@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/via/money/normalize.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Write-side and read-side normalization for money fields.
+ *
+ * - **Write** ({@link quantizeMoneyFields}): user input (`number | string`,
+ *   or `{ amount, currency }` in multi mode) → the canonical *stored*
+ *   form — a scaled-integer **digit string** (`'12345'`), or
+ *   `{ amount: '12345', currency: 'EUR' }` in multi mode. A JSON number
+ *   would truncate past 2^53, so the integer is always stored as a string.
+ * - **Read** ({@link decodeMoneyFields}): stored form → an exact decimal
+ *   string (`'123.45'`) plus, when formatting is requested, the virtual
+ *   `<field>Formatted` (locale currency string) and `<field>Number`
+ *   (convenience JS number, explicitly lossy past 2^53).
+ *
+ * Both return a shallow clone; neither mutates the input record.
+ */
+import { type MoneyDescriptor } from './descriptor.js';
+/**
+ * Canonicalize a STORED-form record's money fields for an internal
+ * callback boundary. Gate handlers (guard `check` /
+ * `frozenFields` / `onDelete`, period guard, amendment invariants) and
+ * derivation `derive(source, ctx)` callbacks are user-facing: they must
+ * see the same decoded canonical decimal that `get()` returns — the
+ * scaled-int storage form never escapes. Decoded with `'raw'` (no
+ * `<field>Formatted`/`<field>Number` virtuals): these boundaries carry
+ * no locale, and fabricating one would re-create a two-read-paths
+ * skew inside comparisons.
+ */
+export declare function canonicalizeStoredMoney(record: unknown, moneyFields: Record<string, MoneyDescriptor> | undefined): unknown;
+/**
+ * Canonicalize an INCOMING record's money fields at the top of the
+ * write pipeline. Raw user input (pre-quantize) may hold a
+ * number (`10000`), a major-unit string (`'10000.00'`), or a spread of
+ * an already-decoded read. Quantize→decode folds all three to the
+ * canonical decimal string, so gate handlers, computed-field
+ * callbacks, and schema validation all see the `get()` shape — and
+ * freeze-style guards comparing `incoming[f]` vs `existing[f]` see
+ * equal values for an unchanged field. Best-effort: input that fails
+ * to quantize passes through unchanged — the write path quantizes
+ * again after validation and surfaces the real
+ * `MoneyPrecisionError`/`TypeError`.
+ */
+export declare function canonicalizeIncomingMoney(record: unknown, moneyFields: Record<string, MoneyDescriptor> | undefined): unknown;
+/**
+ * Convert money fields in `record` from user input to their canonical
+ * stored form. Returns a shallow clone (deep along declared nested
+ * paths). A nested path whose declared shape disagrees with the
+ * data throws: writing through would store an un-quantized amount.
+ */
+export declare function quantizeMoneyFields<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>): T;
+/**
+ * The stored scaled-integer value of a money field as a `BigInt`, for
+ * exact numeric comparison (e.g. `orderBy` / sorting), or `null` when the
+ * stored value is missing/malformed. Mirrors the stored form `decodeValue`
+ * reads: a bare scaled-int (fixed mode) or `{ amount, currency }`
+ * (multi-currency). Comparison is in scaled space and is exact within a
+ * single currency/scale (the `where` / `sum` BigInt model); across
+ * currencies of different scales the raw scaled comparison is best-effort.
+ */
+export declare function moneyScaledValue(stored: unknown, desc: MoneyDescriptor): bigint | null;
+/**
+ * The `ViaBinding.canonicalizeIndexKey` implementation for money (#672) —
+ * bucket an eager index's money field entries by the BigInt-normalized
+ * scaled-int string, not the raw stored bytes, so a pre-declaration /
+ * non-canonical value (e.g. `'0100'`) lands under the SAME key a canonical
+ * write produces (`'100'`). Only FIXED-mode declared money fields
+ * participate — multi-mode stores `{ amount, currency }`, which has no
+ * single bucketable scalar (mirrors `moneyIndexProbe`'s fixed-only gate,
+ * `via/money/where.ts`). `undefined` when `field` isn't a declared
+ * fixed-mode money field, or the stored value doesn't parse — in both
+ * cases the caller falls back to the raw stringified bucket, which is
+ * exactly what the scan (`evaluateMoneyClause`) also treats as a
+ * non-match, preserving fast-path/scan parity.
+ */
+export declare function canonicalizeMoneyIndexKey(field: string, rawValue: unknown, moneyFields: Record<string, MoneyDescriptor>): string | undefined;
+/**
+ * money's `presentLate` hook (#669) — for each field in `virtualMoney` (money ∩
+ * virtual-mode computed on the SAME field), quantize the computed fn's fresh
+ * MAJOR-UNITS output to the descriptor's scale (with its declared rounding)
+ * and present it EXACTLY like a stored money field: the exact decimal string
+ * (via {@link formatScaledInt}), plus `<field>Formatted`/`<field>Number` when
+ * `locale !== 'raw'`. NEVER the scaled-int decode {@link decodeMoneyFields}
+ * runs for a genuinely-stored value — that would misread a virtual field's
+ * raw major-unit `21` as 21 SCALED units (`'0.21'`, the #665 corruption this
+ * must not reintroduce). Runs AFTER computed's `present()` (the pipeline's
+ * `presentLate` fold point, `kernel/via/pipeline.ts`), so `record[field]`
+ * already holds the fn's fresh output by the time this runs.
+ *
+ * Absent/null value → left untouched (nothing to dress). Unparseable value
+ * (fails `parseToScaledInt` — e.g. excess precision with no declared
+ * rounding) → left RAW, no throw: read-time dressing must never brick a
+ * read. Fixed-mode fields only — a virtual field's computed output has no
+ * natural `{ amount, currency }` shape to parse for multi-currency mode.
+ */
+export declare function presentVirtualMoneyFields<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>, virtualMoney: ReadonlySet<string>, locale: string | undefined): T;
+/**
+ * Convert money fields in `record` from stored form to the read shape:
+ * an exact decimal string, plus `<field>Formatted` / `<field>Number`
+ * virtuals when `locale !== 'raw'`. Returns a shallow clone (deep along
+ * declared nested paths; virtuals land as siblings inside the
+ * nested container, e.g. each `lineItems[]` element gains
+ * `amountFormatted`, except for values held directly in arrays where a
+ * scalar has no sibling slot). The decode walk is LENIENT: stored data
+ * predating a declaration change must stay readable.
+ */
+export declare function decodeMoneyFields<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>, locale: string | undefined): T;

package/dist/via/money/paths.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Nested-path support for `moneyFields` declarations.
+ *
+ * A descriptor map key is a PATH, not just a top-level field name:
+ *
+ * - `'total'`                      — top-level scalar (the original form)
+ * - `'billing.monthlyServiceFee'`  — nested object member
+ * - `'lineItems[].amount'`         — member of every element of an array
+ * - `'summary.*'`                  — every value of a record/map object
+ * - `'income[].taxWithheld'`, `'byMonth.*.amount'` — segments compose
+ *
+ * Paths are parsed ONCE, at collection registration, and a syntactically
+ * invalid declaration throws there — loudly, at setup time. (The
+ * historical failure mode this kills: a declared-but-unreachable path
+ * that was silently ignored, leaving the field un-quantized — a latent
+ * 100× bug.) A path that doesn't match a given record at write time is
+ * NOT an error — optional fields and empty arrays are legitimate — but
+ * a path segment that hits a value of the WRONG SHAPE (`[]` on a
+ * non-array, `.*` on a non-object) throws, because that means the
+ * declaration and the data model disagree.
+ */
+export type MoneyPathSegment = {
+    readonly kind: 'key';
+    readonly key: string;
+    readonly array: boolean;
+} | {
+    readonly kind: 'wildcard';
+    readonly array: boolean;
+};
+/**
+ * Parse a moneyFields path into segments. Throws `ValidationError` on
+ * bad syntax. Results are memoized — the same declared paths are walked
+ * on every write/read.
+ */
+export declare function parseMoneyPath(path: string): readonly MoneyPathSegment[];
+/** True when the path is a plain top-level field name (the fast path). */
+export declare function isSimpleMoneyPath(path: string): boolean;
+/**
+ * Validate every declared path's syntax. Call at collection
+ * registration so typos throw at setup, not silently no-op per write.
+ */
+export declare function validateMoneyFieldPaths(moneyFields: Record<string, unknown>): void;
+/**
+ * The leaf visitor: receives the (already-cloned) container holding the
+ * money value and the key/index of that value. Mutating the container
+ * is safe — every container on a matched path is a fresh clone.
+ */
+export type MoneyLeafVisitor = (container: Record<string, unknown> | unknown[], key: string | number) => void;
+/**
+ * Walk `node` along `segments`, copy-on-write-cloning every container on
+ * a matched path, and call `visit` at each leaf position. Returns the
+ * (possibly new) node; unmatched paths return the input untouched.
+ *
+ * Shape mismatches (`[]` on a non-array, `*` on a non-object) THROW on
+ * the write path — the declaration and the data model disagree, and
+ * writing through would store an un-quantized amount. On the READ path
+ * pass `lenient: true` instead: stored data predating a declaration
+ * change must stay readable, so a mismatched node is returned untouched
+ * (mirrors the defensive `continue` the flat decoder always had).
+ */
+export declare function transformAtMoneyPath(node: unknown, path: string, segments: readonly MoneyPathSegment[], index: number, visit: MoneyLeafVisitor, lenient: boolean): unknown;

package/dist/via/money/where.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Money-aware `where()` comparison.
+ *
+ * Query clauses evaluate against RAW stored records — money decode
+ * happens on output only — so a money field's stored form is a
+ * scaled-integer digit string (`'1000000'`) while the caller naturally
+ * writes the operand in major units (`10000`, `'10000.00'`). Without a
+ * rewrite the comparison is silently wrong by the scale factor, and a
+ * string-vs-number comparison is excluded by `isComparable` anyway.
+ *
+ * Two halves:
+ *
+ * - {@link moneyFieldClause} runs at QUERY BUILD time: it quantizes the
+ *   caller's major-unit operand into stored scaled-int space via the
+ *   same `parseToScaledInt` path as writes, so a malformed operand
+ *   throws at `.where()` — not silently filters everything out.
+ * - {@link evaluateMoneyClause} runs per record and compares
+ *   `BigInt`-exact in scaled space (exact past 2^53, like the rest of
+ *   the money service).
+ *
+ * Currency semantics (multi mode): an operand carries one currency —
+ * explicit via `{ amount, currency }`, or the descriptor's sole allowed
+ * currency for a bare amount. A record in a DIFFERENT currency has no
+ * defined order against the operand: it matches `!=` and nothing else.
+ */
+import { type MoneyDescriptor } from './descriptor.js';
+import type { Operator } from '../../kernel/query/predicate.js';
+/** One quantized operand value: scaled digit string + its currency. */
+interface MoneyOperandEntry {
+    readonly scaled: string;
+    readonly currency: string;
+}
+/**
+ * The opaque `via` clause payload for a `where()` over a declared money
+ * field (see `ViaBinding.buildClause` in kernel/via/index.ts). `entries` holds
+ * one element for comparison ops, two for `between` (lo, hi — same
+ * currency), N for `in`.
+ */
+export interface MoneyWhereOperand {
+    readonly mode: 'fixed' | 'multi';
+    readonly entries: ReadonlyArray<MoneyOperandEntry>;
+}
+/**
+ * Build the `via` clause payload ({@link MoneyWhereOperand}) for a
+ * `where()` over a declared money field — the `ViaBinding.buildClause`
+ * implementation for money. The operand is quantized into stored
+ * scaled-int space NOW — build time — so typos throw at the call site.
+ */
+export declare function moneyFieldClause(field: string, op: Operator, value: unknown, desc: MoneyDescriptor): MoneyWhereOperand;
+/**
+ * The `via` index-probe operand for a `where()` over a declared money
+ * field (see `ViaBinding.indexProbe` in kernel/via/index.ts) — the STORED-form
+ * value `CollectionIndexes.lookupEqual`/`lookupIn` (`with-lookup/indexing/
+ * eager-indexes.ts`) can bucket directly.
+ *
+ * Only FIXED-mode `==`/`in` are sound:
+ * - fixed-mode stores a bare scaled-int digit string (no currency
+ *   component), and `entries[i].scaled` is built by {@link parseOperand}
+ *   via the exact same `parseToScaledInt(...).value.toString()` path
+ *   `quantizeMoneyFields` (`via-money/normalize.ts#quantizeAmount`) uses
+ *   to produce the STORED value — so the two strings are byte-identical
+ *   by construction, and `stringifyKey` (which passes a string through
+ *   unchanged) buckets them the same way.
+ * - multi-mode stores `{ amount, currency }` — the index would stringify
+ *   that object to its no-match `'\0OBJECT\0'` sentinel — so multi-mode
+ *   always returns `undefined` (no sound probe).
+ * - every op besides `==`/`in` (range comparisons, `between`) has no
+ *   single stored-form value the hash index can serve, so they return
+ *   `undefined` too — the caller falls back to a scan.
+ *
+ * MIXED-ERA DATA (#672, fixed — including the #672 review's C1 finding): a
+ * record whose stored value predates the field's `money()` declaration, or
+ * otherwise bypassed `quantizeMoneyFields`, may hold a NON-canonical scaled
+ * string (e.g. `'0100'` instead of `'100'`). `CollectionIndexes` no longer
+ * buckets it under that raw string verbatim at ANY bucket-mutation site —
+ * `build`, `upsert`, and `remove` all consult the same registered
+ * canonicalizer (`ViaPipeline.canonicalizeIndexKey`; money's implementation:
+ * `canonicalizeMoneyIndexKey`, `via/money/normalize.ts`), which re-parses the
+ * stored value the same way the scan's `evaluateMoneyClause`/`readStored`
+ * does (`BigInt(actual).toString()`). So the legacy record lands in the SAME
+ * bucket a canonical write produces, an `==`/`in` probe for `'100'` finds it,
+ * and — because add and remove now agree on that bucket — a later `put()`
+ * (update) or `delete()` of that same legacy record cleans up the correct
+ * bucket instead of stranding the id under a bucket the removal could never
+ * reach. The two-string byte-identity argument above still explains WHY a
+ * canonical write's probe hits directly (no canonicalization needed for the
+ * common case); this note covers the pre-declaration tail.
+ *
+ * Boundary — CLOSED for the index layer (#677): LAZY mode's
+ * `PersistedCollectionIndex` (`with-lookup/indexing/persisted-indexes.ts`)
+ * now consults the SAME `ViaPipeline.canonicalizeIndexKey` at every
+ * bucket-mutation site (`ingest`/`upsert`/`remove`) as `CollectionIndexes`
+ * does, and its query path (`with-lookup/indexing/lazy-builder.ts`'s
+ * `resolveCandidateIds()`) canonicalizes the `==`/`in` probe value before
+ * calling `lookupEqual`/`lookupIn` — mirroring `candidateRecords()` above
+ * resolving `indexValue` before its own `lookupEqual`/`lookupIn` call. A
+ * lazy-mode mixed-era record's bucket and a canonicalized probe now agree,
+ * the same as eager mode.
+ *
+ * Residual boundary CLOSED by #684: `LazyQuery.where()` now builds
+ * `clause.via` exactly like `Query.where()`/`ScanBuilder.where()` do, and
+ * `LazyQuery`'s post-filter (`lazy-builder.ts`'s `toArray()`) runs it
+ * against the RAW record (a dedicated raw-fetch seam on `Collection`, split
+ * out of `get()`) instead of the DECODED one — `clause.via.evaluate` (this
+ * file's {@link evaluateMoneyClause}) now sees the same stored-form
+ * operand/actual-value space eager's `filterRecords` does, at any `scale`.
+ * Only survivors are decoded (`present()`) on the way out. Money RANGE
+ * clauses additionally route around `PersistedCollectionIndex.lookupRange`
+ * (raw/typed, wrong space for scaled-int money) — `resolveCandidateIds()`
+ * enumerates the field's indexed ids instead and lets this now-via-aware
+ * post-filter apply the correct BigInt-exact comparison. `lazyQuery().
+ * where()` on a money field now agrees with `scan().where()` /
+ * `query().where()` at every `scale` — for `.where()` results specifically.
+ * `orderBy` ordering is a separate, still-open lazy-vs-eager divergence,
+ * tracked in #695.
+ */
+export declare function moneyIndexProbe(op: Operator, payload: MoneyWhereOperand): unknown | undefined;
+/**
+ * Per-record evaluation of a money clause: BigInt-exact comparison in
+ * scaled-integer space. `actual` is the RAW stored field value.
+ *
+ * Missing/malformed stored values and cross-currency comparisons match
+ * `!=` only — consistent with the generic clause semantics where an
+ * absent field is "not equal" and has no defined order.
+ */
+export declare function evaluateMoneyClause(actual: unknown, op: Operator, operand: MoneyWhereOperand): boolean;
+export {};

package/dist/walk-SVNDIZ62.js

@@ -0,0 +1,241 @@
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema
+} from "./chunk-W22IKJE2.js";
+import {
+  loadPersistedSchema
+} from "./chunk-VZRODIM3.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/introspection/walk.ts
+var INTERNAL_PREFIX = "_";
+var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
+async function dumpVaultSchema(vault, opts) {
+  const state = vault._introspectState();
+  const sampleSize = opts.sampleSize ?? 50;
+  const withStats = opts.withStats === true;
+  const cacheNames = [...state.collectionCache.keys()];
+  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
+  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
+  const collections = {};
+  for (const name of allNames) {
+    collections[name] = await describeCollection(state, name, sampleSize, withStats);
+  }
+  const materializedViews = describeMVs(state.mvRegistry);
+  const overlayViews = describeOverlays(state.overlayRegistry);
+  const derivations = describeDerivations(state.derivationRegistry);
+  let internal;
+  if (withStats) {
+    internal = {};
+    for (const name of KNOWN_INTERNAL_NAMES) {
+      const stats = await statsForCollection(state.adapter, state.name, name);
+      if (stats.records > 0) {
+        internal[name] = { records: stats.records, bytes: stats.bytes };
+      }
+    }
+  }
+  const snap = {
+    _noydb_snapshot: 1,
+    vault: state.name,
+    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    subsystems: state.subsystems,
+    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
+    collections,
+    materializedViews,
+    overlayViews,
+    derivations,
+    ...internal !== void 0 ? { internal } : {}
+  };
+  return snap;
+}
+async function safeListAllCollections(adapter, vault) {
+  try {
+    const snap = await adapter.loadAll(vault);
+    return Object.keys(snap);
+  } catch {
+    return [];
+  }
+}
+async function describeCollection(state, collectionName, sampleSize, withStats) {
+  let fields = {};
+  let validator;
+  const refsRaw = state.refRegistry.getOutbound(collectionName);
+  const refs = {};
+  for (const [name, desc] of Object.entries(refsRaw)) {
+    refs[name] = { target: desc.target, mode: desc.mode };
+  }
+  try {
+    const dek = await state.getDEK(collectionName);
+    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
+    if (persisted) {
+      validator = { kind: persisted.kind, source: "persisted" };
+      if (persisted.jsonSchema) {
+        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
+      }
+    }
+  } catch {
+  }
+  const liveColl = state.collectionCache.get(collectionName);
+  if (!validator) {
+    const schema = liveColl?.getSchema();
+    if (schema) {
+      try {
+        const derived = await derivePersistedSchema(schema);
+        validator = { kind: derived.kind, source: "live-validator" };
+        if (derived.jsonSchema) {
+          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
+        }
+      } catch {
+      }
+    }
+  }
+  if (Object.keys(fields).length === 0 && sampleSize > 0) {
+  }
+  const collMeta = liveColl?.getMeta();
+  const collConfig = liveColl?.getConfig();
+  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
+  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
+  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
+  let mergedConfig;
+  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
+    mergedConfig = {
+      ...collConfig ?? {},
+      ...archivePresent ? { archive: true } : {},
+      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
+    };
+  }
+  const descriptor = {
+    fields,
+    indexes: [],
+    refs,
+    ...validator ? { validator } : {},
+    ...collMeta !== void 0 ? { meta: collMeta } : {},
+    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
+  };
+  if (withStats) {
+    const stats = await statsForCollection(state.adapter, state.name, collectionName);
+    descriptor.stats = stats;
+  }
+  return descriptor;
+}
+async function statsForCollection(adapter, vault, collection) {
+  const ids = await adapter.list(vault, collection);
+  if (ids.length === 0) {
+    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
+  }
+  let total = 0;
+  let min = Number.POSITIVE_INFINITY;
+  let max = 0;
+  let oldest = "\uFFFF";
+  let newest = "";
+  for (const id of ids) {
+    const env = await adapter.get(vault, collection, id);
+    if (!env) continue;
+    const size = env._data.length;
+    total += size;
+    if (size < min) min = size;
+    if (size > max) max = size;
+    if (env._ts < oldest) oldest = env._ts;
+    if (env._ts > newest) newest = env._ts;
+  }
+  return {
+    records: ids.length,
+    bytes: total,
+    bytesAvg: Math.round(total / ids.length),
+    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
+    bytesMax: max,
+    oldest: oldest === "\uFFFF" ? "" : oldest,
+    newest
+  };
+}
+function describeMVs(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const spec = reg.spec;
+    if (!spec?.name) continue;
+    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
+    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
+    const aggregate = spec.aggregate ? Object.fromEntries(
+      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
+    ) : void 0;
+    out[spec.name] = {
+      sources,
+      ...groupBy ? { groupBy } : {},
+      ...aggregate ? { aggregate } : {},
+      refresh: spec.refresh ?? "eager"
+    };
+  }
+  return out;
+}
+function describeOverlays(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const specs = listFromRegistry(registry);
+  const out = {};
+  for (const spec of specs) {
+    const s = spec;
+    if (!s.name || !s.base || !s.overlay) continue;
+    out[s.name] = { base: s.base, overlay: s.overlay };
+  }
+  return out;
+}
+function describeDerivations(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const s = reg.spec ?? reg;
+    if (!s.source) continue;
+    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
+    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
+    out[key] = {
+      source: s.source,
+      outputs: outputCollections
+    };
+  }
+  return out;
+}
+function listFromRegistry(reg) {
+  for (const method of ["all", "list", "specs", "values"]) {
+    const fn = reg[method];
+    if (typeof fn === "function") {
+      try {
+        const out = fn.call(reg);
+        if (Array.isArray(out)) return out;
+        if (out && typeof out.values === "function") {
+          return [...out.values()];
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+  return [];
+}
+function summariseAggregateOp(value) {
+  if (value && typeof value === "object") {
+    const op = value.op ?? value.kind;
+    const field = value.field;
+    if (op && field) return `${op}(${field})`;
+    if (op) return op;
+  }
+  return String(value);
+}
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-SVNDIZ62.js.map

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-QTXQ6RNZ.js";
-import "../chunk-6CU3FN74.js";
-import "../chunk-E5AHO65E.js";
-import "../chunk-XHD3L3JO.js";
-import "../chunk-Z5YFRMG5.js";
-import "../chunk-XQ7UYPVN.js";
-import "../chunk-6MWUANRF.js";
-import "../chunk-2KOSJTMU.js";
+} from "../chunk-6QTNZJBS.js";
+import "../chunk-J2ZX2XUV.js";
+import "../chunk-4JBYV75E.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AUR7MRHA.js";
-import "../chunk-UNJU345Q.js";
-import "../chunk-CU62BBRB.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-audit/attestation/active.d.ts

@@ -0,0 +1,10 @@
+import type { AttestationStrategy } from './strategy.js';
+/**
+ * Enable the attestation capability.
+ * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the
+ * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`
+ * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods
+ * live. The issue/revoke/signer engines are dynamically imported here, so they
+ * stay out of the floor bundle until opted in.
+ */
+export declare function withAttestation(): AttestationStrategy;

package/dist/with-audit/attestation/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @category capability
+ * Document attestation — issue side. Mint a signed, per-field commitment
+ * for a record and emit a QR credential verifiable offline via
+ * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.
+ */
+export { withAttestation } from './active.js';
+export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
+export { AttestationNotEnabledError } from '../../kernel/errors.js';
+export { issueAttestationCore } from './issue.js';
+export type { IssueContext, IssueArgs, IssueResult } from './issue.js';
+export { ATTESTATIONS_COLLECTION } from './signer.js';
+export { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js';
+export type { RevokeContext } from './revoke.js';
+export { AttestationError } from '../../kernel/errors.js';
+export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation';

package/dist/with-audit/attestation/issue.d.ts

@@ -0,0 +1,29 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type AttestationFieldSchema, type QrPayload } from '@noy-db/attestation';
+/** Everything issueAttestationCore needs from the Vault, injected for testability. */
+export interface IssueContext {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly role: string;
+    /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */
+    getDEK(): Promise<EnclaveKey>;
+    /** Decrypted source record + its envelope version, or null if absent. */
+    readRecord(collection: string, id: string): Promise<{
+        record: Record<string, unknown>;
+        version: number;
+    } | null>;
+}
+export interface IssueArgs {
+    readonly collection: string;
+    readonly id: string;
+    readonly fieldSchema: AttestationFieldSchema;
+}
+export interface IssueResult {
+    readonly docId: string;
+    readonly qr: string;
+    readonly payload: QrPayload;
+    readonly keyId: string;
+    readonly publicKeyB64: string;
+}
+export declare function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>;

package/dist/with-audit/attestation/revoke.d.ts

@@ -0,0 +1,15 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type RevocationList } from '@noy-db/attestation';
+/** Everything the revoke core needs from the Vault, injected for testability. */
+export interface RevokeContext {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly role: string;
+    /** The _attestations collection DEK. */
+    getDEK(): Promise<EnclaveKey>;
+}
+export declare function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
+export declare function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
+export declare function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]>;
+export declare function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList>;