@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-25G7PUTA.js

@@ -1,235 +0,0 @@
-import {
-  resolveManagedSecret
-} from "./chunk-P2PEPSPK.js";
-import {
-  parseExtractedPartitionBody,
-  readPod,
-  readPodHeader
-} from "./chunk-BJ2XF2RC.js";
-import {
-  createOwnerKeyring
-} from "./chunk-TUL5YQWF.js";
-import {
-  LedgerStore
-} from "./chunk-3YKBGS3I.js";
-import {
-  LEDGER_COLLECTION
-} from "./chunk-I7FD46FF.js";
-import {
-  openEnvelopeJson
-} from "./chunk-7TAV3BFQ.js";
-import {
-  base64ToBuffer,
-  wrapKey
-} from "./chunk-5HZULLHE.js";
-import {
-  AdoptionStateError,
-  TransferSealError,
-  ValidationError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-cargo/adopt-partition.ts
-async function unsealDeks(seal, transferKey) {
-  if (transferKey.byteLength !== 32) {
-    throw new TransferSealError(
-      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
-    );
-  }
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
-  const raw = base64ToBuffer(seal.payload);
-  let plaintext;
-  try {
-    plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: raw.slice(0, 12) },
-      key,
-      raw.slice(12)
-    );
-  } catch {
-    throw new TransferSealError(
-      "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
-    );
-  }
-  let dekMap;
-  try {
-    dekMap = JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
-  }
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collection, b64] of Object.entries(dekMap)) {
-    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
-    deks.set(collection, dek);
-  }
-  return deks;
-}
-async function adoptPartition(bundleBytes, opts) {
-  const { transferKey, destinationStore, vaultName } = opts;
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new ValidationError(
-      "adoptPartition requires an extracted-partition bundle with a transfer seal. For ordinary backups use readPod + vault.load."
-    );
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  await unsealDeks(seal, transferKey);
-  const existing = await destinationStore.get(vaultName, "_meta", "adoption");
-  if (existing) {
-    const prior = JSON.parse(existing._data);
-    if (prior.sealId === seal.sealId) {
-      throw new AdoptionStateError(
-        `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
-      );
-    }
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds an adopted partition (sealId ${prior.sealId}); adopting a different partition (sealId ${seal.sealId}) here would overwrite it. Adopt into a fresh vaultName instead.`
-    );
-  }
-  const existingKeyring = await destinationStore.list(vaultName, "_keyring");
-  if (existingKeyring.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already holds a keyring (an unrelated owner exists at this slot); adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`
-    );
-  }
-  const backup = JSON.parse(dump);
-  await destinationStore.saveAll(vaultName, backup.collections);
-  if (backup._internal) {
-    for (const [collection, records] of Object.entries(backup._internal)) {
-      for (const [id, envelope] of Object.entries(records)) {
-        await destinationStore.put(vaultName, collection, id, envelope);
-      }
-    }
-  }
-  const adoptedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true, transferSeal: seal };
-  await destinationStore.put(vaultName, "_meta", "adoption", {
-    _noydb: 1,
-    _v: 1,
-    _ts: adoptedAt,
-    _iv: "",
-    _data: JSON.stringify(adoption)
-  });
-  return { vaultName, needsOwner: true, sealId: seal.sealId };
-}
-function isManaged(o) {
-  return "passphraseMode" in o && o.passphraseMode === "managed";
-}
-async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
-  const { userId, transferKey } = opts;
-  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === "shamir")) {
-    throw new AdoptionStateError(
-      "managed-mode adoption requires at least one strong (shamir) recovery profile in `recovery` \u2014 paper alone is not strong when there is no user passphrase to fall back on."
-    );
-  }
-  const adoptionEnv = await store.get(vaultName, "_meta", "adoption");
-  if (!adoptionEnv) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
-    );
-  }
-  const adoption = JSON.parse(adoptionEnv._data);
-  if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
-    );
-  }
-  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey);
-  const existingKeyring = await store.get(vaultName, "_keyring", userId);
-  const otherOwners = (await store.list(vaultName, "_keyring")).filter((u) => u !== userId);
-  if (otherOwners.length > 0) {
-    throw new AdoptionStateError(
-      `vault "${vaultName}" already has a keyring for a different owner; cannot create owner "${userId}".`
-    );
-  }
-  const partitionCollections = [...partitionDeks.keys()];
-  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
-  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
-  if (!ownerMinted) {
-    const passphrase = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.passphrase;
-    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase);
-    const env = await store.get(vaultName, "_keyring", userId);
-    if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
-    const keyringFile = JSON.parse(env._data);
-    const kek = unlocked.kek;
-    if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
-    const mergedDeks = { ...keyringFile.deks };
-    for (const [collection, dek] of partitionDeks) {
-      mergedDeks[collection] = await wrapKey(dek, kek);
-    }
-    const mergedFile = { ...keyringFile, deks: mergedDeks };
-    await store.put(vaultName, "_keyring", userId, { ...env, _data: JSON.stringify(mergedFile) });
-  }
-  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION);
-  if (ledgerDek) {
-    const ledger = new LedgerStore({
-      adapter: store,
-      vault: vaultName,
-      encrypted: true,
-      getDEK: async () => ledgerDek,
-      actor: userId
-    });
-    const creationReason = `creation-of-new-owner:${userId}`;
-    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`;
-    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason));
-    if (!recordedReasons.has(creationReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: creationReason });
-    }
-    if (!recordedReasons.has(consumedReason)) {
-      await ledger.append({ op: "lifecycle", collection: "", id: "", version: 0, actor: "", payloadHash: "", reason: consumedReason });
-    }
-  }
-  if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-POVTIVQ6.js");
-    const db = await createNoydb({
-      store,
-      user: userId,
-      passphraseMode: "managed",
-      sealingKey: opts.sealingKey,
-      shamirRecovery: opts.shamirRecovery
-    });
-    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery });
-  }
-  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await store.put(vaultName, "_meta", "adoption", { ...adoptionEnv, _data: JSON.stringify(consumed) });
-  return { vaultName, userId };
-}
-
-// src/with-cargo/decrypt-partition.ts
-async function decryptExtractedPartition(bundleBytes, transferKey) {
-  const header = readPodHeader(bundleBytes);
-  if (header.bundleKind !== "extracted-partition" || header.transferSeal === void 0) {
-    throw new Error("decryptExtractedPartition: bundle is not an extracted-partition.");
-  }
-  const { dumpJson } = await readPod(bundleBytes);
-  const { dump, seal } = parseExtractedPartitionBody(dumpJson);
-  const deks = await unsealDeks(seal, transferKey);
-  const backup = JSON.parse(dump);
-  const out = {};
-  for (const [collection, byId] of Object.entries(backup.collections)) {
-    const dek = deks.get(collection);
-    if (dek === void 0) continue;
-    const recs = [];
-    for (const [id, env] of Object.entries(byId)) {
-      const plaintext = await openEnvelopeJson(env, dek);
-      const body = JSON.parse(plaintext);
-      recs.push({
-        id,
-        record: { ...body, id },
-        ts: env._ts,
-        version: env._v,
-        ...env._source !== void 0 ? { source: env._source } : {},
-        ...env._sourceTs !== void 0 ? { sourceTs: env._sourceTs } : {}
-      });
-    }
-    out[collection] = recs;
-  }
-  return out;
-}
-
-export {
-  unsealDeks,
-  adoptPartition,
-  createOwnerOnAdoptedPartition,
-  decryptExtractedPartition
-};
-//# sourceMappingURL=chunk-25G7PUTA.js.map

package/dist/chunk-26FSVNBL.js

@@ -1,34 +0,0 @@
-import {
-  TierNotGrantedError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-party/team/tiers.ts
-function dekKey(collection, tier) {
-  if (tier <= 0) return collection;
-  return `${collection}#${tier}`;
-}
-function effectiveClearance(keyring, collection) {
-  let max = 0;
-  const prefix = `${collection}#`;
-  for (const key of keyring.deks.keys()) {
-    if (!key.startsWith(prefix)) continue;
-    const suffix = key.slice(prefix.length);
-    const n = Number.parseInt(suffix, 10);
-    if (Number.isFinite(n) && n > max) max = n;
-  }
-  return max;
-}
-function assertTierAccess(keyring, collection, tier) {
-  if (tier <= 0) return;
-  if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
-  if (!keyring.deks.has(dekKey(collection, tier))) {
-    throw new TierNotGrantedError(collection, tier);
-  }
-}
-
-export {
-  dekKey,
-  effectiveClearance,
-  assertTierAccess
-};
-//# sourceMappingURL=chunk-26FSVNBL.js.map

package/dist/chunk-2PJB6H3H.js

@@ -1,167 +0,0 @@
-import {
-  canonicalize,
-  derivePersistedSchema
-} from "./chunk-55LSDABW.js";
-import {
-  loadPersistedSchemaEntry,
-  savePersistedSchema
-} from "./chunk-J7OH6R4K.js";
-import {
-  ConflictError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-var MAX_SCHEMA_CAS_RETRIES = 5;
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored && isEquivalent(stored, fresh)) {
-      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-    }
-    let decision = { action: "allow" };
-    const strategies = opts.strategies ?? [];
-    if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-    }
-    if (decision.action !== "allow") {
-      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-    }
-    let toSave = fresh;
-    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
-    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
-      return { written: true, skipped: false, envelope: toSave, decision };
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistClassifiedMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      classified: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistSatelliteMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      satellite: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-function satelliteMarkersEqual(a, b) {
-  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
-}
-function markersEqual(a, b) {
-  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
-}
-function sameSet(a, b) {
-  if (a.length !== b.length) return false;
-  const s = new Set(a);
-  return b.every((x) => s.has(x));
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
-}
-
-export {
-  persistSchemaIfNeeded,
-  persistClassifiedMarker,
-  persistSatelliteMarker
-};
-//# sourceMappingURL=chunk-2PJB6H3H.js.map

package/dist/chunk-2PJB6H3H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}

package/dist/chunk-37JZR7CY.js

@@ -1,91 +0,0 @@
-import {
-  canonicalJson,
-  sha256Hex
-} from "./chunk-UMH35AQV.js";
-import {
-  PeriodClosedError,
-  ValidationError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-audit/periods/periods.ts
-var PERIODS_COLLECTION = "_periods";
-var PERIOD_FREEZES_COLLECTION = "_period_freezes";
-var PERIOD_ARCHIVES_COLLECTION = "_period_archives";
-var PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
-function periodExclusiveUpperBound(endDate) {
-  const ms = Date.parse(endDate);
-  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate "${endDate}".`);
-  const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(endDate);
-  return new Date(ms + (dateOnly ? 864e5 : 1)).toISOString();
-}
-async function loadPeriods(adapter, vault, decrypt) {
-  const ids = await adapter.list(vault, PERIODS_COLLECTION);
-  const records = [];
-  for (const id of ids) {
-    const env = await adapter.get(vault, PERIODS_COLLECTION, id);
-    if (env) records.push(await decrypt(env));
-  }
-  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt));
-  return records;
-}
-async function chainAnchor(records) {
-  const last = records[records.length - 1];
-  if (!last) return { priorPeriodHash: "" };
-  const hash = await sha256Hex(canonicalJson(last));
-  return { priorPeriodName: last.name, priorPeriodHash: hash };
-}
-function assertTsWritable(existing, incomingRecord, closedPeriods) {
-  for (const p of closedPeriods) {
-    if (p.kind !== "closed") continue;
-    if (p.dateField) {
-      const checkRecord = (label, r) => {
-        if (!r) return;
-        const v = r[p.dateField];
-        if (typeof v === "string" && v <= p.endDate) {
-          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`);
-        }
-      };
-      checkRecord("existing", existing?.record ?? null);
-      checkRecord("incoming", incomingRecord);
-      continue;
-    }
-    const existingTs = existing?.ts ?? null;
-    if (existingTs !== null && existingTs <= p.endDate) {
-      throw new PeriodClosedError(p.name, p.endDate, existingTs);
-    }
-  }
-}
-function validatePeriodName(name, existing) {
-  if (name.length === 0) {
-    throw new ValidationError("Period name cannot be empty.");
-  }
-  if (existing.some((p) => p.name === name)) {
-    throw new ValidationError(`Period "${name}" already exists.`);
-  }
-}
-async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
-  if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-3LR3YO2W.js");
-  await ledger.append({
-    op: "put",
-    collection,
-    id: name,
-    version: envelope._v,
-    actor,
-    payloadHash: await envelopePayloadHash(envelope)
-  });
-}
-
-export {
-  PERIODS_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound,
-  loadPeriods,
-  chainAnchor,
-  assertTsWritable,
-  validatePeriodName,
-  appendPeriodLedgerEntry
-};
-//# sourceMappingURL=chunk-37JZR7CY.js.map

package/dist/chunk-3KBK5LU4.js

@@ -1,117 +0,0 @@
-import {
-  buildAccessibleBundle,
-  resolveAccessibleCollections
-} from "./chunk-DCVVCJVB.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-REWTMYSF.js";
-import {
-  sha256Hex
-} from "./chunk-5HZULLHE.js";
-import {
-  ReadOnlyError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-audit/portability/withdraw-accessible.ts
-var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
-var ENC = new TextEncoder();
-function randomId() {
-  const b = globalThis.crypto.getRandomValues(new Uint8Array(12));
-  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
-}
-async function freezeSnapshotOnly(vault, collections, opts) {
-  const { name: vaultName, adapter } = vault._introspectState();
-  const closure = [];
-  for (const c of collections) {
-    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id });
-  }
-  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`;
-  const snap = {};
-  for (const { collection, id } of closure) {
-    const env = await adapter.get(vaultName, collection, id);
-    if (env) (snap[collection] ??= {})[id] = env;
-  }
-  const frozenAt = (/* @__PURE__ */ new Date()).toISOString();
-  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap });
-  const sha = await sha256Hex(ENC.encode(body));
-  await adapter.put(
-    vaultName,
-    FROZEN_SNAPSHOTS_COLLECTION,
-    withdrawalId,
-    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: "", _data: body, _by: opts.actorUserId },
-    0
-  );
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: opts.actorUserId,
-    payloadHash: "",
-    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`
-  });
-  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt };
-}
-async function freezeAndDeleteClosure(vault, collections, opts) {
-  const snapshot = opts.disposition === "freeze" ? await freezeSnapshotOnly(vault, collections, {
-    actorUserId: opts.actorUserId,
-    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
-  }) : void 0;
-  const { name: vaultName, adapter } = vault._introspectState();
-  for (const c of collections) {
-    for (const id of await adapter.list(vaultName, c)) {
-      await vault.collection(c).delete(id);
-    }
-  }
-  return snapshot;
-}
-async function withdrawAccessibleData(vault, opts) {
-  const { keyring } = vault._introspectState();
-  const disposition = opts.disposition ?? "delete";
-  if (keyring.role === "owner" || keyring.role === "admin") {
-    throw new ReadOnlyError(
-      "unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition"
-    );
-  }
-  if (keyring.role === "custodian") {
-    throw new ReadOnlyError(
-      "a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim"
-    );
-  }
-  if (keyring.role === "client" || keyring.role === "viewer") {
-    throw new ReadOnlyError(
-      "read-only role cannot self-serve a destructive withdrawal \u2014 use requestWithdrawal (two-party)"
-    );
-  }
-  const collections = resolveAccessibleCollections(keyring, opts.scope, true);
-  if (!collections || collections.length === 0) {
-    throw new ReadOnlyError(
-      "unilateralWithdrawal requires rw access on the withdrawn collections \u2014 use requestWithdrawal for read-only scope"
-    );
-  }
-  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey);
-  const snapshot = await freezeAndDeleteClosure(vault, collections, {
-    disposition,
-    actorUserId: keyring.userId,
-    ...opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}
-  });
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: keyring.userId,
-    payloadHash: "",
-    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`
-  });
-  return snapshot ? { bundle, snapshot } : { bundle };
-}
-
-export {
-  FROZEN_SNAPSHOTS_COLLECTION,
-  randomId,
-  freezeSnapshotOnly,
-  freezeAndDeleteClosure,
-  withdrawAccessibleData
-};
-//# sourceMappingURL=chunk-3KBK5LU4.js.map