@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.4

package/dist/chunk-AF5ZRTZ4.js

@@ -0,0 +1,108 @@
+import {
+  ClassifiedConfigError,
+  ClassifiedNotEnabledError
+} from "./chunk-U23JUUPX.js";
+
+// src/with-shape/classified/descriptor.ts
+function isClassifiedFieldSpec(x) {
+  return typeof x === "object" && x !== null && x._noydbClassified === true;
+}
+function isClassifiedGroup(x) {
+  return typeof x === "object" && x !== null && x._noydbClassifiedGroup === true;
+}
+
+// src/with-shape/classified/errors.ts
+var ClassifiedNeverStoredError = class extends Error {
+  constructor(collection, field) {
+    super(`Field "${field}" in collection "${collection}" is classified storage:'never' (e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedNeverStoredError";
+  }
+  collection;
+  field;
+};
+var ClassifiedValidationError = class extends Error {
+  constructor(collection, field, detail) {
+    super(`Classified field "${field}" in collection "${collection}" failed validation: ${detail}`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedValidationError";
+  }
+  collection;
+  field;
+};
+
+// src/with-shape/classified/resolve.ts
+function resolveClassifiedFields(collection, config) {
+  const byField = {};
+  const claim = (field, spec) => {
+    if (byField[field] !== void 0) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${field}" is claimed twice \u2014 storage forms are mutually exclusive per field (R5): a field is digest-only OR recoverable OR never, exactly one`
+      );
+    }
+    byField[field] = spec;
+  };
+  for (const [key, entry] of Object.entries(config)) {
+    if (isClassifiedGroup(entry)) {
+      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec);
+    } else {
+      claim(key, entry);
+    }
+  }
+  const riderComputed = {};
+  for (const [field, spec] of Object.entries(byField)) {
+    for (const [name, rider] of Object.entries(spec.riders ?? {})) {
+      const companion = `${field}_${name}`;
+      if (byField[companion] !== void 0 || riderComputed[companion] !== void 0) {
+        throw new ClassifiedConfigError(collection, `rider companion "${companion}" collides with a declared field`);
+      }
+      riderComputed[companion] = (record) => record[field] === void 0 ? void 0 : rider(record[field]);
+    }
+  }
+  return { byField, riderComputed };
+}
+
+// src/with-shape/classified/write.ts
+function enforceClassifiedWrite(record, byField, collection) {
+  for (const [field, spec] of Object.entries(byField)) {
+    const value = record[field];
+    if (value === void 0) continue;
+    if (value === null && spec.storage === "digest-only") continue;
+    if (spec.storage === "never") throw new ClassifiedNeverStoredError(collection, field);
+    const problem = spec.validate?.(value) ?? null;
+    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem);
+  }
+}
+
+// src/with-shape/classified/strategy.ts
+var NO_CLASSIFIED = {
+  async reveal() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async verify() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async verifyText() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async matchGroup() {
+    throw new ClassifiedNotEnabledError();
+  },
+  async computeTarget() {
+    throw new ClassifiedNotEnabledError();
+  }
+};
+
+export {
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  ClassifiedNeverStoredError,
+  ClassifiedValidationError,
+  resolveClassifiedFields,
+  enforceClassifiedWrite,
+  NO_CLASSIFIED
+};
+//# sourceMappingURL=chunk-AF5ZRTZ4.js.map

package/dist/chunk-AF5ZRTZ4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/classified/descriptor.ts","../src/with-shape/classified/errors.ts","../src/with-shape/classified/resolve.ts","../src/with-shape/classified/write.ts","../src/with-shape/classified/strategy.ts"],"sourcesContent":["/**\n * Classified fields — behavioral sensitive-field descriptors (stage 1).\n * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md\n * Law: open on write, declarative on read — read-side behavior is this\n * closed vocabulary; there are no read-side callbacks.\n * @module\n */\n\nexport type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only'\n\nexport type ClassifiedList =\n  | { readonly kind: 'omit' }\n  | { readonly kind: 'mask'; readonly pattern: string }\n  | { readonly kind: 'rider'; readonly rider: string }\n\nexport type ClassifiedRider = (value: unknown) => unknown\n\nexport interface ClassifiedFieldSpec {\n  readonly _noydbClassified: true\n  readonly preset: string\n  readonly storage: ClassifiedStorage\n  readonly list: ClassifiedList\n  readonly sensitivity: 'pii' | 'secret'\n  /** Write-time safe projections; companion field name is `<field>_<rider>`. */\n  readonly riders?: Record<string, ClassifiedRider>\n  /** Write-time validator: error message, or null when valid. */\n  readonly validate?: (value: unknown) => string | null\n  /** Digest-only verify policy (stage 2). Mode both sides normalize under. */\n  readonly verifyNormalize?: 'password' | 'secret-answer'\n  /** Decorate ok:true verdicts with mustRotate after this many days (I1). */\n  readonly rotateDays?: number\n  /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */\n  readonly notLastN?: number\n  /** Member of the collection's matchGroup (secretAnswer preset). */\n  readonly verifyGroupMember?: true\n  /**\n   * Opt into a store-visible blind-index (`_bidx`) tag so equal values become\n   * queryable/joinable while staying digest-only. Digest-only knob (R7); gated\n   * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values\n   * produce equal tags — a partition leak a DEK holder can offline-dictionary\n   * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.\n   */\n  readonly equatable?: true\n}\n\nexport interface ClassifiedGroup {\n  readonly _noydbClassifiedGroup: true\n  readonly preset: string\n  /** member record-field name -> spec (differential per-member policy). */\n  readonly members: Record<string, ClassifiedFieldSpec>\n}\n\nexport type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup\n\nexport function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassified?: unknown })._noydbClassified === true\n}\n\nexport function isClassifiedGroup(x: unknown): x is ClassifiedGroup {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassifiedGroup?: unknown })._noydbClassifiedGroup === true\n}\n","/**\n * Configuration/write errors for classified fields. @module\n *\n * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`\n * (stage 2) so `kernel/enclave/classify/*` can throw them without importing\n * with-*. Re-exported here under the same names so existing import paths\n * keep working.\n */\nexport { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js'\n\nexport class ClassifiedNeverStoredError extends Error {\n  constructor(public readonly collection: string, public readonly field: string) {\n    super(`Field \"${field}\" in collection \"${collection}\" is classified storage:'never' `\n      + `(e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`)\n    this.name = 'ClassifiedNeverStoredError'\n  }\n}\n\nexport class ClassifiedValidationError extends Error {\n  constructor(public readonly collection: string, public readonly field: string, detail: string) {\n    super(`Classified field \"${field}\" in collection \"${collection}\" failed validation: ${detail}`)\n    this.name = 'ClassifiedValidationError'\n  }\n}\n","/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */\n\nimport { isClassifiedGroup, type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from './errors.js'\n\nexport type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js'\nexport { ClassifiedConfigError } from './errors.js'\n\nexport interface ResolvedClassified {\n  readonly byField: Record<string, ClassifiedFieldSpec>\n  readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>\n}\n\nexport function resolveClassifiedFields(\n  collection: string,\n  config: Record<string, ClassifiedEntry>,\n): ResolvedClassified {\n  const byField: Record<string, ClassifiedFieldSpec> = {}\n  const claim = (field: string, spec: ClassifiedFieldSpec): void => {\n    if (byField[field] !== undefined) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is claimed twice — storage forms are mutually exclusive per field (R5): ` +\n        `a field is digest-only OR recoverable OR never, exactly one`)\n    }\n    byField[field] = spec\n  }\n  for (const [key, entry] of Object.entries(config)) {\n    if (isClassifiedGroup(entry)) {\n      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec)\n    } else {\n      claim(key, entry)\n    }\n  }\n  const riderComputed: Record<string, (record: Record<string, unknown>) => unknown> = {}\n  for (const [field, spec] of Object.entries(byField)) {\n    for (const [name, rider] of Object.entries(spec.riders ?? {})) {\n      const companion = `${field}_${name}`\n      if (byField[companion] !== undefined || riderComputed[companion] !== undefined) {\n        throw new ClassifiedConfigError(collection, `rider companion \"${companion}\" collides with a declared field`)\n      }\n      riderComputed[companion] = (record) =>\n        record[field] === undefined ? undefined : rider(record[field])\n    }\n  }\n  return { byField, riderComputed }\n}\n","/** Write-path enforcement: storage:'never' rejection + preset validators.\n *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */\n\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNeverStoredError, ClassifiedValidationError } from './errors.js'\n\nexport function enforceClassifiedWrite(\n  record: Record<string, unknown>,\n  byField: Record<string, ClassifiedFieldSpec>,\n  collection: string,\n): void {\n  for (const [field, spec] of Object.entries(byField)) {\n    const value = record[field]\n    if (value === undefined) continue\n    if (value === null && spec.storage === 'digest-only') continue // explicit clear (C6 branch 3)\n    if (spec.storage === 'never') throw new ClassifiedNeverStoredError(collection, field)\n    const problem = spec.validate?.(value) ?? null\n    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem)\n  }\n}\n","/** The ② capability seam for classified read-egress ops (stage 1: reveal; stage 2: verify). @module */\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNotEnabledError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\nexport type { ClassifiedVerdict } from '../../kernel/types.js'\nimport type { ClassifiedVerdict } from '../../kernel/types.js'\n\nexport interface ClassifiedRevealCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  /** True on an encrypted collection — false selects the plaintext-body read. */\n  readonly encrypted: boolean\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedVerifyCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>       // raw envelope, NOT a decrypted view\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly now: () => number                                        // injected (Q7)\n  /** Group members resolved by the collection (matchGroup only). */\n  readonly groupMembers?: ReadonlyArray<{ readonly field: string; readonly spec: ClassifiedFieldSpec }>\n  readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedStrategy {\n  reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>\n  verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>,\n             opts: { readonly min: number }): Promise<{ readonly passed: boolean }>\n  computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>\n}\n\nexport const NO_CLASSIFIED: ClassifiedStrategy = {\n  async reveal() { throw new ClassifiedNotEnabledError() },\n  async verify() { throw new ClassifiedNotEnabledError() },\n  async verifyText() { throw new ClassifiedNotEnabledError() },\n  async matchGroup() { throw new ClassifiedNotEnabledError() },\n  async computeTarget() { throw new ClassifiedNotEnabledError() },\n}\n"],"mappings":";;;;;;AAsDO,SAAS,sBAAsB,GAAsC;AAC1E,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAAqC,qBAAqB;AAClE;AAEO,SAAS,kBAAkB,GAAkC;AAClE,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAA0C,0BAA0B;AAC5E;;;ACpDO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,OAAe;AAC7E,UAAM,UAAU,KAAK,oBAAoB,UAAU,0HAC2C;AAFpE;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAA4B,YAAoC,OAAe,QAAgB;AAC7F,UAAM,qBAAqB,KAAK,oBAAoB,UAAU,wBAAwB,MAAM,EAAE;AADpE;AAAoC;AAE9D,SAAK,OAAO;AAAA,EACd;AAAA,EAH4B;AAAA,EAAoC;AAIlE;;;ACVO,SAAS,wBACd,YACA,QACoB;AACpB,QAAM,UAA+C,CAAC;AACtD,QAAM,QAAQ,CAAC,OAAe,SAAoC;AAChE,QAAI,QAAQ,KAAK,MAAM,QAAW;AAChC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAC8C;AAAA,IACjE;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,kBAAkB,KAAK,GAAG;AAC5B,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9E,OAAO;AACL,YAAM,KAAK,KAAK;AAAA,IAClB;AAAA,EACF;AACA,QAAM,gBAA8E,CAAC;AACrF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;AAC7D,YAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,UAAI,QAAQ,SAAS,MAAM,UAAa,cAAc,SAAS,MAAM,QAAW;AAC9E,cAAM,IAAI,sBAAsB,YAAY,oBAAoB,SAAS,kCAAkC;AAAA,MAC7G;AACA,oBAAc,SAAS,IAAI,CAAC,WAC1B,OAAO,KAAK,MAAM,SAAY,SAAY,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACA,SAAO,EAAE,SAAS,cAAc;AAClC;;;ACvCO,SAAS,uBACd,QACA,SACA,YACM;AACN,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,UAAU,QAAQ,KAAK,YAAY,cAAe;AACtD,QAAI,KAAK,YAAY,QAAS,OAAM,IAAI,2BAA2B,YAAY,KAAK;AACpF,UAAM,UAAU,KAAK,WAAW,KAAK,KAAK;AAC1C,QAAI,YAAY,KAAM,OAAM,IAAI,0BAA0B,YAAY,OAAO,OAAO;AAAA,EACtF;AACF;;;ACsBO,IAAM,gBAAoC;AAAA,EAC/C,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,gBAAgB;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAChE;","names":[]}

package/dist/{chunk-I3TIKTJO.js → chunk-BKGIWGCX.js}

@@ -1,6 +1,6 @@
 import {
   readPath
-} from "./chunk-M2YKN37S.js";
+} from "./chunk-ZKF6HH7V.js";
 
 // src/with-lookup/indexing/eager-indexes.ts
 var CollectionIndexes = class {
@@ -129,4 +129,4 @@ function removeFromIndex(idx, id, record) {
 export {
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-I3TIKTJO.js.map
+//# sourceMappingURL=chunk-BKGIWGCX.js.map

package/dist/{chunk-IO6GRPT6.js → chunk-BMQOH7MM.js}

@@ -1,6 +1,6 @@
 import {
   TierNotGrantedError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-party/team/tiers.ts
 function dekKey(collection, tier) {
@@ -31,4 +31,4 @@ export {
   effectiveClearance,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-IO6GRPT6.js.map
+//# sourceMappingURL=chunk-BMQOH7MM.js.map

package/dist/{chunk-26LGBE4T.js → chunk-CPXPHQGX.js}

@@ -1,10 +1,12 @@
 import {
-  encrypt,
   openEnvelopeJson
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -39,4 +41,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-26LGBE4T.js.map
+//# sourceMappingURL=chunk-CPXPHQGX.js.map

package/dist/{chunk-26LGBE4T.js.map → chunk-CPXPHQGX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/persisted-schemas/storage.ts"],"sourcesContent":["/**\n * Read / write the per-collection persisted-schema envelope. Mirrors the\n * standard noy-db record envelope shape and is **AES-GCM encrypted with\n * the collection's DEK** — the schema body (field names, enum values,\n * constraints) is sensitive metadata, so it gets the same encryption\n * envelope as the records it describes.\n *\n * Storage layout:\n *\n *   <vault>/_schemas/<collection>   →   EncryptedEnvelope\n *\n * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}\n * is the same key the collection uses for its records.\n *\n * @module\n */\n\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\n\n/** Reserved collection name where persisted schemas live. */\nexport const SCHEMAS_COLLECTION = '_schemas' as const\n\n/**\n * Read and decrypt the persisted-schema envelope for one collection.\n * Returns `undefined` when no envelope has been written or when decryption\n * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse\n * failures surface as `undefined`, mirroring `_meta/handle`'s contract.\n */\nexport async function loadPersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEnvelope | undefined> {\n  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  if (!envelope) return undefined\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as PersistedSchemaEnvelope\n    if (parsed._noydb_schema !== 1) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist a schema envelope for one collection. Always\n * overwrites any prior write (callers gate on hash equality before calling\n * to avoid no-op writes).\n */\nexport async function savePersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n  payload: PersistedSchemaEnvelope,\n): Promise<void> {\n  const json = JSON.stringify(payload)\n  const { iv, data } = await encrypt(json, dek)\n  const prior = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n  }\n  await store.put(vault, SCHEMAS_COLLECTION, collection, env)\n}\n"],"mappings":";;;;;;;;;AAuBO,IAAM,qBAAqB;AAQlC,eAAsB,oBACpB,OACA,OACA,YACA,KAC8C;AAC9C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACtE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,oBACpB,OACA,OACA,YACA,KACA,SACe;AACf,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACnE,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,OAAO,oBAAoB,YAAY,GAAG;AAC5D;","names":[]}
+{"version":3,"sources":["../src/with-shape/persisted-schemas/storage.ts"],"sourcesContent":["/**\n * Read / write the per-collection persisted-schema envelope. Mirrors the\n * standard noy-db record envelope shape and is **AES-GCM encrypted with\n * the collection's DEK** — the schema body (field names, enum values,\n * constraints) is sensitive metadata, so it gets the same encryption\n * envelope as the records it describes.\n *\n * Storage layout:\n *\n *   <vault>/_schemas/<collection>   →   EncryptedEnvelope\n *\n * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}\n * is the same key the collection uses for its records.\n *\n * @module\n */\n\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\n\n/** Reserved collection name where persisted schemas live. */\nexport const SCHEMAS_COLLECTION = '_schemas' as const\n\n/**\n * Read and decrypt the persisted-schema envelope for one collection.\n * Returns `undefined` when no envelope has been written or when decryption\n * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse\n * failures surface as `undefined`, mirroring `_meta/handle`'s contract.\n */\nexport async function loadPersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEnvelope | undefined> {\n  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  if (!envelope) return undefined\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as PersistedSchemaEnvelope\n    if (parsed._noydb_schema !== 1) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist a schema envelope for one collection. Always\n * overwrites any prior write (callers gate on hash equality before calling\n * to avoid no-op writes).\n */\nexport async function savePersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n  payload: PersistedSchemaEnvelope,\n): Promise<void> {\n  const json = JSON.stringify(payload)\n  const { iv, data } = await encrypt(json, dek)\n  const prior = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n  }\n  await store.put(vault, SCHEMAS_COLLECTION, collection, env)\n}\n"],"mappings":";;;;;;;;;;;AAuBO,IAAM,qBAAqB;AAQlC,eAAsB,oBACpB,OACA,OACA,YACA,KAC8C;AAC9C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACtE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,oBACpB,OACA,OACA,YACA,KACA,SACe;AACf,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACnE,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,OAAO,oBAAoB,YAAY,GAAG;AAC5D;","names":[]}

package/dist/{chunk-FISN7WE4.js → chunk-EWR7HL3K.js}

@@ -1,14 +1,14 @@
 import {
   pickLocale
-} from "./chunk-SMXWYP24.js";
+} from "./chunk-3QRQOBS7.js";
 import {
   sha256Hex
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   BundleIntegrityError,
   BundleSealMismatchError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-pod/format.ts
 var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
@@ -795,4 +795,4 @@ export {
   readPod,
   readNoydbBundle
 };
-//# sourceMappingURL=chunk-FISN7WE4.js.map
+//# sourceMappingURL=chunk-EWR7HL3K.js.map

package/dist/{chunk-AQTBSL7R.js → chunk-FH52CDEW.js}

@@ -1,17 +1,17 @@
 import {
   wrapDbWithPredicates
-} from "./chunk-62QYRORB.js";
+} from "./chunk-LIP6JWYK.js";
 import {
   canonicalGroupKey,
   groupAndReduce
-} from "./chunk-LV7M27WM.js";
+} from "./chunk-P5WXDYMD.js";
 import {
   applyI18nLocale
-} from "./chunk-5LUY7UTV.js";
+} from "./chunk-4K3MQ5S3.js";
 import {
   LocaleNotSpecifiedError,
   MaterializedViewTooLargeError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-formula/materialized-views/executor.ts
 var DEFAULT_MAX_ROWS = 1e5;
@@ -178,4 +178,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-AQTBSL7R.js.map
+//# sourceMappingURL=chunk-FH52CDEW.js.map

package/dist/chunk-G4MGYGSS.js

@@ -0,0 +1,130 @@
+import {
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-P3NGV5RV.js";
+import {
+  openEnvelopeJson
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
+import {
+  NoydbError
+} from "./chunk-U23JUUPX.js";
+
+// src/with-shape/links/link-set.ts
+var LinkSet = class {
+  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
+    this.adapter = adapter;
+    this.vault = vault;
+    this.name = name;
+    this.spec = spec;
+    this.encrypted = encrypted;
+    this.getDEK = getDEK;
+    this.actor = actor;
+    this.emitter = emitter;
+    this.endpointExists = endpointExists;
+    this.collName = linkCollectionName(name);
+  }
+  adapter;
+  vault;
+  name;
+  spec;
+  encrypted;
+  getDEK;
+  actor;
+  emitter;
+  endpointExists;
+  collName;
+  dekPromise = null;
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
+    return this.dekPromise;
+  }
+  async encryptEntry(entry, version) {
+    const json = JSON.stringify(entry);
+    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
+    if (!this.encrypted) return { ...base, _iv: "", _data: json };
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { ...base, _iv: iv, _data: data };
+  }
+  async decryptEntry(env) {
+    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    return JSON.parse(json);
+  }
+  async connect(aId, bId, meta) {
+    if (!await this.endpointExists(this.spec.a, aId)) {
+      throw new LinkEndpointError(this.name, this.spec.a, aId);
+    }
+    if (!await this.endpointExists(this.spec.b, bId)) {
+      throw new LinkEndpointError(this.name, this.spec.b, bId);
+    }
+    const key = linkRowKey(aId, bId);
+    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
+    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
+  }
+  async disconnect(aId, bId) {
+    const key = linkRowKey(aId, bId);
+    const existing = await this.adapter.get(this.vault, this.collName, key);
+    if (!existing) return;
+    await this.adapter.delete(this.vault, this.collName, key);
+    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
+  }
+  async has(aId, bId) {
+    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
+  }
+  async of(id) {
+    const rows = await this.list();
+    return rows.filter((r) => r.a === id || r.b === id);
+  }
+  async list() {
+    const keys = await this.adapter.list(this.vault, this.collName);
+    const out = [];
+    for (const key of keys) {
+      const env = await this.adapter.get(this.vault, this.collName, key);
+      if (!env) continue;
+      const e = await this.decryptEntry(env);
+      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
+    }
+    return out;
+  }
+  // ── Vault-internal cascade helpers ──────────────────────────────────
+  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
+  async _rowsTouchingEndpoint(collection, id) {
+    const rows = await this.list();
+    return rows.filter(
+      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
+    );
+  }
+  /** @internal — the storage collection name (for tx pre-image capture). */
+  get _collectionName() {
+    return this.collName;
+  }
+};
+var LinkEndpointError = class extends NoydbError {
+  link;
+  endpoint;
+  missingId;
+  constructor(link, endpoint, missingId) {
+    super(
+      "LINK_ENDPOINT",
+      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
+    );
+    this.name = "LinkEndpointError";
+    this.link = link;
+    this.endpoint = endpoint;
+    this.missingId = missingId;
+  }
+};
+
+export {
+  LinkSet,
+  LinkEndpointError
+};
+//# sourceMappingURL=chunk-G4MGYGSS.js.map

package/dist/chunk-G4MGYGSS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/links/link-set.ts"],"sourcesContent":["/**\n * `_links_*` reserved collections — managed bidirectional many-to-many\n * junctions (design B).\n *\n * Where `refArray` (design A) stores an id-array on one owning record,\n * `vault.link()` creates a first-class junction: a dedicated encrypted\n * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.\n * It is queryable from BOTH sides (`of(id)`), carries optional per-link\n * metadata, and cascades on endpoint delete.\n *\n * Each link is slot-typed: `a` is an id in the `a` endpoint collection,\n * `b` an id in the `b` endpoint collection (they may be the same\n * collection for self-links). A link's identity is the ordered pair\n * `(a, b)`; `of(id)` matches either slot.\n *\n * Rows are encrypted under a dedicated `_links_<name>` DEK — same\n * zero-knowledge stack as every other collection (the store sees only\n * ciphertext). Backup/restore rides the normal `loadAll` path.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\n\n// Naming helpers, declaration types, and LinkIntegrityError live in\n// `names.ts` (the always-loadable slice — #553); re-exported here so\n// existing import paths and the root barrel are unchanged.\nexport {\n  LINK_COLLECTION_PREFIX,\n  linkCollectionName,\n  isLinkCollectionName,\n  linkRowKey,\n  LinkIntegrityError,\n} from './names.js'\nexport type { LinkOnDelete, LinkSpec, LinkRow, LinkSetHandle } from './names.js'\nimport { linkCollectionName, linkRowKey } from './names.js'\nimport type { LinkSpec, LinkRow, LinkSetHandle } from './names.js'\n\n/** Stored form (also the row key derivation source). */\ninterface LinkEntry {\n  a: string\n  b: string\n  meta?: Record<string, unknown>\n}\n\n/**\n * @internal — the concrete handle. The Vault owns construction (one per\n * link name) and the cascade hooks; consumers use the {@link LinkSetHandle}\n * surface via `vault.links(name)`.\n */\nexport class LinkSet implements LinkSetHandle {\n  private readonly collName: string\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(\n    private readonly adapter: NoydbStore,\n    private readonly vault: string,\n    private readonly name: string,\n    private readonly spec: LinkSpec,\n    private readonly encrypted: boolean,\n    private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>,\n    private readonly actor: string,\n    private readonly emitter: NoydbEventEmitter,\n    /** Vault-provided existence check for endpoint validation on connect(). */\n    private readonly endpointExists: (collection: string, id: string) => Promise<boolean>,\n  ) {\n    this.collName = linkCollectionName(name)\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName)\n    return this.dekPromise\n  }\n\n  private async encryptEntry(entry: LinkEntry, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(entry)\n    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _by: this.actor }\n    if (!this.encrypted) return { ...base, _iv: '', _data: json }\n    const { iv, data } = await encrypt(json, await this.dek())\n    return { ...base, _iv: iv, _data: data }\n  }\n\n  private async decryptEntry(env: EncryptedEnvelope): Promise<LinkEntry> {\n    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data\n    return JSON.parse(json) as LinkEntry\n  }\n\n  async connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void> {\n    if (!(await this.endpointExists(this.spec.a, aId))) {\n      throw new LinkEndpointError(this.name, this.spec.a, aId)\n    }\n    if (!(await this.endpointExists(this.spec.b, bId))) {\n      throw new LinkEndpointError(this.name, this.spec.b, bId)\n    }\n    const key = linkRowKey(aId, bId)\n    const entry: LinkEntry = meta !== undefined ? { a: aId, b: bId, meta } : { a: aId, b: bId }\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1)\n    await this.adapter.put(this.vault, this.collName, key, env, existing?._v)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'put' })\n  }\n\n  async disconnect(aId: string, bId: string): Promise<void> {\n    const key = linkRowKey(aId, bId)\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    if (!existing) return\n    await this.adapter.delete(this.vault, this.collName, key)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'delete' })\n  }\n\n  async has(aId: string, bId: string): Promise<boolean> {\n    return (await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId))) !== null\n  }\n\n  async of(id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter((r) => r.a === id || r.b === id)\n  }\n\n  async list(): Promise<LinkRow[]> {\n    const keys = await this.adapter.list(this.vault, this.collName)\n    const out: LinkRow[] = []\n    for (const key of keys) {\n      const env = await this.adapter.get(this.vault, this.collName, key)\n      if (!env) continue\n      const e = await this.decryptEntry(env)\n      out.push(e.meta !== undefined ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b })\n    }\n    return out\n  }\n\n  // ── Vault-internal cascade helpers ──────────────────────────────────\n\n  /** @internal — rows where the deleted endpoint id matches the relevant slot. */\n  async _rowsTouchingEndpoint(collection: string, id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter(\n      (r) => (this.spec.a === collection && r.a === id) || (this.spec.b === collection && r.b === id),\n    )\n  }\n\n  /** @internal — the storage collection name (for tx pre-image capture). */\n  get _collectionName(): string {\n    return this.collName\n  }\n}\n\n/** Thrown by `connect()` when an endpoint record does not exist. */\nexport class LinkEndpointError extends NoydbError {\n  readonly link: string\n  readonly endpoint: string\n  readonly missingId: string\n  constructor(link: string, endpoint: string, missingId: string) {\n    super(\n      'LINK_ENDPOINT',\n      `link(\"${link}\").connect: endpoint \"${endpoint}\" has no record \"${missingId}\".`,\n    )\n    this.name = 'LinkEndpointError'\n    this.link = link\n    this.endpoint = endpoint\n    this.missingId = missingId\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoDO,IAAM,UAAN,MAAuC;AAAA,EAI5C,YACmB,SACA,OACA,MACA,MACA,WACA,QACA,OACA,SAEA,gBACjB;AAViB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEjB,SAAK,WAAW,mBAAmB,IAAI;AAAA,EACzC;AAAA,EAZmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAbF;AAAA,EACT,aAAyC;AAAA,EAiBzC,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,KAAK,QAAQ;AACjE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,aAAa,OAAkB,SAA6C;AACxF,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAM,OAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,KAAK,MAAM;AACzG,QAAI,CAAC,KAAK,UAAW,QAAO,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,KAAK;AAC5D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,CAAC;AACzD,WAAO,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,KAAK;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,KAA4C;AACrE,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAClF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAM,QAAQ,KAAa,KAAa,MAA+C;AACrF,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,QAAmB,SAAS,SAAY,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,GAAG,IAAI;AAC1F,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,UAAM,MAAM,MAAM,KAAK,aAAa,QAAQ,UAAU,MAAM,KAAK,CAAC;AAClE,UAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,KAAK,KAAK,UAAU,EAAE;AACxE,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,MAAM,CAAC;AAAA,EACtG;AAAA,EAEA,MAAM,WAAW,KAAa,KAA4B;AACxD,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,GAAG;AACxD,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,SAAS,CAAC;AAAA,EACzG;AAAA,EAEA,MAAM,IAAI,KAAa,KAA+B;AACpD,WAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,GAAG,CAAC,MAAO;AAAA,EACvF;AAAA,EAEA,MAAM,GAAG,IAAgC;AACvC,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,OAA2B;AAC/B,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,KAAK,QAAQ;AAC9D,UAAM,MAAiB,CAAC;AACxB,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACjE,UAAI,CAAC,IAAK;AACV,YAAM,IAAI,MAAM,KAAK,aAAa,GAAG;AACrC,UAAI,KAAK,EAAE,SAAS,SAAY,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAoB,IAAgC;AAC9E,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK;AAAA,MACV,CAAC,MAAO,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM,MAAQ,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM;AAAA,IAC9F;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,kBAA0B;AAC5B,WAAO,KAAK;AAAA,EACd;AACF;AAGO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,MAAc,UAAkB,WAAmB;AAC7D;AAAA,MACE;AAAA,MACA,SAAS,IAAI,yBAAyB,QAAQ,oBAAoB,SAAS;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,YAAY;AAAA,EACnB;AACF;","names":[]}

package/dist/{chunk-UV5MFVO3.js → chunk-G7RDYYTE.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-UV5MFVO3.js.map
+//# sourceMappingURL=chunk-G7RDYYTE.js.map