@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-45QPICLE.js

@@ -0,0 +1,69 @@
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  bufferToBase64
+} from "./chunk-37WOJQWY.js";
+
+// src/kernel/enclave/classify/bidx.ts
+var subtle = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/kernel/enclave/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-45QPICLE.js.map

package/dist/chunk-4BQXMCE5.js

@@ -0,0 +1,164 @@
+import {
+  ViaGraph
+} from "./chunk-DJ7MRXNA.js";
+import {
+  sha256Hex
+} from "./chunk-37WOJQWY.js";
+import {
+  DerivationCycleError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-formula/derivations/strategy-hash.ts
+async function computeStrategyHash(source, outputKeys, derive, sources) {
+  const canonical = JSON.stringify({
+    source,
+    outputs: [...outputKeys].sort(),
+    derive: derive.toString(),
+    // Declared sibling sources — adding/removing a trigger
+    // collection invalidates cached derived records. Omitted when empty
+    // so strategies without siblings keep their existing hash.
+    ...sources?.length ? { sources: [...sources].sort() } : {}
+  });
+  const bytes = new TextEncoder().encode(canonical);
+  return sha256Hex(bytes);
+}
+
+// src/with-formula/derivations/registry.ts
+var WHOLE_RECORD = "*";
+function stripArtifactSuffix(displayId) {
+  const suffix = `.${WHOLE_RECORD}`;
+  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId;
+}
+var DerivationRegistry = class {
+  _bySource = /* @__PURE__ */ new Map();
+  _byOutput = /* @__PURE__ */ new Map();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async register(spec) {
+    const outputKeys = Object.keys(spec.outputs);
+    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources);
+    const reg = { spec, strategyHash };
+    const fromSource = this._bySource.get(spec.source);
+    if (fromSource) fromSource.push(reg);
+    else this._bySource.set(spec.source, [reg]);
+    for (const extra of spec.sources ?? []) {
+      const fromExtra = this._bySource.get(extra);
+      if (fromExtra) fromExtra.push(reg);
+      else this._bySource.set(extra, [reg]);
+    }
+    for (const t of spec.triggerBy ?? []) {
+      const fromTrigger = this._bySource.get(t.collection);
+      if (fromTrigger) fromTrigger.push(reg);
+      else this._bySource.set(t.collection, [reg]);
+    }
+    if (spec.rollup) {
+      const fromRollup = this._bySource.get(spec.rollup.from);
+      if (fromRollup) fromRollup.push(reg);
+      else this._bySource.set(spec.rollup.from, [reg]);
+    }
+    for (const key of outputKeys) {
+      const output = spec.outputs[key];
+      if (!output) continue;
+      const outputCollection = output.collection;
+      const arr = this._byOutput.get(outputCollection);
+      if (arr) arr.push(reg);
+      else this._byOutput.set(outputCollection, [reg]);
+    }
+  }
+  strategiesForSource(source) {
+    return this._bySource.get(source) ?? [];
+  }
+  strategiesProducingOutput(collection) {
+    return this._byOutput.get(collection) ?? [];
+  }
+  /**
+   * All registered strategies as a flat, deduplicated array.
+   * Each strategy is indexed once per source (not once per output key),
+   * so iterating `_bySource.values()` naturally yields each strategy
+   * exactly once per source — deduplication is handled by flattening
+   * the per-source arrays and collecting into a Set by identity.
+   *
+   * Used by `dumpSchema()` / `describeDerivations()` in the introspection
+   * walker to populate the derivations map.
+   */
+  all() {
+    const seen = /* @__PURE__ */ new Set();
+    for (const strategies of this._bySource.values()) {
+      for (const s of strategies) seen.add(s);
+    }
+    return [...seen];
+  }
+  /**
+   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per
+   * (non-self-write) output key — target = the output collection (a
+   * `WHOLE_RECORD` artifact node), sources = every collection that can
+   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,
+   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys
+   * `register()` indexes under `_bySource`. The self-write reverse-denorm
+   * output (`output.collection === source` with `denorm` declared) is
+   * skipped — the SAME condition the old local DFS used; it is not a cycle
+   * (see the comment `validate()` used to carry, now on this skip).
+   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge
+   * targeting the real `rollup.field` on the parent (`source`) — the
+   * self-write output above only covers the cycle-DFS skip, not
+   * dispatch/taint (Tasks 3/4/6), which need the real field.
+   */
+  edges() {
+    const out = [];
+    for (const reg of this.all()) {
+      const spec = reg.spec;
+      const triggerCollections = [
+        spec.source,
+        ...spec.sources ?? [],
+        ...(spec.triggerBy ?? []).map((t) => t.collection),
+        ...spec.rollup ? [spec.rollup.from] : []
+      ];
+      const sources = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }));
+      for (const key of Object.keys(spec.outputs)) {
+        const output = spec.outputs[key];
+        if (!output) continue;
+        if (output.shape === "record" && output.collection === spec.source && output.denorm !== void 0) continue;
+        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: "derivation", grain: "record" });
+      }
+      if (spec.rollup) {
+        out.push({
+          target: { collection: spec.source, field: spec.rollup.field },
+          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],
+          kind: "rollup",
+          grain: "aggregate"
+        });
+      }
+    }
+    return out;
+  }
+  /**
+   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —
+   * retires the local DFS). Call after all `register()` calls complete (i.e.
+   * at vault open). Throws `DerivationCycleError` on the first cycle found —
+   * SAME class/timing as before; the message/path is byte-identical to the
+   * pre-#638 shape for a pure record-shape derivation cycle (the
+   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection
+   * name before re-throwing).
+   *
+   * `graph` is the caller's shared per-vault graph, ALREADY carrying this
+   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)
+   * — omit it (e.g. this registry's own unit tests) to validate this
+   * registry's edges in isolation against a throwaway graph.
+   */
+  validate(graph) {
+    const g = graph ?? new ViaGraph();
+    if (!graph) {
+      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain);
+    }
+    try {
+      g.assertAcyclic();
+    } catch (e) {
+      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix));
+      throw e;
+    }
+  }
+};
+
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=chunk-4BQXMCE5.js.map

package/dist/chunk-4GPE63GU.js

@@ -0,0 +1,111 @@
+// src/with-commit/crdt/crdt.ts
+function resolveCrdtSnapshot(state) {
+  switch (state._crdt) {
+    case "lww-map": {
+      const result = {};
+      for (const [field, reg] of Object.entries(state.fields)) {
+        result[field] = reg.v;
+      }
+      return result;
+    }
+    case "rga": {
+      const dead = new Set(state.tombstones);
+      return state.items.filter((i) => !dead.has(i.nid)).map((i) => i.v);
+    }
+    case "yjs":
+      return state.update;
+  }
+}
+function mergeCrdtStates(a, b) {
+  if (a._crdt !== b._crdt) return a;
+  switch (a._crdt) {
+    case "lww-map":
+      return mergeLwwMap(a, b);
+    case "rga":
+      return mergeRga(a, b);
+    case "yjs":
+      return a;
+  }
+}
+function mergeLwwMap(a, b) {
+  const merged = {};
+  const allFields = /* @__PURE__ */ new Set([...Object.keys(a.fields), ...Object.keys(b.fields)]);
+  for (const field of allFields) {
+    const fa = a.fields[field];
+    const fb = b.fields[field];
+    if (!fa) {
+      merged[field] = fb;
+    } else if (!fb) {
+      merged[field] = fa;
+    } else {
+      merged[field] = fa.ts >= fb.ts ? fa : fb;
+    }
+  }
+  return { _crdt: "lww-map", fields: merged };
+}
+function mergeRga(a, b) {
+  const allTombstones = /* @__PURE__ */ new Set([...a.tombstones, ...b.tombstones]);
+  const seenNids = new Set(a.items.map((i) => i.nid));
+  const merged = [
+    ...a.items,
+    ...b.items.filter((i) => !seenNids.has(i.nid))
+  ];
+  return { _crdt: "rga", items: merged, tombstones: [...allTombstones] };
+}
+function buildLwwMapState(record, existing, now) {
+  const fields = {};
+  for (const [field, value] of Object.entries(record)) {
+    fields[field] = { v: value, ts: now };
+  }
+  if (existing) {
+    for (const [field, reg] of Object.entries(existing.fields)) {
+      if (!(field in fields)) {
+        fields[field] = reg;
+      }
+    }
+  }
+  return { _crdt: "lww-map", fields };
+}
+function buildRgaState(arr, existing, generateNid) {
+  const existingByValue = /* @__PURE__ */ new Map();
+  if (existing) {
+    for (const item of existing.items) {
+      const key = JSON.stringify(item.v);
+      if (!existingByValue.has(key)) existingByValue.set(key, item);
+    }
+  }
+  const usedNids = /* @__PURE__ */ new Set();
+  const newItems = [];
+  for (const el of arr) {
+    const key = JSON.stringify(el);
+    const match = existingByValue.get(key);
+    if (match && !usedNids.has(match.nid)) {
+      newItems.push(match);
+      usedNids.add(match.nid);
+    } else {
+      const nid = generateNid();
+      newItems.push({ nid, v: el });
+      usedNids.add(nid);
+    }
+  }
+  const tombstones = existing ? [...existing.tombstones] : [];
+  const extraItems = [];
+  if (existing) {
+    for (const item of existing.items) {
+      if (!usedNids.has(item.nid)) {
+        if (!tombstones.includes(item.nid)) tombstones.push(item.nid);
+        extraItems.push(item);
+      }
+    }
+  }
+  const items = [...newItems, ...extraItems];
+  return { _crdt: "rga", items, tombstones };
+}
+
+export {
+  resolveCrdtSnapshot,
+  mergeCrdtStates,
+  buildLwwMapState,
+  buildRgaState
+};
+//# sourceMappingURL=chunk-4GPE63GU.js.map

package/dist/chunk-4GPE63GU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/crdt/crdt.ts"],"sourcesContent":["/**\n * CRDT state types, merge logic, and build helpers.\n * per-collection CRDT mode: 'lww-map' | 'rga' | 'yjs'\n *\n * The encrypted envelope wraps the CRDT state (not the resolved snapshot).\n * Adapters only ever see ciphertext. `collection.get(id)` returns the\n * resolved snapshot; `collection.getRaw(id)` returns the full CRDT state.\n */\n\n// Hoisted to kernel/types.ts (C3 — enclave self-containment: record-codec.ts\n// consumes CrdtState/CrdtMode as spine-owned contract types; LwwMapState/\n// RgaState/YjsState were hoisted alongside them to break the types.ts ↔\n// crdt.ts cycle — #667). Re-exported here so existing importers of this\n// module are unaffected.\nimport type { CrdtState, LwwMapState, RgaState } from '../../kernel/types.js'\nexport type { CrdtMode, CrdtState, LwwMapState, RgaState, YjsState } from '../../kernel/types.js'\n\n// ─── Snapshot resolution ──────────────────────────────────────────────\n\n/**\n * Resolve a CRDT state into the end-user record snapshot.\n *\n * - `lww-map` → `Record<string, unknown>` (field values extracted from registers)\n * - `rga`     → `unknown[]` (non-tombstoned items in insertion order)\n * - `yjs`     → `string` (base64 update blob; use @noy-db/yjs for a Y.Doc)\n */\nexport function resolveCrdtSnapshot(state: CrdtState): unknown {\n  switch (state._crdt) {\n    case 'lww-map': {\n      const result: Record<string, unknown> = {}\n      for (const [field, reg] of Object.entries(state.fields)) {\n        result[field] = reg.v\n      }\n      return result\n    }\n    case 'rga': {\n      const dead = new Set(state.tombstones)\n      return state.items.filter(i => !dead.has(i.nid)).map(i => i.v)\n    }\n    case 'yjs':\n      return state.update\n  }\n}\n\n// ─── CRDT merge ───────────────────────────────────────────────────────\n\n/**\n * Merge two CRDT states produced by concurrent writes.\n * Called by the collection-level conflict resolver registered with SyncEngine.\n *\n * For `yjs`: core cannot merge Yjs without importing the `yjs` package.\n * The caller must handle that case by falling back to the higher-`_v` envelope.\n */\nexport function mergeCrdtStates(a: CrdtState, b: CrdtState): CrdtState {\n  // Mismatched modes shouldn't happen in practice — same collection, same schema.\n  if (a._crdt !== b._crdt) return a\n\n  switch (a._crdt) {\n    case 'lww-map':\n      return mergeLwwMap(a, b as LwwMapState)\n    case 'rga':\n      return mergeRga(a, b as RgaState)\n    case 'yjs':\n      // Signal to caller that Yjs merge is needed externally\n      return a\n  }\n}\n\nfunction mergeLwwMap(a: LwwMapState, b: LwwMapState): LwwMapState {\n  const merged: Record<string, { v: unknown; ts: string }> = {}\n  const allFields = new Set([...Object.keys(a.fields), ...Object.keys(b.fields)])\n  for (const field of allFields) {\n    const fa = a.fields[field]\n    const fb = b.fields[field]\n    if (!fa) { merged[field] = fb! }\n    else if (!fb) { merged[field] = fa }\n    else { merged[field] = fa.ts >= fb.ts ? fa : fb }\n  }\n  return { _crdt: 'lww-map', fields: merged }\n}\n\nfunction mergeRga(a: RgaState, b: RgaState): RgaState {\n  // Union tombstones from both sides\n  const allTombstones = new Set([...a.tombstones, ...b.tombstones])\n  // Union items by nid: start with a's ordering, append b-only items\n  const seenNids = new Set(a.items.map(i => i.nid))\n  const merged: Array<{ nid: string; v: unknown }> = [\n    ...a.items,\n    ...b.items.filter(i => !seenNids.has(i.nid)),\n  ]\n  return { _crdt: 'rga', items: merged, tombstones: [...allTombstones] }\n}\n\n// ─── Build helpers ────────────────────────────────────────────────────\n\n/**\n * Build (or update) an lww-map state from a new record.\n *\n * All fields in the new record win at timestamp `now`.\n * Fields present in the existing state but absent from the new record\n * are preserved (they were written by another device).\n */\nexport function buildLwwMapState(\n  record: Record<string, unknown>,\n  existing: LwwMapState | undefined,\n  now: string,\n): LwwMapState {\n  const fields: Record<string, { v: unknown; ts: string }> = {}\n\n  // New record fields all get the current timestamp — this device wins for these\n  for (const [field, value] of Object.entries(record)) {\n    fields[field] = { v: value, ts: now }\n  }\n\n  // Preserve fields from the existing state that aren't in the new record\n  if (existing) {\n    for (const [field, reg] of Object.entries(existing.fields)) {\n      if (!(field in fields)) {\n        fields[field] = reg\n      }\n    }\n  }\n\n  return { _crdt: 'lww-map', fields }\n}\n\n/**\n * Build (or update) an RGA state from a new array.\n *\n * Existing items are matched to new elements by deep-equality of their `v`.\n * Unmatched existing items are tombstoned. New elements that have no existing\n * match get a fresh NID via `generateNid()`.\n */\nexport function buildRgaState(\n  arr: unknown[],\n  existing: RgaState | undefined,\n  generateNid: () => string,\n): RgaState {\n  // Build an index from JSON(v) → existing item so we can match by value\n  const existingByValue = new Map<string, { nid: string; v: unknown }>()\n  if (existing) {\n    for (const item of existing.items) {\n      // Only add first occurrence per value to avoid double-matching\n      const key = JSON.stringify(item.v)\n      if (!existingByValue.has(key)) existingByValue.set(key, item)\n    }\n  }\n\n  const usedNids = new Set<string>()\n  const newItems: Array<{ nid: string; v: unknown }> = []\n\n  for (const el of arr) {\n    const key = JSON.stringify(el)\n    const match = existingByValue.get(key)\n    if (match && !usedNids.has(match.nid)) {\n      // Reuse existing NID to preserve cross-device identity\n      newItems.push(match)\n      usedNids.add(match.nid)\n    } else {\n      // New element — assign a fresh NID\n      const nid = generateNid()\n      newItems.push({ nid, v: el })\n      usedNids.add(nid)\n    }\n  }\n\n  // Elements in the existing state that aren't in the new array → tombstone.\n  // Tombstoned items are kept in the items array to preserve ordering for\n  // cross-device merge — the resolved snapshot filters them out.\n  const tombstones: string[] = existing ? [...existing.tombstones] : []\n  const extraItems: Array<{ nid: string; v: unknown }> = []\n  if (existing) {\n    for (const item of existing.items) {\n      if (!usedNids.has(item.nid)) {\n        if (!tombstones.includes(item.nid)) tombstones.push(item.nid)\n        extraItems.push(item) // retain in items for ordering\n      }\n    }\n  }\n\n  // Final items: live items in new order, then tombstoned extras at the end\n  const items = [...newItems, ...extraItems]\n\n  return { _crdt: 'rga', items, tombstones }\n}\n"],"mappings":";AA0BO,SAAS,oBAAoB,OAA2B;AAC7D,UAAQ,MAAM,OAAO;AAAA,IACnB,KAAK,WAAW;AACd,YAAM,SAAkC,CAAC;AACzC,iBAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACvD,eAAO,KAAK,IAAI,IAAI;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,OAAO;AACV,YAAM,OAAO,IAAI,IAAI,MAAM,UAAU;AACrC,aAAO,MAAM,MAAM,OAAO,OAAK,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,OAAK,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,KAAK;AACH,aAAO,MAAM;AAAA,EACjB;AACF;AAWO,SAAS,gBAAgB,GAAc,GAAyB;AAErE,MAAI,EAAE,UAAU,EAAE,MAAO,QAAO;AAEhC,UAAQ,EAAE,OAAO;AAAA,IACf,KAAK;AACH,aAAO,YAAY,GAAG,CAAgB;AAAA,IACxC,KAAK;AACH,aAAO,SAAS,GAAG,CAAa;AAAA,IAClC,KAAK;AAEH,aAAO;AAAA,EACX;AACF;AAEA,SAAS,YAAY,GAAgB,GAA6B;AAChE,QAAM,SAAqD,CAAC;AAC5D,QAAM,YAAY,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9E,aAAW,SAAS,WAAW;AAC7B,UAAM,KAAK,EAAE,OAAO,KAAK;AACzB,UAAM,KAAK,EAAE,OAAO,KAAK;AACzB,QAAI,CAAC,IAAI;AAAE,aAAO,KAAK,IAAI;AAAA,IAAI,WACtB,CAAC,IAAI;AAAE,aAAO,KAAK,IAAI;AAAA,IAAG,OAC9B;AAAE,aAAO,KAAK,IAAI,GAAG,MAAM,GAAG,KAAK,KAAK;AAAA,IAAG;AAAA,EAClD;AACA,SAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;AAC5C;AAEA,SAAS,SAAS,GAAa,GAAuB;AAEpD,QAAM,gBAAgB,oBAAI,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,EAAE,UAAU,CAAC;AAEhE,QAAM,WAAW,IAAI,IAAI,EAAE,MAAM,IAAI,OAAK,EAAE,GAAG,CAAC;AAChD,QAAM,SAA6C;AAAA,IACjD,GAAG,EAAE;AAAA,IACL,GAAG,EAAE,MAAM,OAAO,OAAK,CAAC,SAAS,IAAI,EAAE,GAAG,CAAC;AAAA,EAC7C;AACA,SAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,GAAG,aAAa,EAAE;AACvE;AAWO,SAAS,iBACd,QACA,UACA,KACa;AACb,QAAM,SAAqD,CAAC;AAG5D,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,WAAO,KAAK,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI;AAAA,EACtC;AAGA,MAAI,UAAU;AACZ,eAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAC1D,UAAI,EAAE,SAAS,SAAS;AACtB,eAAO,KAAK,IAAI;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,WAAW,OAAO;AACpC;AASO,SAAS,cACd,KACA,UACA,aACU;AAEV,QAAM,kBAAkB,oBAAI,IAAyC;AACrE,MAAI,UAAU;AACZ,eAAW,QAAQ,SAAS,OAAO;AAEjC,YAAM,MAAM,KAAK,UAAU,KAAK,CAAC;AACjC,UAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,iBAAgB,IAAI,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AAEA,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,WAA+C,CAAC;AAEtD,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,KAAK,UAAU,EAAE;AAC7B,UAAM,QAAQ,gBAAgB,IAAI,GAAG;AACrC,QAAI,SAAS,CAAC,SAAS,IAAI,MAAM,GAAG,GAAG;AAErC,eAAS,KAAK,KAAK;AACnB,eAAS,IAAI,MAAM,GAAG;AAAA,IACxB,OAAO;AAEL,YAAM,MAAM,YAAY;AACxB,eAAS,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC;AAC5B,eAAS,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AAKA,QAAM,aAAuB,WAAW,CAAC,GAAG,SAAS,UAAU,IAAI,CAAC;AACpE,QAAM,aAAiD,CAAC;AACxD,MAAI,UAAU;AACZ,eAAW,QAAQ,SAAS,OAAO;AACjC,UAAI,CAAC,SAAS,IAAI,KAAK,GAAG,GAAG;AAC3B,YAAI,CAAC,WAAW,SAAS,KAAK,GAAG,EAAG,YAAW,KAAK,KAAK,GAAG;AAC5D,mBAAW,KAAK,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,QAAQ,CAAC,GAAG,UAAU,GAAG,UAAU;AAEzC,SAAO,EAAE,OAAO,OAAO,OAAO,WAAW;AAC3C;","names":[]}

package/dist/chunk-5HNX4OD4.js

@@ -0,0 +1,30 @@
+import {
+  PortabilityNotEnabledError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-audit/portability/strategy.ts
+var NO_PORTABILITY = {
+  async exportAccessibleData() {
+    throw new PortabilityNotEnabledError();
+  },
+  async withdrawAccessibleData() {
+    throw new PortabilityNotEnabledError();
+  },
+  async requestWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  },
+  async listWithdrawalRequests() {
+    throw new PortabilityNotEnabledError();
+  },
+  async approveWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  },
+  async rejectWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  }
+};
+
+export {
+  NO_PORTABILITY
+};
+//# sourceMappingURL=chunk-5HNX4OD4.js.map

package/dist/chunk-65VLRG3I.js

@@ -0,0 +1,54 @@
+// src/with-formula/materialized-views/stale.ts
+var _staleByRegistry = /* @__PURE__ */ new WeakMap();
+function markMVStale(registry, mvName) {
+  let set = _staleByRegistry.get(registry);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    _staleByRegistry.set(registry, set);
+  }
+  set.add(mvName);
+}
+function isMVStale(registry, mvName) {
+  return _staleByRegistry.get(registry)?.has(mvName) ?? false;
+}
+async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
+  const registry = accessor.registry();
+  const pending = _staleByRegistry.get(registry);
+  if (!pending || pending.size === 0) return;
+  const candidates = [];
+  for (const mv of registry.all()) {
+    if (mv.outputCollection !== outputCollection) continue;
+    if (!pending.has(mv.spec.name)) continue;
+    candidates.push(mv.spec.name);
+  }
+  if (candidates.length === 0) return;
+  let executor = null;
+  for (const name of candidates) {
+    const reg = registry.byName(name);
+    if (!reg) {
+      pending.delete(name);
+      continue;
+    }
+    if (executor === null) {
+      ({ MaterializedViewExecutor: executor } = await import("./executor-6OCCE5VM.js"));
+    }
+    await executor.refresh(reg, {
+      getCollection: (n) => accessor.getCollection(n),
+      getActiveTxContext: () => accessor.getActiveTxContext(),
+      getQueryContext: () => accessor.getQueryContext(),
+      ...dispatchCtx !== void 0 ? { dispatchCtx } : {}
+    });
+    pending.delete(name);
+  }
+}
+function clearMVStale(registry, mvName) {
+  _staleByRegistry.get(registry)?.delete(mvName);
+}
+
+export {
+  markMVStale,
+  isMVStale,
+  resolveStaleMVOnRead,
+  clearMVStale
+};
+//# sourceMappingURL=chunk-65VLRG3I.js.map

package/dist/chunk-6MA575R5.js

@@ -0,0 +1,59 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  loadOrCreateSigner
+} from "./chunk-NT2ZO4KI.js";
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  encrypt
+} from "./chunk-37WOJQWY.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JC75UBMT.js";
+import {
+  AttestationError
+} from "./chunk-FZCGIJEJ.js";
+
+// src/with-audit/attestation/issue.ts
+import {
+  computeFieldHashes,
+  signPayloadCore,
+  encodeQr,
+  bytesToB64url
+} from "@noy-db/attestation";
+async function issueAttestationCore(ctx, args) {
+  if (ctx.role !== "owner") {
+    throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`);
+  }
+  const src = await ctx.readRecord(args.collection, args.id);
+  if (!src) throw new AttestationError(`issueAttestation: source record '${args.collection}/${args.id}' not found.`);
+  const dek = await ctx.getDEK();
+  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => Promise.resolve(dek));
+  const saltB64 = bytesToB64url(crypto.getRandomValues(new Uint8Array(16)));
+  let fieldHashes;
+  try {
+    fieldHashes = await computeFieldHashes(saltB64, args.fieldSchema, src.record);
+  } catch (e) {
+    throw new AttestationError(`issueAttestation: ${e.message}`);
+  }
+  const docId = generateULID();
+  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64);
+  const payload = { v: 1, docId, salt: saltB64, alg: "ed25519", keyId: signer.keyId, fieldHashes, sig };
+  const index = {
+    docId,
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    keyId: signer.keyId,
+    fieldPaths: args.fieldSchema.fields.map((f) => f.path),
+    sourceRefs: [{ collection: args.collection, id: args.id, version: src.version }]
+  };
+  const { iv, data } = await encrypt(JSON.stringify(index), dek);
+  const env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: index.issuedAt, _iv: iv, _data: data };
+  await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, docId, env);
+  return { docId, qr: encodeQr(payload), payload, keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
+}
+
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=chunk-6MA575R5.js.map