@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/chunk-2644KEGW.js

@@ -1,247 +0,0 @@
-// src/shape/via-classified/validators.ts
-function luhnCheck(pan) {
-  const digits = pan.replace(/[\s-]/g, "");
-  if (!/^\d{12,19}$/.test(digits)) return false;
-  let sum = 0;
-  for (let i = 0; i < digits.length; i++) {
-    let d = Number(digits[digits.length - 1 - i]);
-    if (i % 2 === 1) {
-      d *= 2;
-      if (d > 9) d -= 9;
-    }
-    sum += d;
-  }
-  return sum % 10 === 0;
-}
-
-// src/shape/via-classified/presets.ts
-var digitsOf = (v) => String(v).replace(/\D/g, "");
-function panSpec() {
-  return {
-    _noydbClassified: true,
-    _viaBrand: "classified",
-    preset: "creditCard.pan",
-    storage: "recoverable",
-    sensitivity: "secret",
-    list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022 ${last4}" },
-    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },
-    validate: (v) => typeof v === "string" && luhnCheck(v) ? null : "not a Luhn-valid card number"
-  };
-}
-function expirySpec() {
-  return {
-    _noydbClassified: true,
-    _viaBrand: "classified",
-    preset: "creditCard.expiry",
-    storage: "recoverable",
-    sensitivity: "pii",
-    list: { kind: "mask", pattern: "\u2022\u2022/\u2022\u2022" },
-    validate: (v) => typeof v === "string" && /^(0[1-9]|1[0-2])\/\d{2}$/.test(v) ? null : "expected MM/YY"
-  };
-}
-function cvcSpec() {
-  return {
-    _noydbClassified: true,
-    _viaBrand: "classified",
-    preset: "creditCard.cvc",
-    storage: "never",
-    sensitivity: "secret",
-    list: { kind: "omit" },
-    validate: (v) => typeof v === "string" && /^\d{3,4}$/.test(v) ? null : "expected 3-4 digits"
-  };
-}
-var classified = {
-  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
-  creditCard(fields) {
-    const members = { [fields.pan]: panSpec() };
-    if (fields.expiry !== void 0) members[fields.expiry] = expirySpec();
-    if (fields.cvc !== void 0) members[fields.cvc] = cvcSpec();
-    return { _noydbClassifiedGroup: true, _viaBrand: "classified", preset: "creditCard", members };
-  },
-  birthDate() {
-    return {
-      _noydbClassified: true,
-      _viaBrand: "classified",
-      preset: "birthDate",
-      storage: "recoverable",
-      sensitivity: "pii",
-      list: { kind: "mask", pattern: "${yob}-\u2022\u2022-\u2022\u2022" },
-      riders: { yob: (v) => String(v).slice(0, 4) },
-      validate: (v) => {
-        if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(v)) return "expected ISO yyyy-mm-dd";
-        const parts = v.split("-").map(Number);
-        const year = parts[0], month = parts[1], day = parts[2];
-        if (month < 1 || month > 12) return "not a valid calendar date";
-        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-        const isLeapYear = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
-        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1];
-        if (day < 1 || day > maxDay) return "not a valid calendar date";
-        return null;
-      }
-    };
-  },
-  email() {
-    return {
-      _noydbClassified: true,
-      _viaBrand: "classified",
-      preset: "email",
-      storage: "recoverable",
-      sensitivity: "pii",
-      list: { kind: "mask", pattern: "\u2022\u2022\u2022@${domain}" },
-      riders: { domain: (v) => String(v).split("@")[1] ?? "" },
-      validate: (v) => typeof v === "string" && v.includes("@") ? null : "expected an email address"
-    };
-  },
-  phone() {
-    return {
-      _noydbClassified: true,
-      _viaBrand: "classified",
-      preset: "phone",
-      storage: "recoverable",
-      sensitivity: "pii",
-      list: { kind: "mask", pattern: "\u2022\u2022\u2022\u2022\u2022${last2}" },
-      riders: { last2: (v) => digitsOf(v).slice(-2) },
-      validate: (v) => digitsOf(v).length >= 5 ? null : "expected at least 5 digits"
-    };
-  },
-  /** Digest-only password: verify-without-reveal; never listed, never revealed.
-   *  Enumeration math is on the caller for low-entropy values — see the
-   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
-   *
-   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-   *  `findByDigest`). Cost band you are accepting:
-   *
-   *  equal values produce equal store-visible tags: anyone with store access
-   *  learns which records share this secret and how many share each value —
-   *  never the value itself. A collection-DEK holder can additionally test
-   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-   *  answers) offline recovery of the equality partition is seconds-to-hours, not
-   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-   *  hardest primitive available; the iteration count raises the price but does
-   *  not make a low-entropy field safe. The real control for low-entropy fields
-   *  is the DOOR — do not enable `equatable` for them unless the partition being
-   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-   *  tags. */
-  password(opts = {}) {
-    const minLength = opts.minLength ?? 10;
-    const notLastN = opts.notLastN ?? 0;
-    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {
-      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented), got ${notLastN}`);
-    }
-    return {
-      _noydbClassified: true,
-      _viaBrand: "classified",
-      preset: "password",
-      storage: "digest-only",
-      sensitivity: "secret",
-      list: { kind: "omit" },
-      verifyNormalize: "password",
-      ...opts.rotateDays !== void 0 ? { rotateDays: opts.rotateDays } : {},
-      ...notLastN > 0 ? { notLastN } : {},
-      ...opts.equatable === true ? { equatable: true } : {},
-      validate: (v) => typeof v === "string" && v.normalize("NFC").length >= minLength ? null : `password must be at least ${minLength} characters`
-    };
-  },
-  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
-   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
-   *  enumeration math to your users; add app-side rate limiting.
-   *
-   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-   *  `findByDigest`). Cost band you are accepting:
-   *
-   *  equal values produce equal store-visible tags: anyone with store access
-   *  learns which records share this secret and how many share each value —
-   *  never the value itself. A collection-DEK holder can additionally test
-   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-   *  answers) offline recovery of the equality partition is seconds-to-hours, not
-   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-   *  hardest primitive available; the iteration count raises the price but does
-   *  not make a low-entropy field safe. The real control for low-entropy fields
-   *  is the DOOR — do not enable `equatable` for them unless the partition being
-   *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-   *  tags. */
-  secretAnswer(opts = {}) {
-    return {
-      _noydbClassified: true,
-      _viaBrand: "classified",
-      preset: "secretAnswer",
-      storage: "digest-only",
-      sensitivity: "secret",
-      list: { kind: "omit" },
-      verifyNormalize: "secret-answer",
-      verifyGroupMember: true,
-      ...opts.equatable === true ? { equatable: true } : {},
-      validate: (v) => typeof v === "string" && v.normalize("NFC").toLowerCase().trim().replace(/\s+/g, " ").length > 0 ? null : "secret answer must be non-empty after normalization"
-    };
-  }
-};
-
-// src/shape/via-classified/active.ts
-function policyOf(spec) {
-  return {
-    normalize: spec.verifyNormalize ?? "password",
-    notLastN: spec.notLastN ?? 0,
-    equatable: spec.equatable === true,
-    ...spec.rotateDays !== void 0 ? { rotateDays: spec.rotateDays } : {}
-  };
-}
-var engineCtx = (ctx) => ({
-  collection: ctx.collection,
-  getEnvelope: ctx.getEnvelope,
-  resolveCek: ctx.resolveCek,
-  getDEK: ctx.getDEK,
-  now: ctx.now
-});
-function withClassified() {
-  return {
-    async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-LT3I2K4P.js");
-      const value = await revealSealedField({
-        collection: ctx.collection,
-        encrypted: ctx.encrypted,
-        getEnvelope: ctx.getEnvelope,
-        resolveCek: ctx.resolveCek,
-        getDEK: ctx.getDEK
-      }, id, field);
-      await ctx.onAccess?.("reveal", id);
-      return value;
-    },
-    async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-GH6CWVSW.js");
-      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
-      await ctx.onAccess?.("verify", id);
-      return verdict;
-    },
-    async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-GH6CWVSW.js");
-      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
-      await ctx.onAccess?.("verify", id);
-      return verdict;
-    },
-    async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-GH6CWVSW.js");
-      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
-      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
-      await ctx.onAccess?.("verify", id);
-      return result;
-    },
-    async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-FISGUWSK.js");
-      const dek = await ctx.getDEK();
-      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
-    }
-  };
-}
-
-export {
-  luhnCheck,
-  classified,
-  withClassified
-};
-//# sourceMappingURL=chunk-2644KEGW.js.map

package/dist/chunk-2644KEGW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shape/via-classified/validators.ts","../src/shape/via-classified/presets.ts","../src/shape/via-classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../kernel/enclave/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../kernel/enclave/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../kernel/enclave/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;AClJA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAyC;AAClF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAAyC;AACnF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAAuC;AAClF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-2HVUKRNE.js

@@ -1,21 +0,0 @@
-import {
-  SealedRecordNotEnabledError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-audit/sealed-record/strategy.ts
-var NO_SEALED_RECORD = {
-  async sealRecordToHost() {
-    throw new SealedRecordNotEnabledError();
-  },
-  async revokeSealedRecord() {
-    throw new SealedRecordNotEnabledError();
-  },
-  async rotateRecordCek() {
-    throw new SealedRecordNotEnabledError();
-  }
-};
-
-export {
-  NO_SEALED_RECORD
-};
-//# sourceMappingURL=chunk-2HVUKRNE.js.map

package/dist/chunk-2KOSJTMU.js

@@ -1,69 +0,0 @@
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
-import {
-  bufferToBase64
-} from "./chunk-AUR7MRHA.js";
-
-// src/kernel/enclave/classify/bidx.ts
-var subtle = globalThis.crypto.subtle;
-var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
-var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
-var COST_BYTE_V1 = 1;
-var CURRENT_COST_BYTE = COST_BYTE_V1;
-function iterationsForCostByte(b) {
-  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
-  return null;
-}
-async function deriveClassifyIndexKey(dek, collection, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
-  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
-  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-}
-async function deriveClassifyIndexSalt(dek, collection, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
-  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
-  return new Uint8Array(bits);
-}
-async function mintAt(normalized, dek, collection, field, costByte) {
-  const iterations = iterationsForCostByte(costByte);
-  if (iterations == null) {
-    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
-  }
-  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
-  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
-  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
-  const mac = await subtle.sign("HMAC", kIdx, inner);
-  const tag = new Uint8Array(1 + 32);
-  tag[0] = costByte;
-  tag.set(new Uint8Array(mac), 1);
-  return bufferToBase64(tag);
-}
-async function mintBidxTag(normalized, dek, collection, field) {
-  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
-}
-
-// src/kernel/enclave/classify/find.ts
-async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
-  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
-  const iters = iterationsForCostByte(resolvedCostByte);
-  if (iters === null) return null;
-  const normalized = normalizeForVerify(normalize, candidate);
-  return mintAt(normalized, dek, collection, field, resolvedCostByte);
-}
-
-export {
-  deriveClassifyIndexKey,
-  deriveClassifyIndexSalt,
-  mintBidxTag,
-  computeBidxTarget
-};
-//# sourceMappingURL=chunk-2KOSJTMU.js.map

package/dist/chunk-2UQ4RMHV.js

@@ -1,167 +0,0 @@
-import {
-  canonicalize,
-  derivePersistedSchema
-} from "./chunk-HBTT7YQX.js";
-import {
-  loadPersistedSchemaEntry,
-  savePersistedSchema
-} from "./chunk-KXKLKJW4.js";
-import {
-  ConflictError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-var MAX_SCHEMA_CAS_RETRIES = 5;
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored && isEquivalent(stored, fresh)) {
-      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-    }
-    let decision = { action: "allow" };
-    const strategies = opts.strategies ?? [];
-    if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-    }
-    if (decision.action !== "allow") {
-      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-    }
-    let toSave = fresh;
-    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
-    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
-      return { written: true, skipped: false, envelope: toSave, decision };
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistClassifiedMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      classified: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-async function persistSatelliteMarker(opts) {
-  for (let attempt = 0; ; attempt++) {
-    const { version, payload: stored } = await loadPersistedSchemaEntry(
-      opts.store,
-      opts.vault,
-      opts.collectionName,
-      opts.dek
-    );
-    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
-    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
-      _noydb_schema: 1,
-      kind: "Unknown",
-      jsonSchema: null,
-      hash: null,
-      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      satellite: opts.marker
-    };
-    try {
-      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
-      return;
-    } catch (err) {
-      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
-      throw err;
-    }
-  }
-}
-function satelliteMarkersEqual(a, b) {
-  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
-}
-function markersEqual(a, b) {
-  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
-}
-function sameSet(a, b) {
-  if (a.length !== b.length) return false;
-  const s = new Set(a);
-  return b.every((x) => s.has(x));
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
-}
-
-export {
-  persistSchemaIfNeeded,
-  persistClassifiedMarker,
-  persistSatelliteMarker
-};
-//# sourceMappingURL=chunk-2UQ4RMHV.js.map

package/dist/chunk-2UQ4RMHV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/schema-update/delta.ts","../src/with-shape/schema-update/dispatch.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Classify the difference between two derived JSON Schemas.\n *\n * v1 ruleset — top-level object properties + required-ness:\n *   - additive  ⇔ only new OPTIONAL properties (no removals, no changed\n *                 properties, no new required field, no required-ness flip)\n *   - non-additive ⇔ any removal, any shape/type change, any required-ness\n *                 flip, or a new REQUIRED property\n * Deeper rules (nested objects, union widening, type narrowing) are\n * deferred. Callers only invoke this with two object schemas.\n */\nimport { canonicalize } from '../persisted-schemas/canonicalize.js'\nimport type { SchemaDelta, FieldChange } from './types.js'\n\ninterface ObjectSchema {\n  readonly properties?: Record<string, unknown>\n  readonly required?: readonly string[]\n}\n\nexport function computeSchemaDelta(\n  stored: object,\n  fresh: object,\n  collection: string,\n): SchemaDelta {\n  const a = stored as ObjectSchema\n  const b = fresh as ObjectSchema\n  const aProps = a.properties ?? {}\n  const bProps = b.properties ?? {}\n  const aReq = new Set(a.required ?? [])\n  const bReq = new Set(b.required ?? [])\n\n  const aKeys = Object.keys(aProps)\n  const bKeys = Object.keys(bProps)\n\n  const added = bKeys.filter(k => !(k in aProps))\n  const removed = aKeys.filter(k => !(k in bProps))\n\n  const changed: FieldChange[] = []\n  for (const k of bKeys) {\n    if (!(k in aProps)) continue\n    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k])\n    const requiredChanged = aReq.has(k) !== bReq.has(k)\n    if (shapeChanged || requiredChanged) {\n      changed.push({ field: k, requiredChanged, shapeChanged })\n    }\n  }\n\n  let kind: SchemaDelta['kind']\n  if (added.length === 0 && removed.length === 0 && changed.length === 0) {\n    kind = 'none'\n  } else if (\n    removed.length === 0 &&\n    changed.length === 0 &&\n    added.every(k => !bReq.has(k))\n  ) {\n    kind = 'additive'\n  } else {\n    kind = 'non-additive'\n  }\n\n  return { collection, kind, added, removed, changed }\n}\n","/** Ordered strategy evaluation: first non-`allow` decision wins. */\nimport type { SchemaDelta, SchemaUpdateStrategy, UpdateContext, UpdateDecision } from './types.js'\n\nexport async function evaluateStrategies(\n  delta: SchemaDelta,\n  strategies: readonly SchemaUpdateStrategy[],\n  ctx: UpdateContext,\n): Promise<UpdateDecision> {\n  for (const strategy of strategies) {\n    const decision = await strategy.onSchemaDelta(delta, ctx)\n    if (decision.action !== 'allow') return decision\n  }\n  return { action: 'allow' }\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport type { SchemaUpdateStrategy, UpdateDecision } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Run update strategies only when we\n    // have a comparable JSON-Schema baseline and strategies were registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    if (\n      stored &&\n      strategies.length > 0 &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (err instanceof ConflictError && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;AAmBO,SAAS,mBACd,QACA,OACA,YACa;AACb,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,SAAS,EAAE,cAAc,CAAC;AAChC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,QAAM,QAAQ,OAAO,KAAK,MAAM;AAEhC,QAAM,QAAQ,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAC9C,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,KAAK,OAAO;AAEhD,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,QAAS;AACpB,UAAM,eAAe,aAAa,OAAO,CAAC,CAAC,MAAM,aAAa,OAAO,CAAC,CAAC;AACvE,UAAM,kBAAkB,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;AAClD,QAAI,gBAAgB,iBAAiB;AACnC,cAAQ,KAAK,EAAE,OAAO,GAAG,iBAAiB,aAAa,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,MAAM,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW,GAAG;AACtE,WAAO;AAAA,EACT,WACE,QAAQ,WAAW,KACnB,QAAQ,WAAW,KACnB,MAAM,MAAM,OAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAC7B;AACA,WAAO;AAAA,EACT,OAAO;AACL,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,YAAY,MAAM,OAAO,SAAS,QAAQ;AACrD;;;AC1DA,eAAsB,mBACpB,OACA,YACA,KACyB;AACzB,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,MAAM,SAAS,cAAc,OAAO,GAAG;AACxD,QAAI,SAAS,WAAW,QAAS,QAAO;AAAA,EAC1C;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;;;ACqBA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MAOX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAIA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QACE,UACA,WAAW,SAAS,KACpB,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,YAAM,QAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACzF,iBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,IAC5F;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AACvF,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,UAAU,uBAAwB;AACtE,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}