@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-Y2OCKFZ3.js

@@ -1,80 +0,0 @@
-import {
-  FieldFrozenError,
-  InvariantError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/guards/executor.ts
-var GuardExecutor = {
-  /**
-   * Compare existing vs incoming for each `frozenFields.fields` entry
-   * when `frozenFields.when(existing)` is true. Throws
-   * `FieldFrozenError` listing every changed frozen field.
-   *
-   * @param skipFields — field names that are schema-owned computed fields.
-   *   These are excluded from the comparison because `incoming` carries the
-   *   raw user input (computed fields not yet evaluated), so comparing
-   *   `existing[field]` vs `incoming[field]` would always look like a
-   *   change even when the computed result is unchanged.
-   */
-  async checkFrozenFields(guard, id, existing, incoming, skipFields) {
-    const ff = guard.frozenFields;
-    if (!ff) return;
-    if (existing === null) return;
-    if (!ff.when(existing)) return;
-    const changed = [];
-    for (const f of ff.fields) {
-      if (skipFields?.has(String(f))) continue;
-      if (existing[f] !== incoming[f]) {
-        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
-      }
-    }
-    if (changed.length > 0) {
-      throw new FieldFrozenError(guard.collection, id, changed);
-    }
-  },
-  /**
-   * Run a single guard's invariant over its slice of the change-set.
-   * Any throw is converted to `InvariantError` unless it already is one.
-   */
-  async runInvariant(guard, changes, ctx) {
-    const amendment = guard.amendment;
-    if (!amendment) return;
-    try {
-      await amendment.invariant(changes, ctx);
-    } catch (err) {
-      if (err instanceof InvariantError) throw err;
-      throw new InvariantError(
-        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
-      );
-    }
-  }
-};
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return a === b;
-  if (typeof a !== typeof b) return false;
-  if (typeof a !== "object") return a === b;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a)) {
-    const aa = a;
-    const bb = b;
-    if (aa.length !== bb.length) return false;
-    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const ak = Object.keys(ao);
-  const bk = Object.keys(bo);
-  if (ak.length !== bk.length) return false;
-  for (const k of ak) {
-    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-    if (!deepEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-
-export {
-  GuardExecutor
-};
-//# sourceMappingURL=chunk-Y2OCKFZ3.js.map

package/dist/chunk-YBFOBRTO.js

@@ -1,367 +0,0 @@
-import {
-  loadVaultPolicy,
-  saveVaultPolicy
-} from "./chunk-X66MXMR5.js";
-import {
-  PolicyDeniedError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-party/policy/presets.ts
-var PERSONAL_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 6,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      // Any second factor satisfies the gate — off-device kinds (TOTP,
-      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;
-      // platform-bound kinds (platform WebAuthn, password, PIN) are
-      // accepted because requiring "something off-device" is overkill
-      // for personal/SMB threat models. Consumers needing the off-device
-      // guarantee should use STRICT_POLICY or override this gate.
-      factors: [{
-        anyOf: [
-          "totp",
-          "email-otp",
-          "recovery",
-          "webauthn-roaming",
-          "webauthn-platform",
-          "password",
-          "pin"
-        ]
-      }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: deliberate paper-sheet regeneration
-    // when the user remembers their passphrase. PERSONAL allows tier-1 —
-    // knowing the passphrase is enough.
-    "rotate-recovery": { minTier: 1 },
-    "enroll-authenticator": { minTier: 1 },
-    "remove-authenticator": { minTier: 1 },
-    // update-authenticator: meta-only mutation (slot rename, label
-    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
-    // unlock alone. The structural anti-slot-swap guard inside the
-    // implementation enforces wrap-material/id/method immutability
-    // regardless of this gate's settings.
-    "update-authenticator": { minTier: 1 },
-    "rotate-unlock": { minTier: 2 },
-    "enroll-user": { minTier: 1 },
-    "revoke-user": { minTier: 1 },
-    // Peer-recovery is a high-trust intentional op — co-owners
-    // recovering each other should not need an off-device factor in
-    // the personal/SMB threat model (the partner is already vetted by
-    // virtue of being a co-owner). Tier-1 unlock is the floor; the
-    // STRICT preset adds a recovery/email-OTP requirement.
-    "peer-recover-user": { minTier: 1 },
-    // update-user: post-grant identity mutation (role/displayName/
-    // permissions). PERSONAL_POLICY treats this on par with enroll-user
-    // / revoke-user — tier-1 unlock alone. The role-elevation guard
-    // inside the implementation is the structural backstop that this
-    // gate's settings cannot weaken.
-    "update-user": { minTier: 1 },
-    "export-bundle": { minTier: 1 },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // edit-own-profile: tier 3 floor — any active session can edit their
-    //   own profile/preferences. Tightening to require a TOTP for
-    //   profile changes is a one-line override.
-    // view-team-profiles: tier 2 floor — an authenticated session can
-    //   read teammates' profiles (display names, avatars, locales).
-    //   Setting `enabled: false` makes vault.user.list() return only
-    //   self (privacy-strict opt-out).
-    "edit-own-profile": { minTier: 3 },
-    "view-team-profiles": { minTier: 2 },
-    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE
-    // withdrawal (export-and-delete/freeze). Fail-closed by default —
-    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).
-    // Listed explicitly (not just relying on the built-in default) so it is
-    // discoverable in describeGate / policy dumps.
-    "client-unilateral-withdraw": { minTier: 1, enabled: false },
-    // Two-party withdrawal: filing a request is non-destructive
-    // (tier-1, enabled so a read-only client can ask); deciding it is the
-    // destructive step (tier-2 floor + owner/admin role, enforced in code).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": { minTier: 2 }
-  }
-});
-var STRICT_POLICY = Object.freeze({
-  passphrase: {
-    minWords: 8,
-    minWordLength: 3,
-    rejectRepeatedAdjacent: true
-  },
-  gates: {
-    "rotate-passphrase": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "recovery"], count: 2 }]
-    },
-    "recover-passphrase": {
-      minTier: 1,
-      enabled: true
-    },
-    // rotate-recovery: STRICT requires an off-device factor —
-    // rotating recovery is an off-site-trust event; a stolen unlocked
-    // laptop must not be able to silently mint a new sheet for the
-    // attacker. Matches the `peer-recover-user` STRICT default.
-    "rotate-recovery": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp", "webauthn-roaming"] }]
-    },
-    "enroll-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "remove-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT update-authenticator: same factor floor as enroll/remove.
-    // Even though meta changes don't touch wrap material, a malicious
-    // rename could mislead the user about which device a slot
-    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
-    // shared workstation). STRICT requires a fresh factor proof.
-    "update-authenticator": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "rotate-unlock": { minTier: 1 },
-    "enroll-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "revoke-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    // STRICT peer-recovery: the issuer must present a recovery code
-    // OR a fresh off-device second factor at the moment of recovery.
-    // This binds the high-trust operation to a verifiable proof
-    // (recovery sheet photographed by an attacker won't suffice —
-    // they'd also need tier-1 unlock first; this gate is the freshness
-    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)
-    // accepted; platform-bound kinds (Touch ID, password, PIN)
-    // intentionally excluded under STRICT because they don't survive
-    // device theft — the off-device requirement is the whole point.
-    "peer-recover-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
-    },
-    // STRICT update-user: matches the enroll-user / revoke-user shape
-    // (off-device factor required). Update-user is admin-shaped — it
-    // mutates someone else's role/permissions; STRICT requires a fresh
-    // off-device factor proof so the operator affirmatively re-asserts
-    // identity at the moment of mutation. Platform-bound factors
-    // (Touch ID / password / PIN) intentionally excluded: same logic as
-    // peer-recover-user — the off-device requirement is the whole
-    // point under STRICT.
-    "update-user": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "export-bundle": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    },
-    "export-plaintext": {
-      minTier: 1,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    "view-user-auth": {
-      minTier: 1,
-      enabled: false
-    },
-    // ─── User envelope gates ──────────────────────────────────────────
-    // STRICT: profile edits require a TOTP/email-OTP factor (typical
-    // shared-workstation hardening — your name/avatar shouldn't change
-    // without a fresh second-factor proof).
-    "edit-own-profile": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }]
-    },
-    "view-team-profiles": { minTier: 2 },
-    // STRICT: still fail-closed, but if a regulated firm flips enabled:true
-    // they inherit a two-factor proof + shared-device block for the
-    // destructive withdrawal (mirrors export-plaintext's hardening).
-    "client-unilateral-withdraw": {
-      minTier: 1,
-      enabled: false,
-      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
-      warn: { sharedDevice: "block" }
-    },
-    // STRICT: filing stays tier-1; the destructive APPROVE demands an
-    // off-device factor + shared-device block (mirrors export-bundle).
-    "user-request-withdrawal": { minTier: 1 },
-    "approve-user-withdrawal": {
-      minTier: 2,
-      factors: [{ anyOf: ["totp", "email-otp"] }],
-      warn: { sharedDevice: "block" }
-    }
-  }
-});
-function mergePolicy(base, override) {
-  if (!override) return base;
-  const passphrase = override.passphrase ?? base.passphrase;
-  return {
-    ...passphrase !== void 0 ? { passphrase } : {},
-    gates: {
-      ...base.gates,
-      ...override.gates ?? {}
-    }
-  };
-}
-
-// src/with-party/policy/engine.ts
-var DEFAULT_FRESHNESS_MS = 5 * 60 * 1e3;
-async function checkGate(policy, gate, context) {
-  const configured = policy.gates[gate];
-  if (!configured) {
-    if (gate.startsWith("app:")) {
-      return;
-    }
-    throw deny(gate, "disabled", { minTier: 1, enabled: false });
-  }
-  if (configured.enabled === false) {
-    throw deny(gate, "disabled", configured);
-  }
-  if (context.activeTier > configured.minTier) {
-    throw deny(gate, "insufficient-tier", configured);
-  }
-  if (configured.factors && configured.factors.length > 0) {
-    const presented = context.factors ?? [];
-    const now = context.now ?? Date.now();
-    for (const requirement of configured.factors) {
-      const matches = countMatchingFactors(presented, requirement, now);
-      const need = requirement.count ?? 1;
-      if (matches.fresh < need) {
-        if (matches.totalKindMatches < need) {
-          throw deny(gate, "missing-factor", configured);
-        }
-        throw deny(gate, "stale-proof", configured);
-      }
-    }
-  }
-  if (configured.warn?.sharedDevice === "block" && context.sharedDevice === true) {
-    throw deny(gate, "shared-device-blocked", configured);
-  }
-}
-async function describeGate(policy, gate, context) {
-  try {
-    await checkGate(policy, gate, context);
-    return { ok: true };
-  } catch (err) {
-    if (err instanceof PolicyDeniedError) {
-      return { ok: false, reason: err.reason, required: err.required };
-    }
-    throw err;
-  }
-}
-function countMatchingFactors(presented, requirement, now) {
-  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS;
-  let totalKindMatches = 0;
-  let fresh = 0;
-  for (const proof of presented) {
-    if (!requirement.anyOf.includes(proof.kind)) continue;
-    totalKindMatches += 1;
-    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now;
-    if (Number.isFinite(minted) && now - minted <= freshnessMs) {
-      fresh += 1;
-    }
-  }
-  return { totalKindMatches, fresh };
-}
-function deny(gate, reason, required) {
-  return new PolicyDeniedError(gate, reason, required);
-}
-
-// src/with-party/policy/noydb-facade.ts
-var NoydbPolicy = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  /**
-   * Touch the policy enforcer for a vault (records activity, resets
-   * idle timer). Also touches the legacy session timer. No-op if no enforcer.
-   */
-  touchPolicy(vault) {
-    this.deps.resetSessionTimer();
-    if (vault) {
-      this.deps.policyEnforcers.get(vault)?.touch();
-    }
-  }
-  /**
-   * Check that a policy-guarded operation is permitted.
-   * Throws `SessionPolicyError` if re-auth is required.
-   */
-  checkPolicyOperation(vault, op) {
-    this.deps.policyEnforcers.get(vault)?.checkOperation(op);
-  }
-  /**
-   * Read the active policy for a vault. Loads from `_meta/policy` on
-   * first call; subsequent calls hit the in-memory cache. Throws
-   * `ValidationError` if the vault has not been opened.
-   */
-  async getPolicy(vault) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const cached = this.deps.policyCache.get(vault);
-    if (cached) return cached;
-    await this.bootstrapPolicy(vault);
-    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY;
-  }
-  /**
-   * Replace the policy document at `_meta/policy` and update the
-   * in-memory cache. Gated by the `enroll-user` policy (a policy
-   * change is fundamentally a privilege-management action).
-   */
-  async updatePolicy(vault, override) {
-    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
-    const current = await this.getPolicy(vault);
-    const merged = mergePolicy(current, override);
-    if (this.deps.encrypted) {
-      await saveVaultPolicy(this.deps.store, vault, merged);
-    }
-    this.deps.policyCache.set(vault, merged);
-    return merged;
-  }
-  /** Read or persist the vault policy at `_meta/policy` on first open. */
-  async bootstrapPolicy(vault, opts) {
-    const onDisk = await loadVaultPolicy(this.deps.store, vault);
-    if (onDisk) {
-      this.deps.policyCache.set(vault, onDisk);
-      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts);
-      return;
-    }
-    const initial = this.deps.policyOption ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption) : PERSONAL_POLICY;
-    await saveVaultPolicy(this.deps.store, vault, initial);
-    this.deps.policyCache.set(vault, initial);
-    await this.deps.assertRecoveryEnrolled(vault, initial, opts);
-  }
-};
-var createNoydbPolicy = (deps) => new NoydbPolicy(deps);
-
-export {
-  PERSONAL_POLICY,
-  STRICT_POLICY,
-  mergePolicy,
-  DEFAULT_FRESHNESS_MS,
-  checkGate,
-  describeGate,
-  createNoydbPolicy
-};
-//# sourceMappingURL=chunk-YBFOBRTO.js.map

package/dist/chunk-YLN33ADH.js

@@ -1,97 +0,0 @@
-import {
-  MaterializedViewConfigError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-formula/materialized-views/with-materialized-view.ts
-function withMaterializedView(spec) {
-  if (!spec.name || spec.name.length === 0) {
-    throw new ValidationError("withMaterializedView: name is required");
-  }
-  if (spec.query && spec.unionSources) {
-    throw new MaterializedViewConfigError(
-      "query and unionSources are mutually exclusive \u2014 pick one"
-    );
-  }
-  if (!spec.query && !spec.unionSources) {
-    throw new MaterializedViewConfigError(
-      "strategy must declare either query or unionSources"
-    );
-  }
-  if (spec.query !== void 0 && typeof spec.query !== "function") {
-    throw new ValidationError("withMaterializedView: query must be a function returning a Query<T>");
-  }
-  if (spec.unionSources) {
-    if (spec.unionSources.length < 1) {
-      throw new MaterializedViewConfigError(
-        "unionSources requires at least 1 source collection"
-      );
-    }
-    const seen = /* @__PURE__ */ new Set();
-    for (const s of spec.unionSources) {
-      if (typeof s?.collection !== "string" || s.collection.length === 0) {
-        throw new MaterializedViewConfigError(
-          "each unionSources entry must declare a non-empty `collection` string"
-        );
-      }
-      if (typeof s.map !== "function") {
-        throw new MaterializedViewConfigError(
-          `unionSources entry for "${s.collection}" is missing a \`map\` function`
-        );
-      }
-      if (seen.has(s.collection)) {
-        throw new MaterializedViewConfigError(
-          `unionSources must reference distinct collections (duplicate: "${s.collection}")`
-        );
-      }
-      seen.add(s.collection);
-    }
-    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {
-      throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": groupBy must not be an empty array \u2014 omit it or provide at least one field name`
-      );
-    }
-    if (spec.aggregate && !spec.groupBy) {
-      throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": UNION strategy with aggregate requires groupBy \u2014 use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`
-      );
-    }
-    if (spec.moneyFields && !spec.aggregate) {
-      throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": moneyFields requires aggregate \u2014 moneyFields rewrites sum/min/max reducers over money output fields, so it is meaningless without an aggregate spec`
-      );
-    }
-    if (spec.unionSources.some((s) => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {
-      throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": a unionSources arm declares join(s) but no \`sources\` are listed \u2014 declare sources: [...] with the right-side (join-target) collection names so writes to them trigger MV refresh`
-      );
-    }
-    if (spec.predicates) {
-      throw new MaterializedViewConfigError(
-        `withMaterializedView "${spec.name}": predicates are not supported on UNION strategies \u2014 UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. Use the query() form, or open an issue if per-arm predicates are needed`
-      );
-    }
-  }
-  if (spec.i18nLocale !== void 0 && spec.i18nFields === void 0) {
-    throw new MaterializedViewConfigError(
-      `withMaterializedView "${spec.name}": i18nLocale requires i18nFields \u2014 declare the i18nText descriptors of the group-key fields so they can be resolved at the mv layer before bucketing.`
-    );
-  }
-  if (typeof spec.rowKey !== "function") {
-    throw new ValidationError("withMaterializedView: rowKey is required (no default; see spec \xA7 Type surface)");
-  }
-  if (spec.refresh !== "eager" && spec.refresh !== "lazy" && spec.refresh !== "manual") {
-    throw new ValidationError(
-      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got "${String(spec.refresh)}"`
-    );
-  }
-  return {
-    __noydb_strategy: "materialized-view",
-    spec
-  };
-}
-
-export {
-  withMaterializedView
-};
-//# sourceMappingURL=chunk-YLN33ADH.js.map

package/dist/chunk-Z5YFRMG5.js

@@ -1,45 +0,0 @@
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-UNJU345Q.js";
-
-// src/kernel/enclave/record-keys/tombstone.ts
-function isTombstoneShape(envelope) {
-  return envelope._data === "" && envelope._cek === void 0 && envelope._del !== true;
-}
-function isTombstone(envelope, encrypted) {
-  if (!encrypted) return false;
-  return isTombstoneShape(envelope);
-}
-function buildTombstone(version, actor) {
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: "",
-    ...actor ? { _by: actor } : {}
-  };
-}
-function isDeleteMarker(envelope) {
-  return envelope._del === true;
-}
-function buildDeleteMarker(version, actor) {
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: "",
-    _del: true,
-    ...actor ? { _by: actor } : {}
-  };
-}
-
-export {
-  isTombstoneShape,
-  isTombstone,
-  buildTombstone,
-  isDeleteMarker,
-  buildDeleteMarker
-};
-//# sourceMappingURL=chunk-Z5YFRMG5.js.map

package/dist/chunk-ZWQFOXBR.js

@@ -1,54 +0,0 @@
-import {
-  QuiesceTimeoutError
-} from "./chunk-CU62BBRB.js";
-
-// src/port/by/types.ts
-function isQuorum(writers, generation, excludeWriterId) {
-  return writers.filter((w) => w.writerId !== excludeWriterId).every((w) => w.quiescedAtVersion === generation);
-}
-async function runDrainBarrier(provider, o, run) {
-  await provider.setFence(o.vault, { currentSchemaVersion: o.generation, fenceState: "draining" });
-  await o.onFlush();
-  const deadline = o.now() + o.quiesceTimeoutMs;
-  const seeded = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
-  if (!isQuorum(seeded, o.generation, o.writerId)) {
-    await new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (fn) => {
-        if (!settled) {
-          settled = true;
-          unsub();
-          fn();
-        }
-      };
-      const unsub = provider.observePresence(o.vault, (writers) => {
-        if (isQuorum(writers, o.generation, o.writerId)) finish(resolve);
-      });
-      const tick = async () => {
-        if (settled) return;
-        if (o.now() >= deadline) {
-          finish(
-            () => reject(
-              new QuiesceTimeoutError(
-                `Cutover of vault "${o.vault}" to generation ${o.generation} timed out after ${o.quiesceTimeoutMs}ms waiting for active writers to quiesce.`
-              )
-            )
-          );
-          return;
-        }
-        if (o.onPoll) await o.onPoll();
-        const w = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
-        if (isQuorum(w, o.generation, o.writerId)) finish(resolve);
-        else setTimeout(() => void tick(), 25);
-      };
-      void tick();
-    });
-  }
-  await run();
-}
-
-export {
-  isQuorum,
-  runDrainBarrier
-};
-//# sourceMappingURL=chunk-ZWQFOXBR.js.map

package/dist/classified/index.d.ts

@@ -1,16 +0,0 @@
-import { dS as ClassifiedFieldSpec, dT as ClassifiedStrategy } from '../index-DzhNI2vE.js';
-export { dU as ClassifiedConfigError, dV as ClassifiedEntry, dW as ClassifiedGroup, dX as ClassifiedList, dY as ClassifiedRevealCtx, dZ as ClassifiedRevealError, d_ as ClassifiedRider, d$ as ClassifiedRotationError, e0 as ClassifiedStorage, e1 as ClassifiedVerdict, e2 as ClassifiedVerifyCtx, e3 as ClassifiedVerifyError, e4 as NO_CLASSIFIED, e5 as isClassifiedFieldSpec, e6 as isClassifiedGroup } from '../index-DzhNI2vE.js';
-export { C as ClassifiedNeverStoredError, a as ClassifiedValidationError, R as ResolvedClassified, c as classified, l as luhnCheck, r as resolveClassifiedFields } from '../validators-B3SalxlJ.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/** Write-path enforcement: storage:'never' rejection + preset validators.
- *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */
-
-declare function enforceClassifiedWrite(record: Record<string, unknown>, byField: Record<string, ClassifiedFieldSpec>, collection: string): void;
-
-/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */
-declare function withClassified(): ClassifiedStrategy;
-
-export { ClassifiedFieldSpec, ClassifiedStrategy, enforceClassifiedWrite, withClassified };

package/dist/classified-marker-IO5EBW7Q.js

@@ -1,24 +0,0 @@
-import "./chunk-PZ5AY32C.js";
-
-// src/shape/via-classified/config-drift.ts
-function markerForFields(vdigFields) {
-  if (vdigFields === null || vdigFields.size === 0) return null;
-  const digestOnly = [...vdigFields.keys()];
-  return { digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true) };
-}
-async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
-  const marker = markerForFields(vdigFields);
-  if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-OVJKW7BS.js");
-  await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
-}
-async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-Y44CAPE6.js");
-  const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
-  return persisted?.classified?.digestOnly ?? [];
-}
-export {
-  persistClassifiedMarkerForFields,
-  readClassifiedMarkerDigestOnly
-};
-//# sourceMappingURL=classified-marker-IO5EBW7Q.js.map