@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.12

package/dist/{chunk-67TNU77I.js → chunk-ZHOJOT6S.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-ELNBMFOS.js";
+} from "./chunk-F44XWXOA.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-67TNU77I.js.map
+//# sourceMappingURL=chunk-ZHOJOT6S.js.map

package/dist/{chunk-WGV4CUZT.js → chunk-ZL6PRULX.js}

@@ -1,14 +1,14 @@
 import {
   canonicalize,
   derivePersistedSchema
-} from "./chunk-QLLKLFE2.js";
+} from "./chunk-P2LJI6JE.js";
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
-} from "./chunk-C7NTK5I3.js";
+} from "./chunk-HK4XTXO4.js";
 import {
   ConflictError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-shape/schema-update/delta.ts
 function computeSchemaDelta(stored, fresh, collection) {
@@ -164,4 +164,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-WGV4CUZT.js.map
+//# sourceMappingURL=chunk-ZL6PRULX.js.map

package/dist/{chunk-WGV4CUZT.js.map → chunk-ZL6PRULX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n// #597: both equality checks below deliberately do NOT compare `epoch`. A\n// live collection re-opening itself computes a fresh epoch candidate on\n// every declare (marker.ts / config-drift.ts) that must still be treated as\n// \"the same marker\" so the no-op fast path fires and the already-persisted\n// epoch is left untouched — that's what makes epoch stable across re-opens.\n// Comparing epoch here would break that fast path today, with no\n// corresponding benefit: there is no delete-collection API yet, so a\n// mismatched epoch can't (yet) mean \"this name was reused for a genuinely\n// new collection.\" Wiring an epoch-mismatch REJECTION is a deferred\n// follow-up for whenever collection deletion ships.\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAaA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-DMFNPHCX.js";
+} from "../chunk-IQIVD7TP.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-PR5LC5YX.js";
-import "../chunk-ARSAMO24.js";
-import "../chunk-CKZW6P5V.js";
+} from "../chunk-WHQHTNT7.js";
+import "../chunk-GXLZXD2W.js";
+import "../chunk-JC75UBMT.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,

package/dist/{classified-marker-LQWWQNIJ.js → classified-marker-M7K3OJPM.js}

@@ -4,16 +4,20 @@ import "./chunk-PZ5AY32C.js";
 function markerForFields(vdigFields) {
   if (vdigFields === null || vdigFields.size === 0) return null;
   const digestOnly = [...vdigFields.keys()];
-  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) };
+  return {
+    digestOnly,
+    equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true),
+    epoch: (/* @__PURE__ */ new Date()).toISOString()
+  };
 }
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-VCKOBWKT.js");
+  const { persistClassifiedMarker } = await import("./register-ZI7YI7US.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const { loadPersistedSchema } = await import("./storage-GR7KZRH4.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -21,4 +25,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-LQWWQNIJ.js.map
+//# sourceMappingURL=classified-marker-M7K3OJPM.js.map

package/dist/classified-marker-M7K3OJPM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `via/classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/**\n * Build the marker for a handle's digest-only field map, or null when it\n * declares none. `epoch` (#597) is stamped fresh on every call, but only\n * ever lands in storage on a genuine first-write or a real reconfiguration —\n * `persistClassifiedMarker`'s equality check (register.ts) ignores epoch, so\n * an identical re-declare's freshly-stamped value is discarded as a no-op\n * and the already-persisted epoch is left untouched (stable per lifetime).\n */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return {\n    digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true),\n    epoch: new Date().toISOString(),\n  }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";;;AA+BA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI;AAAA,IACrF,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACF;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}

package/dist/collection-facade-DWA735G2.js

@@ -0,0 +1,39 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+} from "./chunk-BDPAVYGJ.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-EXGDL2UQ.js";
+import "./chunk-F44XWXOA.js";
+import "./chunk-VCUQR6ZL.js";
+import "./chunk-GXLZXD2W.js";
+import "./chunk-EIZ4YOG2.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-DWA735G2.js.map

package/dist/{computed-W6MVAMWZ.js → computed-ORCGM5JE.js}

@@ -1,11 +1,11 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-45ZZLTFH.js";
-import "./chunk-FH542DDY.js";
+} from "./chunk-HGAB325C.js";
+import "./chunk-FZCGIJEJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-W6MVAMWZ.js.map
+//# sourceMappingURL=computed-ORCGM5JE.js.map

package/dist/consent/index.js

@@ -2,17 +2,17 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-C3YH34IL.js";
+} from "../chunk-2MTRJCBI.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/{dead-filter-4KXZEB3X.js → dead-filter-OV5FGKOG.js}

@@ -5,7 +5,7 @@ import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const { loadPersistedSchema } = await import("./storage-GR7KZRH4.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +25,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-4KXZEB3X.js.map
+//# sourceMappingURL=dead-filter-OV5FGKOG.js.map

package/dist/delegation-YVSHMIZZ.js

@@ -0,0 +1,25 @@
+import {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+} from "./chunk-44IL5G3W.js";
+import "./chunk-KKYEZCQG.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=delegation-YVSHMIZZ.js.map

package/dist/derivations/index.js

@@ -1,29 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-CB25ONKC.js";
+} from "../chunk-BDEMZD4F.js";
 import {
   DerivationRegistry
-} from "../chunk-BEIRE5K4.js";
-import "../chunk-7QIXUSDQ.js";
+} from "../chunk-4BQXMCE5.js";
+import "../chunk-DJ7MRXNA.js";
 import {
   DerivationExecutor
-} from "../chunk-YSXEFGND.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-APHLCXVC.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-BUO555L5.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-P2LJI6JE.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-BUO555L5.js.map

package/dist/{enclave-VXAQD4XJ.js → enclave-XXFUKJC6.js}

@@ -18,26 +18,26 @@ import {
   sealRecordToHost,
   verifyBrokerProof,
   writeEnvelopeBody
-} from "./chunk-QQJXBZCO.js";
+} from "./chunk-HA6ZQWA2.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-FQQF23MC.js";
+} from "./chunk-J3JIYFYL.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-MSPNM2OM.js";
-import "./chunk-SYMS4546.js";
+} from "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-X6CMGUAG.js";
+} from "./chunk-45QPICLE.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -68,9 +68,9 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-HUS3J5WM.js";
-import "./chunk-CKZW6P5V.js";
-import "./chunk-FH542DDY.js";
+} from "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -132,4 +132,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-VXAQD4XJ.js.map
+//# sourceMappingURL=enclave-XXFUKJC6.js.map

package/dist/executor-6OCCE5VM.js

@@ -0,0 +1,25 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-HG76BZ6G.js";
+import "./chunk-R3NHNVS5.js";
+import "./chunk-XJ47GS53.js";
+import "./chunk-EVHBK7BN.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-F44XWXOA.js";
+import "./chunk-VCUQR6ZL.js";
+import "./chunk-GXLZXD2W.js";
+import "./chunk-EIZ4YOG2.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-6OCCE5VM.js.map

package/dist/executor-JFVAJY42.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-APHLCXVC.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-JFVAJY42.js.map

package/dist/executor-UPSH5O3F.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-JRKE5MAZ.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-UPSH5O3F.js.map

package/dist/export-accessible-L4A2QZA5.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-QF5LGMSV.js";
+import "./chunk-PH7G7ZI7.js";
+import "./chunk-FJTWLQV3.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-L4A2QZA5.js.map

package/dist/extract-partition-ZHQ4RGGM.js

@@ -0,0 +1,36 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-F3LGBRSV.js";
+import "./chunk-HK4XTXO4.js";
+import "./chunk-CZMCOFEA.js";
+import "./chunk-PH7G7ZI7.js";
+import "./chunk-FJTWLQV3.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-EIZ4YOG2.js";
+import "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-ZHQ4RGGM.js.map

package/dist/{fanout-sidecar-CKYFH33E.js → fanout-sidecar-IO2KDUWV.js}

@@ -1,18 +1,18 @@
 import {
   openEnvelopeJson
-} from "./chunk-QQJXBZCO.js";
-import "./chunk-FQQF23MC.js";
-import "./chunk-MSPNM2OM.js";
-import "./chunk-SYMS4546.js";
-import "./chunk-X6CMGUAG.js";
+} from "./chunk-HA6ZQWA2.js";
+import "./chunk-J3JIYFYL.js";
+import "./chunk-XS6DLN67.js";
+import "./chunk-NM3IFKBL.js";
+import "./chunk-45QPICLE.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
-import "./chunk-FH542DDY.js";
+} from "./chunk-JC75UBMT.js";
+import "./chunk-FZCGIJEJ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -71,4 +71,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-CKYFH33E.js.map
+//# sourceMappingURL=fanout-sidecar-IO2KDUWV.js.map

package/dist/find-ZFZDZQ2U.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-45QPICLE.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-37WOJQWY.js";
+import "./chunk-FZCGIJEJ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-ZFZDZQ2U.js.map

package/dist/forget/index.js

@@ -1,16 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-DJ3VKYFA.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-EHW5KTTA.js";
+import "../chunk-HA6ZQWA2.js";
+import "../chunk-J3JIYFYL.js";
+import "../chunk-XS6DLN67.js";
+import "../chunk-NM3IFKBL.js";
+import "../chunk-45QPICLE.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-37WOJQWY.js";
+import "../chunk-JC75UBMT.js";
+import "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/guards/index.js

@@ -2,7 +2,7 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-VA4ZWLFY.js";
+} from "../chunk-7GAXFU2O.js";
 import {
   GuardRegistry
 } from "../chunk-YMUGBZN2.js";
@@ -11,14 +11,14 @@ import {
 } from "../chunk-JK733I5V.js";
 import {
   GuardExecutor
-} from "../chunk-ZP5PL65C.js";
+} from "../chunk-JRKE5MAZ.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-FZCGIJEJ.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,