@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.9

package/dist/{chunk-J54DC5IC.js → chunk-4G3IT7J7.js}

@@ -1,15 +1,15 @@
 import {
   isTombstone
-} from "./chunk-HGQ6UNHE.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-Z5YFRMG5.js";
 import {
   decrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-commit/history/history.ts
 var HISTORY_COLLECTION = "_history";
@@ -277,4 +277,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-J54DC5IC.js.map
+//# sourceMappingURL=chunk-4G3IT7J7.js.map

package/dist/{chunk-WJEMUO32.js → chunk-4RQ62VSR.js}

@@ -30,7 +30,7 @@ async function resolveStaleMVOnRead(accessor, outputCollection) {
       continue;
     }
     if (executor === null) {
-      ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
+      ({ MaterializedViewExecutor: executor } = await import("./executor-IL7SRNUZ.js"));
     }
     await executor.refresh(reg, {
       getCollection: (n) => accessor.getCollection(n),
@@ -50,4 +50,4 @@ export {
   resolveStaleMVOnRead,
   clearMVStale
 };
-//# sourceMappingURL=chunk-WJEMUO32.js.map
+//# sourceMappingURL=chunk-4RQ62VSR.js.map

package/dist/{chunk-QAVFI23O.js → chunk-4ZSGSRBI.js}

@@ -1,9 +1,6 @@
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -15,11 +12,14 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   ConflictError,
   NotFoundError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-shape/blobs/mime-magic.ts
 function hex(s) {
@@ -1155,7 +1155,7 @@ var BlobSet = class {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-7X5BUAMS.js");
+    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-EUBEJGPG.js");
     const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const body = new ReadableStream({
@@ -1218,4 +1218,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-QAVFI23O.js.map
+//# sourceMappingURL=chunk-4ZSGSRBI.js.map

package/dist/{chunk-C4NOLA5X.js → chunk-5GAX2QOH.js}

@@ -1,6 +1,6 @@
 import {
   readPath
-} from "./chunk-6P5AJ2ZS.js";
+} from "./chunk-KCG3BHFG.js";
 
 // src/with-lookup/indexing/eager-indexes.ts
 var CollectionIndexes = class {
@@ -129,4 +129,4 @@ function removeFromIndex(idx, id, record) {
 export {
   CollectionIndexes
 };
-//# sourceMappingURL=chunk-C4NOLA5X.js.map
+//# sourceMappingURL=chunk-5GAX2QOH.js.map

package/dist/{chunk-IEKK2XI4.js → chunk-5SAZMBW7.js}

@@ -1,19 +1,19 @@
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   ConflictError,
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-commit/sequence/strategy.ts
 var NO_SEQUENCE = {
@@ -199,4 +199,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-IEKK2XI4.js.map
+//# sourceMappingURL=chunk-5SAZMBW7.js.map

package/dist/{chunk-II6DLDZM.js → chunk-5TZZUL5X.js}

@@ -1,6 +1,6 @@
 import {
   PortabilityNotEnabledError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-audit/portability/strategy.ts
 var NO_PORTABILITY = {
@@ -27,4 +27,4 @@ var NO_PORTABILITY = {
 export {
   NO_PORTABILITY
 };
-//# sourceMappingURL=chunk-II6DLDZM.js.map
+//# sourceMappingURL=chunk-5TZZUL5X.js.map

package/dist/{chunk-GMZFHDSG.js → chunk-6CU3FN74.js}

@@ -5,11 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-3CHNKEFI.js";
-import {
-  NOYDB_FORMAT_VERSION,
-  NOYDB_KEYRING_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-E5AHO65E.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -20,7 +16,11 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION,
+  NOYDB_KEYRING_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -32,7 +32,7 @@ import {
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/kernel/validation.ts
 var WeakPassphraseError = class extends NoydbError {
@@ -774,4 +774,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-GMZFHDSG.js.map
+//# sourceMappingURL=chunk-6CU3FN74.js.map

package/dist/chunk-6G2SCQYS.js

@@ -0,0 +1,29 @@
+import {
+  NoydbError
+} from "./chunk-CU62BBRB.js";
+
+// src/kernel/via.ts
+var binders = /* @__PURE__ */ new Map();
+function installViaBinder(brand, binder) {
+  if (!binders.has(brand)) binders.set(brand, binder);
+}
+function isViaInstalled(brand) {
+  return binders.has(brand);
+}
+function viaBinder(brand) {
+  const b = binders.get(brand);
+  if (!b) {
+    throw new NoydbError(
+      "VIA_NOT_LINKED",
+      `via feature "${brand}" requires descriptors created via its declaration factory from @noy-db/hub`
+    );
+  }
+  return b;
+}
+
+export {
+  installViaBinder,
+  isViaInstalled,
+  viaBinder
+};
+//# sourceMappingURL=chunk-6G2SCQYS.js.map

package/dist/chunk-6G2SCQYS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via.ts"],"sourcesContent":["// kernel/via.ts — the ONLY kernel-resident via surface.\nimport { NoydbError } from './errors.js'\nimport type { EncryptedEnvelope } from './types.js'\n\n/** Awaitable type for potentially async results. */\ntype Awaitable<T> = T | Promise<T>\n\n/** Declared security posture — a property the kernel enforces (enforcement activates in phases B/C). */\nexport interface ViaPosture {\n  readonly encryptedAtRest: 'envelope' | 'sealed'\n  readonly queryable: 'none' | 'det-exact' | 'ordered' | 'full'\n  readonly exportable: boolean\n  readonly forgettable: boolean\n}\n\n/** Opaque marker every feature descriptor extends; the kernel never sees concrete descriptor types. */\nexport interface ViaDescriptor { readonly _viaBrand: string }\n\n/** Per-call write context (A: minimal; B/C extend). */\nexport interface ViaWriteCtx {\n  readonly id: string\n  /** Owning vault name (event payload identity — e.g. i18n:script-violation). */\n  readonly vault: string\n  /** Prior stored record (decoded), lazily resolved. Null when creating. */\n  readonly prior: () => Promise<Record<string, unknown> | null>\n  /** Typed event emission (e.g. i18n:script-violation). */\n  readonly emit: (event: string, payload: unknown) => void\n}\n\n/** Per-call read context — mirrors LocaleReadOptions loosely; features narrow. */\nexport interface ViaReadCtx {\n  readonly locale?: unknown\n  readonly fallback?: unknown\n  readonly layer: string\n}\n\n/** One sealed slot's ciphertext — matches the existing `iv:data` sealed map entries (seam map §2 step 2). */\nexport interface SealedSlotRef { readonly iv: string; readonly data: string }\n\n/**\n * A scoped crypto capability handed to a `via` feature's `encodeAtRest`/\n * `decodeAtRest`/`erase` hooks — never the keyring, never the enclave.\n * `sealedSlots` is pre-bound to one `(collection, recordId)`; `reservedEnvelopes`\n * is a whole-envelope encrypt/decrypt door scoped to collection names under a\n * declared prefix (e.g. `_dict_`).\n */\nexport interface ViaCryptoCtx {\n  readonly sealedSlots: {\n    seal(field: string, plaintext: unknown): Promise<SealedSlotRef>\n    unseal(field: string, ref: SealedSlotRef): Promise<unknown>\n    delete(field: string): Promise<void>\n  }\n  reservedEnvelopes(prefix: string): {\n    encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>\n    decrypt(collection: string, env: EncryptedEnvelope): Promise<string>\n  }\n}\n\n/** Per-call erase context — `forget()`'s per-ref participation door (phase C). */\nexport interface ViaEraseCtx { readonly id: string; readonly vault: string; readonly live: unknown /* EncryptedEnvelope */; readonly crypto: ViaCryptoCtx }\n/**\n * What an `erase` hook reports back to `forget()`'s summary ledger entry.\n * `retainedShared` is additive (#629 Task 10) — content NOT erased because\n * still referenced by another live record (blob's shared-chunk dual\n * accounting, `shredAllForRecord()`'s `retainedShared` count). Absent/0 for\n * bindings with no such concept (a sealed field is never \"shared\").\n */\nexport interface ViaEraseReport { readonly shredded: number; readonly residue: readonly unknown[]; readonly retainedShared?: number }\n\n/**\n * A feature bound to one collection's declared config. Record-grain hooks —\n * every hook receives the whole record (matches the real engine signatures,\n * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;\n * absent = passthrough. Query-participation hooks are SYNC (#553).\n */\nexport interface ViaBinding {\n  readonly brand: string\n  readonly posture: ViaPosture\n  /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future\n   *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,\n   *  reference declared fields) and graph-registers a derived edge for each covered\n   *  field at declare time, right after `compileViaBindings` builds the bindings\n   *  (unknown source field throws `ValidationError`). See\n   *  `kernel/collection-config.ts`'s `resolveViaBindingDepsEdges`. */\n  readonly deps?: readonly string[]\n  /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */\n  readonly reservedPrefixes?: readonly string[]\n  /**\n   * Does this binding own `field`? Backs `ViaPipeline.postureFor` (#629 Task\n   * 8's posture consumer) — a passive coverage check, independent of\n   * `buildClause`/`compareForOrder` (which some bindings, e.g. classified and\n   * blob, never define). SYNC, no side effects.\n   *\n   * Contract (documentation only — not enforced at runtime, future work):\n   * any binding declaring a non-default posture value — `queryable: 'none'`\n   * (#629 Task 8) or `exportable: false` (#629 Task 9's `redactForExport`)\n   * — MUST implement `covers()`. `postureFor`'s consumers only engage for\n   * fields a binding actively claims via `covers()`; a binding that omits\n   * it would silently fall through to the generic (unrefused/unredacted)\n   * path instead.\n   */\n  covers?(field: string): boolean\n  // NOTE: phase C adds a `derive` hook ADDITIVELY — do not stub it now.\n  // ── write pipeline ──\n  /** Refuse a write before crypto runs (classified step-3 slot: storage:'never' rejection + validators). Throws to refuse. */\n  enforceWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): void | Promise<void>\n  /** First pipeline stage (money canonicalizeIncomingMoney). SYNC. */\n  ingest?(record: Record<string, unknown>): Record<string, unknown>\n  /** Decode STORED form to canonical for internal boundaries (gates, derivations, patch bases). SYNC. */\n  canonicalizeStored?(record: Record<string, unknown>): Record<string, unknown>\n  /** Post-validation write encoding (money quantize; i18n translate→script→validate→densify). May be async. */\n  encodeWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): Awaitable<Record<string, unknown>>\n  /** Final write-pipeline stage: seal/encrypt declared fields via `crypto` before the envelope body is built (classified step-2 slot). */\n  encodeAtRest?(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }>\n  // ── read pipeline ──\n  /** First read-pipeline stage: unseal/decrypt declared fields via `crypto` before `present` runs (classified sealed-handle slot). */\n  decodeAtRest?(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: { asHandles: boolean }): Promise<Record<string, unknown>>\n  /** Read-time presentation (money decode+virtuals; i18n locale/labels/strip). May be async. */\n  present?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  // ── query participation (ALL SYNC — #553) ──\n  /** Returns an opaque clause payload when this binding covers `field`, else undefined. */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  buildClause?(field: string, op: string, value: unknown): unknown | undefined\n  /** Evaluate a payload produced by buildClause against a raw stored value. */\n  evaluateClause?(actual: unknown, op: string, payload: unknown): boolean\n  /** Decode a raw stored record for query/scan results and callback views ('raw' — no virtuals). */\n  decodeResults?(record: unknown): unknown\n  /** Exact ordering for a covered field; undefined when the field is not covered. */\n  compareForOrder?(field: string, a: unknown, b: unknown): number | undefined\n  /**\n   * Per-key, PER-CALL-locale label resolution for `orderBy(field, dir,\n   * { by: 'label' })` (#650 Task 7) — the sibling `compareForOrder` above\n   * structurally cannot serve, since it carries no locale parameter.\n   * `locale` is the query's per-call locale (`undefined` for a locale-less\n   * query — a binding may fall back to its own descriptor-level default,\n   * mirroring `present`'s displayLocale hinge). `undefined` return = this\n   * binding doesn't resolve a label for `key` at `field` — caller falls\n   * back to the raw stored value, same graceful-degrade discipline every\n   * other via query hook uses. SYNC (#553 — query participation).\n   */\n  resolveOrderLabel?(field: string, key: string, locale: string | undefined): string | undefined\n  /** Rewrite an aggregate spec (money exact reducers). */\n  wrapReducers?(spec: unknown): unknown\n  // ── forget participation ──\n  /** `forget()`'s per-ref erasure door — shred/report this binding's residue for one record (classified/blob forget participation). */\n  erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>\n  // ── introspection ──\n  describeFragment?(): Record<string, unknown>\n}\n\n/** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */\nexport type ViaBinder = (config: unknown) => ViaBinding\n\nconst binders = new Map<string, ViaBinder>()\n\n/** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */\nexport function installViaBinder(brand: string, binder: ViaBinder): void {\n  if (!binders.has(brand)) binders.set(brand, binder)\n}\n\n/** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */\nexport function isViaInstalled(brand: string): boolean {\n  return binders.has(brand)\n}\n\n/** @internal — resolve a binder; throws when the declaration factory never ran (hand-rolled descriptors). */\nexport function viaBinder(brand: string): ViaBinder {\n  const b = binders.get(brand)\n  if (!b) {\n    throw new NoydbError(\n      'VIA_NOT_LINKED',\n      `via feature \"${brand}\" requires descriptors created via its declaration factory from @noy-db/hub`,\n    )\n  }\n  return b\n}\n"],"mappings":";;;;;AAyJA,IAAM,UAAU,oBAAI,IAAuB;AAGpC,SAAS,iBAAiB,OAAe,QAAyB;AACvE,MAAI,CAAC,QAAQ,IAAI,KAAK,EAAG,SAAQ,IAAI,OAAO,MAAM;AACpD;AAGO,SAAS,eAAe,OAAwB;AACrD,SAAO,QAAQ,IAAI,KAAK;AAC1B;AAGO,SAAS,UAAU,OAA0B;AAClD,QAAM,IAAI,QAAQ,IAAI,KAAK;AAC3B,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-UWZ7O4NR.js → chunk-6MWUANRF.js}

@@ -2,7 +2,7 @@ import {
   decrypt,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 
 // src/kernel/enclave/record-keys/sealed-slot.ts
 function parseSealedSlot(blob) {
@@ -26,4 +26,4 @@ export {
   parseSealedSlot,
   dualReadSealedSlot
 };
-//# sourceMappingURL=chunk-UWZ7O4NR.js.map
+//# sourceMappingURL=chunk-6MWUANRF.js.map

package/dist/{chunk-U7LV2DUN.js → chunk-6ULCYCMU.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-U7LV2DUN.js.map
+//# sourceMappingURL=chunk-6ULCYCMU.js.map