@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/vault-diff-_LSIcOMv.d.ts

@@ -1,147 +0,0 @@
-import { V as Vault, cM as DiffEntry } from './index-Dn5GzPg_.js';
-
-/**
- * Vault-level diff orchestrator.
- *
- * Compares a live `Vault`'s plaintext state against a candidate state
- * (another vault, a plain `{ collection: records[] }` map, or a vault
- * dump JSON) and returns a structured `VaultDiff` plan listing the
- * records that would be added, modified, or deleted to bring the live
- * vault into the candidate's shape.
- *
- * Builds on two existing record-level helpers:
- *
- *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed
- *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for
- *      each changed field of two records. Used here for the
- *      `fieldDiffs` of every `modified` entry, and (with empty result)
- *      as the default deep-equal check.
- *
- *   2. `Vault.exportStream()` from `./vault.ts` — the canonical
- *      decrypt-and-stream-records iterator. Used to walk both sides
- *      when the candidate is itself a `Vault`. ACL-scoped: collections
- *      the caller can't read silently drop out, the same way every
- *      other plaintext-emitting export pipeline filters them.
- *
- * The new orchestration is the **vault-level** enumeration: bucket
- * each record id into added (only in candidate), deleted (only in
- * vault), or modified (in both with field changes); leave the
- * field-level granularity to the existing `diff()`.
- *
- * Use cases:
- *
- *   - Import preview (`@noy-db/as-*` `fromString` returns a plan
- *     whose body is a `VaultDiff`).
- *   - Backup verification ("does this `.noydb` bundle from yesterday
- *     match the current vault?").
- *   - Two-vault reconciliation ("what's different between Office A
- *     and Office B before we sync?").
- *   - Test assertions (golden-file testing with one-liner
- *     `expect(plan.summary).toEqual(...)`).
- *
- * @module
- */
-
-/** Per-record entry shape — added and deleted records carry only the record value. */
-interface VaultDiffEntry<T = unknown> {
-    readonly collection: string;
-    readonly id: string;
-    readonly record: T;
-    /**
-     * Unencrypted envelope metadata for the RECEIVER-side record.
-     * Populated only when `diffVault` is called with `{includeMetadata: true}`.
-     * Default: `undefined` (zero extra reads, no behavior change).
-     *
-     * Populated for `modified` (the CURRENT receiver state, before the candidate
-     * is applied) and `deleted` (the receiver envelope of the record being
-     * removed). `added` entries have no receiver envelope at diff time, so their
-     * `metadata` is always absent.
-     */
-    readonly metadata?: {
-        readonly version: number;
-        readonly timestamp: string;
-        readonly by?: string;
-        readonly source?: string;
-        readonly sourceTs?: string;
-    };
-}
-/** Modified records carry both halves of the diff plus the field-level breakdown. */
-interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {
-    /** The record as it stands in the live vault. */
-    readonly before: T;
-    /** Top-level keys whose values differ between `before` and `record`. */
-    readonly fieldsChanged: readonly string[];
-    /**
-     * Field-level diff entries from `diff(before, record)`. Reuses the
-     * existing per-record diff helper so consumers can render git-style
-     * `path: from → to` rows without re-walking the records.
-     */
-    readonly fieldDiffs: readonly DiffEntry[];
-}
-interface VaultDiff<T = unknown> {
-    readonly added: readonly VaultDiffEntry<T>[];
-    readonly modified: readonly VaultDiffModifiedEntry<T>[];
-    readonly deleted: readonly VaultDiffEntry<T>[];
-    /** Only populated when `options.includeUnchanged: true`. */
-    readonly unchanged: readonly VaultDiffEntry<T>[] | undefined;
-    readonly summary: {
-        readonly add: number;
-        readonly modify: number;
-        readonly delete: number;
-        readonly total: number;
-    };
-    /**
-     * Format the diff as a human-readable string.
-     *
-     *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)
-     *   - `'one-line'` — count plus a single overview line
-     *   - `'full'`    — count + one row per added/modified/deleted record (default)
-     */
-    format(opts?: {
-        detail?: 'count' | 'one-line' | 'full';
-    }): string;
-}
-interface DiffOptions {
-    /** Restrict the diff to a subset of collections. */
-    readonly collections?: readonly string[];
-    /** Field on each record that carries its id. Defaults to `'id'`. */
-    readonly idKey?: string;
-    /** Override the default deep-equal check for "modified vs unchanged". */
-    readonly compareFn?: (a: unknown, b: unknown) => boolean;
-    /** If true, include unchanged records in the diff (off by default to save memory). */
-    readonly includeUnchanged?: boolean;
-    /**
-     * When `true`, each entry in `added`, `modified`, and `deleted` will carry a
-     * `metadata` field with the RECEIVER-side envelope metadata
-     * (`version`, `timestamp`, `by?`, `source?`, `sourceTs?`).
-     *
-     * Off by default — no extra adapter reads, no behavior change for existing callers.
-     */
-    readonly includeMetadata?: boolean;
-}
-/**
- * Candidate state to diff the vault against:
- *
- *   - A `Vault` instance — both sides are walked via `exportStream()`.
- *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`
- *     produces. Useful for diffing parsed file content against the live vault.
- *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the
- *     full vault state. Parsed and reduced to the map shape above.
- */
-type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
-/**
- * Compute the diff between a live vault and a candidate state.
- *
- * Ungated shared import/merge infrastructure: the `as-*` exporters call this
- * internally from their `fromString`/import merge logic, so it is always
- * available (not behind `withCargo()`). Only `extractPartition` is a gated
- * cargo capability.
- *
- * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is
- * O(n + m) in the row count of vault + candidate. For documented
- * 1K-50K-record vaults this is fine; a streaming variant lands as a
- * follow-up if a > 100K-record consumer arrives.
- */
-declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
-
-export { type DiffCandidate as D, type VaultDiff as V, type DiffOptions as a, type VaultDiffEntry as b, type VaultDiffModifiedEntry as c, diffVault as d };

package/dist/verify-CAYGXYNO.js

@@ -1,139 +0,0 @@
-import {
-  blindedEqual,
-  evaluateKofN,
-  openVdigPayload
-} from "./chunk-5UOPIPZC.js";
-import {
-  dualReadSealedSlot
-} from "./chunk-UWZ7O4NR.js";
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
-import {
-  base64ToBuffer,
-  generateSalt
-} from "./chunk-5HZULLHE.js";
-import {
-  ClassifiedConfigError,
-  ClassifiedVerifyError
-} from "./chunk-OJ64XMPJ.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/kernel/enclave/classify/verify.ts
-async function padOnce(iter = VDIG_ITERATIONS) {
-  const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
-  await blindedEqual(dummy, dummy);
-}
-async function padFalse() {
-  await padOnce();
-  return { ok: false };
-}
-function refuseSealedResidue(collection, field) {
-  throw new ClassifiedConfigError(
-    collection,
-    `field "${field}" carries a recoverable _sealed slot but no _vdig \u2014 storage-form transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`
-  );
-}
-async function verifyDigestField(ctx, id, field, candidate, policy) {
-  const env = await ctx.getEnvelope(id);
-  if (env === null) return padFalse();
-  const blob = env._vdig?.[field];
-  if (blob === void 0) {
-    if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
-    return padFalse();
-  }
-  const cek = await ctx.resolveCek(env);
-  if (cek === void 0) return padFalse();
-  let payload;
-  try {
-    payload = await openVdigPayload(blob, cek, ctx.collection, id, field);
-  } catch {
-    return padFalse();
-  }
-  const normalized = normalizeForVerify(policy.normalize, candidate);
-  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
-  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash));
-  if (!ok) return { ok: false };
-  if (policy.rotateDays !== void 0 && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 864e5) {
-    return { ok: true, mustRotate: true };
-  }
-  return { ok: true };
-}
-async function verifyTextField(ctx, id, field, candidate, normalize) {
-  const env = await ctx.getEnvelope(id);
-  const blob = env?._sealed?.[field];
-  let stored;
-  if (env !== null && blob !== void 0) {
-    const cek = await ctx.resolveCek(env);
-    const dek = await ctx.getDEK();
-    try {
-      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
-    } catch {
-      stored = void 0;
-    }
-  }
-  await padOnce();
-  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate));
-  const b = stored !== void 0 ? new TextEncoder().encode(normalizeForVerify(normalize, stored)) : a;
-  const eq = await blindedEqual(a, b);
-  return { ok: stored !== void 0 && eq };
-}
-async function matchGroupFields(ctx, id, answers, members, opts) {
-  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {
-    throw new ClassifiedVerifyError(
-      ctx.collection,
-      "*",
-      `matchGroup min ${opts.min} out of range 1..${members.length}`
-    );
-  }
-  const normalized = /* @__PURE__ */ new Map();
-  for (const m of members) {
-    const answer = answers[m.field];
-    if (answer === void 0) continue;
-    if (typeof answer !== "string") {
-      throw new ClassifiedVerifyError(ctx.collection, m.field, "candidate must be a string");
-    }
-    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
-  }
-  const env = await ctx.getEnvelope(id);
-  if (env !== null) {
-    for (const m of members) {
-      if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
-        refuseSealedResidue(ctx.collection, m.field);
-      }
-    }
-  }
-  const cek = env !== null ? await ctx.resolveCek(env) : void 0;
-  const results = [];
-  for (const m of members) {
-    const candidate = normalized.get(m.field);
-    const blob = env?._vdig?.[m.field];
-    if (env === null || cek === void 0 || blob === void 0) {
-      await padOnce();
-      results.push(false);
-      continue;
-    }
-    try {
-      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field);
-      if (candidate === void 0) {
-        await padOnce(payload.iter);
-        results.push(false);
-        continue;
-      }
-      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
-      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
-    } catch {
-      await padOnce();
-      results.push(false);
-    }
-  }
-  return { passed: evaluateKofN(results, opts.min) };
-}
-export {
-  matchGroupFields,
-  verifyDigestField,
-  verifyTextField
-};
-//# sourceMappingURL=verify-CAYGXYNO.js.map

package/dist/verify-CAYGXYNO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && blob !== undefined) {\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const env = await ctx.getEnvelope(id)\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,KAAM,QAAO,SAAS;AAClC,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/walk-SMAE4IEI.js

@@ -1,241 +0,0 @@
-import {
-  jsonSchemaToFields
-} from "./chunk-TQ3REHVF.js";
-import {
-  derivePersistedSchema
-} from "./chunk-55LSDABW.js";
-import {
-  loadPersistedSchema
-} from "./chunk-J7OH6R4K.js";
-import "./chunk-7TAV3BFQ.js";
-import "./chunk-PVC2FBCQ.js";
-import "./chunk-5UOPIPZC.js";
-import "./chunk-UWZ7O4NR.js";
-import "./chunk-REWTMYSF.js";
-import "./chunk-VFQOE76I.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-5HZULLHE.js";
-import "./chunk-OJ64XMPJ.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/with-shape/introspection/walk.ts
-var INTERNAL_PREFIX = "_";
-var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
-async function dumpVaultSchema(vault, opts) {
-  const state = vault._introspectState();
-  const sampleSize = opts.sampleSize ?? 50;
-  const withStats = opts.withStats === true;
-  const cacheNames = [...state.collectionCache.keys()];
-  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
-  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
-  const collections = {};
-  for (const name of allNames) {
-    collections[name] = await describeCollection(state, name, sampleSize, withStats);
-  }
-  const materializedViews = describeMVs(state.mvRegistry);
-  const overlayViews = describeOverlays(state.overlayRegistry);
-  const derivations = describeDerivations(state.derivationRegistry);
-  let internal;
-  if (withStats) {
-    internal = {};
-    for (const name of KNOWN_INTERNAL_NAMES) {
-      const stats = await statsForCollection(state.adapter, state.name, name);
-      if (stats.records > 0) {
-        internal[name] = { records: stats.records, bytes: stats.bytes };
-      }
-    }
-  }
-  const snap = {
-    _noydb_snapshot: 1,
-    vault: state.name,
-    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    subsystems: state.subsystems,
-    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
-    collections,
-    materializedViews,
-    overlayViews,
-    derivations,
-    ...internal !== void 0 ? { internal } : {}
-  };
-  return snap;
-}
-async function safeListAllCollections(adapter, vault) {
-  try {
-    const snap = await adapter.loadAll(vault);
-    return Object.keys(snap);
-  } catch {
-    return [];
-  }
-}
-async function describeCollection(state, collectionName, sampleSize, withStats) {
-  let fields = {};
-  let validator;
-  const refsRaw = state.refRegistry.getOutbound(collectionName);
-  const refs = {};
-  for (const [name, desc] of Object.entries(refsRaw)) {
-    refs[name] = { target: desc.target, mode: desc.mode };
-  }
-  try {
-    const dek = await state.getDEK(collectionName);
-    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
-    if (persisted) {
-      validator = { kind: persisted.kind, source: "persisted" };
-      if (persisted.jsonSchema) {
-        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
-      }
-    }
-  } catch {
-  }
-  const liveColl = state.collectionCache.get(collectionName);
-  if (!validator) {
-    const schema = liveColl?.getSchema();
-    if (schema) {
-      try {
-        const derived = await derivePersistedSchema(schema);
-        validator = { kind: derived.kind, source: "live-validator" };
-        if (derived.jsonSchema) {
-          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
-        }
-      } catch {
-      }
-    }
-  }
-  if (Object.keys(fields).length === 0 && sampleSize > 0) {
-  }
-  const collMeta = liveColl?.getMeta();
-  const collConfig = liveColl?.getConfig();
-  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
-  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
-  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
-  let mergedConfig;
-  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
-    mergedConfig = {
-      ...collConfig ?? {},
-      ...archivePresent ? { archive: true } : {},
-      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
-    };
-  }
-  const descriptor = {
-    fields,
-    indexes: [],
-    refs,
-    ...validator ? { validator } : {},
-    ...collMeta !== void 0 ? { meta: collMeta } : {},
-    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
-  };
-  if (withStats) {
-    const stats = await statsForCollection(state.adapter, state.name, collectionName);
-    descriptor.stats = stats;
-  }
-  return descriptor;
-}
-async function statsForCollection(adapter, vault, collection) {
-  const ids = await adapter.list(vault, collection);
-  if (ids.length === 0) {
-    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
-  }
-  let total = 0;
-  let min = Number.POSITIVE_INFINITY;
-  let max = 0;
-  let oldest = "\uFFFF";
-  let newest = "";
-  for (const id of ids) {
-    const env = await adapter.get(vault, collection, id);
-    if (!env) continue;
-    const size = env._data.length;
-    total += size;
-    if (size < min) min = size;
-    if (size > max) max = size;
-    if (env._ts < oldest) oldest = env._ts;
-    if (env._ts > newest) newest = env._ts;
-  }
-  return {
-    records: ids.length,
-    bytes: total,
-    bytesAvg: Math.round(total / ids.length),
-    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
-    bytesMax: max,
-    oldest: oldest === "\uFFFF" ? "" : oldest,
-    newest
-  };
-}
-function describeMVs(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const spec = reg.spec;
-    if (!spec?.name) continue;
-    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
-    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
-    const aggregate = spec.aggregate ? Object.fromEntries(
-      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
-    ) : void 0;
-    out[spec.name] = {
-      sources,
-      ...groupBy ? { groupBy } : {},
-      ...aggregate ? { aggregate } : {},
-      refresh: spec.refresh ?? "eager"
-    };
-  }
-  return out;
-}
-function describeOverlays(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const specs = listFromRegistry(registry);
-  const out = {};
-  for (const spec of specs) {
-    const s = spec;
-    if (!s.name || !s.base || !s.overlay) continue;
-    out[s.name] = { base: s.base, overlay: s.overlay };
-  }
-  return out;
-}
-function describeDerivations(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const s = reg.spec ?? reg;
-    if (!s.source) continue;
-    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
-    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
-    out[key] = {
-      source: s.source,
-      outputs: outputCollections
-    };
-  }
-  return out;
-}
-function listFromRegistry(reg) {
-  for (const method of ["all", "list", "specs", "values"]) {
-    const fn = reg[method];
-    if (typeof fn === "function") {
-      try {
-        const out = fn.call(reg);
-        if (Array.isArray(out)) return out;
-        if (out && typeof out.values === "function") {
-          return [...out.values()];
-        }
-      } catch {
-        continue;
-      }
-    }
-  }
-  return [];
-}
-function summariseAggregateOp(value) {
-  if (value && typeof value === "object") {
-    const op = value.op ?? value.kind;
-    const field = value.field;
-    if (op && field) return `${op}(${field})`;
-    if (op) return op;
-  }
-  return String(value);
-}
-export {
-  dumpVaultSchema
-};
-//# sourceMappingURL=walk-SMAE4IEI.js.map

package/dist/with/index.d.ts

@@ -1,38 +0,0 @@
-export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { cN as UnlockedKeyring, cO as ExportFormat } from '../index-Dn5GzPg_.js';
-export { cP as BusHandler, cQ as GateDeleteEvent, cR as GateEventMap, cS as GateHandler, cT as GatePoint, cU as GatePutEvent, cV as LifecycleEventMap, cW as LifecyclePoint, cX as ServiceBus, cY as SubsystemBus } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
-import '@noy-db/attestation';
-
-/**
- * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.
- * Throws `ExportCapabilityError` if the keyring is not authorised.
- *
- * - plaintext tier requires a `format`; defaults to empty for every role.
- * - bundle tier defaults to on for owner/admin, off for others.
- */
-declare function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
-/**
- * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.
- * Throws `ImportCapabilityError` if the keyring is not authorised.
- *
- * - plaintext tier requires a `format`; default-closed for every role.
- * - bundle tier is default-closed for every role, including owner — import is
- *   more dangerous than export (corrupts vs leaks).
- */
-declare function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
-/**
- * Read-only accessor for the keyring's export capability, with role-based
- * defaults resolved. Useful for UI affordances (grey out the export button if
- * no capability) without throwing.
- */
-declare function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
-/**
- * Read-only accessor for the keyring's import capability. UI affordance —
- * returns false in every default-closed case (every role with no explicit
- * `importCapability` grant).
- */
-declare function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
-
-export { assertCanExport, assertCanImport, canExport, canImport };

package/dist/with-materialized-view-Xv1-9Bh0.d.ts

@@ -1,27 +0,0 @@
-import { cn as MaterializedViewStrategy, co as MaterializedViewStrategyHandle } from './index-Dn5GzPg_.js';
-
-/**
- * Register a materialized view: a declared query whose result is
- * persisted as a queryable collection and kept fresh as sources
- * change. Writes go through the standard `Collection.put` pipeline;
- * refresh-driven deletes route through `Collection._internalDelete` so
- * user `onDelete` guards on the output collection aren't tripped by
- * housekeeping.
- *
- * Two registration modes:
- *   - **single-source** — declare `query: (db) => Query<TRow>`; the
- *     dependency analyzer derives source collections from the plan.
- *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`
- *     plus optional `groupBy` + `aggregate`; the executor reads each
- *     arm, maps to the unified row shape, concatenates, then groups
- *     and aggregates.
- *
- * The two modes are mutually exclusive — exactly one of `query` /
- * `unionSources` must be set at registration time.
- *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2)
- * and docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION).
- */
-declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewStrategy<TRow>): MaterializedViewStrategyHandle;
-
-export { withMaterializedView as w };

package/dist/with-overlayed-view-CuWhq_-C.d.ts

@@ -1,12 +0,0 @@
-import { cp as OverlayedViewStrategy, cy as OverlayedViewStrategyHandle } from './index-Dn5GzPg_.js';
-
-/**
- * Register a read-shadow overlay: bind an MV-owned base collection to
- * a user-writable overlay so consumers can express operator-editable
- * lifecycles as one declarative block.
- *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md.
- */
-declare function withOverlayedView(spec: OverlayedViewStrategy): OverlayedViewStrategyHandle;
-
-export { withOverlayedView as w };

package/dist/with-rollup-K_iwal4b.d.ts

@@ -1,47 +0,0 @@
-import { ca as DerivationStrategy, cj as DerivationStrategyHandle } from './index-Dn5GzPg_.js';
-
-/**
- * Register a deterministic derivation: one source collection → one or
- * more typed outputs, computed by the user's `derive` function on
- * plaintext after DEK unwrap. Outputs are encrypted with the same DEK
- * as the source and written via the standard `Collection.put` path.
- *
- * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
- */
-declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(spec: DerivationStrategy<TSource, TOutputs>): DerivationStrategyHandle;
-
-/**
- * `withRollup` — aggregate many child records onto a single field of their
- * parent. The reverse of a join: instead of reading children
- * on demand, the parent carries a maintained summary.
- *
- * ```ts
- * withRollup<Sale, Buyer>({
- *   from: 'sales',          // child collection (the trigger)
- *   key: 'buyerId',         // FK on the child → parent id
- *   into: 'buyers',         // parent collection
- *   field: 'revenueByYear', // field on the parent to maintain
- *   compute: (sales) => groupSumByYear(sales, 'total'),
- * })
- * ```
- *
- * On every write OR delete of a `from` record, the parent at id `child[key]`
- * is recomputed: `compute(allChildren where child[key] === parentId)` is
- * patched onto `parent[field]`. A parent write also recomputes its own
- * aggregate (so a parent created after its children still fills in). Only the
- * `field` is touched — the rest of the parent record is never clobbered — and
- * a value-equality guard suppresses no-op writes. The aggregate is gap-free
- * with respect to child inserts, updates, and deletes.
- *
- * Desugars to a `withDerivation` strategy carrying a `rollup` marker; dispatch
- * handles it without invoking the executor. Eager-only in this slice.
- */
-declare function withRollup<TChild extends Record<string, unknown> = Record<string, unknown>, TParent extends Record<string, unknown> = Record<string, unknown>>(config: {
-    from: string;
-    key: keyof TChild & string;
-    into: string;
-    field: keyof TParent & string;
-    compute: (children: TChild[]) => unknown;
-}): DerivationStrategyHandle;
-
-export { withRollup as a, withDerivation as w };