@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.4

package/dist/{stale-LX4BR43V.js → stale-7Q62KVI3.js}

@@ -3,7 +3,7 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-BYW7EU5L.js";
+} from "./chunk-HY6ZGGEC.js";
 import "./chunk-PZ5AY32C.js";
 export {
   clearMVStale,
@@ -11,4 +11,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-LX4BR43V.js.map
+//# sourceMappingURL=stale-7Q62KVI3.js.map

package/dist/stale-7Q62KVI3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/storage-5E6YB2JY.js

@@ -0,0 +1,21 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  savePersistedSchema
+} from "./chunk-CPXPHQGX.js";
+import "./chunk-OVO2RZAE.js";
+import "./chunk-QKVILR7N.js";
+import "./chunk-LN22XH4B.js";
+import "./chunk-PGFY7IRW.js";
+import "./chunk-TCIUO62Z.js";
+import "./chunk-UOEWDCUX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-TLJOJBZD.js";
+import "./chunk-U23JUUPX.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-5E6YB2JY.js.map

package/dist/storage-5E6YB2JY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{store-coordination-provider-KTRIC6PR.js → store-coordination-provider-JJCEMTAE.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-4NZCZUGL.js";
+} from "./chunk-YFF2RP3X.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-KTRIC6PR.js.map
+//# sourceMappingURL=store-coordination-provider-JJCEMTAE.js.map

package/dist/sync/index.d.ts

@@ -1,6 +1,6 @@
-import { cr as SyncStrategy } from '../index-D05bV0_g.js';
+import { cr as SyncStrategy } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/sync/index.js

@@ -2,14 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-LHYQE3BP.js";
+} from "../chunk-OFBFAVLI.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-5EZAJEES.js";
-import "../chunk-6RASM2J4.js";
-import "../chunk-CPAROOKP.js";
-import "../chunk-L4IRFTIF.js";
-import "../chunk-OCDUQUAP.js";
-import "../chunk-BLZRNHMG.js";
+import "../chunk-OVO2RZAE.js";
+import "../chunk-QKVILR7N.js";
+import "../chunk-LN22XH4B.js";
+import "../chunk-PGFY7IRW.js";
+import "../chunk-TCIUO62Z.js";
+import "../chunk-UOEWDCUX.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-TLJOJBZD.js";
+import "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.d.ts

@@ -1,10 +1,24 @@
-import { cT as NoydbStore, cF as UnlockedKeyring } from '../index-D05bV0_g.js';
-export { e1 as BundleRecipient, fy as EnrollAuthenticatorOptions, fz as EnrollAuthenticatorWrappingDEKsOptions, fA as EnrollAuthenticatorWrappingKEKOptions, gx as ListUsersOptions, hk as PaperRecoveryEntry, hw as PresenceHandle, h_ as RecoverPassphraseInput, h$ as RecoverPassphraseResult, i0 as RecoverUserOptions, i3 as RecoveryProof, ig as RotatePassphraseInput, iO as SlotRewrapCeremony, iP as SlotRewrapContext, iY as SyncEngine, j4 as SyncTransaction, jo as UpdateAuthenticatorOptions, jF as WrappedDeksBlob, jQ as buildRecipientKeyringFile, jR as burnPaperRecoveryEntry, l4 as changeSecret, l5 as createOwnerKeyring, jX as deriveMagicLinkContentKey, j$ as enrollAuthenticator, l6 as ensureCollectionDEK, k3 as evaluateExportCapability, k5 as evaluateImportCapability, k8 as findAuthenticator, l7 as grant, k9 as hasExportCapability, ka as hasImportCapability, kd as isMagicLinkGrantExpired, km as listMagicLinkGrants, kn as listUsers, ko as listUsersWithEnvelopes, l8 as loadKeyring, kr as loadPaperRecoveryEntries, ku as magicLinkGrantRecordId, kv as mintPaperRecoveryEntry, kx as mintWrappedDeksBlob, l9 as persistKeyring, kC as readMagicLinkGrantRecord, kj as recoverPassphrase, kE as recoverUser, kI as removeAuthenticator, la as revoke, kO as revokeMagicLinkGrant, kk as rotatePassphrase, kQ as savePaperRecoveryEntries, kU as unwrapDeksFromBlob, kV as unwrapDeksFromPaperEntry, kX as unwrapMagicLinkGrant, lb as updateAuthenticator, lc as updateKeyringIdentity, l3 as writeMagicLinkGrant } from '../index-D05bV0_g.js';
+import { je as TeamStrategy, cT as NoydbStore, cF as UnlockedKeyring } from '../index-D4GQe1Rx.js';
+export { e1 as BundleRecipient, fz as EnrollAuthenticatorOptions, fA as EnrollAuthenticatorWrappingDEKsOptions, fB as EnrollAuthenticatorWrappingKEKOptions, gy as ListUsersOptions, h3 as NO_TEAM, hl as PaperRecoveryEntry, hx as PresenceHandle, h$ as RecoverPassphraseInput, i0 as RecoverPassphraseResult, i1 as RecoverUserOptions, i4 as RecoveryProof, ih as RotatePassphraseInput, iP as SlotRewrapCeremony, iQ as SlotRewrapContext, iZ as SyncEngine, j5 as SyncTransaction, jd as TeamNotEnabledError, jr as UpdateAuthenticatorOptions, jI as WrappedDeksBlob, jT as buildRecipientKeyringFile, jU as burnPaperRecoveryEntry, l7 as changeSecret, l8 as createOwnerKeyring, j_ as deriveMagicLinkContentKey, k2 as enrollAuthenticator, l9 as ensureCollectionDEK, k6 as evaluateExportCapability, k8 as evaluateImportCapability, kb as findAuthenticator, la as grant, kc as hasExportCapability, kd as hasImportCapability, kg as isMagicLinkGrantExpired, kp as listMagicLinkGrants, kq as listUsers, kr as listUsersWithEnvelopes, lb as loadKeyring, ku as loadPaperRecoveryEntries, kx as magicLinkGrantRecordId, ky as mintPaperRecoveryEntry, kA as mintWrappedDeksBlob, lc as persistKeyring, kF as readMagicLinkGrantRecord, km as recoverPassphrase, kH as recoverUser, kL as removeAuthenticator, ld as revoke, kR as revokeMagicLinkGrant, kn as rotatePassphrase, kT as savePaperRecoveryEntries, kX as unwrapDeksFromBlob, kY as unwrapDeksFromPaperEntry, k_ as unwrapMagicLinkGrant, le as updateAuthenticator, lf as updateKeyringIdentity, l6 as writeMagicLinkGrant } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
+/**
+ * Enable the multi-user team capability (#267 Track A tail).
+ *
+ * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /
+ * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines
+ * are statically imported HERE — this module is reachable only through the
+ * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable
+ * re-export), so a single-user floor bundle never carries them. The facade
+ * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +
+ * keyring plumbing and receives the engine as an argument.
+ */
+
+declare function withTeam(): TeamStrategy;
+
 /**
  * _sync_credentials reserved collection —
  *
@@ -113,4 +127,4 @@ declare function credentialStatus(adapter: NoydbStore, vault: string, keyring: U
     expired: boolean;
 }>;
 
-export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential };
+export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, TeamStrategy, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential, withTeam };

package/dist/team/index.js

@@ -4,9 +4,11 @@ import {
   deleteCredential,
   getCredential,
   listCredentials,
-  putCredential
-} from "../chunk-NIA5VQ7G.js";
+  putCredential,
+  withTeam
+} from "../chunk-TVRQ3RYH.js";
 import {
+  NO_TEAM,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
@@ -22,7 +24,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-OVIVYAQL.js";
+} from "../chunk-K5P46KB3.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -31,14 +33,14 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-IJW6K6UX.js";
-import "../chunk-O5DNEXQC.js";
+} from "../chunk-LPRPVCNY.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-LHYQE3BP.js";
+} from "../chunk-OFBFAVLI.js";
 import "../chunk-VQNJ7UZL.js";
+import "../chunk-BMQOH7MM.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -55,20 +57,27 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-5A6TC3RQ.js";
-import "../chunk-2N4MUSF3.js";
-import "../chunk-5EZAJEES.js";
-import "../chunk-6RASM2J4.js";
-import "../chunk-CPAROOKP.js";
-import "../chunk-L4IRFTIF.js";
-import "../chunk-OCDUQUAP.js";
-import "../chunk-BLZRNHMG.js";
+} from "../chunk-VAWY44JW.js";
+import "../chunk-TB5RNNJ4.js";
+import "../chunk-OVO2RZAE.js";
+import "../chunk-QKVILR7N.js";
+import "../chunk-LN22XH4B.js";
+import "../chunk-PGFY7IRW.js";
+import "../chunk-TCIUO62Z.js";
+import "../chunk-UOEWDCUX.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-TLJOJBZD.js";
+import {
+  TeamNotEnabledError
+} from "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 export {
+  NO_TEAM,
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,
   SyncEngine,
   SyncTransaction,
+  TeamNotEnabledError,
   buildRecipientKeyringFile,
   burnPaperRecoveryEntry,
   changeSecret,
@@ -110,6 +119,7 @@ export {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   updateKeyringIdentity,
+  withTeam,
   writeMagicLinkGrant
 };
 //# sourceMappingURL=index.js.map

package/dist/tiers/index.d.ts

@@ -1,5 +1,5 @@
-export { li as NO_TIERS, lj as TiersContext, jf as TiersNotEnabledError, lk as TiersStrategy, ll as assertDeclaredTier, lm as assertTiersEnabled, ln as classifySealedShred, lo as demote, lp as elevate, lq as getAtTier, lr as listAtTier, ls as putAtTier, lt as withTiers } from '../index-D05bV0_g.js';
+export { lm as NO_TIERS, ln as TiersContext, ji as TiersNotEnabledError, lo as TiersStrategy, lp as assertDeclaredTier, lq as assertTiersEnabled, lr as classifySealedShred, ls as demote, lt as elevate, lu as getAtTier, lv as listAtTier, lw as putAtTier, lx as withTiers } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -9,16 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-4DZGZ7II.js";
-import "../chunk-O5DNEXQC.js";
-import "../chunk-5EZAJEES.js";
-import "../chunk-6RASM2J4.js";
-import "../chunk-CPAROOKP.js";
-import "../chunk-L4IRFTIF.js";
-import "../chunk-OCDUQUAP.js";
+} from "../chunk-VMJ5URU7.js";
+import "../chunk-BMQOH7MM.js";
+import "../chunk-OVO2RZAE.js";
+import "../chunk-QKVILR7N.js";
+import "../chunk-LN22XH4B.js";
+import "../chunk-PGFY7IRW.js";
+import "../chunk-TCIUO62Z.js";
+import "../chunk-UOEWDCUX.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-TLJOJBZD.js";
 import {
   TiersNotEnabledError
-} from "../chunk-BLZRNHMG.js";
+} from "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.d.ts

@@ -1,5 +1,5 @@
-export { dq as BundleVersionConflictError, e$ as ConflictError, cV as EncryptedEnvelope, gw as ListPageResult, h2 as NetworkError, h8 as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iV as StoreCapabilities, iW as StoreCapabilityError, iX as StoreTime, jj as TxOp, jy as VaultSnapshot } from '../index-D05bV0_g.js';
+export { dq as BundleVersionConflictError, f0 as ConflictError, cV as EncryptedEnvelope, gx as ListPageResult, h4 as NetworkError, ha as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iW as StoreCapabilities, iX as StoreCapabilityError, iY as StoreTime, jm as TxOp, jB as VaultSnapshot } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/to/index.js

@@ -5,7 +5,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-BLZRNHMG.js";
+} from "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/{transition-guard-C1Pyz8nH.d.ts → transition-guard-C4hvR-Ac.d.ts}

@@ -1,4 +1,4 @@
-import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-D05bV0_g.js';
+import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-D4GQe1Rx.js';
 
 /**
  * Register a guard for a collection. Guards run on every `put()` /

package/dist/tx/index.d.ts

@@ -1,7 +1,7 @@
-import { jg as TransactionInvariant, ld as TxStrategy } from '../index-D05bV0_g.js';
-export { le as AmendmentTxOptions, ji as TxCollection, e4 as TxContext, jk as TxVault, kP as runTransaction } from '../index-D05bV0_g.js';
+import { jj as TransactionInvariant, lh as TxStrategy } from '../index-D4GQe1Rx.js';
+export { li as AmendmentTxOptions, jl as TxCollection, e4 as TxContext, jn as TxVault, kS as runTransaction } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-4NMFWOS2.js";
+} from "../chunk-T65UZXR6.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-BLZRNHMG.js";
+import "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-IKT47SH2.js");
+      const { GuardExecutor } = await import("../executor-DJHNSTIR.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/ui/index.d.ts

@@ -1 +1 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-0tiXAjoO.js';
+export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-C6iHNlqJ.js';

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-BLZRNHMG.js";
+} from "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/validators-Ctgkj5qd.d.ts

@@ -0,0 +1,101 @@
+import { dO as ClassifiedEntry, dL as ClassifiedFieldSpec, dP as ClassifiedGroup } from './index-D4GQe1Rx.js';
+
+/**
+ * Configuration/write errors for classified fields. @module
+ *
+ * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
+ * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
+ * with-*. Re-exported here under the same names so existing import paths
+ * keep working.
+ */
+
+declare class ClassifiedNeverStoredError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string);
+}
+declare class ClassifiedValidationError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}
+
+/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */
+
+interface ResolvedClassified {
+    readonly byField: Record<string, ClassifiedFieldSpec>;
+    readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>;
+}
+declare function resolveClassifiedFields(collection: string, config: Record<string, ClassifiedEntry>): ResolvedClassified;
+
+/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative
+ *  knobs, not read-side callbacks (design law D2/D3). @module */
+
+declare const classified: {
+    /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
+    creditCard(fields: {
+        pan: string;
+        expiry?: string;
+        cvc?: string;
+    }): ClassifiedGroup;
+    birthDate(): ClassifiedFieldSpec;
+    email(): ClassifiedFieldSpec;
+    phone(): ClassifiedFieldSpec;
+    /** Digest-only password: verify-without-reveal; never listed, never revealed.
+     *  Enumeration math is on the caller for low-entropy values — see the
+     *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
+     *
+     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+     *  `findByDigest`). Cost band you are accepting:
+     *
+     *  equal values produce equal store-visible tags: anyone with store access
+     *  learns which records share this secret and how many share each value —
+     *  never the value itself. A collection-DEK holder can additionally test
+     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+     *  answers) offline recovery of the equality partition is seconds-to-hours, not
+     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+     *  hardest primitive available; the iteration count raises the price but does
+     *  not make a low-entropy field safe. The real control for low-entropy fields
+     *  is the DOOR — do not enable `equatable` for them unless the partition being
+     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+     *  tags. */
+    password(opts?: {
+        minLength?: number;
+        rotateDays?: number;
+        notLastN?: number;
+        equatable?: true;
+    }): ClassifiedFieldSpec;
+    /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
+     *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
+     *  enumeration math to your users; add app-side rate limiting.
+     *
+     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+     *  `findByDigest`). Cost band you are accepting:
+     *
+     *  equal values produce equal store-visible tags: anyone with store access
+     *  learns which records share this secret and how many share each value —
+     *  never the value itself. A collection-DEK holder can additionally test
+     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+     *  answers) offline recovery of the equality partition is seconds-to-hours, not
+     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+     *  hardest primitive available; the iteration count raises the price but does
+     *  not make a low-entropy field safe. The real control for low-entropy fields
+     *  is the DOOR — do not enable `equatable` for them unless the partition being
+     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+     *  tags. */
+    secretAnswer(opts?: {
+        equatable?: true;
+    }): ClassifiedFieldSpec;
+};
+
+/** Pure write-time validators. Exported so userland can validate storage:'never'
+ *  fields (e.g. CVC) at capture, before dropping them. @module */
+declare function luhnCheck(pan: string): boolean;
+
+export { ClassifiedNeverStoredError as C, type ResolvedClassified as R, ClassifiedValidationError as a, classified as c, luhnCheck as l, resolveClassifiedFields as r };

package/dist/{vault-diff-Fn0WeY2w.d.ts → vault-diff-B1Ir6EGs.d.ts}

@@ -1,4 +1,4 @@
-import { V as Vault, cE as DiffEntry } from './index-D05bV0_g.js';
+import { V as Vault, cE as DiffEntry } from './index-D4GQe1Rx.js';
 
 /**
  * Vault-level diff orchestrator.

package/dist/{verify-SW6J63Q2.js → verify-YB5LQHNA.js}

@@ -1,20 +1,24 @@
 import {
-  VDIG_ITERATIONS,
   blindedEqual,
   evaluateKofN,
+  openVdigPayload
+} from "./chunk-PGFY7IRW.js";
+import {
+  dualReadSealedSlot
+} from "./chunk-TCIUO62Z.js";
+import {
+  VDIG_ITERATIONS,
   normalizeForVerify,
-  openVdigPayload,
   pbkdf2VerifyDigest
-} from "./chunk-CPAROOKP.js";
+} from "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
-  dualReadSealedSlot,
   generateSalt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -132,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-SW6J63Q2.js.map
+//# sourceMappingURL=verify-YB5LQHNA.js.map

package/dist/{verify-SW6J63Q2.js.map → verify-YB5LQHNA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && blob !== undefined) {\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const env = await ctx.getEnvelope(id)\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,KAAM,QAAO,SAAS;AAClC,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}
+{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && blob !== undefined) {\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const env = await ctx.getEnvelope(id)\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,KAAM,QAAO,SAAS;AAClC,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}