@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.4

package/dist/{chunk-U5DWHU3S.js → chunk-U24XHXNK.js}

@@ -1,7 +1,7 @@
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -94,4 +94,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-U5DWHU3S.js.map
+//# sourceMappingURL=chunk-U24XHXNK.js.map

package/dist/chunk-ULIHDPKL.js

@@ -0,0 +1,94 @@
+import {
+  sha256Hex
+} from "./chunk-TLJOJBZD.js";
+
+// src/with-shape/persisted-schemas/canonicalize.ts
+function canonicalize(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalize).join(",") + "]";
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
+  return "{" + parts.join(",") + "}";
+}
+
+// src/with-shape/persisted-schemas/derive.ts
+function isZodSchema(value) {
+  if (value === null || typeof value !== "object") return false;
+  const std = value["~standard"];
+  if (std && typeof std === "object" && std.vendor === "zod") return true;
+  const def = value._def;
+  if (!def || typeof def !== "object") return false;
+  return typeof def.typeName === "string" && def.typeName.startsWith("Zod");
+}
+function detectKind(validator) {
+  if (isZodSchema(validator)) return "Zod";
+  return "Unknown";
+}
+function isZod4Schema(value) {
+  if (value === null || typeof value !== "object") return false;
+  return "_zod" in value;
+}
+async function loadZodToJsonSchemaConverter() {
+  try {
+    const mod = await import("zod-to-json-schema");
+    if (!mod.zodToJsonSchema) {
+      throw new Error("zod-to-json-schema export missing");
+    }
+    return mod.zodToJsonSchema;
+  } catch (err) {
+    throw new Error(
+      `persistJsonSchema requires the optional peer-dep \`zod-to-json-schema\`. Install it: \`pnpm add zod-to-json-schema\` (or npm/yarn equivalent). Original error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function loadZodV4Converter() {
+  try {
+    const mod = await import("./zod-HAJM7LMS.js");
+    if (typeof mod.toJSONSchema !== "function") {
+      throw new Error("zod.toJSONSchema not available (zod v4 required)");
+    }
+    return mod.toJSONSchema;
+  } catch (err) {
+    throw new Error(
+      `persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. Original error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function derivePersistedSchema(validator) {
+  const kind = detectKind(validator);
+  const derivedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (kind === "Zod") {
+    let jsonSchema;
+    if (isZod4Schema(validator)) {
+      const convert = await loadZodV4Converter();
+      jsonSchema = convert(validator);
+    } else {
+      const convert = await loadZodToJsonSchemaConverter();
+      jsonSchema = convert(validator);
+    }
+    const canonical = canonicalize(jsonSchema);
+    const hash = await sha256Hex(new TextEncoder().encode(canonical));
+    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
+  }
+  return {
+    _noydb_schema: 1,
+    kind,
+    jsonSchema: null,
+    hash: null,
+    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,
+    derivedAt
+  };
+}
+
+export {
+  canonicalize,
+  isZodSchema,
+  isZod4Schema,
+  derivePersistedSchema
+};
+//# sourceMappingURL=chunk-ULIHDPKL.js.map

package/dist/chunk-ULIHDPKL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/canonicalize.ts","../src/with-shape/persisted-schemas/derive.ts"],"sourcesContent":["/**\n * Deterministic JSON serializer: sorts object keys lexicographically at every\n * depth so structurally-equivalent objects produce identical strings. Array\n * order is preserved (arrays are semantically ordered).\n *\n * Used by {@link sha256Hex} to fingerprint a derived JSON Schema for\n * hash-based skip on persisted-schema writes.\n *\n * @module\n */\n\nexport function canonicalize(value: unknown): string {\n  if (value === null || typeof value !== 'object') {\n    return JSON.stringify(value)\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map(canonicalize).join(',') + ']'\n  }\n  const obj = value as Record<string, unknown>\n  const keys = Object.keys(obj).sort()\n  const parts = keys.map((k) => JSON.stringify(k) + ':' + canonicalize(obj[k]))\n  return '{' + parts.join(',') + '}'\n}\n","/**\n * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1\n * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)\n * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so\n * hub never statically imports zod. Other validator families write a stub\n * envelope flagging the kind.\n *\n * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md\n *\n * @module\n */\n\nimport { canonicalize } from './canonicalize.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport type { PersistedSchemaEnvelope, PersistedSchemaKind } from './types.js'\n\n/**\n * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`\n * property (present in Zod v3.23+ and Zod v4+). Falls back to the\n * `_def.typeName` heuristic for older Zod v3 builds that predate Standard\n * Schema support.\n */\nexport function isZodSchema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  // Standard Schema v1 vendor tag — most reliable across Zod majors\n  const std = (value as { '~standard'?: { vendor?: unknown } })['~standard']\n  if (std && typeof std === 'object' && (std as { vendor?: unknown }).vendor === 'zod') return true\n  // Zod v3 fallback: _def.typeName starts with 'Zod' (e.g. 'ZodObject')\n  const def = (value as { _def?: { typeName?: unknown } })._def\n  if (!def || typeof def !== 'object') return false\n  return typeof (def as { typeName?: unknown }).typeName === 'string'\n    && ((def as { typeName: string }).typeName).startsWith('Zod')\n}\n\nfunction detectKind(validator: unknown): PersistedSchemaKind {\n  if (isZodSchema(validator)) return 'Zod'\n  return 'Unknown'\n}\n\n/**\n * Returns `true` when the validator was created with the Zod v4 native API\n * (i.e. `import { z } from 'zod'` where zod resolves to v4). Zod v4 native\n * schemas carry a `_zod` property whereas Zod v3 schemas (and the v3-compat\n * shim shipped inside zod@4 at `zod/v3`) use `_def.typeName`.\n *\n * Kept duck-typed so hub never statically imports zod.\n */\nexport function isZod4Schema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  return '_zod' in value\n}\n\n/**\n * Lazy-require `zod-to-json-schema`. Returns the converter, or throws a\n * clear error if the peer-dep isn't installed.\n */\nasync function loadZodToJsonSchemaConverter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod-to-json-schema')) as { zodToJsonSchema?: (s: unknown) => object }\n    if (!mod.zodToJsonSchema) {\n      throw new Error('zod-to-json-schema export missing')\n    }\n    return mod.zodToJsonSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema requires the optional peer-dep `zod-to-json-schema`. '\n      + 'Install it: `pnpm add zod-to-json-schema` (or npm/yarn equivalent). '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\n/**\n * Lazy-require Zod v4's built-in `toJSONSchema`. Used when the validator is a\n * Zod v4 native schema and `zod-to-json-schema` is absent or cannot handle it.\n * This is a dynamic import so it does not add a static zod dependency to hub.\n */\nasync function loadZodV4Converter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod')) as { toJSONSchema?: (s: unknown) => object }\n    if (typeof mod.toJSONSchema !== 'function') {\n      throw new Error('zod.toJSONSchema not available (zod v4 required)')\n    }\n    return mod.toJSONSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\nexport async function derivePersistedSchema(\n  validator: unknown,\n): Promise<PersistedSchemaEnvelope> {\n  const kind = detectKind(validator)\n  const derivedAt = new Date().toISOString()\n\n  if (kind === 'Zod') {\n    let jsonSchema: object\n\n    if (isZod4Schema(validator)) {\n      // Zod v4 native schemas: use zod's built-in toJSONSchema (available in\n      // zod@4) because zod-to-json-schema@3.x parses _def.typeName which is\n      // absent in native v4 schemas.\n      const convert = await loadZodV4Converter()\n      jsonSchema = convert(validator)\n    } else {\n      // Zod v3 schemas (or v3-compat shim): use the optional peer-dep\n      // zod-to-json-schema for backward compatibility.\n      const convert = await loadZodToJsonSchemaConverter()\n      jsonSchema = convert(validator)\n    }\n\n    const canonical = canonicalize(jsonSchema)\n    const hash = await sha256Hex(new TextEncoder().encode(canonical))\n    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt }\n  }\n\n  return {\n    _noydb_schema: 1,\n    kind,\n    jsonSchema: null,\n    hash: null,\n    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,\n    derivedAt,\n  }\n}\n"],"mappings":";;;;;AAWO,SAAS,aAAa,OAAwB;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,YAAY,EAAE,KAAK,GAAG,IAAI;AAAA,EACnD;AACA,QAAM,MAAM;AACZ,QAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;AACnC,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,MAAM,aAAa,IAAI,CAAC,CAAC,CAAC;AAC5E,SAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AACjC;;;ACAO,SAAS,YAAY,OAAyB;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,MAAO,MAAiD,WAAW;AACzE,MAAI,OAAO,OAAO,QAAQ,YAAa,IAA6B,WAAW,MAAO,QAAO;AAE7F,QAAM,MAAO,MAA4C;AACzD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,SAAO,OAAQ,IAA+B,aAAa,YACpD,IAA6B,SAAU,WAAW,KAAK;AAChE;AAEA,SAAS,WAAW,WAAyC;AAC3D,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,SAAO;AACT;AAUO,SAAS,aAAa,OAAyB;AACpD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,SAAO,UAAU;AACnB;AAMA,eAAe,+BAAgE;AAC7E,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,oBAAoB;AAC9C,QAAI,CAAC,IAAI,iBAAiB;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kKAEqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAOA,eAAe,qBAAsD;AACnE,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,mBAAK;AAC/B,QAAI,OAAO,IAAI,iBAAiB,YAAY;AAC1C,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,4FACqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,WACkC;AAClC,QAAM,OAAO,WAAW,SAAS;AACjC,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,MAAI,SAAS,OAAO;AAClB,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAI3B,YAAM,UAAU,MAAM,mBAAmB;AACzC,mBAAa,QAAQ,SAAS;AAAA,IAChC,OAAO;AAGL,YAAM,UAAU,MAAM,6BAA6B;AACnD,mBAAa,QAAQ,SAAS;AAAA,IAChC;AAEA,UAAM,YAAY,aAAa,UAAU;AACzC,UAAM,OAAO,MAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,EAAE,eAAe,GAAG,MAAM,YAAY,MAAM,UAAU;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ,yCAAyC,IAAI;AAAA,IACrD;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-UOEWDCUX.js

@@ -0,0 +1,69 @@
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  bufferToBase64
+} from "./chunk-TLJOJBZD.js";
+
+// src/kernel/enclave/classify/bidx.ts
+var subtle = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/kernel/enclave/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-UOEWDCUX.js.map

package/dist/chunk-UOEWDCUX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/bidx.ts","../src/kernel/enclave/classify/find.ts"],"sourcesContent":["/**\n * Blind-index slow-tag primitive for classified `equatable` fields (stage 2).\n *\n * `mintBidxTag` mints a deterministic, key-and-cost-gated tag —\n * `COST_BYTE ‖ HMAC-SHA256(K_idx, PBKDF2-SHA256(normalized, salt_cf))` — that\n * lets `find.ts` do blind equality lookup over an otherwise-opaque field\n * without ever storing the plaintext or a fast dictionary-crackable digest.\n *\n * Rationale (M-2/I3, spec §4/Crypto #1):\n *  - The outer HMAC is **keyed** by `K_idx`, a DEK-derived key never seen by\n *    the store. A key-less adversary (store access only) cannot mint a\n *    candidate tag to test against the index at all — the HMAC blocks the\n *    classic \"key-less dictionary attack\" a plain digest would invite.\n *  - The inner `pbkdf2VerifyDigest` (stage-2, `digest.ts`) reuses the\n *    existing 600K-iteration cost floor, so even a **DEK holder** who can\n *    compute `K_idx` still pays the PBKDF2 cost per guess — minting is not\n *    free just because you crossed the door.\n *  - Neither control is the real security boundary: the DOOR (who is ever\n *    handed the DEK to begin with) is. These two costs only shape the\n *    economics for whoever is already inside; they do not substitute for\n *    access control.\n *\n * `K_idx` and `salt_cf` are separate HKDF derivations off the same DEK\n * (L-1, #554 precedent: dedicated keys from day one, no shared/legacy form) —\n * sign-key hygiene, not `HMAC(K_idx, const)`. Both derivations are\n * domain-separated per `(collection, field)` so a tag cannot be replayed\n * across fields or collections (join-attack separation).\n *\n * `CURRENT_COST_BYTE` is a 1-byte discriminator prefixed onto every tag so a\n * future iteration-tier bump can mint new tags while old ones still parse:\n * an unknown discriminator is a cheap, immediate non-match instead of a\n * PBKDF2 run at the wrong iteration count.\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { bufferToBase64 } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the `K_idx` (blind-index HMAC key) derivation. */\nexport const CLASSIFY_INDEX_KEY_DOMAIN = 'noydb-classify-index-v1'\n\n/** HKDF salt domain for the `salt_cf` (per collection/field PBKDF2 salt) derivation. */\nexport const CLASSIFY_INDEX_SALT_DOMAIN = 'noydb-classify-index-salt-v1'\n\n/** Cost-byte discriminator: version 1, iteration-tier 600K. */\nexport const COST_BYTE_V1 = 0x01\n/** The cost byte new tags are minted at. */\nexport const CURRENT_COST_BYTE = COST_BYTE_V1\n\n/**\n * Map a tag's cost-byte discriminator to its PBKDF2 iteration count.\n * An unrecognized discriminator returns `null` — a mismatched/legacy byte\n * is a cheap non-match, never a PBKDF2 run at the wrong tier.\n */\nexport function iterationsForCostByte(b: number): number | null {\n  if (b === COST_BYTE_V1) return VDIG_ITERATIONS\n  return null\n}\n\n/**\n * Derive the collection+field's dedicated blind-index HMAC key `K_idx` from\n * the DEK via HKDF-SHA256. Non-extractable, `sign`-only — it never leaves\n * this module in usable form.\n */\nexport async function deriveClassifyIndexKey(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<EnclaveKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * Derive the collection+field's dedicated PBKDF2 salt `salt_cf` from the DEK\n * via a SEPARATE HKDF-deriveBits (distinct from {@link deriveClassifyIndexKey}\n * — sign-key hygiene, not `HMAC(K_idx, const)`). 32 raw bytes.\n */\nexport async function deriveClassifyIndexSalt(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<Uint8Array> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Mint a blind-index tag at a given cost byte:\n * `tag = base64(COST_BYTE ‖ HMAC(K_idx, PBKDF2(normalized, salt_cf, iterations-for(COST_BYTE))))`.\n * Factored out of {@link mintBidxTag} so `find.ts`'s `computeBidxTarget` can\n * reuse the same crypto at a caller-chosen cost byte (e.g. to evaluate a\n * legacy tier) without duplicating the derivation/digest/MAC pipeline.\n */\nexport async function mintAt(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte: number,\n): Promise<string> {\n  const iterations = iterationsForCostByte(costByte)\n  if (iterations == null) {\n    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`)\n  }\n  const saltCf = await deriveClassifyIndexSalt(dek, collection, field)\n  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations)\n  const kIdx = await deriveClassifyIndexKey(dek, collection, field)\n  const mac = await subtle.sign('HMAC', kIdx, inner as BufferSource)\n  const tag = new Uint8Array(1 + 32)\n  tag[0] = costByte\n  tag.set(new Uint8Array(mac), 1)\n  return bufferToBase64(tag)\n}\n\n/**\n * Mint a blind-index tag for an already-normalized value at\n * {@link CURRENT_COST_BYTE}. The caller normalizes once via\n * `normalizeForVerify` (the shared pipeline with `mintVdigSlot`) —\n * `mintBidxTag` never re-normalizes.\n */\nexport async function mintBidxTag(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<string> {\n  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE)\n}\n","/**\n * Query-side blind-index target derivation for classified `equatable`\n * fields (stage 2). `computeBidxTarget` normalizes a caller-supplied\n * candidate and mints it into the same 33-byte `_bidx` tag shape produced by\n * `mintBidxTag` (`bidx.ts`), so a caller can string-compare the result\n * against a stored tag to answer \"does this candidate match?\" without ever\n * decrypting or dictionary-attacking the field.\n *\n * Discriminator-scan contract (Oracle #4): a scanning caller reads each\n * stored tag's leading cost-byte discriminator and derives the target tag\n * **once per distinct discriminator present** — never per-record. `find.ts`\n * itself only computes a single target for a single requested `costByte`;\n * the batching-by-discriminator behavior belongs to the scanner\n * (`findByDigest`, a later task), which calls this function once per\n * distinct discriminator it encounters at step 2 of its scan.\n *\n * An unrecognized `costByte` (unknown or legacy tier not yet supported) is a\n * cheap `null` non-match — `computeBidxTarget` never runs PBKDF2 at a wrong\n * iteration tier just to produce a target that could not possibly match.\n * A legacy tag of a KNOWN older tier remains matchable today by passing that\n * tier's `costByte` explicitly (v1-only today: `CURRENT_COST_BYTE` is the\n * only recognized tier, so this is a future-proofing hook, not live behavior\n * yet).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { mintAt, iterationsForCostByte, CURRENT_COST_BYTE } from './bidx.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\n\n/**\n * Normalize `candidate` and mint it into a blind-index target tag at\n * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison\n * against a stored `_bidx` tag. Returns `null` when `costByte` is not a\n * recognized discriminator — no PBKDF2 is attempted at an unknown/wrong\n * tier (Oracle #4).\n */\nexport async function computeBidxTarget(\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte?: number,\n): Promise<string | null> {\n  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE\n  const iters = iterationsForCostByte(resolvedCostByte)\n  if (iters === null) return null\n  const normalized = normalizeForVerify(normalize, candidate)\n  return mintAt(normalized, dek, collection, field, resolvedCostByte)\n}\n"],"mappings":";;;;;;;;;;AAuCA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,eAAe;AAErB,IAAM,oBAAoB;AAO1B,SAAS,sBAAsB,GAA0B;AAC9D,MAAI,MAAM,aAAc,QAAO;AAC/B,SAAO;AACT;AAOA,eAAsB,uBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,yBAAyB;AAC/D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,2BAA2B,YAAY,KAAK,CAAC,CAAC;AACpG,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAOA,eAAsB,wBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,0BAA0B;AAChE,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,4BAA4B,YAAY,KAAK,CAAC,CAAC;AACrG,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AASA,eAAsB,OACpB,YACA,KACA,YACA,OACA,UACiB;AACjB,QAAM,aAAa,sBAAsB,QAAQ;AACjD,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,MAAM,6BAA6B,SAAS,SAAS,EAAE,CAAC,EAAE;AAAA,EACtE;AACA,QAAM,SAAS,MAAM,wBAAwB,KAAK,YAAY,KAAK;AACnE,QAAM,QAAQ,MAAM,mBAAmB,YAAY,QAAQ,UAAU;AACrE,QAAM,OAAO,MAAM,uBAAuB,KAAK,YAAY,KAAK;AAChE,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM,KAAqB;AACjE,QAAM,MAAM,IAAI,WAAW,IAAI,EAAE;AACjC,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC;AAC9B,SAAO,eAAe,GAAG;AAC3B;AAQA,eAAsB,YACpB,YACA,KACA,YACA,OACiB;AACjB,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,iBAAiB;AACrE;;;ACtGA,eAAsB,kBACpB,WACA,WACA,KACA,YACA,OACA,UACwB;AACxB,QAAM,mBAAmB,YAAY;AACrC,QAAM,QAAQ,sBAAsB,gBAAgB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,aAAa,mBAAmB,WAAW,SAAS;AAC1D,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,gBAAgB;AACpE;","names":[]}

package/dist/{chunk-5A6TC3RQ.js → chunk-VAWY44JW.js}

@@ -5,7 +5,11 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-2N4MUSF3.js";
+} from "./chunk-TB5RNNJ4.js";
+import {
+  NOYDB_FORMAT_VERSION,
+  NOYDB_KEYRING_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -16,11 +20,7 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION,
-  NOYDB_KEYRING_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -32,7 +32,7 @@ import {
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
   ValidationError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/kernel/validation.ts
 var WeakPassphraseError = class extends NoydbError {
@@ -759,4 +759,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-5A6TC3RQ.js.map
+//# sourceMappingURL=chunk-VAWY44JW.js.map