@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/verify-GH6CWVSW.js

@@ -1,139 +0,0 @@
-import {
-  blindedEqual,
-  evaluateKofN,
-  openVdigPayload
-} from "./chunk-XQ7UYPVN.js";
-import {
-  dualReadSealedSlot
-} from "./chunk-6MWUANRF.js";
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
-import {
-  base64ToBuffer,
-  generateSalt
-} from "./chunk-AUR7MRHA.js";
-import {
-  ClassifiedConfigError,
-  ClassifiedVerifyError
-} from "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/kernel/enclave/classify/verify.ts
-async function padOnce(iter = VDIG_ITERATIONS) {
-  const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
-  await blindedEqual(dummy, dummy);
-}
-async function padFalse() {
-  await padOnce();
-  return { ok: false };
-}
-function refuseSealedResidue(collection, field) {
-  throw new ClassifiedConfigError(
-    collection,
-    `field "${field}" carries a recoverable _sealed slot but no _vdig \u2014 storage-form transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`
-  );
-}
-async function verifyDigestField(ctx, id, field, candidate, policy) {
-  const env = await ctx.getEnvelope(id);
-  if (env === null) return padFalse();
-  const blob = env._vdig?.[field];
-  if (blob === void 0) {
-    if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
-    return padFalse();
-  }
-  const cek = await ctx.resolveCek(env);
-  if (cek === void 0) return padFalse();
-  let payload;
-  try {
-    payload = await openVdigPayload(blob, cek, ctx.collection, id, field);
-  } catch {
-    return padFalse();
-  }
-  const normalized = normalizeForVerify(policy.normalize, candidate);
-  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
-  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash));
-  if (!ok) return { ok: false };
-  if (policy.rotateDays !== void 0 && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 864e5) {
-    return { ok: true, mustRotate: true };
-  }
-  return { ok: true };
-}
-async function verifyTextField(ctx, id, field, candidate, normalize) {
-  const env = await ctx.getEnvelope(id);
-  const blob = env?._sealed?.[field];
-  let stored;
-  if (env !== null && blob !== void 0) {
-    const cek = await ctx.resolveCek(env);
-    const dek = await ctx.getDEK();
-    try {
-      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
-    } catch {
-      stored = void 0;
-    }
-  }
-  await padOnce();
-  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate));
-  const b = stored !== void 0 ? new TextEncoder().encode(normalizeForVerify(normalize, stored)) : a;
-  const eq = await blindedEqual(a, b);
-  return { ok: stored !== void 0 && eq };
-}
-async function matchGroupFields(ctx, id, answers, members, opts) {
-  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {
-    throw new ClassifiedVerifyError(
-      ctx.collection,
-      "*",
-      `matchGroup min ${opts.min} out of range 1..${members.length}`
-    );
-  }
-  const normalized = /* @__PURE__ */ new Map();
-  for (const m of members) {
-    const answer = answers[m.field];
-    if (answer === void 0) continue;
-    if (typeof answer !== "string") {
-      throw new ClassifiedVerifyError(ctx.collection, m.field, "candidate must be a string");
-    }
-    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
-  }
-  const env = await ctx.getEnvelope(id);
-  if (env !== null) {
-    for (const m of members) {
-      if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
-        refuseSealedResidue(ctx.collection, m.field);
-      }
-    }
-  }
-  const cek = env !== null ? await ctx.resolveCek(env) : void 0;
-  const results = [];
-  for (const m of members) {
-    const candidate = normalized.get(m.field);
-    const blob = env?._vdig?.[m.field];
-    if (env === null || cek === void 0 || blob === void 0) {
-      await padOnce();
-      results.push(false);
-      continue;
-    }
-    try {
-      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field);
-      if (candidate === void 0) {
-        await padOnce(payload.iter);
-        results.push(false);
-        continue;
-      }
-      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
-      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
-    } catch {
-      await padOnce();
-      results.push(false);
-    }
-  }
-  return { passed: evaluateKofN(results, opts.min) };
-}
-export {
-  matchGroupFields,
-  verifyDigestField,
-  verifyTextField
-};
-//# sourceMappingURL=verify-GH6CWVSW.js.map

package/dist/verify-GH6CWVSW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && blob !== undefined) {\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const env = await ctx.getEnvelope(id)\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,KAAM,QAAO,SAAS;AAClC,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/walk-76UCFXYV.js

@@ -1,241 +0,0 @@
-import {
-  jsonSchemaToFields
-} from "./chunk-TQ3REHVF.js";
-import {
-  derivePersistedSchema
-} from "./chunk-HBTT7YQX.js";
-import {
-  loadPersistedSchema
-} from "./chunk-KXKLKJW4.js";
-import "./chunk-XHD3L3JO.js";
-import "./chunk-Z5YFRMG5.js";
-import "./chunk-XQ7UYPVN.js";
-import "./chunk-6MWUANRF.js";
-import "./chunk-2KOSJTMU.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-AUR7MRHA.js";
-import "./chunk-UNJU345Q.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-
-// src/with-shape/introspection/walk.ts
-var INTERNAL_PREFIX = "_";
-var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
-async function dumpVaultSchema(vault, opts) {
-  const state = vault._introspectState();
-  const sampleSize = opts.sampleSize ?? 50;
-  const withStats = opts.withStats === true;
-  const cacheNames = [...state.collectionCache.keys()];
-  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
-  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
-  const collections = {};
-  for (const name of allNames) {
-    collections[name] = await describeCollection(state, name, sampleSize, withStats);
-  }
-  const materializedViews = describeMVs(state.mvRegistry);
-  const overlayViews = describeOverlays(state.overlayRegistry);
-  const derivations = describeDerivations(state.derivationRegistry);
-  let internal;
-  if (withStats) {
-    internal = {};
-    for (const name of KNOWN_INTERNAL_NAMES) {
-      const stats = await statsForCollection(state.adapter, state.name, name);
-      if (stats.records > 0) {
-        internal[name] = { records: stats.records, bytes: stats.bytes };
-      }
-    }
-  }
-  const snap = {
-    _noydb_snapshot: 1,
-    vault: state.name,
-    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    subsystems: state.subsystems,
-    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
-    collections,
-    materializedViews,
-    overlayViews,
-    derivations,
-    ...internal !== void 0 ? { internal } : {}
-  };
-  return snap;
-}
-async function safeListAllCollections(adapter, vault) {
-  try {
-    const snap = await adapter.loadAll(vault);
-    return Object.keys(snap);
-  } catch {
-    return [];
-  }
-}
-async function describeCollection(state, collectionName, sampleSize, withStats) {
-  let fields = {};
-  let validator;
-  const refsRaw = state.refRegistry.getOutbound(collectionName);
-  const refs = {};
-  for (const [name, desc] of Object.entries(refsRaw)) {
-    refs[name] = { target: desc.target, mode: desc.mode };
-  }
-  try {
-    const dek = await state.getDEK(collectionName);
-    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
-    if (persisted) {
-      validator = { kind: persisted.kind, source: "persisted" };
-      if (persisted.jsonSchema) {
-        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
-      }
-    }
-  } catch {
-  }
-  const liveColl = state.collectionCache.get(collectionName);
-  if (!validator) {
-    const schema = liveColl?.getSchema();
-    if (schema) {
-      try {
-        const derived = await derivePersistedSchema(schema);
-        validator = { kind: derived.kind, source: "live-validator" };
-        if (derived.jsonSchema) {
-          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
-        }
-      } catch {
-      }
-    }
-  }
-  if (Object.keys(fields).length === 0 && sampleSize > 0) {
-  }
-  const collMeta = liveColl?.getMeta();
-  const collConfig = liveColl?.getConfig();
-  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
-  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
-  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
-  let mergedConfig;
-  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
-    mergedConfig = {
-      ...collConfig ?? {},
-      ...archivePresent ? { archive: true } : {},
-      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
-    };
-  }
-  const descriptor = {
-    fields,
-    indexes: [],
-    refs,
-    ...validator ? { validator } : {},
-    ...collMeta !== void 0 ? { meta: collMeta } : {},
-    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
-  };
-  if (withStats) {
-    const stats = await statsForCollection(state.adapter, state.name, collectionName);
-    descriptor.stats = stats;
-  }
-  return descriptor;
-}
-async function statsForCollection(adapter, vault, collection) {
-  const ids = await adapter.list(vault, collection);
-  if (ids.length === 0) {
-    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
-  }
-  let total = 0;
-  let min = Number.POSITIVE_INFINITY;
-  let max = 0;
-  let oldest = "\uFFFF";
-  let newest = "";
-  for (const id of ids) {
-    const env = await adapter.get(vault, collection, id);
-    if (!env) continue;
-    const size = env._data.length;
-    total += size;
-    if (size < min) min = size;
-    if (size > max) max = size;
-    if (env._ts < oldest) oldest = env._ts;
-    if (env._ts > newest) newest = env._ts;
-  }
-  return {
-    records: ids.length,
-    bytes: total,
-    bytesAvg: Math.round(total / ids.length),
-    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
-    bytesMax: max,
-    oldest: oldest === "\uFFFF" ? "" : oldest,
-    newest
-  };
-}
-function describeMVs(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const spec = reg.spec;
-    if (!spec?.name) continue;
-    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
-    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
-    const aggregate = spec.aggregate ? Object.fromEntries(
-      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
-    ) : void 0;
-    out[spec.name] = {
-      sources,
-      ...groupBy ? { groupBy } : {},
-      ...aggregate ? { aggregate } : {},
-      refresh: spec.refresh ?? "eager"
-    };
-  }
-  return out;
-}
-function describeOverlays(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const specs = listFromRegistry(registry);
-  const out = {};
-  for (const spec of specs) {
-    const s = spec;
-    if (!s.name || !s.base || !s.overlay) continue;
-    out[s.name] = { base: s.base, overlay: s.overlay };
-  }
-  return out;
-}
-function describeDerivations(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const s = reg.spec ?? reg;
-    if (!s.source) continue;
-    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
-    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
-    out[key] = {
-      source: s.source,
-      outputs: outputCollections
-    };
-  }
-  return out;
-}
-function listFromRegistry(reg) {
-  for (const method of ["all", "list", "specs", "values"]) {
-    const fn = reg[method];
-    if (typeof fn === "function") {
-      try {
-        const out = fn.call(reg);
-        if (Array.isArray(out)) return out;
-        if (out && typeof out.values === "function") {
-          return [...out.values()];
-        }
-      } catch {
-        continue;
-      }
-    }
-  }
-  return [];
-}
-function summariseAggregateOp(value) {
-  if (value && typeof value === "object") {
-    const op = value.op ?? value.kind;
-    const field = value.field;
-    if (op && field) return `${op}(${field})`;
-    if (op) return op;
-  }
-  return String(value);
-}
-export {
-  dumpVaultSchema
-};
-//# sourceMappingURL=walk-76UCFXYV.js.map

package/dist/with/index.d.ts

@@ -1,37 +0,0 @@
-export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { c8 as UnlockedKeyring, c9 as ExportFormat } from '../index-DzhNI2vE.js';
-export { ca as BusHandler, cb as GateDeleteEvent, cc as GateEventMap, cd as GateHandler, ce as GatePoint, cf as GatePutEvent, cg as LifecycleEventMap, ch as LifecyclePoint, ci as ServiceBus, cj as SubsystemBus } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '@noy-db/attestation';
-
-/**
- * Authorize an `@noy-db/as-*` export against the keyring's `exportCapability`.
- * Throws `ExportCapabilityError` if the keyring is not authorised.
- *
- * - plaintext tier requires a `format`; defaults to empty for every role.
- * - bundle tier defaults to on for owner/admin, off for others.
- */
-declare function assertCanExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
-/**
- * Authorize an `@noy-db/as-*` import against the keyring's `importCapability`.
- * Throws `ImportCapabilityError` if the keyring is not authorised.
- *
- * - plaintext tier requires a `format`; default-closed for every role.
- * - bundle tier is default-closed for every role, including owner — import is
- *   more dangerous than export (corrupts vs leaks).
- */
-declare function assertCanImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): void;
-/**
- * Read-only accessor for the keyring's export capability, with role-based
- * defaults resolved. Useful for UI affordances (grey out the export button if
- * no capability) without throwing.
- */
-declare function canExport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
-/**
- * Read-only accessor for the keyring's import capability. UI affordance —
- * returns false in every default-closed case (every role with no explicit
- * `importCapability` grant).
- */
-declare function canImport(keyring: UnlockedKeyring, tier: 'plaintext' | 'bundle', format?: ExportFormat): boolean;
-
-export { assertCanExport, assertCanImport, canExport, canImport };

package/dist/with-materialized-view-BP33v1Z6.d.ts

@@ -1,27 +0,0 @@
-import { bK as MaterializedViewStrategy, bL as MaterializedViewStrategyHandle } from './index-DzhNI2vE.js';
-
-/**
- * Register a materialized view: a declared query whose result is
- * persisted as a queryable collection and kept fresh as sources
- * change. Writes go through the standard `Collection.put` pipeline;
- * refresh-driven deletes route through `Collection._internalDelete` so
- * user `onDelete` guards on the output collection aren't tripped by
- * housekeeping.
- *
- * Two registration modes:
- *   - **single-source** — declare `query: (db) => Query<TRow>`; the
- *     dependency analyzer derives source collections from the plan.
- *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`
- *     plus optional `groupBy` + `aggregate`; the executor reads each
- *     arm, maps to the unified row shape, concatenates, then groups
- *     and aggregates.
- *
- * The two modes are mutually exclusive — exactly one of `query` /
- * `unionSources` must be set at registration time.
- *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md (single-source v2)
- * and docs/superpowers/specs/2026-05-21-dim14-mv-multikey-and-union.md (UNION).
- */
-declare function withMaterializedView<TRow extends Record<string, unknown>>(spec: MaterializedViewStrategy<TRow>): MaterializedViewStrategyHandle;
-
-export { withMaterializedView as w };

package/dist/with-overlayed-view-DntFpOKN.d.ts

@@ -1,12 +0,0 @@
-import { bM as OverlayedViewStrategy, bV as OverlayedViewStrategyHandle } from './index-DzhNI2vE.js';
-
-/**
- * Register a read-shadow overlay: bind an MV-owned base collection to
- * a user-writable overlay so consumers can express operator-editable
- * lifecycles as one declarative block.
- *
- * See docs/superpowers/specs/2026-05-20-dim14-mv-v2-design.md.
- */
-declare function withOverlayedView(spec: OverlayedViewStrategy): OverlayedViewStrategyHandle;
-
-export { withOverlayedView as w };

package/dist/with-rollup-ClCHO6-4.d.ts

@@ -1,47 +0,0 @@
-import { bx as DerivationStrategy, bG as DerivationStrategyHandle } from './index-DzhNI2vE.js';
-
-/**
- * Register a deterministic derivation: one source collection → one or
- * more typed outputs, computed by the user's `derive` function on
- * plaintext after DEK unwrap. Outputs are encrypted with the same DEK
- * as the source and written via the standard `Collection.put` path.
- *
- * See docs/superpowers/specs/2026-05-01-dim14-derivation-v1-design.md.
- */
-declare function withDerivation<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>>>>(spec: DerivationStrategy<TSource, TOutputs>): DerivationStrategyHandle;
-
-/**
- * `withRollup` — aggregate many child records onto a single field of their
- * parent. The reverse of a join: instead of reading children
- * on demand, the parent carries a maintained summary.
- *
- * ```ts
- * withRollup<Sale, Buyer>({
- *   from: 'sales',          // child collection (the trigger)
- *   key: 'buyerId',         // FK on the child → parent id
- *   into: 'buyers',         // parent collection
- *   field: 'revenueByYear', // field on the parent to maintain
- *   compute: (sales) => groupSumByYear(sales, 'total'),
- * })
- * ```
- *
- * On every write OR delete of a `from` record, the parent at id `child[key]`
- * is recomputed: `compute(allChildren where child[key] === parentId)` is
- * patched onto `parent[field]`. A parent write also recomputes its own
- * aggregate (so a parent created after its children still fills in). Only the
- * `field` is touched — the rest of the parent record is never clobbered — and
- * a value-equality guard suppresses no-op writes. The aggregate is gap-free
- * with respect to child inserts, updates, and deletes.
- *
- * Desugars to a `withDerivation` strategy carrying a `rollup` marker; dispatch
- * handles it without invoking the executor. Eager-only in this slice.
- */
-declare function withRollup<TChild extends Record<string, unknown> = Record<string, unknown>, TParent extends Record<string, unknown> = Record<string, unknown>>(config: {
-    from: string;
-    key: keyof TChild & string;
-    into: string;
-    field: keyof TParent & string;
-    compute: (children: TChild[]) => unknown;
-}): DerivationStrategyHandle;
-
-export { withRollup as a, withDerivation as w };

package/dist/withdraw-accessible-6J2UH3IN.js

@@ -1,28 +0,0 @@
-import {
-  FROZEN_SNAPSHOTS_COLLECTION,
-  freezeAndDeleteClosure,
-  freezeSnapshotOnly,
-  randomId,
-  withdrawAccessibleData
-} from "./chunk-GX2BYNCT.js";
-import "./chunk-OQAODTYR.js";
-import "./chunk-Q2KVKTC2.js";
-import "./chunk-KNXN47MO.js";
-import "./chunk-XHD3L3JO.js";
-import "./chunk-Z5YFRMG5.js";
-import "./chunk-XQ7UYPVN.js";
-import "./chunk-6MWUANRF.js";
-import "./chunk-2KOSJTMU.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-AUR7MRHA.js";
-import "./chunk-UNJU345Q.js";
-import "./chunk-CU62BBRB.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  FROZEN_SNAPSHOTS_COLLECTION,
-  freezeAndDeleteClosure,
-  freezeSnapshotOnly,
-  randomId,
-  withdrawAccessibleData
-};
-//# sourceMappingURL=withdraw-accessible-6J2UH3IN.js.map

package/dist/withdraw-accessible-6J2UH3IN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}