@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/sync/index.d.ts

@@ -1,41 +0,0 @@
-import { cz as SyncStrategy } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active sync strategy — `withSync()` returns the real implementation
- * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`
- * constructors into the Noydb / Vault / Collection hot paths.
- *
- * Consumers opt in by:
- *
- * ```ts
- * import { createNoydb } from '@noy-db/hub'
- * import { withSync } from '@noy-db/hub/sync'
- *
- * const db = await createNoydb({
- *   store: localStore,
- *   sync: remoteStore,
- *   user: ...,
- *   syncStrategy: withSync(),
- * })
- * ```
- *
- * The factory delegates to the existing `sync.ts`,
- * `sync-transaction.ts`, and `presence.ts` modules. Splitting the
- * import chain through this file is what lets tsup tree-shake the
- * ~856 LOC of replication + presence machinery out of the default
- * bundle when no `withSync()` import is present.
- *
- * Keyring + grant/revoke/magic-link/delegation stay in the always-on
- * core (or tree-shake via direct named imports) — those are required
- * for any multi-user vault, even purely local ones.
- *
- * @public
- */
-
-declare function withSync(): SyncStrategy;
-
-export { SyncStrategy, withSync };

package/dist/team/index.d.ts

@@ -1,155 +0,0 @@
-import { jn as TeamStrategy, c$ as NoydbStore, cN as UnlockedKeyring } from '../index-Dn5GzPg_.js';
-export { e9 as BundleRecipient, fH as EnrollAuthenticatorOptions, fI as EnrollAuthenticatorWrappingDEKsOptions, fJ as EnrollAuthenticatorWrappingKEKOptions, gH as ListUsersOptions, hc as NO_TEAM, hu as PaperRecoveryEntry, hG as PresenceHandle, i8 as RecoverPassphraseInput, i9 as RecoverPassphraseResult, ia as RecoverUserOptions, id as RecoveryProof, ir as RotatePassphraseInput, iY as SlotRewrapCeremony, iZ as SlotRewrapContext, j6 as SyncEngine, je as SyncTransaction, jm as TeamNotEnabledError, jA as UpdateAuthenticatorOptions, jR as WrappedDeksBlob, k0 as buildRecipientKeyringFile, k1 as burnPaperRecoveryEntry, lg as changeSecret, lh as createOwnerKeyring, k7 as deriveMagicLinkContentKey, kb as enrollAuthenticator, li as ensureCollectionDEK, kf as evaluateExportCapability, kh as evaluateImportCapability, kk as findAuthenticator, lj as grant, kl as hasExportCapability, km as hasImportCapability, kp as isMagicLinkGrantExpired, ky as listMagicLinkGrants, kz as listUsers, kA as listUsersWithEnvelopes, lk as loadKeyring, kD as loadPaperRecoveryEntries, kG as magicLinkGrantRecordId, kH as mintPaperRecoveryEntry, kJ as mintWrappedDeksBlob, ll as persistKeyring, kO as readMagicLinkGrantRecord, kv as recoverPassphrase, kQ as recoverUser, kU as removeAuthenticator, lm as revoke, k_ as revokeMagicLinkGrant, kw as rotatePassphrase, l0 as savePaperRecoveryEntries, l4 as unwrapDeksFromBlob, l5 as unwrapDeksFromPaperEntry, l7 as unwrapMagicLinkGrant, ln as updateAuthenticator, lo as updateKeyringIdentity, lf as writeMagicLinkGrant } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Enable the multi-user team capability (#267 Track A tail).
- *
- * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /
- * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines
- * are statically imported HERE — this module is reachable only through the
- * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable
- * re-export), so a single-user floor bundle never carries them. The facade
- * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +
- * keyring plumbing and receives the engine as an argument.
- */
-
-declare function withTeam(): TeamStrategy;
-
-/**
- * Secret-bearing reserved collections — the `_`-prefixed reserved collections
- * whose record CONTENTS are directly-usable secrets (transport OAuth tokens,
- * connection strings, API keys), as opposed to the *operational* reserved
- * collections (`_ledger`, `_history`, `_sync`, …) whose contents are metadata
- * (collection names, record ids, ciphertext hashes).
- *
- * This distinction matters at two trust-boundary seams:
- *
- *  1. `vault.collection()` — a secret-bearing reserved name must never be
- *     reachable through the generic public collection handle. It is served
- *     ONLY by its dedicated, role-gated API (e.g. `_sync_credentials` →
- *     `getCredential`/`putCredential`, which enforce owner/admin access).
- *
- *  2. `grant()` DEK propagation — a sub-admin grantee (operator, viewer,
- *     client, custodian) must NOT receive a secret-bearing collection's DEK.
- *     Operational reserved DEKs still propagate to every role (grantees must
- *     write ledger/history entries on every mutation), but handing a
- *     sub-admin the `_sync_credentials` DEK would let them decrypt the firm's
- *     transport secrets — a plaintext leak, not a metadata leak.
- *
- * Kept dependency-free so both the kernel (`vault.ts`) and the team layer
- * (`keyring.ts`) can import it without an import cycle.
- */
-/** Reserved collection holding per-adapter sync transport secrets. */
-declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
-
-/**
- * _sync_credentials reserved collection —
- *
- * Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as
- * encrypted records inside the vault itself. Tokens are wrapped with the
- * compartment's own DEK, live on disk as ciphertext like any other record, and
- * are accessed only through the dedicated API in this module — never via
- * `vault.collection('_sync_credentials')`.
- *
- * Design decisions
- * ────────────────
- *
- * **Why a reserved collection, not a separate store?**
- * The compartment's existing encryption stack (AES-256-GCM + collection DEK)
- * is exactly the right primitive for protecting OAuth tokens at rest. Using a
- * separate store would require a new encryption surface, new adapter calls,
- * and a new backup/restore path — all of which already exist for collections.
- *
- * **Why not exposed as a regular collection?**
- * The same reason `_keyring` and `_ledger` aren't: they have invariants that
- * must be enforced (naming scheme, no cross-user leakage, no schema
- * validation, no history/ledger writes for privacy). Routing through a
- * dedicated API enforces those invariants.
- *
- * **Token lifecycle:**
- * - `putCredential(vault, adapterId, token)` — store or overwrite
- * - `getCredential(vault, adapterId)` — load and decrypt
- * - `deleteCredential(vault, adapterId)` — remove
- * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)
- *
- * The `adapterId` is the record ID within the `_sync_credentials` collection.
- * It should be a stable, human-readable identifier for the adapter instance
- * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).
- *
- * **ACL:** only `owner` and `admin` roles can read/write sync credentials.
- * Operators, viewers, and clients cannot call this API. The check is made
- * against the caller's keyring role at call time.
- */
-
-/**
- * An OAuth/auth token stored in `_sync_credentials`.
- *
- * Fields mirror the OAuth2 token response shape. `customData` is an escape
- * hatch for adapter-specific secrets (API keys, connection strings, etc.)
- * that don't fit the OAuth2 shape.
- */
-interface SyncCredential {
-    /** Stable identifier for the adapter instance (e.g. 'google-drive'). */
-    readonly adapterId: string;
-    /** OAuth token type, usually 'Bearer'. */
-    readonly tokenType: string;
-    /** The access token. Expires at `expiresAt` if set. */
-    readonly accessToken: string;
-    /** Long-lived refresh token for renewing the access token. */
-    readonly refreshToken?: string;
-    /** ISO timestamp when `accessToken` expires. Absent means "no expiry". */
-    readonly expiresAt?: string;
-    /** Space-separated OAuth scopes. */
-    readonly scopes?: string;
-    /** Adapter-specific opaque data (API keys, endpoints, etc.). */
-    readonly customData?: Record<string, string>;
-}
-/**
- * Store or overwrite a sync credential for the given adapter.
- *
- * The credential is encrypted with the `_sync_credentials` collection DEK
- * (auto-generated on first use). The record ID is the `adapterId`.
- *
- * Requires owner or admin role.
- */
-declare function putCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, credential: SyncCredential): Promise<void>;
-/**
- * Load and decrypt a sync credential for the given adapter ID.
- *
- * Returns `null` if no credential exists for this adapter.
- * Requires owner or admin role.
- */
-declare function getCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<SyncCredential | null>;
-/**
- * Delete a sync credential by adapter ID.
- *
- * No-op if the credential doesn't exist. Requires owner or admin role.
- */
-declare function deleteCredential(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<void>;
-/**
- * List all adapter IDs that have stored credentials.
- *
- * Returns only the IDs, never the credential payloads. Useful for
- * displaying "connected adapters" in UI without decrypting tokens.
- * Requires owner or admin role.
- */
-declare function listCredentials(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<string[]>;
-/**
- * Check whether a credential exists and whether its access token has expired.
- *
- * Returns `{ exists: false }` if no credential is stored, or
- * `{ exists: true, expired: boolean }` based on the `expiresAt` field.
- * Requires owner or admin role.
- */
-declare function credentialStatus(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, adapterId: string): Promise<{
-    exists: false;
-} | {
-    exists: true;
-    expired: boolean;
-}>;
-
-export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, TeamStrategy, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential, withTeam };

package/dist/tiers/index.d.ts

@@ -1,5 +0,0 @@
-export { lv as NO_TIERS, lw as TiersContext, jr as TiersNotEnabledError, lx as TiersStrategy, ly as assertDeclaredTier, lz as assertTiersEnabled, lA as classifySealedShred, lB as demote, lC as elevate, lD as getAtTier, lE as listAtTier, lF as putAtTier, lG as withTiers } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/to/index.d.ts

@@ -1,5 +0,0 @@
-export { dy as BundleVersionConflictError, f8 as ConflictError, d1 as EncryptedEnvelope, gG as ListPageResult, hd as NetworkError, hj as NoydbBundleStore, c3 as NoydbPodStore, c$ as NoydbStore, dC as PodVersionConflictError, j3 as StoreCapabilities, j4 as StoreCapabilityError, j5 as StoreTime, jv as TxOp, jK as VaultSnapshot } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/transition-guard-D5RLJv8S.d.ts

@@ -1,165 +0,0 @@
-import { bR as GuardStrategy, bX as GuardStrategyHandle, bS as GuardChange, bT as GuardContext } from './index-Dn5GzPg_.js';
-
-/**
- * Register a guard for a collection. Guards run on every `put()` /
- * `delete()` for the named collection (after permissions, before
- * encryption) and may:
- *
- *   - `check` — block writes by throwing (typically `RecordLockedError`)
- *   - `frozenFields` — freeze specific fields once a condition is true
- *   - `amendment` — declare an authorized-override path with invariant
- *
- * Pass the returned handle to `createNoydb({ strategies: [...] })`.
- *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
- */
-declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
-
-/**
- * `immutableGuard` — declarative WORM / append-only sugar over the guard
- * service.
- *
- * Issued fiscal documents (invoices, DDTs) must be immutable after issue.
- * That is expressible today with a hand-rolled `withGuard` (block on
- * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is
- * repetitive and easy to get subtly wrong. `immutableGuard` generates
- * exactly that guard from a declarative config, reusing the guard
- * machinery wholesale — `check`/`onDelete` rejection, the ledgered
- * `amendment` override, and composition with `periods`/`history`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   immutableGuard({
- *     collection: 'invoices',
- *     after: (r) => r.status === 'issued',   // immutable once issued
- *   }),
- * ] })
- * ```
- *
- * A record is mutable until `after(record)` holds; from then on, updates
- * and deletes throw `RecordLockedError` unless performed inside an
- * `amendment` transaction by an authorized role (the override is
- * ledgered by the guard amendment mechanism). `appendOnly: true` is
- * shorthand for `after: () => true` — immutable from creation.
- */
-
-interface ImmutableGuardConfig<T extends Record<string, unknown>> {
-    /** The collection to make WORM. */
-    collection: string;
-    /**
-     * A record becomes immutable once this predicate holds. Evaluated on
-     * the *existing* (already-persisted) record, so the write that first
-     * makes it true is still allowed; subsequent writes are blocked.
-     * Mutually exclusive with `appendOnly`.
-     */
-    after?: (record: T) => boolean;
-    /** Shorthand for `after: () => true` — immutable from creation. */
-    appendOnly?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly: it receives every {before, after} pair touching this
-     * collection in the amendment plus the guard context; throwing reverts
-     * the whole amendment and surfaces as `InvariantError`.
-     *
-     * Use this to keep a constraint inviolable EVEN under amendment — e.g.
-     * forbid deleting an issued document by re-throwing on any
-     * `before !== null && after === null` change, or assert a cross-record
-     * sum is preserved. When omitted the amendment is unconditionally
-     * allowed (the amendment itself is the sanctioned, ledgered override) —
-     * this is the backward-compatible default.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build an immutability guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
-
-/**
- * `transitionGuard` — declarative state-machine sugar over the guard
- * service.
- *
- * Any record with a lifecycle field (invoice `status`, order state,
- * ticket workflow, subscription phase) needs transition validation: a
- * write may only move the field along a declared arc. That is expressible
- * with a hand-rolled `withGuard({ check })`, but every consumer
- * re-implements the same graph lookup + error. `transitionGuard`
- * generates exactly that guard from a state graph, reusing the guard
- * machinery wholesale — `check` rejection, the ledgered `amendment`
- * override, and composition with `periods`/`history`.
- *
- * It generalizes {@link immutableGuard}: WORM is the special case "every
- * state has no outgoing arcs", i.e. `transitions` mapping each state to `[]`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   transitionGuard<Sale>({
- *     collection: 'sales', field: 'status',
- *     transitions: {                          // absence of an arc = forbidden
- *       draft: ['to_verify', 'cancelled'],
- *       to_verify: ['proforma', 'draft', 'cancelled'],
- *       proforma: ['invoiced', 'cancelled'],
- *       invoiced: ['paid'], paid: [], cancelled: [],
- *     },
- *     initial: ['draft', 'to_verify'],        // allowed status on insert
- *   }),
- * ] })
- * ```
- *
- * Semantics:
- * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in
- *   `initial`. When `initial` is omitted, any value is allowed on insert.
- * - **Update**: the arc `(existing[field] → incoming[field])` must be
- *   listed in `transitions[from]`, else `IllegalTransitionError`. A
- *   same-value write (`from === to`) is allowed when `allowIdempotent`
- *   (default `true`) — so writes that touch other fields without moving
- *   state pass.
- * - **Override**: inside an `amendment` transaction by an authorized role
- *   the check is skipped and the change is ledgered (mirrors every guard).
- *
- * The status graph is caller-supplied data — no UI, no domain logic.
- */
-
-interface TransitionGuardConfig<T extends Record<string, unknown>> {
-    /** The collection whose state field is governed. */
-    collection: string;
-    /** The state field on the record (e.g. `'status'`). */
-    field: keyof T & string;
-    /**
-     * The transition graph: each state maps to the states it may move to.
-     * A state absent from the map (or mapped to `[]`) is terminal — no
-     * outgoing arc, so any non-idempotent write from it is rejected.
-     */
-    transitions: Readonly<Record<string, readonly string[]>>;
-    /**
-     * States allowed as the initial value on insert (`existing === null`).
-     * Omit to allow any value on insert.
-     */
-    initial?: readonly string[];
-    /**
-     * Allow a same-value write (`from === to`) on update. Default `true` —
-     * lets a put that changes other fields, but not the state, through.
-     */
-    allowIdempotent?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly. When omitted the amendment is unconditionally allowed (the
-     * amendment itself is the sanctioned, ledgered override) — the
-     * backward-compatible default. Mirrors {@link immutableGuard}.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build a state-machine transition guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
-
-export { type ImmutableGuardConfig as I, type TransitionGuardConfig as T, immutableGuard as i, transitionGuard as t, withGuard as w };

package/dist/tx/index.d.ts

@@ -1,35 +0,0 @@
-import { js as TransactionInvariant, lq as TxStrategy } from '../index-Dn5GzPg_.js';
-export { lr as AmendmentTxOptions, ju as TxCollection, ec as TxContext, jw as TxVault, k$ as runTransaction } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.
- */
-
-/**
- * Options for {@link withTransactions}. Currently only commit-time
- * changeset `invariants` (see {@link TransactionInvariant}).
- */
-interface TransactionStrategyOptions {
-    /**
-     * Commit-time set-level invariants run over the changeset on every
-     * commit (ordinary AND amendment). See {@link TransactionInvariant}.
-     */
-    invariants?: ReadonlyArray<TransactionInvariant>;
-}
-/**
- * Build the default transactions strategy. Pass into
- * `createNoydb({ txStrategy: withTransactions() })` to enable
- * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).
- *
- * Supply `{ invariants }` to register commit-time changeset invariants —
- * set-level constraints that fire after the writes commit and revert the
- * transaction on a throw. Unlike `amendment.invariant`, these run for
- * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.
- */
-declare function withTransactions(opts?: TransactionStrategyOptions): TxStrategy;
-
-export { TransactionInvariant, type TransactionStrategyOptions, TxStrategy, withTransactions };

package/dist/ui/index.d.ts

@@ -1 +0,0 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-C6iHNlqJ.js';

package/dist/ulid-DRH25k3y.d.ts

@@ -1,66 +0,0 @@
-/**
- * Minimal ULID generator — zero dependencies, Web Crypto API only.
- *
- *. Used by the bundle writer to generate stable opaque
- * handles for `.noydb` containers.
- *
- * **What's a ULID?** A 128-bit identifier encoded as 26 Crockford
- * base32 characters. Layout:
- *
- * ```
- *   01HYABCDEFGHJKMNPQRSTVWXYZ
- *   |--------||---------------|
- *    48-bit     80-bit
- *    timestamp  randomness
- * ```
- *
- * The first 10 chars encode a millisecond Unix timestamp (so ULIDs
- * sort lexicographically by creation time), and the remaining 16
- * chars are random. Crockford base32 omits I/L/O/U to avoid
- * ambiguity in handwriting and URLs.
- *
- * **Why hand-roll instead of pulling in `ulid`?** The package adds
- * a dep, the implementation is ~30 lines, and the bundle module
- * is the only consumer. Adding `ulid` would also drag in its own
- * crypto polyfill that we don't need on Node 18+ or modern
- * browsers.
- *
- * **Privacy consideration:** the timestamp prefix is observable in
- * the bundle header. This is a deliberate trade-off:
- *   - Pro: lexicographic sortability lets bundle adapters list
- *     newest-first without an extra index.
- *   - Con: a casual observer can read the bundle's creation time
- *     from the handle. They cannot read it from any OTHER field
- *     (the header explicitly forbids `_exported_at`), and a
- *     creation timestamp is the same kind of metadata that
- *     filesystem mtime would already expose for a downloaded
- *     bundle. The leak is therefore equivalent to what's already
- *     visible from the file's mtime — not a new exposure.
- *
- * If a future use case needs timestamp-free handles, a v2 of the
- * format could specify "use the random portion only" without a
- * format break — `validateBundleHeader` only checks the regex
- * shape, not the encoded timestamp.
- */
-/**
- * Generate a fresh ULID. Uses `crypto.getRandomValues` for the
- * randomness portion — same Web Crypto API the rest of the
- * codebase uses for IVs and salt.
- *
- * Returns a 26-character string. Calling twice in the same
- * millisecond produces two distinct ULIDs (the random portion
- * differs); ULIDs from the same millisecond are NOT guaranteed
- * to be monotonically ordered relative to each other, only
- * relative to ULIDs from a different millisecond. The bundle
- * format never relies on intra-millisecond ordering.
- */
-declare function generateULID(): string;
-/**
- * Validate that a string is a syntactically well-formed ULID. Used
- * by the bundle header validator. Does NOT verify that the
- * timestamp portion decodes to a sensible date — the format only
- * cares about the encoding shape.
- */
-declare function isULID(value: string): boolean;
-
-export { generateULID as g, isULID as i };

package/dist/util/index.d.ts

@@ -1,79 +0,0 @@
-export { i as isDiscriminant } from '../discriminant-BN9REW3o.js';
-
-/**
- * Target-profile aware filename sanitizer.
- *
- * Pure string in / string out. No filesystem access, no I/O. Use this
- * at the boundary where a user-supplied filename meets a storage
- * destination — local FS, ZIP archive, S3 key, URL path, SMB share —
- * to defuse the canonical 14-class footgun before it reaches that
- * destination.
- *
- * ## Threat model
- *
- *   1. Path injection — `..`, NUL bytes, `\` on POSIX, absolute paths.
- *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,
- *      `COM1-9`, `LPT1-9`, with or without an extension.
- *   3. Windows reserved chars — `< > : " / \ | ? *` plus ASCII 0-31.
- *   4. Trailing `.` and ` ` on Windows / SMB.
- *   5. Unicode normalization drift — same display, different bytes →
- *      "two files with the same name" sync ghosts.
- *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`
- *      into `harmless.txt.exe`.
- *   7. URL `+` ambiguity in S3 presigned URLs.
- *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in
- *      pre-2006 readers.
- *   9-14. Length caps, leading/trailing whitespace + controls,
- *      `.DS_Store`-style hidden noise, etc.
- *
- * ## Always-on transforms (every profile)
- *
- *   - NFC normalize (`String.prototype.normalize('NFC')`).
- *   - Reject NUL — hard fail, not strip. Silent strip enables a
- *     classic truncation bypass (`safe.txt\0.exe` → `safe.txt`).
- *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).
- *   - Trim leading/trailing whitespace and ASCII control chars.
- *
- * ## Non-goals (i18n boundary policy, )
- *
- *   - No transliteration.
- *   - No locale-aware slugging.
- *   - No script-specific segmentation.
- *
- * @module
- */
-/**
- * One of seven storage destinations the sanitizer knows how to defang
- * for. Pick the most restrictive that covers your write site:
- * `'macos-smb'` is the safe default for "I don't know where these
- * files end up but they're going to a real filesystem somewhere."
- */
-type FilenameProfile = 'posix' | 'windows' | 'macos-smb' | 'zip' | 'url-path' | 's3-key' | 'opaque';
-interface SanitizeFilenameOptions {
-    /** Target-destination profile. */
-    readonly profile: FilenameProfile;
-    /**
-     * Override the per-profile length cap. Useful when leaving headroom
-     * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write
-     * site that wants 15 bytes of slack for `-1`, `-2`, …
-     */
-    readonly maxBytes?: number;
-    /**
-     * Required when `profile === 'opaque'`. The opaque profile replaces
-     * the entire input with `${opaqueId}.${ext}` (extension preserved
-     * from the input when present).
-     */
-    readonly opaqueId?: string;
-}
-/**
- * Sanitize a filename for a target-destination profile. Pure: same
- * input + options always returns the same output, no I/O.
- *
- * Returns the sanitized name. Throws {@link FilenameSanitizationError}
- * when the input cannot be made safe at all (NUL byte, empty after
- * normalization, missing `opaqueId` for the opaque profile,
- * `..` segment that would fall out of any reasonable target).
- */
-declare function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string;
-
-export { type FilenameProfile, type SanitizeFilenameOptions, sanitizeFilename };

package/dist/validators-C3lrVF-c.d.ts

@@ -1,101 +0,0 @@
-import { dW as ClassifiedEntry, dT as ClassifiedFieldSpec, dX as ClassifiedGroup } from './index-Dn5GzPg_.js';
-
-/**
- * Configuration/write errors for classified fields. @module
- *
- * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
- * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
- * with-*. Re-exported here under the same names so existing import paths
- * keep working.
- */
-
-declare class ClassifiedNeverStoredError extends Error {
-    readonly collection: string;
-    readonly field: string;
-    constructor(collection: string, field: string);
-}
-declare class ClassifiedValidationError extends Error {
-    readonly collection: string;
-    readonly field: string;
-    constructor(collection: string, field: string, detail: string);
-}
-
-/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */
-
-interface ResolvedClassified {
-    readonly byField: Record<string, ClassifiedFieldSpec>;
-    readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>;
-}
-declare function resolveClassifiedFields(collection: string, config: Record<string, ClassifiedEntry>): ResolvedClassified;
-
-/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative
- *  knobs, not read-side callbacks (design law D2/D3). @module */
-
-declare const classified: {
-    /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
-    creditCard(fields: {
-        pan: string;
-        expiry?: string;
-        cvc?: string;
-    }): ClassifiedGroup;
-    birthDate(): ClassifiedFieldSpec;
-    email(): ClassifiedFieldSpec;
-    phone(): ClassifiedFieldSpec;
-    /** Digest-only password: verify-without-reveal; never listed, never revealed.
-     *  Enumeration math is on the caller for low-entropy values — see the
-     *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
-     *
-     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-     *  `findByDigest`). Cost band you are accepting:
-     *
-     *  equal values produce equal store-visible tags: anyone with store access
-     *  learns which records share this secret and how many share each value —
-     *  never the value itself. A collection-DEK holder can additionally test
-     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-     *  answers) offline recovery of the equality partition is seconds-to-hours, not
-     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-     *  hardest primitive available; the iteration count raises the price but does
-     *  not make a low-entropy field safe. The real control for low-entropy fields
-     *  is the DOOR — do not enable `equatable` for them unless the partition being
-     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-     *  tags. */
-    password(opts?: {
-        minLength?: number;
-        rotateDays?: number;
-        notLastN?: number;
-        equatable?: true;
-    }): ClassifiedFieldSpec;
-    /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
-     *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
-     *  enumeration math to your users; add app-side rate limiting.
-     *
-     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-     *  `findByDigest`). Cost band you are accepting:
-     *
-     *  equal values produce equal store-visible tags: anyone with store access
-     *  learns which records share this secret and how many share each value —
-     *  never the value itself. A collection-DEK holder can additionally test
-     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-     *  answers) offline recovery of the equality partition is seconds-to-hours, not
-     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-     *  hardest primitive available; the iteration count raises the price but does
-     *  not make a low-entropy field safe. The real control for low-entropy fields
-     *  is the DOOR — do not enable `equatable` for them unless the partition being
-     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-     *  tags. */
-    secretAnswer(opts?: {
-        equatable?: true;
-    }): ClassifiedFieldSpec;
-};
-
-/** Pure write-time validators. Exported so userland can validate storage:'never'
- *  fields (e.g. CVC) at capture, before dropping them. @module */
-declare function luhnCheck(pan: string): boolean;
-
-export { ClassifiedNeverStoredError as C, type ResolvedClassified as R, ClassifiedValidationError as a, classified as c, luhnCheck as l, resolveClassifiedFields as r };