function guardClassifiedCompat(collection, byField, ctx) {
-  const digestOnly = Object.entries(byField).filter(([, s]) => s.storage === "digest-only");
-  const protectedForms = Object.values(byField).filter((s) => s.storage === "digest-only" || s.storage === "recoverable");
-  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {
-    throw new ClassifiedConfigError(
-      collection,
-      "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
-    );
-  }
-  for (const [f, spec] of Object.entries(byField)) {
-    if (spec.equatable === true && spec.storage !== "digest-only") {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${f}" declares equatable but storage is '${spec.storage}' \u2014 equatable is a digest-only knob; recoverable equality is _det's job (R7)`
-      );
-    }
-  }
-  const hasEquatable = Object.values(byField).some((s) => s.equatable === true);
-  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {
-    throw new ClassifiedConfigError(
-      collection,
-      `classified equatable fields require \`acknowledgeEquatableRisk: true\` \u2014 equal values produce equal store-visible index tags (a partition leak a DEK holder can offline-dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`
-    );
-  }
-  if (digestOnly.length === 0) return;
-  if (!ctx.storeCiphertext) {
-    throw new ClassifiedConfigError(
-      collection,
-      `storage:'digest-only' requires an encrypted collection \u2014 with encrypt: false the write path skips the digest slot entirely and the secret would persist as raw plaintext`
-    );
-  }
-  if (!ctx.perRecordKeys) {
-    throw new ClassifiedConfigError(
-      collection,
-      `storage:'digest-only' requires perRecordKeys: true \u2014 vdig keys derive from the per-record CEK so forget() shreds them (R1)`
-    );
-  }
-  for (const [f, spec] of digestOnly) {
-    const n = spec.notLastN ?? 0;
-    if (!Number.isInteger(n) || n < 0 || n > 8) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" declares notLastN ${n} \u2014 must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented)`
-      );
-    }
-    if (ctx.bareSensitiveFields.has(f)) {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${f}" is digest-only AND listed in sensitive[] \u2014 storage forms are mutually exclusive per field (R5)`
-      );
-    }
-    if (ctx.deterministicFields?.has(f)) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" cannot be deterministic \u2014 equality-correlatable ciphertext defeats per-write salts (R3)`
-      );
-    }
-    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f) || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`
-      );
-    }
-  }
-}
-
-// src/via/classified/binding.ts
-function recoverableFields(byField) {
-  return Object.entries(byField).filter(([, spec]) => spec.storage === "recoverable").map(([field]) => field);
-}
-function sealFieldNames(byField, guardCtx) {
-  return [...recoverableFields(byField), ...guardCtx.bareSensitiveFields];
-}
-async function encodeClassifiedAtRest(record, crypto, fields) {
-  let open = record;
-  let sealed;
-  for (const field of fields) {
-    if (!(field in record)) continue;
-    const value = record[field];
-    if (value === void 0) continue;
-    const ref = await crypto.sealedSlots.seal(field, value);
-    if (open === record) open = { ...record };
-    delete open[field];
-    sealed ??= {};
-    sealed[field] = ref;
-  }
-  return sealed ? { record: open, sealed } : { record };
-}
-async function decodeClassifiedAtRest(record, sealed, crypto, opts, fields) {
-  let out = record;
-  for (const field of fields) {
-    const ref = sealed[field];
-    if (ref === void 0) continue;
-    if (out === record) out = { ...record };
-    out[field] = opts.asHandles ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref)) : await crypto.sealedSlots.unseal(field, ref);
-  }
-  return out;
-}
-async function eraseClassified(ctx, cfg) {
-  let shredded = 0;
-  const residue = [];
-  if (cfg.classifySealedShred) {
-    const { slots } = await cfg.classifySealedShred(ctx.live);
-    for (const slot of slots) {
-      if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") {
-        shredded += 1;
-        await ctx.crypto.sealedSlots.delete(slot.field);
-      }
-      if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") {
-        residue.push({ kind: "classified-sealed-dek-residue", field: slot.field });
-      }
-    }
-  }
-  if (cfg.purgeSealedCekEnvelopes) {
-    shredded += await cfg.purgeSealedCekEnvelopes(ctx.id);
-  }
-  return { shredded, residue };
-}
-function buildClassifiedDescribeFragment(byField) {
-  return {
-    classifiedFields: Object.fromEntries(
-      Object.entries(byField).map(([field, spec]) => [field, { storage: spec.storage, sensitivity: spec.sensitivity }])
-    )
-  };
-}
-function classifiedBinding(cfg) {
-  const resolved = resolveClassifiedFields(cfg.collectionName, cfg.entries);
-  guardClassifiedCompat(cfg.collectionName, resolved.byField, cfg.guardCtx);
-  const byField = resolved.byField;
-  const sealFields = sealFieldNames(byField, cfg.guardCtx);
-  return {
-    brand: "classified",
-    posture: { encryptedAtRest: "sealed", queryable: "det-exact", exportable: false, forgettable: true },
-    covers: (field) => field in byField,
-    // async (rather than a bare passthrough) so a refusal is always a
-    // rejected Promise for direct callers, matching every other async-stack
-    // hook's calling convention — `enforceClassifiedWrite` itself stays sync.
-    enforceWrite: async (record, _ctx) => enforceClassifiedWrite(record, byField, cfg.collectionName),
-    encodeAtRest: (record, crypto) => encodeClassifiedAtRest(record, crypto, sealFields),
-    decodeAtRest: (record, sealed, crypto, opts) => decodeClassifiedAtRest(record, sealed, crypto, opts, sealFields),
-    erase: (ctx) => eraseClassified(ctx, cfg),
-    describeFragment: () => buildClassifiedDescribeFragment(byField)
-  };
-}
-function linkClassifiedVia() {
-  installViaBinder("classified", (c) => classifiedBinding(c));
-}
-
-// src/port/with/classified-strategy.ts
-linkClassifiedVia();
-var NO_CLASSIFIED = {
-  async reveal() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verify() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verifyText() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async matchGroup() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async computeTarget() {
-    throw new ClassifiedNotEnabledError();
-  }
-};
-
-export {
-  isClassifiedFieldSpec,
-  isClassifiedGroup,
-  ClassifiedNeverStoredError,
-  ClassifiedValidationError,
-  resolveClassifiedFields,
-  guardClassifiedCompat,
-  enforceClassifiedWrite,
-  NO_CLASSIFIED
-};
-//# sourceMappingURL=chunk-VWM3DAVB.js.map

package/dist/chunk-VWRRVE6D.js

@@ -1,80 +0,0 @@
-import {
-  FieldFrozenError,
-  InvariantError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-audit/guards/executor.ts
-var GuardExecutor = {
-  /**
-   * Compare existing vs incoming for each `frozenFields.fields` entry
-   * when `frozenFields.when(existing)` is true. Throws
-   * `FieldFrozenError` listing every changed frozen field.
-   *
-   * @param skipFields — field names that are schema-owned computed fields.
-   *   These are excluded from the comparison because `incoming` carries the
-   *   raw user input (computed fields not yet evaluated), so comparing
-   *   `existing[field]` vs `incoming[field]` would always look like a
-   *   change even when the computed result is unchanged.
-   */
-  async checkFrozenFields(guard, id, existing, incoming, skipFields) {
-    const ff = guard.frozenFields;
-    if (!ff) return;
-    if (existing === null) return;
-    if (!ff.when(existing)) return;
-    const changed = [];
-    for (const f of ff.fields) {
-      if (skipFields?.has(String(f))) continue;
-      if (existing[f] !== incoming[f]) {
-        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
-      }
-    }
-    if (changed.length > 0) {
-      throw new FieldFrozenError(guard.collection, id, changed);
-    }
-  },
-  /**
-   * Run a single guard's invariant over its slice of the change-set.
-   * Any throw is converted to `InvariantError` unless it already is one.
-   */
-  async runInvariant(guard, changes, ctx) {
-    const amendment = guard.amendment;
-    if (!amendment) return;
-    try {
-      await amendment.invariant(changes, ctx);
-    } catch (err) {
-      if (err instanceof InvariantError) throw err;
-      throw new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-};
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return a === b;
-  if (typeof a !== typeof b) return false;
-  if (typeof a !== "object") return a === b;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a)) {
-    const aa = a;
-    const bb = b;
-    if (aa.length !== bb.length) return false;
-    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const ak = Object.keys(ao);
-  const bk = Object.keys(bo);
-  if (ak.length !== bk.length) return false;
-  for (const k of ak) {
-    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-    if (!deepEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-
-export {
-  GuardExecutor
-};
-//# sourceMappingURL=chunk-VWRRVE6D.js.map

package/dist/chunk-WBJIQSLL.js

@@ -1,167 +0,0 @@
-import {
-  canonicalize,
-  derivePersistedSchema
-} from "./chunk-5I35DOHK.js";
-import {
-  loadPersistedSchemaEntry,
-  savePersistedSchema
-} from "./chunk-T7WSLRAU.js";
-import {
-  ConflictError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-var MAX_SCHEMA_CAS_RETRIES = 5;
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored && isEquivalent(stored, fresh)) {
-      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-    }
-    let decision = { action: "allow" };
-    const strategies = opts.strategies ?? [];
-    if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-    }
-    if (decision.action !== "allow") {
-      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-    }
-    let toSave = fresh;
-    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
-    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
-      return { written: true, skipped: false, envelope: toSave, decision };
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistClassifiedMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      classified: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistSatelliteMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      satellite: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-function satelliteMarkersEqual(a, b) {
-  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
-}
-function markersEqual(a, b) {
-  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
-}
-function sameSet(a, b) {
-  if (a.length !== b.length) return false;
-  const s = new Set(a);
-  return b.every((x) => s.has(x));
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
-}
-
-export {
-  persistSchemaIfNeeded,
-  persistClassifiedMarker,
-  persistSatelliteMarker
-};
-//# sourceMappingURL=chunk-WBJIQSLL.js.map

package/dist/chunk-WBJIQSLL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}