@noy-db/hub 0.4.0-pre.6 → 0.4.0-pre.7

package/dist/{chunk-XSOGLHGY.js → chunk-6L3DKWRY.js}

@@ -201,7 +201,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-7OOT5XPD.js");
+      const { revealSealedField } = await import("./reveal-BXZGWIOP.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -213,26 +213,26 @@ function withClassified() {
       return value;
     },
     async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-5X37OXRY.js");
+      const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
       const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-5X37OXRY.js");
+      const { verifyTextField } = await import("./verify-7XWHJWUN.js");
       const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-5X37OXRY.js");
+      const { matchGroupFields } = await import("./verify-7XWHJWUN.js");
       const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
       const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
       await ctx.onAccess?.("verify", id);
       return result;
     },
     async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-LEBUXVL7.js");
+      const { computeBidxTarget } = await import("./find-OZMTRIK3.js");
       const dek = await ctx.getDEK();
       return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
     }
@@ -244,4 +244,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-XSOGLHGY.js.map
+//# sourceMappingURL=chunk-6L3DKWRY.js.map

package/dist/chunk-6LJY7X5A.js

@@ -0,0 +1,18 @@
+// src/with-shape/schema-update/gate.ts
+var SchemaUpdateGate = class {
+  #decision;
+  constructor(decision) {
+    this.#decision = decision.catch(() => null);
+  }
+  async assertWritable() {
+    const decision = await this.#decision;
+    if (decision && decision.action === "reject") {
+      throw decision.error;
+    }
+  }
+};
+
+export {
+  SchemaUpdateGate
+};
+//# sourceMappingURL=chunk-6LJY7X5A.js.map

package/dist/chunk-6LJY7X5A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/gate.ts"],"sourcesContent":["/**\n * Per-collection write gate. Holds the (async) update decision\n * computed at registration; `Collection.put`/`delete` await it before\n * writing and throw the strategy's rejection error.\n *\n * Detection FAILURE (the promise rejecting) is deliberately NOT a write\n * block — schema detection is a fingerprint safety net, not a correctness\n * invariant (matches how persisted-schema write failures are swallowed).\n * Only an explicit `reject` decision blocks writes.\n */\nimport type { UpdateDecision } from './types.js'\n\nexport class SchemaUpdateGate {\n  readonly #decision: Promise<UpdateDecision | null>\n\n  constructor(decision: Promise<UpdateDecision>) {\n    // Swallow detection failures into a non-blocking null.\n    this.#decision = decision.catch(() => null)\n  }\n\n  async assertWritable(): Promise<void> {\n    const decision = await this.#decision\n    if (decision && decision.action === 'reject') {\n      throw decision.error\n    }\n    // 'cutover' write-gating is handled by coordinatedCutover.\n  }\n}\n"],"mappings":";AAYO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAET,YAAY,UAAmC;AAE7C,SAAK,YAAY,SAAS,MAAM,MAAM,IAAI;AAAA,EAC5C;AAAA,EAEA,MAAM,iBAAgC;AACpC,UAAM,WAAW,MAAM,KAAK;AAC5B,QAAI,YAAY,SAAS,WAAW,UAAU;AAC5C,YAAM,SAAS;AAAA,IACjB;AAAA,EAEF;AACF;","names":[]}

package/dist/{chunk-44Y3P5U6.js → chunk-6M2I3DKF.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-DOZFU7OZ.js";
+} from "./chunk-GZACYEOB.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -37,4 +37,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-44Y3P5U6.js.map
+//# sourceMappingURL=chunk-6M2I3DKF.js.map

package/dist/{chunk-HDF5R2K6.js → chunk-6R6Q3MRN.js}

@@ -1,29 +1,29 @@
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-LC7DSMHR.js";
+} from "./chunk-PTHKZWEH.js";
 import {
   applyRewrappedBody,
   rewrapBodyToDek
-} from "./chunk-MMVQ3SUO.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-KCZAFDP5.js";
+} from "./chunk-VH6SOCXH.js";
 import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-DOZFU7OZ.js";
+} from "./chunk-GZACYEOB.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UnsupportedTierCompositionError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -378,4 +378,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-HDF5R2K6.js.map
+//# sourceMappingURL=chunk-6R6Q3MRN.js.map

package/dist/{chunk-ZUDAK436.js → chunk-6UBZ6I5Z.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/kernel/via/index.ts
 var binders = /* @__PURE__ */ new Map();
@@ -26,4 +26,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-ZUDAK436.js.map
+//# sourceMappingURL=chunk-6UBZ6I5Z.js.map

package/dist/{chunk-SEU6QHH4.js → chunk-6ZNSB3H6.js}

@@ -1,20 +1,9 @@
+import {
+  canonicalize
+} from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-7U6AB7DZ.js";
-
-// src/with-shape/persisted-schemas/canonicalize.ts
-function canonicalize(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return "[" + value.map(canonicalize).join(",") + "]";
-  }
-  const obj = value;
-  const keys = Object.keys(obj).sort();
-  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
-  return "{" + parts.join(",") + "}";
-}
+} from "./chunk-AKKRXT23.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -86,9 +75,8 @@ async function derivePersistedSchema(validator) {
 }
 
 export {
-  canonicalize,
   isZodSchema,
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-SEU6QHH4.js.map
+//# sourceMappingURL=chunk-6ZNSB3H6.js.map

package/dist/chunk-6ZNSB3H6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/derive.ts"],"sourcesContent":["/**\n * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1\n * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)\n * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so\n * hub never statically imports zod. Other validator families write a stub\n * envelope flagging the kind.\n *\n * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md\n *\n * @module\n */\n\nimport { canonicalize } from './canonicalize.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport type { PersistedSchemaEnvelope, PersistedSchemaKind } from './types.js'\n\n/**\n * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`\n * property (present in Zod v3.23+ and Zod v4+). Falls back to the\n * `_def.typeName` heuristic for older Zod v3 builds that predate Standard\n * Schema support.\n */\nexport function isZodSchema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  // Standard Schema v1 vendor tag — most reliable across Zod majors\n  const std = (value as { '~standard'?: { vendor?: unknown } })['~standard']\n  if (std && typeof std === 'object' && (std as { vendor?: unknown }).vendor === 'zod') return true\n  // Zod v3 fallback: _def.typeName starts with 'Zod' (e.g. 'ZodObject')\n  const def = (value as { _def?: { typeName?: unknown } })._def\n  if (!def || typeof def !== 'object') return false\n  return typeof (def as { typeName?: unknown }).typeName === 'string'\n    && ((def as { typeName: string }).typeName).startsWith('Zod')\n}\n\nfunction detectKind(validator: unknown): PersistedSchemaKind {\n  if (isZodSchema(validator)) return 'Zod'\n  return 'Unknown'\n}\n\n/**\n * Returns `true` when the validator was created with the Zod v4 native API\n * (i.e. `import { z } from 'zod'` where zod resolves to v4). Zod v4 native\n * schemas carry a `_zod` property whereas Zod v3 schemas (and the v3-compat\n * shim shipped inside zod@4 at `zod/v3`) use `_def.typeName`.\n *\n * Kept duck-typed so hub never statically imports zod.\n */\nexport function isZod4Schema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  return '_zod' in value\n}\n\n/**\n * Lazy-require `zod-to-json-schema`. Returns the converter, or throws a\n * clear error if the peer-dep isn't installed.\n */\nasync function loadZodToJsonSchemaConverter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod-to-json-schema')) as { zodToJsonSchema?: (s: unknown) => object }\n    if (!mod.zodToJsonSchema) {\n      throw new Error('zod-to-json-schema export missing')\n    }\n    return mod.zodToJsonSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema requires the optional peer-dep `zod-to-json-schema`. '\n      + 'Install it: `pnpm add zod-to-json-schema` (or npm/yarn equivalent). '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\n/**\n * Lazy-require Zod v4's built-in `toJSONSchema`. Used when the validator is a\n * Zod v4 native schema and `zod-to-json-schema` is absent or cannot handle it.\n * This is a dynamic import so it does not add a static zod dependency to hub.\n */\nasync function loadZodV4Converter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod')) as { toJSONSchema?: (s: unknown) => object }\n    if (typeof mod.toJSONSchema !== 'function') {\n      throw new Error('zod.toJSONSchema not available (zod v4 required)')\n    }\n    return mod.toJSONSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\nexport async function derivePersistedSchema(\n  validator: unknown,\n): Promise<PersistedSchemaEnvelope> {\n  const kind = detectKind(validator)\n  const derivedAt = new Date().toISOString()\n\n  if (kind === 'Zod') {\n    let jsonSchema: object\n\n    if (isZod4Schema(validator)) {\n      // Zod v4 native schemas: use zod's built-in toJSONSchema (available in\n      // zod@4) because zod-to-json-schema@3.x parses _def.typeName which is\n      // absent in native v4 schemas.\n      const convert = await loadZodV4Converter()\n      jsonSchema = convert(validator)\n    } else {\n      // Zod v3 schemas (or v3-compat shim): use the optional peer-dep\n      // zod-to-json-schema for backward compatibility.\n      const convert = await loadZodToJsonSchemaConverter()\n      jsonSchema = convert(validator)\n    }\n\n    const canonical = canonicalize(jsonSchema)\n    const hash = await sha256Hex(new TextEncoder().encode(canonical))\n    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt }\n  }\n\n  return {\n    _noydb_schema: 1,\n    kind,\n    jsonSchema: null,\n    hash: null,\n    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,\n    derivedAt,\n  }\n}\n"],"mappings":";;;;;;;;AAsBO,SAAS,YAAY,OAAyB;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,MAAO,MAAiD,WAAW;AACzE,MAAI,OAAO,OAAO,QAAQ,YAAa,IAA6B,WAAW,MAAO,QAAO;AAE7F,QAAM,MAAO,MAA4C;AACzD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,SAAO,OAAQ,IAA+B,aAAa,YACpD,IAA6B,SAAU,WAAW,KAAK;AAChE;AAEA,SAAS,WAAW,WAAyC;AAC3D,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,SAAO;AACT;AAUO,SAAS,aAAa,OAAyB;AACpD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,SAAO,UAAU;AACnB;AAMA,eAAe,+BAAgE;AAC7E,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,oBAAoB;AAC9C,QAAI,CAAC,IAAI,iBAAiB;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kKAEqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAOA,eAAe,qBAAsD;AACnE,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,mBAAK;AAC/B,QAAI,OAAO,IAAI,iBAAiB,YAAY;AAC1C,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,4FACqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,WACkC;AAClC,QAAM,OAAO,WAAW,SAAS;AACjC,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,MAAI,SAAS,OAAO;AAClB,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAI3B,YAAM,UAAU,MAAM,mBAAmB;AACzC,mBAAa,QAAQ,SAAS;AAAA,IAChC,OAAO;AAGL,YAAM,UAAU,MAAM,6BAA6B;AACnD,mBAAa,QAAQ,SAAS;AAAA,IAChC;AAEA,UAAM,YAAY,aAAa,UAAU;AACzC,UAAM,OAAO,MAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,EAAE,eAAe,GAAG,MAAM,YAAY,MAAM,UAAU;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ,yCAAyC,IAAI;AAAA,IACrD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-7U6AB7DZ.js → chunk-AKKRXT23.js}

@@ -2,7 +2,7 @@ import {
   DecryptionError,
   InvalidKeyError,
   TamperedError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/kernel/enclave/crypto.ts
 var PBKDF2_ITERATIONS = 6e5;
@@ -401,4 +401,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-7U6AB7DZ.js.map
+//# sourceMappingURL=chunk-AKKRXT23.js.map

package/dist/{chunk-2PDBYF2O.js → chunk-AT2JJEKJ.js}

@@ -1,12 +1,12 @@
 import {
   ViaGraph
-} from "./chunk-Z4D3YGAB.js";
+} from "./chunk-4ZKNC6A6.js";
 import {
   sha256Hex
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   DerivationCycleError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-formula/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive, sources) {
@@ -161,4 +161,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-2PDBYF2O.js.map
+//# sourceMappingURL=chunk-AT2JJEKJ.js.map

package/dist/chunk-AT2JJEKJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/strategy-hash.ts","../src/with-formula/derivations/registry.ts"],"sourcesContent":["/**\n * Deterministic hash of a derivation strategy's \"shape\": source\n * collection, declared sibling sources, output keys, derive function\n * source. Used to detect\n * strategy drift: a record whose `_derivedFrom.strategyHash` doesn't\n * match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeStrategyHash(\n  source: string,\n  outputKeys: readonly string[],\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  derive: (...args: any[]) => any,\n  sources?: ReadonlyArray<string>,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    source,\n    outputs: [...outputKeys].sort(),\n    derive: derive.toString(),\n    // Declared sibling sources — adding/removing a trigger\n    // collection invalidates cached derived records. Omitted when empty\n    // so strategies without siblings keep their existing hash.\n    ...(sources?.length ? { sources: [...sources].sort() } : {}),\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n","import { DerivationCycleError } from '../../kernel/errors.js'\nimport { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js'\nimport { computeStrategyHash } from './strategy-hash.js'\nimport type { DerivationSpec } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2). A derivation's\n * `derive()`/a rollup's `compute()` reads the WHOLE source record — there is\n * no single declared field to point at — so a trigger/output collection is\n * modelled as one artifact node per collection (`kernel/via/graph.ts`'s\n * \"Artifact-grain targets... modelled as a field node whose field is the\n * artifact key\" convention). MUST match `materialized-views/registry.ts`'s\n * and `vault.ts`'s overlay-edge marker so cross-registry edges (a derivation\n * feeding into / out of an MV or overlay collection) resolve to the SAME\n * graph node.\n */\nconst WHOLE_RECORD = '*'\n\n/** Strip this registry's `.${WHOLE_RECORD}` artifact suffix off a graph cycle\n *  path entry, recovering the bare collection name — preserves the exact\n *  pre-#638 `DerivationCycleError` message shape (behavior lock) for a pure\n *  record-shape derivation cycle. A rollup's real-field target (not suffixed\n *  `.${WHOLE_RECORD}`) is left untouched. */\nfunction stripArtifactSuffix(displayId: string): string {\n  const suffix = `.${WHOLE_RECORD}`\n  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId\n}\n\ninterface RegisteredStrategy {\n  // Type-erased to allow the registry to hold heterogeneous strategies.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: DerivationSpec<any, any>\n  strategyHash: string\n}\n\n/**\n * Vault-internal registry of derivation strategies. Owned by `Vault`;\n * not exported.\n *\n * @internal\n */\nexport class DerivationRegistry {\n  private readonly _bySource = new Map<string, RegisteredStrategy[]>()\n  private readonly _byOutput = new Map<string, RegisteredStrategy[]>()\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async register(spec: DerivationSpec<any, any>): Promise<void> {\n    const outputKeys = Object.keys(spec.outputs)\n    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources)\n    const reg: RegisteredStrategy = { spec, strategyHash }\n\n    const fromSource = this._bySource.get(spec.source)\n    if (fromSource) fromSource.push(reg)\n    else this._bySource.set(spec.source, [reg])\n\n    // Declared sibling sources index the SAME `reg` under each\n    // extra collection so `strategiesForSource(extra)` returns it and a\n    // sibling write re-fires the derivation. Sibling keys also enter\n    // `_bySource`, so `validate()`'s cycle DFS walks them automatically.\n    for (const extra of spec.sources ?? []) {\n      const fromExtra = this._bySource.get(extra)\n      if (fromExtra) fromExtra.push(reg)\n      else this._bySource.set(extra, [reg])\n    }\n\n    // FK triggers index the SAME `reg` under each parent collection so\n    // a parent write re-fires the derivation (fanned out to matching source\n    // records in `dispatchDerivations`). Like sources[], these keys enter\n    // `_bySource` so the cycle DFS walks the trigger→output edge.\n    for (const t of spec.triggerBy ?? []) {\n      const fromTrigger = this._bySource.get(t.collection)\n      if (fromTrigger) fromTrigger.push(reg)\n      else this._bySource.set(t.collection, [reg])\n    }\n\n    // Rollup: a write to the child `from` collection recomputes\n    // the parent (= spec.source = into) at id child[key]. Index under `from`\n    // so a child write fires it; spec.source (into) is already indexed above,\n    // so a parent write also recomputes its own aggregate (covers the\n    // parent-created-after-children case). The from→into edge enters the cycle\n    // DFS automatically.\n    if (spec.rollup) {\n      const fromRollup = this._bySource.get(spec.rollup.from)\n      if (fromRollup) fromRollup.push(reg)\n      else this._bySource.set(spec.rollup.from, [reg])\n    }\n\n    for (const key of outputKeys) {\n      const output = spec.outputs[key]\n      if (!output) continue\n      const outputCollection = output.collection\n      const arr = this._byOutput.get(outputCollection)\n      if (arr) arr.push(reg)\n      else this._byOutput.set(outputCollection, [reg])\n    }\n  }\n\n  strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy> {\n    return this._bySource.get(source) ?? []\n  }\n\n  strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy> {\n    return this._byOutput.get(collection) ?? []\n  }\n\n  /**\n   * All registered strategies as a flat, deduplicated array.\n   * Each strategy is indexed once per source (not once per output key),\n   * so iterating `_bySource.values()` naturally yields each strategy\n   * exactly once per source — deduplication is handled by flattening\n   * the per-source arrays and collecting into a Set by identity.\n   *\n   * Used by `dumpSchema()` / `describeDerivations()` in the introspection\n   * walker to populate the derivations map.\n   */\n  all(): ReadonlyArray<RegisteredStrategy> {\n    const seen = new Set<RegisteredStrategy>()\n    for (const strategies of this._bySource.values()) {\n      for (const s of strategies) seen.add(s)\n    }\n    return [...seen]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per\n   * (non-self-write) output key — target = the output collection (a\n   * `WHOLE_RECORD` artifact node), sources = every collection that can\n   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,\n   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys\n   * `register()` indexes under `_bySource`. The self-write reverse-denorm\n   * output (`output.collection === source` with `denorm` declared) is\n   * skipped — the SAME condition the old local DFS used; it is not a cycle\n   * (see the comment `validate()` used to carry, now on this skip).\n   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge\n   * targeting the real `rollup.field` on the parent (`source`) — the\n   * self-write output above only covers the cycle-DFS skip, not\n   * dispatch/taint (Tasks 3/4/6), which need the real field.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this.all()) {\n      const spec = reg.spec\n      const triggerCollections = [\n        spec.source,\n        ...(spec.sources ?? []),\n        ...(spec.triggerBy ?? []).map((t) => t.collection),\n        ...(spec.rollup ? [spec.rollup.from] : []),\n      ]\n      const sources: FieldRef[] = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }))\n      for (const key of Object.keys(spec.outputs)) {\n        const output = spec.outputs[key]\n        if (!output) continue\n        if (output.shape === 'record' && output.collection === spec.source && output.denorm !== undefined) continue\n        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: 'derivation', grain: 'record' })\n      }\n      if (spec.rollup) {\n        out.push({\n          target: { collection: spec.source, field: spec.rollup.field },\n          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],\n          kind: 'rollup',\n          grain: 'aggregate',\n        })\n      }\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). Call after all `register()` calls complete (i.e.\n   * at vault open). Throws `DerivationCycleError` on the first cycle found —\n   * SAME class/timing as before; the message/path is byte-identical to the\n   * pre-#638 shape for a pure record-shape derivation cycle (the\n   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection\n   * name before re-throwing).\n   *\n   * `graph` is the caller's shared per-vault graph, ALREADY carrying this\n   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)\n   * — omit it (e.g. this registry's own unit tests) to validate this\n   * registry's edges in isolation against a throwaway graph.\n   */\n  validate(graph?: ViaGraph): void {\n    const g = graph ?? new ViaGraph()\n    if (!graph) {\n      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain)\n    }\n    try {\n      g.assertAcyclic()\n    } catch (e) {\n      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix))\n      throw e\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAWA,eAAsB,oBACpB,QACA,YAEA,QACA,SACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK;AAAA,IAC9B,QAAQ,OAAO,SAAS;AAAA;AAAA;AAAA;AAAA,IAIxB,GAAI,SAAS,SAAS,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;;;ACbA,IAAM,eAAe;AAOrB,SAAS,oBAAoB,WAA2B;AACtD,QAAM,SAAS,IAAI,YAAY;AAC/B,SAAO,UAAU,SAAS,MAAM,IAAI,UAAU,MAAM,GAAG,CAAC,OAAO,MAAM,IAAI;AAC3E;AAeO,IAAM,qBAAN,MAAyB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,YAAY,oBAAI,IAAkC;AAAA;AAAA,EAGnE,MAAM,SAAS,MAA+C;AAC5D,UAAM,aAAa,OAAO,KAAK,KAAK,OAAO;AAC3C,UAAM,eAAe,MAAM,oBAAoB,KAAK,QAAQ,YAAY,KAAK,QAAQ,KAAK,OAAO;AACjG,UAAM,MAA0B,EAAE,MAAM,aAAa;AAErD,UAAM,aAAa,KAAK,UAAU,IAAI,KAAK,MAAM;AACjD,QAAI,WAAY,YAAW,KAAK,GAAG;AAAA,QAC9B,MAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC;AAM1C,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,YAAY,KAAK,UAAU,IAAI,KAAK;AAC1C,UAAI,UAAW,WAAU,KAAK,GAAG;AAAA,UAC5B,MAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,IACtC;AAMA,eAAW,KAAK,KAAK,aAAa,CAAC,GAAG;AACpC,YAAM,cAAc,KAAK,UAAU,IAAI,EAAE,UAAU;AACnD,UAAI,YAAa,aAAY,KAAK,GAAG;AAAA,UAChC,MAAK,UAAU,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;AAAA,IAC7C;AAQA,QAAI,KAAK,QAAQ;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI;AACtD,UAAI,WAAY,YAAW,KAAK,GAAG;AAAA,UAC9B,MAAK,UAAU,IAAI,KAAK,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,IACjD;AAEA,eAAW,OAAO,YAAY;AAC5B,YAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAI,CAAC,OAAQ;AACb,YAAM,mBAAmB,OAAO;AAChC,YAAM,MAAM,KAAK,UAAU,IAAI,gBAAgB;AAC/C,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,oBAAoB,QAAmD;AACrE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA,EAEA,0BAA0B,YAAuD;AAC/E,WAAO,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAyC;AACvC,UAAM,OAAO,oBAAI,IAAwB;AACzC,eAAW,cAAc,KAAK,UAAU,OAAO,GAAG;AAChD,iBAAW,KAAK,WAAY,MAAK,IAAI,CAAC;AAAA,IACxC;AACA,WAAO,CAAC,GAAG,IAAI;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,IAAI,GAAG;AAC5B,YAAM,OAAO,IAAI;AACjB,YAAM,qBAAqB;AAAA,QACzB,KAAK;AAAA,QACL,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,IAAI,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU;AAAA,QACjD,GAAI,KAAK,SAAS,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,MAC1C;AACA,YAAM,UAAsB,mBAAmB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,aAAa,EAAE;AAClG,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,YAAI,CAAC,OAAQ;AACb,YAAI,OAAO,UAAU,YAAY,OAAO,eAAe,KAAK,UAAU,OAAO,WAAW,OAAW;AACnG,YAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,OAAO,YAAY,OAAO,aAAa,GAAG,SAAS,MAAM,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3H;AACA,UAAI,KAAK,QAAQ;AACf,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE,YAAY,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM;AAAA,UAC5D,SAAS,CAAC,EAAE,YAAY,KAAK,OAAO,MAAM,OAAO,aAAa,CAAC;AAAA,UAC/D,MAAM;AAAA,UACN,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAwB;AAC/B,UAAM,IAAI,SAAS,IAAI,SAAS;AAChC,QAAI,CAAC,OAAO;AACV,iBAAW,QAAQ,KAAK,MAAM,EAAG,GAAE,gBAAgB,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,KAAK;AAAA,IACrG;AACA,QAAI;AACF,QAAE,cAAc;AAAA,IAClB,SAAS,GAAG;AACV,UAAI,aAAa,qBAAsB,OAAM,IAAI,qBAAqB,EAAE,KAAK,IAAI,mBAAmB,CAAC;AACrG,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-OWLZONGX.js → chunk-BLBAQRBM.js}

@@ -1,6 +1,6 @@
 import {
   PortabilityNotEnabledError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-audit/portability/strategy.ts
 var NO_PORTABILITY = {
@@ -27,4 +27,4 @@ var NO_PORTABILITY = {
 export {
   NO_PORTABILITY
 };
-//# sourceMappingURL=chunk-OWLZONGX.js.map
+//# sourceMappingURL=chunk-BLBAQRBM.js.map

package/dist/{chunk-XONZGK6J.js → chunk-BN4HRYAZ.js}

@@ -4,7 +4,7 @@ import {
   chainAnchor,
   loadPeriods,
   validatePeriodName
-} from "./chunk-IUATR5UE.js";
+} from "./chunk-N5PLUFH2.js";
 
 // src/with-audit/periods/active.ts
 function withPeriods() {
@@ -20,4 +20,4 @@ function withPeriods() {
 export {
   withPeriods
 };
-//# sourceMappingURL=chunk-XONZGK6J.js.map
+//# sourceMappingURL=chunk-BN4HRYAZ.js.map

package/dist/{chunk-QVGEVZ5F.js → chunk-BQ6DHN4I.js}

@@ -6,7 +6,7 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/kernel/best-effort-revert.ts
 async function bestEffortRevert(executed, adapter, compensate) {
@@ -231,7 +231,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-OHET7TF7.js");
+    const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -368,4 +368,4 @@ export {
   runTransaction,
   revertExecuted
 };
-//# sourceMappingURL=chunk-QVGEVZ5F.js.map
+//# sourceMappingURL=chunk-BQ6DHN4I.js.map

package/dist/{chunk-LG2GUYRX.js → chunk-BYFXLDVV.js}

@@ -1,6 +1,6 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-32467U5J.js";
+} from "./chunk-OBPVWOSQ.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -8,11 +8,11 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-2ZSC454H.js";
+} from "./chunk-NQSO4UAH.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-E7FSBI6I.js";
+} from "./chunk-SGQ4N5FS.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -23,11 +23,11 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-2BVW754E.js";
+} from "./chunk-ISRKW4YN.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-MMVQ3SUO.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   bufferToBase64,
   decrypt,
@@ -37,14 +37,14 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-DOZFU7OZ.js";
+} from "./chunk-GZACYEOB.js";
 import {
   PartitionExtractionError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -492,4 +492,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-LG2GUYRX.js.map
+//# sourceMappingURL=chunk-BYFXLDVV.js.map

package/dist/{chunk-M4GO4ZJK.js → chunk-C25JXSOR.js}

@@ -1,14 +1,17 @@
+import {
+  loadVaultPolicy
+} from "./chunk-56IIVAEO.js";
 import {
   assertStrongSecret,
   mintKeyringCanary,
   persistKeyring
-} from "./chunk-ZDFU34XY.js";
+} from "./chunk-KPXM4WO6.js";
 import {
   dekKey
-} from "./chunk-LC7DSMHR.js";
+} from "./chunk-PTHKZWEH.js";
 import {
   openEnvelopeJson
-} from "./chunk-MMVQ3SUO.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -18,11 +21,11 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-DOZFU7OZ.js";
+} from "./chunk-GZACYEOB.js";
 import {
   DelegationTargetMissingError,
   InvalidKeyError,
@@ -32,7 +35,7 @@ import {
   RecoveryProfileNotImplementedError,
   TeamNotEnabledError,
   ValidationError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/port/with/team-strategy.ts
 var NO_TEAM = {
@@ -232,7 +235,6 @@ async function unwrapDeksFromPaperEntry(entry, code) {
 // src/with-party/team/magic-link-grant.ts
 var MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
 var MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
-var MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
 async function deriveMagicLinkContentKey(serverSecret, token, vault) {
   const subtle2 = globalThis.crypto.subtle;
   const ikmBytes = serverSecret instanceof Uint8Array ? serverSecret : new TextEncoder().encode(serverSecret);
@@ -660,6 +662,129 @@ async function recoverUser(store, vault, callerKeyring, options) {
   await store.put(vault, "_keyring", options.userId, envelope);
 }
 
+// src/with-party/auth-introspection/index.ts
+async function describeAuthConfig(store, vault) {
+  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
+  const recoveryProfiles = await listRecoveryProfilesEnrolled(store, vault);
+  const lines = [];
+  lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
+  lines.push("");
+  lines.push("Tier 1 \u2014 Secret (master)");
+  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
+  lines.push("  Strength validator: enforced (override available for tests only)");
+  lines.push("");
+  lines.push("Tier 2 \u2014 Authenticate (routine login)");
+  lines.push("  Allowed methods: WebAuthn (passkey), OIDC, Password");
+  lines.push("  Slots per user: unlimited");
+  lines.push("");
+  lines.push("Tier 3 \u2014 Unlock (quick resume)");
+  lines.push("  Method: PIN (per-app configurable)");
+  lines.push("");
+  lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
+  lines.push("Managed-secret mode: off (post-1.0)");
+  lines.push("");
+  lines.push("Sensitive-action gates:");
+  for (const [gate, gp] of Object.entries(policy.gates)) {
+    lines.push(`  ${gate} \u2014 ${describeGatePolicy(gp)}`);
+  }
+  return lines.join("\n");
+}
+async function diagramAuthConfig(store, vault) {
+  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
+  const lines = [];
+  lines.push("flowchart TB");
+  lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
+  lines.push('  tier1["Tier 1<br/>Secret"]');
+  lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
+  lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
+  lines.push("  vault --> tier1");
+  lines.push("  tier1 --> tier2");
+  lines.push("  tier2 --> tier3");
+  for (const [gateName, gp] of Object.entries(policy.gates)) {
+    if (gp.enabled === false) continue;
+    const id = sanitizeId(gateName);
+    const label = `${gateName}<br/>tier \u2265 ${gp.minTier}`;
+    lines.push(`  ${id}["${escapeMermaid(label)}"]`);
+    const tierNode = gp.minTier === 1 ? "tier1" : gp.minTier === 2 ? "tier2" : "tier3";
+    lines.push(`  ${tierNode} --> ${id}`);
+  }
+  return lines.join("\n");
+}
+async function describeUserAuth(store, vault, userId) {
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) return "";
+  const file = JSON.parse(env._data);
+  const lines = [];
+  lines.push(
+    `User: ${file.user_id} (joined ${file.created_at.slice(0, 10)}, role: ${file.role})`
+  );
+  lines.push("");
+  lines.push("Tier 2 enrollments:");
+  if (!file.authenticators || file.authenticators.length === 0) {
+    lines.push("  (none enrolled)");
+  } else {
+    for (const slot of file.authenticators) {
+      lines.push(`  - ${describeSlot(slot)}`);
+    }
+  }
+  return lines.join("\n");
+}
+async function describeAllUsersAuth(store, vault) {
+  const ids = await store.list(vault, "_keyring");
+  const results = [];
+  for (const userId of ids) {
+    const description = await describeUserAuth(store, vault, userId);
+    if (description !== "") results.push({ userId, description });
+  }
+  return results;
+}
+var SLOT_FIELD_ALLOWLIST = [
+  "id",
+  "method",
+  "enrolled_at",
+  "enrolled_via_tier"
+];
+function describeSlot(slot) {
+  const sanitized = {};
+  for (const key of SLOT_FIELD_ALLOWLIST) {
+    if (key in slot) {
+      sanitized[key] = slot[key];
+    }
+  }
+  const date = (sanitized.enrolled_at ?? "").slice(0, 10);
+  return `${sanitized.method ?? "?"} (id=${sanitized.id ?? "?"}, enrolled ${date}, via tier ${sanitized.enrolled_via_tier ?? "?"})`;
+}
+function describeGatePolicy(gp) {
+  if (gp.enabled === false) return "disabled";
+  const parts = [];
+  parts.push(`tier ${gp.minTier}`);
+  if (gp.factors && gp.factors.length > 0) {
+    for (const f of gp.factors) {
+      parts.push(`+ ${f.count ?? 1}\xD7 ${f.anyOf.join("|")}`);
+    }
+  }
+  if (gp.warn?.sharedDevice === "block") parts.push("block-on-shared-device");
+  return parts.join(" ");
+}
+function defaultPolicySnapshot() {
+  return {
+    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
+    gates: {}
+  };
+}
+async function listRecoveryProfilesEnrolled(store, vault) {
+  const enrolled = [];
+  const paper = await loadPaperRecoveryEntries(store, vault);
+  if (paper.length > 0) enrolled.push(`paper (${paper.length} codes)`);
+  return enrolled;
+}
+function escapeMermaid(s) {
+  return s.replace(/"/g, '\\"').replace(/\n/g, " ");
+}
+function sanitizeId(s) {
+  return s.replace(/[^a-zA-Z0-9]/g, "_");
+}
+
 // src/with-party/team/authenticators.ts
 async function enrollAuthenticator(store, vault, keyring, options) {
   const existing = keyring.authenticators.find((a) => a.id === options.id);
@@ -754,12 +879,9 @@ export {
   loadShamirRecoveryEntries,
   saveShamirRecoveryEntries,
   mintShamirRecoveryEntry,
-  unwrapDeksFromShamirEntry,
   mintPaperRecoveryEntry,
   unwrapDeksFromPaperEntry,
   MAGIC_LINK_GRANTS_COLLECTION,
-  MAGIC_LINK_CONTENT_INFO_PREFIX,
-  MAGIC_LINK_KEK_INFO_PREFIX,
   deriveMagicLinkContentKey,
   writeMagicLinkGrant,
   readMagicLinkGrantRecord,
@@ -771,9 +893,13 @@ export {
   rotateSecret,
   recoverSecret,
   recoverUser,
+  describeAuthConfig,
+  diagramAuthConfig,
+  describeUserAuth,
+  describeAllUsersAuth,
   enrollAuthenticator,
   updateAuthenticator,
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-M4GO4ZJK.js.map
+//# sourceMappingURL=chunk-C25JXSOR.js.map