@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-TCGVRKOS.js

@@ -1,367 +0,0 @@
-import {
-  loadVaultPolicy,
-  saveVaultPolicy
-} from "./chunk-BTFTHF6Q.js";
-import {
-  PolicyDeniedError,
-  ValidationError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-party/policy/presets.ts
-var PERSONAL_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 6,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      // Any second factor satisfies the gate — off-device kinds (TOTP,
-      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;
-      // platform-bound kinds (platform WebAuthn, password, PIN) are
-      // accepted because requiring "something off-device" is overkill
-      // for personal/SMB threat models. Consumers needing the off-device
-      // guarantee should use STRICT_POLICY or override this gate.
-      factors: [{
-        anyOf: [
-          "totp",
-          "email-otp",
-          "recovery",
-          "webauthn-roaming",
-          "webauthn-platform",
-          "password",
-          "pin"
-        ]
-      }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: deliberate paper-sheet regeneration
-    // when the user remembers their passphrase. PERSONAL allows tier-1 —
-    // knowing the passphrase is enough.
-    "rotate-recovery": { minTier: 1 },
-    "enroll-authenticator": { minTier: 1 },
-    "remove-authenticator": { minTier: 1 },
-    // update-authenticator: meta-only mutation (slot rename, label
-    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
-    // unlock alone. The structural anti-slot-swap guard inside the
-    // implementation enforces wrap-material/id/method immutability
-    // regardless of this gate's settings.
-    "update-authenticator": { minTier: 1 },
-    "rotate-unlock": { minTier: 2 },
-    "enroll-user": { minTier: 1 },
-    "revoke-user": { minTier: 1 },
-    // Peer-recovery is a high-trust intentional op — co-owners
-    // recovering each other should not need an off-device factor in
-    // the personal/SMB threat model (the partner is already vetted by
-    // virtue of being a co-owner). Tier-1 unlock is the floor; the
-    // STRICT preset adds a recovery/email-OTP requirement.
-    "peer-recover-user": { minTier: 1 },
-    // update-user: post-grant identity mutation (role/displayName/
-    // permissions). PERSONAL_POLICY treats this on par with enroll-user
-    // / revoke-user — tier-1 unlock alone. The role-elevation guard
-    // inside the implementation is the structural backstop that this
-    // gate's settings cannot weaken.
-    "update-user": { minTier: 1 },
-    "export-bundle": { minTier: 1 },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // edit-own-profile: tier 3 floor — any active session can edit their
-    //   own profile/preferences. Tightening to require a TOTP for
-    //   profile changes is a one-line override.
-    // view-team-profiles: tier 2 floor — an authenticated session can
-    //   read teammates' profiles (display names, avatars, locales).
-    //   Setting `enabled: false` makes vault.user.list() return only
-    //   self (privacy-strict opt-out).
-    "edit-own-profile": { minTier: 3 },
-    "view-team-profiles": { minTier: 2 },
-    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE
-    // withdrawal (export-and-delete/freeze). Fail-closed by default —
-    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).
-    // Listed explicitly (not just relying on the built-in default) so it is
-    // discoverable in describeGate / policy dumps.
-    "client-unilateral-withdraw": { minTier: 1, enabled: false },
-    // Two-party withdrawal: filing a request is non-destructive
-    // (tier-1, enabled so a read-only client can ask); deciding it is the
-    // destructive step (tier-2 floor + owner/admin role, enforced in code).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": { minTier: 2 }
-  }
-});
-var STRICT_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 8,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "recovery"], count: 2 }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: STRICT requires an off-device factor —
-    // rotating recovery is an off-site-trust event; a stolen unlocked
-    // laptop must not be able to silently mint a new sheet for the
-    // attacker. Matches the `peer-recover-user` STRICT default.
-    "rotate-recovery": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "webauthn-roaming"] }]
-    },
-    "enroll-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "remove-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT update-authenticator: same factor floor as enroll/remove.
-    // Even though meta changes don't touch wrap material, a malicious
-    // rename could mislead the user about which device a slot
-    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
-    // shared workstation). STRICT requires a fresh factor proof.
-    "update-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "rotate-unlock": { minTier: 1 },
-    "enroll-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "revoke-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT peer-recovery: the issuer must present a recovery code
-    // OR a fresh off-device second factor at the moment of recovery.
-    // This binds the high-trust operation to a verifiable proof
-    // (recovery sheet photographed by an attacker won't suffice —
-    // they'd also need tier-1 unlock first; this gate is the freshness
-    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)
-    // accepted; platform-bound kinds (Touch ID, password, PIN)
-    // intentionally excluded under STRICT because they don't survive
-    // device theft — the off-device requirement is the whole point.
-    "peer-recover-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
-    },
-    // STRICT update-user: matches the enroll-user / revoke-user shape
-    // (off-device factor required). Update-user is admin-shaped — it
-    // mutates someone else's role/permissions; STRICT requires a fresh
-    // off-device factor proof so the operator affirmatively re-asserts
-    // identity at the moment of mutation. Platform-bound factors
-    // (Touch ID / password / PIN) intentionally excluded: same logic as
-    // peer-recover-user — the off-device requirement is the whole
-    // point under STRICT.
-    "update-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "export-bundle": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // STRICT: profile edits require a TOTP/email-OTP factor (typical
-    // shared-workstation hardening — your name/avatar shouldn't change
-    // without a fresh second-factor proof).
-    "edit-own-profile": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-team-profiles": { minTier: 2 },
-    // STRICT: still fail-closed, but if a regulated firm flips enabled:true
-    // they inherit a two-factor proof + shared-device block for the
-    // destructive withdrawal (mirrors export-plaintext's hardening).
-    "client-unilateral-withdraw": {
-      minTier: 1,
-      enabled: false,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    // STRICT: filing stays tier-1; the destructive APPROVE demands an
-    // off-device factor + shared-device block (mirrors export-bundle).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    }
-  }
-});
-function mergePolicy(base, override) {
-  if (!override) return base;
-  const passphrase = override.passphrase ?? base.passphrase;
-  return {
-    ...passphrase !== void 0 ? { passphrase } : {},
-    gates: {
-      ...base.gates,
-      ...override.gates ?? {}
-    }
-  };
-}
-
-// src/with-party/policy/engine.ts
-var DEFAULT_FRESHNESS_MS = 5 * 60 * 1e3;
-async function checkGate(policy, gate, context) {
-  const configured = policy.gates[gate];
-  if (!configured) {
-    if (gate.startsWith("app:")) {
-      return;
-    }
-    throw deny(gate, "disabled", { minTier: 1, enabled: false });
-  }
-  if (configured.enabled === false) {
-    throw deny(gate, "disabled", configured);
-  }
-  if (context.activeTier > configured.minTier) {
-    throw deny(gate, "insufficient-tier", configured);
-  }
-  if (configured.factors && configured.factors.length > 0) {
-    const presented = context.factors ?? [];
-    const now = context.now ?? Date.now();
-    for (const requirement of configured.factors) {
-      const matches = countMatchingFactors(presented, requirement, now);
-      const need = requirement.count ?? 1;
-      if (matches.fresh < need) {
-        if (matches.totalKindMatches < need) {
-          throw deny(gate, "missing-factor", configured);
-        }
-        throw deny(gate, "stale-proof", configured);
-      }
-    }
-  }
-  if (configured.warn?.sharedDevice === "block" && context.sharedDevice === true) {
-    throw deny(gate, "shared-device-blocked", configured);
-  }
-}
-async function describeGate(policy, gate, context) {
-  try {
-    await checkGate(policy, gate, context);
-    return { ok: true };
-  } catch (err) {
-    if (err instanceof PolicyDeniedError) {
-      return { ok: false, reason: err.reason, required: err.required };
-    }
-    throw err;
-  }
-}
-function countMatchingFactors(presented, requirement, now) {
-  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS;
-  let totalKindMatches = 0;
-  let fresh = 0;
-  for (const proof of presented) {
-    if (!requirement.anyOf.includes(proof.kind)) continue;
-    totalKindMatches += 1;
-    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now;
-    if (Number.isFinite(minted) && now - minted <= freshnessMs) {
-      fresh += 1;
-    }
-  }
-  return { totalKindMatches, fresh };
-}
-function deny(gate, reason, required) {
-  return new PolicyDeniedError(gate, reason, required);
-}
-
-// src/with-party/policy/noydb-facade.ts
-var NoydbPolicy = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  /**
-   * Touch the policy enforcer for a vault (records activity, resets
-   * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-   */
-  touchPolicy(vault) {
-    this.deps.resetSessionTimer();
-    if (vault) {
-      this.deps.policyEnforcers.get(vault)?.touch();
-    }
-  }
-  /**
-   * Check that a policy-guarded operation is permitted.
-   * Throws `SessionPolicyError` if re-auth is required.
-   */
-  checkPolicyOperation(vault, op) {
-    this.deps.policyEnforcers.get(vault)?.checkOperation(op);
-  }
-  /**
-   * Read the active policy for a vault. Loads from `_meta/policy` on
-   * first call; subsequent calls hit the in-memory cache. Throws
-   * `ValidationError` if the vault has not been opened.
-   */
-  async getPolicy(vault) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const cached = this.deps.policyCache.get(vault);
-    if (cached) return cached;
-    await this.bootstrapPolicy(vault);
-    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY;
-  }
-  /**
-   * Replace the policy document at `_meta/policy` and update the
-   * in-memory cache. Gated by the `enroll-user` policy (a policy
-   * change is fundamentally a privilege-management action).
-   */
-  async updatePolicy(vault, override) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const current = await this.getPolicy(vault);
-    const merged = mergePolicy(current, override);
-    if (this.deps.encrypted) {
-      await saveVaultPolicy(this.deps.store, vault, merged);
-    }
-    this.deps.policyCache.set(vault, merged);
-    return merged;
-  }
-  /** Read or persist the vault policy at `_meta/policy` on first open. */
-  async bootstrapPolicy(vault, opts) {
-    const onDisk = await loadVaultPolicy(this.deps.store, vault);
-    if (onDisk) {
-      this.deps.policyCache.set(vault, onDisk);
-      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts);
-      return;
-    }
-    const initial = this.deps.policyOption ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption) : PERSONAL_POLICY;
-    await saveVaultPolicy(this.deps.store, vault, initial);
-    this.deps.policyCache.set(vault, initial);
-    await this.deps.assertRecoveryEnrolled(vault, initial, opts);
-  }
-};
-var createNoydbPolicy = (deps) => new NoydbPolicy(deps);
-
-export {
-  PERSONAL_POLICY,
-  STRICT_POLICY,
-  mergePolicy,
-  DEFAULT_FRESHNESS_MS,
-  checkGate,
-  describeGate,
-  createNoydbPolicy
-};
-//# sourceMappingURL=chunk-TCGVRKOS.js.map

package/dist/chunk-TIAYXOEI.js

@@ -1,99 +0,0 @@
-import {
-  dekKey
-} from "./chunk-26FSVNBL.js";
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  openEnvelopeJson
-} from "./chunk-7TAV3BFQ.js";
-import {
-  encrypt,
-  unwrapKey,
-  wrapKey
-} from "./chunk-5HZULLHE.js";
-import {
-  DelegationTargetMissingError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-party/team/delegation.ts
-var DELEGATIONS_COLLECTION = "_delegations";
-async function issueDelegation(store, vault, grantor, targetKek, delegationsDek, opts) {
-  if (!targetKek) {
-    throw new DelegationTargetMissingError(opts.toUser);
-  }
-  const tier = opts.tier;
-  const collectionName = opts.collection ?? null;
-  const dekLookupCollection = collectionName ?? "";
-  const sourceDek = collectionName ? grantor.deks.get(dekKey(collectionName, tier)) : void 0;
-  if (!sourceDek) {
-    throw new DelegationTargetMissingError(
-      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || "(any)"}`
-    );
-  }
-  const wrappedDek = await wrapKey(sourceDek, targetKek);
-  const until = typeof opts.until === "string" ? opts.until : opts.until.toISOString();
-  const token = {
-    id: generateULID(),
-    toUser: opts.toUser,
-    fromUser: grantor.userId,
-    tier,
-    collection: collectionName,
-    ...opts.record && { record: opts.record },
-    until,
-    wrappedDek,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const plaintext = JSON.stringify(token);
-  const { iv, data } = await encrypt(plaintext, delegationsDek);
-  const envelope = {
-    _noydb: 1,
-    _v: 1,
-    _ts: token.createdAt,
-    _iv: iv,
-    _data: data,
-    _by: grantor.userId
-  };
-  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope);
-  return token;
-}
-async function loadActiveDelegations(store, vault, user, delegationsDek, now = /* @__PURE__ */ new Date()) {
-  const ids = await store.list(vault, DELEGATIONS_COLLECTION);
-  const merged = [];
-  const nowIso = now.toISOString();
-  for (const id of ids) {
-    const env = await store.get(vault, DELEGATIONS_COLLECTION, id);
-    if (!env) continue;
-    let token;
-    try {
-      const plaintext = await openEnvelopeJson(env, delegationsDek);
-      token = JSON.parse(plaintext);
-    } catch {
-      continue;
-    }
-    if (token.toUser !== user.userId) continue;
-    if (token.until <= nowIso) continue;
-    if (!user.kek) continue;
-    let dek;
-    try {
-      dek = await unwrapKey(token.wrappedDek, user.kek);
-    } catch {
-      continue;
-    }
-    const k = token.collection ? dekKey(token.collection, token.tier) : `__any#${token.tier}`;
-    user.deks.set(k, dek);
-    merged.push(token);
-  }
-  return merged;
-}
-async function revokeDelegation(store, vault, id) {
-  await store.delete(vault, DELEGATIONS_COLLECTION, id);
-}
-
-export {
-  DELEGATIONS_COLLECTION,
-  issueDelegation,
-  loadActiveDelegations,
-  revokeDelegation
-};
-//# sourceMappingURL=chunk-TIAYXOEI.js.map

package/dist/chunk-TQ3REHVF.js

@@ -1,95 +0,0 @@
-// src/with-shape/introspection/fields.ts
-function jsonSchemaType(node) {
-  if (Array.isArray(node.type)) {
-    const non = node.type.filter((t) => t !== "null");
-    return non[0] ?? "opaque";
-  }
-  if (node.enum && Array.isArray(node.enum)) return "enum";
-  if (node.const !== void 0) return "enum";
-  if (typeof node.type === "string") return node.type;
-  return "opaque";
-}
-function constraintsFor(node) {
-  const out = {};
-  if (node.enum) out.values = node.enum;
-  if (node.const !== void 0) out.values = [node.const];
-  if (node.minLength !== void 0) out.minLength = node.minLength;
-  if (node.maxLength !== void 0) out.maxLength = node.maxLength;
-  if (node.pattern !== void 0) out.pattern = node.pattern;
-  if (node.format !== void 0) out.format = node.format;
-  if (node.minimum !== void 0) out.minimum = node.minimum;
-  if (node.maximum !== void 0) out.maximum = node.maximum;
-  if (node.exclusiveMinimum !== void 0) out.gt = node.exclusiveMinimum;
-  if (node.exclusiveMaximum !== void 0) out.lt = node.exclusiveMaximum;
-  return Object.keys(out).length === 0 ? void 0 : out;
-}
-function extractObjectFields(obj, source, refs) {
-  const required = new Set(Array.isArray(obj.required) ? obj.required : []);
-  const fields = {};
-  if (!obj.properties || typeof obj.properties !== "object") return { fields, required };
-  for (const [name, node] of Object.entries(obj.properties)) {
-    const descriptor = {
-      type: jsonSchemaType(node),
-      source,
-      ...required.has(name) ? {} : { optional: true },
-      ...refs?.[name] ? { references: `${refs[name].target}.id` } : {}
-    };
-    const constraints = constraintsFor(node);
-    if (constraints) descriptor.constraints = constraints;
-    fields[name] = descriptor;
-  }
-  return { fields, required };
-}
-function mergeUnionMembers(members, source, refs) {
-  if (members.length === 0) return {};
-  const extracted = members.filter((m) => m.properties && typeof m.properties === "object").map((m) => extractObjectFields(m, source, refs));
-  if (extracted.length === 0) return {};
-  const allNames = /* @__PURE__ */ new Set();
-  for (const { fields } of extracted) {
-    for (const name of Object.keys(fields)) allNames.add(name);
-  }
-  const memberCount = extracted.length;
-  const out = {};
-  for (const name of allNames) {
-    const presentIn = extracted.filter(({ fields }) => name in fields);
-    const requiredInAll = presentIn.length === memberCount && presentIn.every(({ required }) => required.has(name));
-    const base = presentIn[0].fields[name];
-    const allValues = [];
-    for (const { fields } of presentIn) {
-      const fd = fields[name];
-      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {
-        for (const v of fd.constraints.values) {
-          if (!allValues.includes(v)) allValues.push(v);
-        }
-      }
-    }
-    const mergedConstraints = allValues.length > 0 ? { ...base.constraints ?? {}, values: allValues } : base.constraints;
-    const descriptor = {
-      type: base.type,
-      source,
-      ...requiredInAll ? {} : { optional: true },
-      ...base.references ? { references: base.references } : {}
-    };
-    if (mergedConstraints) {
-      descriptor.constraints = mergedConstraints;
-    }
-    out[name] = descriptor;
-  }
-  return out;
-}
-function jsonSchemaToFields(jsonSchema, source, refs) {
-  if (!jsonSchema || typeof jsonSchema !== "object") return {};
-  const root = jsonSchema;
-  const unionMembers = root.anyOf ?? root.oneOf;
-  if (Array.isArray(unionMembers) && unionMembers.length > 0) {
-    return mergeUnionMembers(unionMembers, source, refs);
-  }
-  if (!root.properties || typeof root.properties !== "object") return {};
-  const { fields } = extractObjectFields(root, source, refs);
-  return fields;
-}
-
-export {
-  jsonSchemaToFields
-};
-//# sourceMappingURL=chunk-TQ3REHVF.js.map

package/dist/chunk-TQ3REHVF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/introspection/fields.ts"],"sourcesContent":["/**\n * Map a JSON Schema (Draft 2020-12 produced by `zod-to-json-schema`) into\n * the {@link FieldDescriptor} map consumed by {@link VaultSchemaSnapshot}.\n *\n * Used by both the persisted-schema path (decrypted envelope body) and the\n * live-validator path (in-process derivation).\n *\n * @module\n */\n\nimport type { FieldDescriptor, FieldSource } from './types.js'\n\ninterface JsonSchemaShape {\n  type?: string | string[]\n  properties?: Record<string, JsonSchemaShape>\n  required?: string[]\n  enum?: unknown[]\n  const?: unknown\n  minLength?: number\n  maxLength?: number\n  pattern?: string\n  minimum?: number\n  maximum?: number\n  exclusiveMinimum?: number\n  exclusiveMaximum?: number\n  format?: string\n  items?: JsonSchemaShape\n  oneOf?: JsonSchemaShape[]\n  anyOf?: JsonSchemaShape[]\n}\n\nfunction jsonSchemaType(node: JsonSchemaShape): string {\n  if (Array.isArray(node.type)) {\n    const non = node.type.filter((t) => t !== 'null')\n    return non[0] ?? 'opaque'\n  }\n  if (node.enum && Array.isArray(node.enum)) return 'enum'\n  // JSON Schema `const` is used by zod-to-json-schema for z.literal(...)\n  if (node.const !== undefined) return 'enum'\n  if (typeof node.type === 'string') return node.type\n  return 'opaque'\n}\n\nfunction constraintsFor(node: JsonSchemaShape): Record<string, unknown> | undefined {\n  const out: Record<string, unknown> = {}\n  if (node.enum) out.values = node.enum\n  // JSON Schema `const` (used by zod-to-json-schema for z.literal) — treat like a single-value enum\n  if (node.const !== undefined) out.values = [node.const]\n  if (node.minLength !== undefined) out.minLength = node.minLength\n  if (node.maxLength !== undefined) out.maxLength = node.maxLength\n  if (node.pattern !== undefined) out.pattern = node.pattern\n  if (node.format !== undefined) out.format = node.format\n  if (node.minimum !== undefined) out.minimum = node.minimum\n  if (node.maximum !== undefined) out.maximum = node.maximum\n  if (node.exclusiveMinimum !== undefined) out.gt = node.exclusiveMinimum\n  if (node.exclusiveMaximum !== undefined) out.lt = node.exclusiveMaximum\n  return Object.keys(out).length === 0 ? undefined : out\n}\n\n/**\n * Extract fields from a single JSON Schema object node (must have `properties`).\n * Used by both the plain-object path and the per-member extraction in the union path.\n */\nfunction extractObjectFields(\n  obj: JsonSchemaShape,\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): { fields: Record<string, FieldDescriptor>; required: Set<string> } {\n  const required = new Set(Array.isArray(obj.required) ? obj.required : [])\n  const fields: Record<string, FieldDescriptor> = {}\n  if (!obj.properties || typeof obj.properties !== 'object') return { fields, required }\n\n  for (const [name, node] of Object.entries(obj.properties)) {\n    const descriptor: FieldDescriptor = {\n      type: jsonSchemaType(node),\n      source,\n      ...(required.has(name) ? {} : { optional: true }),\n      ...(refs?.[name] ? { references: `${refs[name].target}.id` } : {}),\n    }\n    const constraints = constraintsFor(node)\n    if (constraints) (descriptor as { constraints?: Record<string, unknown> }).constraints = constraints\n    fields[name] = descriptor\n  }\n\n  return { fields, required }\n}\n\n/**\n * Merge field descriptors from multiple union members.\n *\n * Merge rules:\n * - Emit the UNION of all field names so no member's fields are hidden.\n * - A field is required (optional=false/absent) only when it is required in\n *   EVERY member; otherwise it is marked optional=true.\n * - For the discriminator field (appears in every member with a `const` value),\n *   collect the const values from all members and surface them as constraints.values\n *   so the caller can see the full literal set.\n * - For conflicting types across members, first-seen wins.\n */\nfunction mergeUnionMembers(\n  members: JsonSchemaShape[],\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): Record<string, FieldDescriptor> {\n  if (members.length === 0) return {}\n\n  // Extract per-member fields + required sets\n  const extracted = members\n    .filter((m) => m.properties && typeof m.properties === 'object')\n    .map((m) => extractObjectFields(m, source, refs))\n\n  if (extracted.length === 0) return {}\n\n  // Collect all field names across all members\n  const allNames = new Set<string>()\n  for (const { fields } of extracted) {\n    for (const name of Object.keys(fields)) allNames.add(name)\n  }\n\n  const memberCount = extracted.length\n  const out: Record<string, FieldDescriptor> = {}\n\n  for (const name of allNames) {\n    // Which members contain this field?\n    const presentIn = extracted.filter(({ fields }) => name in fields)\n    const requiredInAll = presentIn.length === memberCount\n      && presentIn.every(({ required }) => required.has(name))\n\n    // Use first-seen descriptor as the base (presentIn is always non-empty here since\n    // we iterate names that appeared in at least one member's fields)\n    const base = presentIn[0]!.fields[name]!\n\n    // For discriminator-like fields: collect const/enum values across all members\n    // to surface the full literal set in constraints.values\n    const allValues: unknown[] = []\n    for (const { fields } of presentIn) {\n      const fd = fields[name]\n      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {\n        for (const v of fd.constraints.values) {\n          if (!allValues.includes(v)) allValues.push(v)\n        }\n      }\n    }\n\n    const mergedConstraints: Record<string, unknown> | undefined =\n      allValues.length > 0\n        ? { ...(base.constraints ?? {}), values: allValues }\n        : base.constraints\n\n    const descriptor: FieldDescriptor = {\n      type: base.type,\n      source,\n      ...(requiredInAll ? {} : { optional: true }),\n      ...(base.references ? { references: base.references } : {}),\n    }\n    if (mergedConstraints) {\n      (descriptor as { constraints?: Record<string, unknown> }).constraints = mergedConstraints\n    }\n    out[name] = descriptor\n  }\n\n  return out\n}\n\nexport function jsonSchemaToFields(\n  jsonSchema: unknown,\n  source: FieldSource,\n  refs?: Record<string, { target: string; mode: string }>,\n): Record<string, FieldDescriptor> {\n  if (!jsonSchema || typeof jsonSchema !== 'object') return {}\n  const root = jsonSchema as JsonSchemaShape\n\n  // Handle discriminated unions: zod-to-json-schema emits anyOf/oneOf for z.discriminatedUnion\n  const unionMembers = root.anyOf ?? root.oneOf\n  if (Array.isArray(unionMembers) && unionMembers.length > 0) {\n    return mergeUnionMembers(unionMembers, source, refs)\n  }\n\n  if (!root.properties || typeof root.properties !== 'object') return {}\n\n  const { fields } = extractObjectFields(root, source, refs)\n  return fields\n}\n"],"mappings":";AA+BA,SAAS,eAAe,MAA+B;AACrD,MAAI,MAAM,QAAQ,KAAK,IAAI,GAAG;AAC5B,UAAM,MAAM,KAAK,KAAK,OAAO,CAAC,MAAM,MAAM,MAAM;AAChD,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB;AACA,MAAI,KAAK,QAAQ,MAAM,QAAQ,KAAK,IAAI,EAAG,QAAO;AAElD,MAAI,KAAK,UAAU,OAAW,QAAO;AACrC,MAAI,OAAO,KAAK,SAAS,SAAU,QAAO,KAAK;AAC/C,SAAO;AACT;AAEA,SAAS,eAAe,MAA4D;AAClF,QAAM,MAA+B,CAAC;AACtC,MAAI,KAAK,KAAM,KAAI,SAAS,KAAK;AAEjC,MAAI,KAAK,UAAU,OAAW,KAAI,SAAS,CAAC,KAAK,KAAK;AACtD,MAAI,KAAK,cAAc,OAAW,KAAI,YAAY,KAAK;AACvD,MAAI,KAAK,cAAc,OAAW,KAAI,YAAY,KAAK;AACvD,MAAI,KAAK,YAAY,OAAW,KAAI,UAAU,KAAK;AACnD,MAAI,KAAK,WAAW,OAAW,KAAI,SAAS,KAAK;AACjD,MAAI,KAAK,YAAY,OAAW,KAAI,UAAU,KAAK;AACnD,MAAI,KAAK,YAAY,OAAW,KAAI,UAAU,KAAK;AACnD,MAAI,KAAK,qBAAqB,OAAW,KAAI,KAAK,KAAK;AACvD,MAAI,KAAK,qBAAqB,OAAW,KAAI,KAAK,KAAK;AACvD,SAAO,OAAO,KAAK,GAAG,EAAE,WAAW,IAAI,SAAY;AACrD;AAMA,SAAS,oBACP,KACA,QACA,MACoE;AACpE,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC,CAAC;AACxE,QAAM,SAA0C,CAAC;AACjD,MAAI,CAAC,IAAI,cAAc,OAAO,IAAI,eAAe,SAAU,QAAO,EAAE,QAAQ,SAAS;AAErF,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACzD,UAAM,aAA8B;AAAA,MAClC,MAAM,eAAe,IAAI;AAAA,MACzB;AAAA,MACA,GAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC/C,GAAI,OAAO,IAAI,IAAI,EAAE,YAAY,GAAG,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IAClE;AACA,UAAM,cAAc,eAAe,IAAI;AACvC,QAAI,YAAa,CAAC,WAAyD,cAAc;AACzF,WAAO,IAAI,IAAI;AAAA,EACjB;AAEA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAcA,SAAS,kBACP,SACA,QACA,MACiC;AACjC,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAY,QACf,OAAO,CAAC,MAAM,EAAE,cAAc,OAAO,EAAE,eAAe,QAAQ,EAC9D,IAAI,CAAC,MAAM,oBAAoB,GAAG,QAAQ,IAAI,CAAC;AAElD,MAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAGpC,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,EAAE,OAAO,KAAK,WAAW;AAClC,eAAW,QAAQ,OAAO,KAAK,MAAM,EAAG,UAAS,IAAI,IAAI;AAAA,EAC3D;AAEA,QAAM,cAAc,UAAU;AAC9B,QAAM,MAAuC,CAAC;AAE9C,aAAW,QAAQ,UAAU;AAE3B,UAAM,YAAY,UAAU,OAAO,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjE,UAAM,gBAAgB,UAAU,WAAW,eACtC,UAAU,MAAM,CAAC,EAAE,SAAS,MAAM,SAAS,IAAI,IAAI,CAAC;AAIzD,UAAM,OAAO,UAAU,CAAC,EAAG,OAAO,IAAI;AAItC,UAAM,YAAuB,CAAC;AAC9B,eAAW,EAAE,OAAO,KAAK,WAAW;AAClC,YAAM,KAAK,OAAO,IAAI;AACtB,UAAI,IAAI,aAAa,UAAU,MAAM,QAAQ,GAAG,YAAY,MAAM,GAAG;AACnE,mBAAW,KAAK,GAAG,YAAY,QAAQ;AACrC,cAAI,CAAC,UAAU,SAAS,CAAC,EAAG,WAAU,KAAK,CAAC;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBACJ,UAAU,SAAS,IACf,EAAE,GAAI,KAAK,eAAe,CAAC,GAAI,QAAQ,UAAU,IACjD,KAAK;AAEX,UAAM,aAA8B;AAAA,MAClC,MAAM,KAAK;AAAA,MACX;AAAA,MACA,GAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC1C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,mBAAmB;AACrB,MAAC,WAAyD,cAAc;AAAA,IAC1E;AACA,QAAI,IAAI,IAAI;AAAA,EACd;AAEA,SAAO;AACT;AAEO,SAAS,mBACd,YACA,QACA,MACiC;AACjC,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO,CAAC;AAC3D,QAAM,OAAO;AAGb,QAAM,eAAe,KAAK,SAAS,KAAK;AACxC,MAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,WAAO,kBAAkB,cAAc,QAAQ,IAAI;AAAA,EACrD;AAEA,MAAI,CAAC,KAAK,cAAc,OAAO,KAAK,eAAe,SAAU,QAAO,CAAC;AAErE,QAAM,EAAE,OAAO,IAAI,oBAAoB,MAAM,QAAQ,IAAI;AACzD,SAAO;AACT;","names":[]}