npm - @noy-db/hub - Versions diffs - 0.4.0 → 0.5.0 - Mend

@noy-db/hub 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (325) hide show

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/with-commit/numbering/descriptor.ts","../src/via/computed/binding.ts","../src/via/computed/descriptor.ts","../src/via/lookup/binding.ts","../src/via/lookup/descriptor.ts","../src/with-sync/credentials.ts"],"sourcesContent":["/*\n @category capability\n * Deferred-numbering config descriptor. See\n * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.\n /\n\n/* A registered deferred-numbering series. /\nexport interface DeferredNumberingConfig {\n /* Series name — the key passed to `vault.sequence(series)`. /\n readonly series: string\n /* Collection holding the records to number. /\n readonly collection: string\n /* Field on each record where the assigned serial is written. /\n readonly field: string\n /\n Minimum wall-clock age (ms) before an entry is eligible at a pass, in\n * addition to the interval commit-wait. Default 0 — the store-clock\n * interval (`storeLatest ≤ now.earliest`) is the correctness mechanism.\n /\n readonly settleWindowMs: number\n}\n\n/\n Options for {@link withDeferredNumbering} (#844b — was an inline literal, so\n * unnameable). Same shape as {@link DeferredNumberingConfig} except\n * `settleWindowMs` is optional; the factory defaults it to 0.\n /\nexport interface WithDeferredNumberingOptions {\n /* Series name — the key passed to `vault.sequence(series)`. /\n readonly series: string\n /* Collection holding the records to number. /\n readonly collection: string\n /* Field on each record where the assigned serial is written. /\n readonly field: string\n /* See {@link DeferredNumberingConfig.settleWindowMs}. Default 0. /\n readonly settleWindowMs?: number\n}\n\n/* Declare a deferred-numbering series. Pass the result in `createNoydb({ numbering: [...] })`. /\nexport function withDeferredNumbering(opts: WithDeferredNumberingOptions): DeferredNumberingConfig {\n return {\n series: opts.series,\n collection: opts.collection,\n field: opts.field,\n settleWindowMs: opts.settleWindowMs ?? 0,\n }\n}\n","/\n The `computed` via-binding (#638 Task 7) — covers ONLY `mode: 'virtual'`\n * fields. Materialized entries never reach here: they compile into\n * `mergedComputed` (`kernel/collection-config.ts`) and run through the\n * EXISTING stage-5 `evalComputedFields` write path, byte-for-byte unchanged\n * (the behavior lock).\n \n A virtual field is computed on READ, inside `present()` — the money-\n * `Formatted`/i18n-`Label` precedent (seam map Part 4) generalized to a\n * user-declared function. It is NEVER stored (no `encodeAtRest`/\n * `decodeAtRest` — the field never appears in `_data` or any `_sealed`\n * slot), and its posture is fixed `queryable: 'none'` — there is no stored/\n * indexed form to query against, regardless of what its sources would\n * otherwise permit (`ViaGraph`'s grain-'virtual' clamp, `kernel/via/graph.ts`,\n * is the belt; this binding's own static posture is the suspenders for a\n * depsless virtual field, which registers no graph edge at all).\n \n Export/read redaction for a TAINTED virtual field (sourced from a\n * classified/sealed field) is NOT this binding's job — it stays ignorant of\n * taint, exactly like `evalComputedFields` stays ignorant of it for\n * materialized fields. `kernel/via/taint-binding.ts#taintBinding` (appended\n * to the pipeline by `via/graph-wiring.ts#applyTaintOverlay`, AFTER this\n * binding) overwrites a tainted virtual field's value with the same\n * `EXPORT_REDACTION_MARKER` on every present() — the one enforcement seam\n * every via feature's taint already routes through.\n /\nimport type { ViaBinding, ViaPosture } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { ComputedDescriptor } from './descriptor.js'\n\nexport interface ComputedViaConfig {\n /* field name -> its virtual-mode descriptor. Materialized entries are never present here. /\n readonly virtualFields: ReadonlyMap<string, ComputedDescriptor>\n}\n\nconst VIRTUAL_POSTURE: ViaPosture = { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: false }\n\nexport function computedBinding(cfg: ComputedViaConfig): ViaBinding {\n const fields = cfg.virtualFields\n return {\n brand: 'computed',\n posture: VIRTUAL_POSTURE,\n covers: (field) => fields.has(field),\n present: (record) => {\n let r = record\n for (const [field, desc] of fields) {\n if (r === record) r = { ...record }\n r[field] = desc.fn(r)\n }\n return r\n },\n }\n}\n\nexport function linkComputedVia(): void {\n installViaBinder('computed', (cfg) => computedBinding(cfg as ComputedViaConfig))\n}\n","/\n computed() — the declaration factory for a field whose value is DERIVED\n * from other fields on the same record (#638 Task 7, spec §6). Composes\n * with `via()` (the locked grammar since phase A: `via(computed(fn, { deps,\n * mode }), money('EUR'))`), grouped by `_viaBrand` like every other via\n * feature (`kernel/via/compose.ts#mergeViaFields`).\n \n `mode` picks where the function runs:\n * - `'materialized'` (default) — TODAY's stage-5 write-time eager compute\n * (`with-formula/computed/index.ts#evalComputedFields`), stored like any\n * other field. Byte-for-byte the existing `computed: { field: fn }` sugar.\n * - `'virtual'` — rides the `present` read phase (the money-`Formatted`/\n * i18n-`Label` precedent, seam map Part 4): computed fresh on every\n * read, NEVER stored, `queryable: 'none'`, excluded from export unless\n * its declared `deps` permit (identical taint rule to materialized —\n * see `via/computed/binding.ts`).\n \n `deps` names the OTHER fields `fn` reads — feeds `ViaGraph` (Task 1/2) so\n * a source's taint (e.g. a classified field) propagates to this derived\n * field. A depsless entry is fine UNLESS the collection also declares\n * classified fields (`kernel/collection-config.ts#resolveComputedEdges`\n * refuses it — closes the #636 opaque-function leak).\n /\nimport type { ViaDescriptor } from '../../kernel/via/index.js'\nimport { linkComputedVia } from './binding.js'\n\nexport interface ComputedDescriptor extends ViaDescriptor {\n readonly _viaBrand: 'computed'\n readonly fn: (record: Record<string, unknown>) => unknown\n readonly deps?: readonly string[]\n readonly mode: 'materialized' \| 'virtual'\n}\n\nexport function computed(\n fn: (record: Record<string, unknown>) => unknown,\n opts?: { readonly deps?: readonly string[]; readonly mode?: 'materialized' \| 'virtual' },\n): ComputedDescriptor {\n // Self-link, exactly as `money()` and `lookup()` do (#813). Until this call\n // existed, `computed` was the only via feature whose binder was installed by a\n // DIFFERENT module — `port/with/computed-strategy.ts` — rather than by its own\n // declaration factory. That works whenever the kernel spine and the consumer's\n // `computed` import resolve to one module instance, and fails when they do not:\n // under vitest's `server.deps.inline`, a consumer got the descriptor from one\n // transformed instance while the binder registry consulted at bind time lived in\n // another, producing `VIA_NOT_LINKED` for a descriptor `isComputedDescriptor()`\n // accepted. money/i18n/lookup were immune precisely because they self-link.\n //\n // Constructing a descriptor is the binding's opt-in unit, so linking here makes\n // the guarantee local: whatever instance produced the descriptor also has the\n // binder. `installViaBinder` is idempotent + first-wins, so the eager call in\n // `port/with/computed-strategy.ts` stays harmless.\n linkComputedVia()\n return {\n _viaBrand: 'computed',\n fn,\n ...(opts?.deps !== undefined ? { deps: opts.deps } : {}),\n mode: opts?.mode ?? 'materialized',\n }\n}\n\nexport function isComputedDescriptor(x: unknown): x is ComputedDescriptor {\n return typeof x === 'object' && x !== null && (x as { _viaBrand?: unknown })._viaBrand === 'computed'\n}\n","/\n The `'lookup'` `ViaBinding` — wires the lookup engine (present-time label\n * dressing across all three backing tiers) into the kernel's generic Via\n * port. Mirrors `via/i18n/binding.ts`'s #553 static-link pattern; the\n * present-time label-dressing algorithm below is adapted from\n * `via-i18n/binding.ts:253-337` (the same wildcard/array/scalar handling,\n * the same `onMissing`/`substitute` policy engine), generalized to branch on\n * `backing` instead of a static-vs-dynamic descriptor-shape check. For the\n * `'static'` and `'reserved'` tiers this delegates to `cfg.lookupLabelResolver`\n * — the SAME vault-built closure the i18n binding's `dictLabelResolver` uses\n * (static table first, else the `vault.dictionary()` handle) — so a native\n * `dict()`/`lookup(static)` field resolves through the identical label data\n * as its `dictKey()`/`staticDict()` alias (the byte-equivalence lock).\n \n `lookup()`/`enumOf()`/`dict()` each call {@link linkLookupVia} first — the\n * same #553 pattern `money()`/`dictKey()` use.\n \n `buildClause` (label-predicate queries) is still undeclared — out of scope\n * for #650. `compareForOrder` (#650 Task 6, spec §5; matrix tier added Task\n * 7) resolves a `sortBy`-declared field's ordering via `cfg.snapshotFor`'s\n * sync snapshot; the hook signature is UNCHANGED (`via/index.ts:128-129` — no\n * locale param), so it closes over each descriptor's own `displayLocale`\n * (the same locale-less-hinge default `runLookupPresent`'s\n * `hasStaticDisplay` branch already uses). `resolveOrderLabel` (#650 Task\n * 7) is the PER-CALL-locale sibling `orderBy(..., {by:'label'})` needs —\n * see its own doc comment below. `describeFragment` (#650 Task 7) is the\n * first-ever consumed `ViaBinding.describeFragment` implementation — see\n * `with-shape/introspection/describe.ts`'s `buildDescription`.\n /\nimport type { ViaBinding, ViaReadCtx } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { LookupDescriptor, LookupBacking, Vocabulary, OnDelete } from './descriptor.js'\nimport { resolvePolicy, type Layer } from '../i18n/policy.js'\nimport { LocaleNotSpecifiedError, UnknownLookupKeyError, ValidationError } from '../../kernel/errors.js'\nimport { getAtPath, setAtPathInPlace } from '../../kernel/paths.js'\nimport type { MaterializedBacking } from './registry.js'\nimport { buildLookupSnapshot } from './snapshot.js'\n\n/\n Config a collection's lookup declarations resolve to — the binding's\n * construction input. `lookupLabelResolver`/`getLookupBacking`/`membership`/\n * `snapshotFor` are vault-built closures (never a `Collection` handle,\n * keyring, or DEK/CEK — the zero-knowledge boundary).\n /\nexport interface LookupViaConfig {\n readonly lookupFields: Record<string, LookupDescriptor>\n readonly lookupLabelResolver?: (dimension: string, key: string, locale: string, fallback?: unknown) => Promise<string \| undefined>\n /\n The matrix (collection) tier's present-time backing-row source, keyed by the full\n * descriptor (not a bare dimension name) so the closure can resolve by `descriptor.key`,\n * not the backing row's PUT-id (#651 Task 3 — the same descriptor-gaining dispatch Task 7\n * already applied to `snapshotFor`).\n /\n readonly getLookupBacking?: (descriptor: LookupDescriptor) => (key: string) => Promise<Record<string, unknown> \| undefined>\n /* Closed-vocabulary write-time membership test (#650 Task 3) — `(field, key) => known?`. /\n readonly membership?: (field: string, key: string) => boolean \| Promise<boolean>\n /* Sync per-descriptor altKey index — `ingest`'s normalization source (#650 Task 3). /\n readonly getAltIndex?: (desc: LookupDescriptor) => MaterializedBacking \| undefined\n /\n Sync materialized `key -> row` rows for a lookup descriptor (#650 Task\n * 6, spec §5; matrix-tier routing added #650 Task 7) — `compareForOrder`\n * and `resolveOrderLabel` below, and `snapshot.ts`'s `presentForJoin`\n * builder, all read this same vault-built closure. Reserved AND\n * collection (matrix) tier route here (the vault wires\n * `dimension -> LookupHandle.snapshotEntries()` / `dimension ->\n * collection.querySourceForJoin().snapshot()` respectively, keyed by\n * `descriptor.key` for the matrix case — see `registry.ts`'s\n * `buildLookupSnapshotRows`); static tier is resolved locally from\n * `descriptor.table` without calling this.\n /\n readonly snapshotFor?: (descriptor: LookupDescriptor) => ReadonlyMap<string, Record<string, unknown>> \| undefined\n readonly collectionName: string\n}\n\n/* Enum tier (`backing:'static'`, no `table`) has no label source at all — never dressed. /\nfunction hasLabelSource(desc: LookupDescriptor): boolean {\n return !(desc.backing === 'static' && desc.table === undefined)\n}\n\n/\n Resolve one key's label. `'static'`/`'reserved'` both go through\n * `cfg.lookupLabelResolver` (mirrors `dictLabelResolver`'s own static-table-\n * first-else-reserved-handle branching — the SAME closure is reused, see\n * `kernel/vault.ts`). `'collection'` (matrix tier) reads the declared\n * `present.label` off the backing row via `cfg.getLookupBacking`; when\n * `present.by` is set, that field's value is a `{ locale -> label }` map\n * indexed by the effective locale.\n /\nasync function fetchLookupLabel(\n desc: LookupDescriptor,\n key: string,\n effLocale: string,\n fieldFallback: string \| readonly string[] \| undefined,\n cfg: LookupViaConfig,\n): Promise<string \| undefined> {\n if (desc.backing === 'collection') {\n const getRow = cfg.getLookupBacking?.(desc)\n const row = getRow ? await getRow(key) : undefined\n const labelField = desc.present?.label\n if (!row \|\| labelField === undefined) return undefined\n const raw = row[labelField]\n if (desc.present?.by !== undefined) {\n return raw && typeof raw === 'object' ? (raw as Record<string, unknown>)[effLocale] as string \| undefined : undefined\n }\n return typeof raw === 'string' ? raw : undefined\n }\n return cfg.lookupLabelResolver?.(desc.dimension, key, effLocale, fieldFallback)\n}\n\n/* `present` — resolve `<field>Label` for every declared lookup field. Adapted from `via-i18n/binding.ts:253-337`. /\nasync function runLookupPresent(\n record: Record<string, unknown>,\n ctx: ViaReadCtx,\n cfg: LookupViaConfig,\n): Promise<Record<string, unknown>> {\n const fields = Object.entries(cfg.lookupFields).filter(([, d]) => hasLabelSource(d))\n if (fields.length === 0) return record\n\n const locale = typeof ctx.locale === 'string' ? ctx.locale : undefined\n const fallback = ctx.fallback as string \| readonly string[] \| undefined\n const layer = ctx.layer as Layer\n\n // `{ locale: 'raw' }` wants the untouched record — mirrors\n // `via-i18n/binding.ts`'s `locale !== 'raw'` dict-label gate exactly (no\n // synthetic `<field>Label` derivative on a raw read).\n if (locale === 'raw') return record\n\n // Static-display hybrid hinge: a `backing:'static'` field with a declared\n // `displayLocale` resolves its `<field>Label` even under a locale-less\n // read (mirrors staticDict's `hasStaticDisplay` gate).\n const hasStaticDisplay = fields.some(([, d]) => d.backing === 'static' && d.displayLocale !== undefined)\n if (!locale && !hasStaticDisplay) return record\n\n let result = record\n const withLabels = { ...result }\n\n for (const [field, desc] of fields) {\n const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : 'null'\n const fieldFallback = policy === 'substitute' ? (fallback ?? desc.substitute) : fallback\n const effLocale = locale ?? (desc.backing === 'static' ? desc.displayLocale : undefined)\n\n const resolveKey = async (key: string): Promise<string \| null> => {\n if (!effLocale) {\n if (policy === 'throw') {\n throw new LocaleNotSpecifiedError(field, `lookup \"${field}\": no locale active to resolve key \"${key}\".`)\n }\n return null\n }\n const label = await fetchLookupLabel(desc, key, effLocale, fieldFallback, cfg)\n if (label === undefined) {\n if (policy === 'throw') {\n throw new LocaleNotSpecifiedError(field, `lookup \"${field}\": no label for key \"${key}\" in locale \"${effLocale}\".`)\n }\n return null\n }\n return label\n }\n\n if (field.includes('[].')) {\n const parts = field.split('[].')\n const arrayKey = parts[0]!\n const leaf = parts[1]\n if (!leaf \|\| leaf.includes('.')) continue\n const arr = (withLabels as Record<string, unknown>)[arrayKey]\n if (!Array.isArray(arr)) continue\n const labelKey = `${leaf}Label`\n ;(withLabels as Record<string, unknown>)[arrayKey] = await Promise.all(\n arr.map(async (el) => {\n if (!el \|\| typeof el !== 'object' \|\| Array.isArray(el)) return el\n const k = (el as Record<string, unknown>)[leaf]\n if (typeof k !== 'string') return el\n return { ...(el as Record<string, unknown>), [labelKey]: await resolveKey(k) }\n }),\n )\n continue\n }\n\n const val = result[field]\n if (Array.isArray(val)) {\n withLabels[`${field}Label`] = await Promise.all(\n val.map(async (k) => ({ key: k, label: typeof k === 'string' ? await resolveKey(k) : null })),\n )\n } else if (typeof val === 'string') {\n const label = await resolveKey(val)\n if (label !== null) withLabels[`${field}Label`] = label\n }\n }\n\n result = withLabels\n return result\n}\n\n/\n One field's `lookup` descriptor as it appears on a `ViaBinding.\n * describeFragment()` payload (#650 Task 7 — the first real consumer,\n * `with-shape/introspection/describe.ts`'s `buildDescription`, imports this\n * type directly; `describe.ts` is NOT under `kernel/*`, so it's free to\n import concrete via/ types the way it already does for\n * `LookupDescriptor`/`MoneyDescriptor`/etc.). `dimension` is OMITTED (not\n * emitted as `''`) for a bare `enumOf()` descriptor — the #650 Task 2\n * `dimension:''` sentinel resolved: no dimension name means no `dimension`\n * key, not a meaningless empty string (T2 carry, #650 Task 7).\n /\nexport interface LookupDescribeFragmentEntry {\n readonly dimension?: string\n readonly backing: LookupBacking\n readonly vocabulary: Vocabulary\n readonly key: string\n readonly altKeys?: readonly string[]\n readonly present?: { readonly label: string; readonly by?: string }\n readonly sortBy?: string\n readonly onDelete: OnDelete\n /* Statically-known closed-vocabulary key set (declared `keys`, or a static table's own keys). Omitted when membership lives only in the backing collection/dictionary (open vocabulary, or closed with no declared `keys`). /\n readonly keys?: readonly string[]\n}\n\n/* The `'lookup'` binding's `describeFragment()` payload shape. /\nexport interface LookupDescribeFragment {\n readonly lookupFields: Record<string, LookupDescribeFragmentEntry>\n}\n\nfunction buildLookupDescribeFragment(cfg: LookupViaConfig): Record<string, unknown> {\n const lookupFields: Record<string, LookupDescribeFragmentEntry> = {}\n for (const [field, desc] of Object.entries(cfg.lookupFields)) {\n lookupFields[field] = {\n ...(desc.dimension !== '' ? { dimension: desc.dimension } : {}),\n backing: desc.backing,\n vocabulary: desc.vocabulary,\n key: desc.key,\n onDelete: desc.onDelete,\n ...(desc.altKeys !== undefined ? { altKeys: desc.altKeys } : {}),\n ...(desc.present !== undefined ? { present: desc.present } : {}),\n ...(desc.sortBy !== undefined ? { sortBy: desc.sortBy } : {}),\n // #657 — static tier: when no `keys` was explicitly declared but a\n // `table` was (the staticDict()-equivalent `lookup(dim, {backing:\n // 'static', table})` shape), the table's own key set IS the\n // statically-known closed-vocabulary set the DescribedField.lookup\n // docblock promises (\"declared `keys`, OR a static table's own\n // keys\"). Reserved/matrix tiers never carry `table`, so this branch\n // never fires for them — their `keys` emission is unchanged.\n ...(desc.keys !== undefined\n ? { keys: desc.keys }\n : desc.backing === 'static' && desc.table !== undefined ? { keys: Object.keys(desc.table) } : {}),\n }\n }\n return { lookupFields }\n}\n\n/\n `cfg.getAltIndex(desc)` (matrix tier) reads the backing collection's cache\n * via `querySourceForJoin()` (`buildLookupAltIndex`, registry.ts) — which\n * throws a `.join()`-branded message when that collection was opened\n * `{prefetch:false}` (lazy mode is unsupported for altKey normalization).\n * Normalization must never silently not happen (the banned silent-no-op\n * class, #650 Task 3 review, Important 2) — detect that specific failure\n * and surface a CLEAR, lookup-branded `ValidationError` at the point of\n * failure instead of letting the confusing join-branded one leak onto an\n * unrelated `put()`. Any OTHER error (e.g. `materializeBackingTable`'s own\n * altKey-collision `ValidationError`) propagates unchanged.\n /\nfunction getAltIndexOrThrow(field: string, desc: LookupDescriptor, cfg: LookupViaConfig): MaterializedBacking \| undefined {\n try {\n return cfg.getAltIndex?.(desc)\n } catch (err) {\n if (err instanceof Error && err.message.includes('lazy-mode')) {\n throw new ValidationError(\n `lookup: altKeys on \"${field}\" require the backing collection \"${desc.dimension}\" to be ` +\n `prefetch-enabled (lazy mode unsupported); open it without {prefetch:false} or drop altKeys.`,\n )\n }\n throw err\n }\n}\n\n/\n `ingest` — altKey candidate values normalize to the canonical key (#650\n * Task 3, spec §3). Pure, sync, idempotent (a canonical key maps to\n * itself); no store read — consults the pre-materialized\n * `cfg.getAltIndex(desc)`. The money `canonicalizeIncomingMoney` precedent\n * (`via/index.ts:108`).\n \n A `[].`-wildcard multi-value path (`getAtPath` resolves >1 entries — an\n * array of nested objects, e.g. `'lines[].country'`, the same wildcard\n * convention `runLookupPresent` above already handles) normalizes EVERY\n * element's leaf value, not just a lone scalar (#652 fix — this used to bail\n * out entirely here while `runLookupEnforceWrite` below validated every\n * value unnormalized, so a legitimate altKey in an array position was\n * wrongly refused by closed-vocabulary enforcement). `setAtPathInPlace`\n * can't write into a `[].`-wildcard path, so the array is reconstructed\n * immutably instead, mirroring `runLookupPresent`'s own `field.includes\n * ('[].')` branch. A plain field whose OWN value is a bare top-level array\n * (not a `[].`-wildcard path) gets the SAME element-wise normalization\n * against `backing.altIndex` (#661 fix — `getAtPath` resolves it to one\n * opaque value, so the array itself is `values[0]`; a non-string element is\n * left untouched, mirroring the scalar branch's own `typeof !== 'string'`\n * skip — no parallel coercion invented for this shape).\n /\nfunction runLookupIngest(record: Record<string, unknown>, cfg: LookupViaConfig): Record<string, unknown> {\n const withAltKeys = Object.entries(cfg.lookupFields).filter(([, d]) => (d.altKeys?.length ?? 0) > 0)\n if (withAltKeys.length === 0) return record\n\n let result = record\n for (const [field, desc] of withAltKeys) {\n const backing = getAltIndexOrThrow(field, desc, cfg)\n if (!backing \|\| backing.altIndex.size === 0) continue\n\n if (field.includes('[].')) {\n const [arrayKey, leaf] = field.split('[].')\n if (!leaf \|\| leaf.includes('.')) continue\n const arr = record[arrayKey!]\n if (!Array.isArray(arr)) continue\n let changed = false\n const normalized = arr.map((item) => {\n if (!item \|\| typeof item !== 'object' \|\| Array.isArray(item)) return item\n const value = (item as Record<string, unknown>)[leaf]\n if (typeof value !== 'string') return item\n const canonical = backing.altIndex.get(value)\n if (canonical === undefined \|\| canonical === value) return item\n changed = true\n return { ...(item as Record<string, unknown>), [leaf]: canonical }\n })\n if (!changed) continue\n if (result === record) result = { ...record }\n result[arrayKey!] = normalized\n continue\n }\n\n const values = getAtPath(record, field)\n if (values.length !== 1) continue\n const value = values[0]\n\n // `getAtPath`/`setAtPathInPlace` resolve `field` generically, dotted\n // paths included (e.g. 'meta.tags') — do not rewrite this branch to a\n // direct `record[field]` bracket access, which would silently stop\n // normalizing/enforcing a dotted-non-wildcard bare-array field (#661).\n if (Array.isArray(value)) {\n if (value.length === 0) continue\n let changed = false\n const normalized = value.map((el) => {\n if (typeof el !== 'string') return el\n const canonical = backing.altIndex.get(el)\n if (canonical === undefined \|\| canonical === el) return el\n changed = true\n return canonical\n })\n if (!changed) continue\n if (result === record) result = { ...record }\n setAtPathInPlace(result, field, normalized)\n continue\n }\n\n if (typeof value !== 'string') continue\n const canonical = backing.altIndex.get(value)\n if (canonical === undefined \|\| canonical === value) continue\n if (result === record) result = { ...record }\n setAtPathInPlace(result, field, canonical)\n }\n return result\n}\n\n/\n `enforceWrite` — closed-vocabulary write refusal (#650 Task 3, spec §3).\n * Runs only for `vocabulary:'closed'` fields; `'open'` (the dictKey/dict\n * default) skips the check entirely, so #649's fix is additive — existing\n * dictKey/staticDict collections are unaffected. `ctx` carries no\n * cross-collection door (`id`/`vault`/`prior`/`emit` only, unchanged) —\n * membership is a vault-built closure on `cfg`, per spec.\n /\nasync function runLookupEnforceWrite(record: Record<string, unknown>, cfg: LookupViaConfig): Promise<void> {\n for (const [field, desc] of Object.entries(cfg.lookupFields)) {\n if (desc.vocabulary !== 'closed') continue\n // Checks every value `getAtPath` returns — for a `[].`-wildcard\n // multi-value path, that's every element's leaf value.\n // `runLookupIngest` above now normalizes each of those elements first\n // (#652), so what lands here for a `[].`-wildcard field is already\n // canonical; this loop's job stays membership, not normalization.\n for (const value of getAtPath(record, field)) {\n // A plain field whose OWN value is a bare top-level array (#661) —\n // `runLookupIngest` above has already normalized its elements'\n // altKeys, so membership-check each element through the SAME\n // `cfg.membership` closure the scalar branch below uses, refusing on\n // the first unknown one. A non-string element is skipped, mirroring\n // the scalar branch's own skip.\n if (Array.isArray(value)) {\n for (const el of value) {\n if (typeof el !== 'string') continue\n const known = cfg.membership ? await cfg.membership(field, el) : true\n if (!known) throw new UnknownLookupKeyError(desc.dimension, field, el)\n }\n continue\n }\n if (typeof value !== 'string') continue\n const known = cfg.membership ? await cfg.membership(field, value) : true\n if (!known) throw new UnknownLookupKeyError(desc.dimension, field, value)\n }\n }\n}\n\n/\n `compareForOrder` — exact ordering for a `sortBy`-declared lookup field\n * against the sync snapshot (#650 Task 6, spec §5, conflict resolution 4;\n * matrix-tier coverage added #650 Task 7). Opt-in: undeclared `sortBy`\n * (every dictKey/staticDict alias and every lookup field declared before\n * Task 6) returns `undefined` — falls through to the generic stored-value\n * comparator, byte-identical to today. Static tier reads `descriptor.table`\n * directly; reserved AND matrix (collection) tier both read `cfg.snapshotFor`\n * (the SAME live cache `presentForJoin`'s lookup half reads — see\n * `snapshot.ts`'s file header). The hook has no locale parameter\n * (`via/index.ts:128-129`, unchanged) — closes over the descriptor's own\n * `displayLocale` (the same locale-less-hinge default `runLookupPresent`\n * already uses); a `sortBy` field whose value isn't locale-keyed\n * (`present.by` undefined) never needs one. A `by`-keyed `sortBy` field\n * with NO declared `displayLocale` degrades to comparing the raw canonical\n * keys (silent — `LookupSnapshot.compareKeys` never throws; declare-time\n * warning at `descriptor.ts`'s `lookup()` factory; use\n * `orderBy(field, dir, {by:'label'})` — `resolveOrderLabel` below — for a\n * PER-CALL locale instead).\n /\nfunction compareLookupOrder(field: string, a: unknown, b: unknown, cfg: LookupViaConfig): number \| undefined {\n if (typeof a !== 'string' \|\| typeof b !== 'string') return undefined\n const desc = cfg.lookupFields[field]\n if (!desc \|\| desc.sortBy === undefined) return undefined\n const rows = desc.backing === 'static'\n ? (desc.table ? new Map(Object.entries(desc.table)) : undefined)\n : cfg.snapshotFor?.(desc)\n if (!rows) return undefined\n return buildLookupSnapshot(desc.dimension, rows, desc).compareKeys(a, b, desc.displayLocale ?? '')\n}\n\n/\n `resolveOrderLabel` — per-key, PER-CALL-locale label resolution for\n * `orderBy(field, dir, { by: 'label' })` (#650 Task 7, spec §6 / seam map\n * Part 10 surprise 6's option (b)) — the channel `compareForOrder` above\n * structurally cannot serve, since `ViaBinding.compareForOrder` carries no\n * locale parameter. Consumed by `kernel/query/builder.ts`'s\n * `buildOrderLabelMaps` as the fallback for lookup fields the legacy dict\n * registries don't bridge (matrix tier; reserved/static tier already\n * resolves via that bridge — `JoinContext.resolveDictSource` — tried\n * FIRST by the caller, see `registry.ts`'s `collectLookupDictCompat` doc\n * comment). Reuses the exact same `cfg.snapshotFor`/`buildLookupSnapshot`\n * machinery as `compareLookupOrder` above, just with the per-call `locale`\n * in place of the descriptor's own `displayLocale` — falling back to\n * `displayLocale` only when the call itself is locale-less, the same\n * hinge order `runLookupPresent` already uses.\n /\nfunction resolveLookupOrderLabel(field: string, key: string, locale: string \| undefined, cfg: LookupViaConfig): string \| undefined {\n const desc = cfg.lookupFields[field]\n if (!desc) return undefined\n const rows = desc.backing === 'static'\n ? (desc.table ? new Map(Object.entries(desc.table)) : undefined)\n : cfg.snapshotFor?.(desc)\n if (!rows) return undefined\n return buildLookupSnapshot(desc.dimension, rows, desc).label(key, locale ?? desc.displayLocale ?? '')\n}\n\nexport function lookupBinding(cfg: LookupViaConfig): ViaBinding {\n return {\n brand: 'lookup',\n posture: { encryptedAtRest: 'envelope', queryable: 'full', exportable: true, forgettable: false },\n reservedPrefixes: ['_dict_', '_lookup_'],\n covers: (field) => field in cfg.lookupFields,\n ingest: (record) => runLookupIngest(record, cfg),\n enforceWrite: (record) => runLookupEnforceWrite(record, cfg),\n present: async (record, ctx) => runLookupPresent(record, ctx, cfg),\n compareForOrder: (field, a, b) => compareLookupOrder(field, a, b, cfg),\n resolveOrderLabel: (field, key, locale) => resolveLookupOrderLabel(field, key, locale, cfg),\n describeFragment: () => buildLookupDescribeFragment(cfg),\n }\n}\n\nexport function linkLookupVia(): void {\n installViaBinder('lookup', (c) => lookupBinding(c as LookupViaConfig))\n}\n","/\n `lookup()` / `enumOf()` / `dict()` descriptors — the three declaration\n * surfaces for the `'lookup'` via binding (#650 Task 2, phase D of the Via\n * port). One `LookupDescriptor` shape; the tiers are `backing` details:\n \n - `lookup(dimension, opts?)` — matrix tier: first-class collection backing\n * (default `backing:'collection'`) — a reference-collection dimension\n * (e.g. `countries`), open vocabulary by default.\n * - `enumOf(keys)` — enum tier: static in-config table, CLOSED\n * vocabulary, no backing store at all (no dimension name — pure inline\n * keys). Exported as `enumOf`; the barrel (`index.ts`) re-exports it as\n * `enum` (`enum` is a reserved word, so it can't be the function's own\n * name).\n * - `dict(dimension, opts?)` — dict tier: reserved `_dict_<dimension>`\n * micro-collection backing (the `vault.dictionary(name)` engine), open\n * vocabulary by default.\n \n Each factory calls {@link linkLookupVia} first — the declaration IS the\n * via binding's opt-in unit (#553), same pattern as `money()`/`i18nText()`/\n * `dictKey()`.\n /\n\nimport type { OnMissingPolicy } from '../i18n/policy.js'\nimport { linkLookupVia } from './binding.js'\n\n/* `'closed'` = enum semantics (membership enforced, Task 3); `'open'` permits unknown keys. /\nexport type Vocabulary = 'open' \| 'closed'\n\n/* Where a dimension's rows live: static in-config table / reserved micro-collection / first-class collection. /\nexport type LookupBacking = 'static' \| 'reserved' \| 'collection'\n\n/* Delete-time referential policy for the backing dimension (default `'restrict'`, enforced in Task 5). /\nexport type OnDelete = 'restrict' \| 'cascade' \| 'nullify'\n\n/* The one descriptor shape every tier compiles to — tiers differ only by `backing`. /\nexport interface LookupDescriptor<Keys extends string = string> {\n readonly _viaBrand: 'lookup'\n /* Dimension/dictionary/target name. Empty for a bare `enumOf()` (no backing store, no name). /\n readonly dimension: string\n /* Canonical key field on the row (default `'id'`). /\n readonly key: string\n /* Candidate keys normalized to `key` on ingest (Task 3). /\n readonly altKeys?: readonly string[]\n readonly vocabulary: Vocabulary\n /* Dressing dimension: which backing-row field supplies `<field>Label`, optionally keyed `by` a sub-field (e.g. locale). /\n readonly present?: { readonly label: string; readonly by?: string }\n /* Field to sort by against the snapshot (Task 6). /\n readonly sortBy?: string\n readonly backing: LookupBacking\n readonly onDelete: OnDelete\n /* Static/enum inline key set. /\n readonly keys?: readonly Keys[]\n /* Static tier only: in-code `key -> { locale -> label }` table. /\n readonly table?: Readonly<Record<string, Readonly<Record<string, string>>>>\n /* Static hybrid hinge (the `staticDict` alias) — locale-less `<field>Label`. /\n readonly displayLocale?: string\n readonly onMissing?: OnMissingPolicy\n readonly substitute?: readonly string[]\n /* Inline display labels (value -> label), the dict-tier sync fallback (mirrors `dictKey`'s `labels`). /\n readonly labels?: Record<string, string>\n}\n\n/\n `sortBy`/`present.by` coupling warning (#650 Task 7, T6 minor — task-6-\n * report.md Concern #4). A `by`-keyed `present` (locale-map) field used as\n * `sortBy` needs a declared `displayLocale` for the locale-less\n * `compareForOrder` sort hook (a plain `orderBy(field)`, no `{by:'label'}`)\n * to resolve anything — without one it silently degrades to comparing the\n * raw canonical keys (never throws — `LookupSnapshot.compareKeys`'s\n * contract). `orderBy(field, dir, {by:'label'})` doesn't need this (it\n * carries its own per-call locale via `ViaBinding.resolveOrderLabel`,\n * #650 Task 7) — only a sortBy-driven PLAIN orderBy does. Warn once at\n * declare time rather than degrade silently at query time.\n /\nfunction warnIfSortByNeedsDisplayLocale(\n dimension: string,\n opts?: { sortBy?: string; present?: { by?: string }; displayLocale?: string },\n): void {\n if (opts?.sortBy !== undefined && opts.present?.by !== undefined && opts.displayLocale === undefined) {\n console.warn(\n `[noy-db] lookup(\"${dimension}\"): sortBy \"${opts.sortBy}\" is locale-keyed (present.by is set) but no ` +\n `displayLocale is declared — a locale-less orderBy() will silently sort by the raw stored key instead ` +\n `of the resolved label. Declare displayLocale, or sort via orderBy(field, dir, { by: 'label' }), which ` +\n `resolves at the query's own per-call locale.`,\n )\n }\n}\n\n/\n Matrix tier — first-class collection backing (default `backing:'collection'`).\n * `dimension` names the backing collection (e.g. `'countries'`).\n \n `backing` may be overridden to construct any tier through this one\n * factory — e.g. `lookup(name, { backing:'static', table, displayLocale })`\n * is the table-bearing static tier `staticDict()` compiles onto. The\n * `table`/`displayLocale`/`keys`/`onMissing`/`substitute`/`labels` options\n * are a superset of the brief's literal opts list: `LookupDescriptor`\n * already carries these fields for exactly this purpose, and without them\n * `backing:'static'` would be unreachable stand-alone through `lookup()`\n * (see task-2-report.md's \"Design decisions\").\n \n `altKeys` caveat (matrix tier only): normalizing an altKey candidate\n * to its canonical `key` requires the backing `dimension` collection to be\n * open in EAGER mode (the default; `{ prefetch: false }` — lazy mode — is\n * unsupported). A `put()` on a field with `altKeys` whose backing collection\n * is lazy throws a `ValidationError` naming the field and dimension; open\n * the backing collection without `{ prefetch: false }`, or drop `altKeys`.\n /\nexport function lookup<Keys extends string>(\n dimension: string,\n opts?: {\n key?: string\n altKeys?: readonly string[]\n vocabulary?: Vocabulary\n present?: { label: string; by?: string }\n sortBy?: string\n backing?: LookupBacking\n onDelete?: OnDelete\n keys?: readonly Keys[]\n table?: Readonly<Record<string, Readonly<Record<string, string>>>>\n displayLocale?: string\n onMissing?: OnMissingPolicy\n substitute?: readonly string[]\n labels?: Record<string, string>\n },\n): LookupDescriptor<Keys> {\n linkLookupVia()\n warnIfSortByNeedsDisplayLocale(dimension, opts)\n return {\n _viaBrand: 'lookup',\n dimension,\n key: opts?.key ?? 'id',\n vocabulary: opts?.vocabulary ?? 'open',\n backing: opts?.backing ?? 'collection',\n onDelete: opts?.onDelete ?? 'restrict',\n ...(opts?.altKeys !== undefined ? { altKeys: opts.altKeys } : {}),\n ...(opts?.present !== undefined ? { present: opts.present } : {}),\n ...(opts?.sortBy !== undefined ? { sortBy: opts.sortBy } : {}),\n ...(opts?.keys !== undefined ? { keys: opts.keys } : {}),\n ...(opts?.table !== undefined ? { table: opts.table } : {}),\n ...(opts?.displayLocale !== undefined ? { displayLocale: opts.displayLocale } : {}),\n ...(opts?.onMissing !== undefined ? { onMissing: opts.onMissing } : {}),\n ...(opts?.substitute !== undefined ? { substitute: opts.substitute } : {}),\n ...(opts?.labels !== undefined ? { labels: opts.labels } : {}),\n }\n}\n\n/\n Enum tier — static in-config table, CLOSED vocabulary, no backing store.\n * No dimension name (pure inline keys) — `dimension` is `''`.\n /\nexport function enumOf<const Keys extends readonly string[]>(keys: Keys): LookupDescriptor<Keys[number]> {\n linkLookupVia()\n return {\n _viaBrand: 'lookup',\n dimension: '',\n key: 'id',\n vocabulary: 'closed',\n backing: 'static',\n onDelete: 'restrict',\n keys,\n }\n}\n\n/\n Dict tier — reserved `_dict_<dimension>` micro-collection backing (the\n * `vault.dictionary(dimension)` engine), open vocabulary by default. The\n * native equivalent of `dictKey()`.\n \n Unlike `lookup()`'s matrix tier, `dict()` has no `altKeys` option — its\n * `_dict_<dimension>` backing is the always-synchronous `LookupHandle`\n * write-through cache, never a `vault.collection()` that can be opened\n * `{ prefetch: false }`, so the matrix tier's lazy-mode altKeys restriction\n * does not apply here.\n /\nexport function dict<Keys extends string>(\n dimension: string,\n opts?: {\n keys?: readonly Keys[]\n vocabulary?: Vocabulary\n present?: { label: string; by?: string }\n onDelete?: OnDelete\n onMissing?: OnMissingPolicy\n substitute?: readonly string[]\n },\n): LookupDescriptor<Keys> {\n linkLookupVia()\n return {\n _viaBrand: 'lookup',\n dimension,\n key: 'id',\n vocabulary: opts?.vocabulary ?? 'open',\n backing: 'reserved',\n onDelete: opts?.onDelete ?? 'restrict',\n ...(opts?.keys !== undefined ? { keys: opts.keys } : {}),\n ...(opts?.present !== undefined ? { present: opts.present } : {}),\n ...(opts?.onMissing !== undefined ? { onMissing: opts.onMissing } : {}),\n ...(opts?.substitute !== undefined ? { substitute: opts.substitute } : {}),\n }\n}\n","/\n _sync_credentials reserved collection —\n \n Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as\n * encrypted records inside the vault itself. Tokens are wrapped with the\n * compartment's own DEK, live on disk as ciphertext like any other record, and\n * are accessed only through the dedicated API in this module — never via\n * `vault.collection('_sync_credentials')`.\n \n Design decisions\n * ────────────────\n \n Why a reserved collection, not a separate store?\n * The compartment's existing encryption stack (AES-256-GCM + collection DEK)\n * is exactly the right primitive for protecting OAuth tokens at rest. Using a\n * separate store would require a new encryption surface, new adapter calls,\n * and a new backup/restore path — all of which already exist for collections.\n \n Why not exposed as a regular collection?\n * The same reason `_keyring` and `_ledger` aren't: they have invariants that\n * must be enforced (naming scheme, no cross-user leakage, no schema\n * validation, no history/ledger writes for privacy). Routing through a\n * dedicated API enforces those invariants.\n \n Token lifecycle:\n * - `putCredential(vault, adapterId, token)` — store or overwrite\n * - `getCredential(vault, adapterId)` — load and decrypt\n * - `deleteCredential(vault, adapterId)` — remove\n * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)\n \n The `adapterId` is the record ID within the `_sync_credentials` collection.\n * It should be a stable, human-readable identifier for the adapter instance\n * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).\n \n ACL: only `owner` and `admin` roles can read/write sync credentials.\n * Operators, viewers, and clients cannot call this API. The check is made\n * against the caller's keyring role at call time.\n /\n\nimport type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../kernel/types.js'\nimport type { UnlockedKeyring } from '../with-party/team/keyring.js'\nimport { encrypt, openEnvelopeJson } from '../kernel/enclave/index.js'\nimport { ensureCollectionDEK } from '../with-party/team/keyring.js'\nimport { PermissionDeniedError } from '../kernel/errors.js'\n\n/\n The reserved collection name. Never collides with user collections.\n * Canonical definition lives in `reserved-secret-collections.ts` (shared with\n * the `vault.collection()` guard and grant DEK-propagation); re-exported here\n * for existing consumers.\n /\nexport { SYNC_CREDENTIALS_COLLECTION } from '../with-party/team/reserved-secret-collections.js'\nimport { SYNC_CREDENTIALS_COLLECTION } from '../with-party/team/reserved-secret-collections.js'\n\n// ─── Token types ──────────────────────────────────────────────────────\n\n/\n An OAuth/auth token stored in `_sync_credentials`.\n \n Fields mirror the OAuth2 token response shape. `customData` is an escape\n * hatch for adapter-specific secrets (API keys, connection strings, etc.)\n * that don't fit the OAuth2 shape.\n /\nexport interface SyncCredential {\n /* Stable identifier for the adapter instance (e.g. 'google-drive'). /\n readonly adapterId: string\n /* OAuth token type, usually 'Bearer'. /\n readonly tokenType: string\n /* The access token. Expires at `expiresAt` if set. /\n readonly accessToken: string\n /* Long-lived refresh token for renewing the access token. /\n readonly refreshToken?: string\n /* ISO timestamp when `accessToken` expires. Absent means \"no expiry\". /\n readonly expiresAt?: string\n /* Space-separated OAuth scopes. /\n readonly scopes?: string\n /* Adapter-specific opaque data (API keys, endpoints, etc.). /\n readonly customData?: Record<string, string>\n}\n\n// ─── Access check ─────────────────────────────────────────────────────\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n // FR-6: custodian is INTENTIONALLY excluded. Sync credentials are the\n // firm's hosting/infrastructure secrets (OAuth tokens, connection strings) —\n // not the custodian's operational scope. A custodian operates the DATA but\n // must never mint or read transport credentials that could be used to\n // re-home or impersonate the firm's vault. Do NOT add 'custodian' here.\n if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n throw new PermissionDeniedError(\n `Sync credentials require owner or admin role. Current role: \"${keyring.role}\"`,\n )\n }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/\n Store or overwrite a sync credential for the given adapter.\n \n The credential is encrypted with the `_sync_credentials` collection DEK\n * (auto-generated on first use). The record ID is the `adapterId`.\n \n Requires owner or admin role.\n /\nexport async function putCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n credential: SyncCredential,\n): Promise<void> {\n requireAdminAccess(keyring)\n\n const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n const { iv, data } = await encrypt(JSON.stringify(credential), dek)\n\n const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId)\n const version = existing ? existing._v + 1 : 1\n\n const envelope: EncryptedEnvelope = {\n _noydb: NOYDB_FORMAT_VERSION,\n _v: version,\n _ts: new Date().toISOString(),\n _iv: iv,\n _data: data,\n _by: keyring.userId,\n }\n\n await adapter.put(\n vault,\n SYNC_CREDENTIALS_COLLECTION,\n credential.adapterId,\n envelope,\n existing ? existing._v : undefined,\n )\n}\n\n/\n Load and decrypt a sync credential for the given adapter ID.\n \n Returns `null` if no credential exists for this adapter.\n * Requires owner or admin role.\n /\nexport async function getCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<SyncCredential \| null> {\n requireAdminAccess(keyring)\n\n const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n if (!envelope) return null\n\n const plaintext = await openEnvelopeJson(envelope, dek)\n return JSON.parse(plaintext) as SyncCredential\n}\n\n/\n Delete a sync credential by adapter ID.\n \n No-op if the credential doesn't exist. Requires owner or admin role.\n /\nexport async function deleteCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<void> {\n requireAdminAccess(keyring)\n await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n}\n\n/\n List all adapter IDs that have stored credentials.\n \n Returns only the IDs, never the credential payloads. Useful for\n * displaying \"connected adapters\" in UI without decrypting tokens.\n * Requires owner or admin role.\n /\nexport async function listCredentials(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n): Promise<string[]> {\n requireAdminAccess(keyring)\n return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION)\n}\n\n/\n Check whether a credential exists and whether its access token has expired.\n \n Returns `{ exists: false }` if no credential is stored, or\n * `{ exists: true, expired: boolean }` based on the `expiresAt` field.\n * Requires owner or admin role.\n */\nexport async function credentialStatus(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<{ exists: false } \| { exists: true; expired: boolean }> {\n const credential = await getCredential(adapter, vault, keyring, adapterId)\n if (!credential) return { exists: false }\n\n const expired = credential.expiresAt\n ? Date.now() > new Date(credential.expiresAt).getTime()\n : false\n\n return { exists: true, expired }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,sBAAsB,MAA6D;AACjG,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,gBAAgB,KAAK,kBAAkB;AAAA,EACzC;AACF;;;ACXA,IAAM,kBAA8B,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,MAAM;AAEpH,SAAS,gBAAgB,KAAoC;AAClE,QAAM,SAAS,IAAI;AACnB,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,CAAC,UAAU,OAAO,IAAI,KAAK;AAAA,IACnC,SAAS,CAAC,WAAW;AACnB,UAAI,IAAI;AACR,iBAAW,CAAC,OAAO,IAAI,KAAK,QAAQ;AAClC,YAAI,MAAM,OAAQ,KAAI,EAAE,GAAG,OAAO;AAClC,UAAE,KAAK,IAAI,KAAK,GAAG,CAAC;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,kBAAwB;AACtC,mBAAiB,YAAY,CAAC,QAAQ,gBAAgB,GAAwB,CAAC;AACjF;;;ACvBO,SAAS,SACd,IACA,MACoB;AAepB,kBAAgB;AAChB,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,MAAM,MAAM,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB,GAAqC;AACxE,SAAO,OAAO,MAAM,YAAY,MAAM,QAAS,EAA8B,cAAc;AAC7F;;;ACaA,SAAS,eAAe,MAAiC;AACvD,SAAO,EAAE,KAAK,YAAY,YAAY,KAAK,UAAU;AACvD;AAWA,eAAe,iBACb,MACA,KACA,WACA,eACA,KAC6B;AAC7B,MAAI,KAAK,YAAY,cAAc;AACjC,UAAM,SAAS,IAAI,mBAAmB,IAAI;AAC1C,UAAM,MAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACzC,UAAM,aAAa,KAAK,SAAS;AACjC,QAAI,CAAC,OAAO,eAAe,OAAW,QAAO;AAC7C,UAAM,MAAM,IAAI,UAAU;AAC1B,QAAI,KAAK,SAAS,OAAO,QAAW;AAClC,aAAO,OAAO,OAAO,QAAQ,WAAY,IAAgC,SAAS,IAA0B;AAAA,IAC9G;AACA,WAAO,OAAO,QAAQ,WAAW,MAAM;AAAA,EACzC;AACA,SAAO,IAAI,sBAAsB,KAAK,WAAW,KAAK,WAAW,aAAa;AAChF;AAGA,eAAe,iBACb,QACA,KACA,KACkC;AAClC,QAAM,SAAS,OAAO,QAAQ,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,eAAe,CAAC,CAAC;AACnF,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAC7D,QAAM,WAAW,IAAI;AACrB,QAAM,QAAQ,IAAI;AAKlB,MAAI,WAAW,MAAO,QAAO;AAK7B,QAAM,mBAAmB,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,YAAY,EAAE,kBAAkB,MAAS;AACvG,MAAI,CAAC,UAAU,CAAC,iBAAkB,QAAO;AAEzC,MAAI,SAAS;AACb,QAAM,aAAa,EAAE,GAAG,OAAO;AAE/B,aAAW,CAAC,OAAO,IAAI,KAAK,QAAQ;AAClC,UAAM,SAAS,KAAK,YAAY,cAAc,KAAK,WAAW,KAAK,IAAI;AACvE,UAAM,gBAAgB,WAAW,eAAgB,YAAY,KAAK,aAAc;AAChF,UAAM,YAAY,WAAW,KAAK,YAAY,WAAW,KAAK,gBAAgB;AAE9E,UAAM,aAAa,OAAO,QAAwC;AAChE,UAAI,CAAC,WAAW;AACd,YAAI,WAAW,SAAS;AACtB,gBAAM,IAAI,wBAAwB,OAAO,WAAW,KAAK,uCAAuC,GAAG,IAAI;AAAA,QACzG;AACA,eAAO;AAAA,MACT;AACA,YAAM,QAAQ,MAAM,iBAAiB,MAAM,KAAK,WAAW,eAAe,GAAG;AAC7E,UAAI,UAAU,QAAW;AACvB,YAAI,WAAW,SAAS;AACtB,gBAAM,IAAI,wBAAwB,OAAO,WAAW,KAAK,wBAAwB,GAAG,gBAAgB,SAAS,IAAI;AAAA,QACnH;AACA,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,SAAS,KAAK,GAAG;AACzB,YAAM,QAAQ,MAAM,MAAM,KAAK;AAC/B,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,OAAO,MAAM,CAAC;AACpB,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,YAAM,MAAO,WAAuC,QAAQ;AAC5D,UAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,YAAM,WAAW,GAAG,IAAI;AACvB,MAAC,WAAuC,QAAQ,IAAI,MAAM,QAAQ;AAAA,QACjE,IAAI,IAAI,OAAO,OAAO;AACpB,cAAI,CAAC,MAAM,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,EAAG,QAAO;AAC/D,gBAAM,IAAK,GAA+B,IAAI;AAC9C,cAAI,OAAO,MAAM,SAAU,QAAO;AAClC,iBAAO,EAAE,GAAI,IAAgC,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE;AAAA,QAC/E,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,iBAAW,GAAG,KAAK,OAAO,IAAI,MAAM,QAAQ;AAAA,QAC1C,IAAI,IAAI,OAAO,OAAO,EAAE,KAAK,GAAG,OAAO,OAAO,MAAM,WAAW,MAAM,WAAW,CAAC,IAAI,KAAK,EAAE;AAAA,MAC9F;AAAA,IACF,WAAW,OAAO,QAAQ,UAAU;AAClC,YAAM,QAAQ,MAAM,WAAW,GAAG;AAClC,UAAI,UAAU,KAAM,YAAW,GAAG,KAAK,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAEA,WAAS;AACT,SAAO;AACT;AA+BA,SAAS,4BAA4B,KAA+C;AAClF,QAAM,eAA4D,CAAC;AACnE,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC5D,iBAAa,KAAK,IAAI;AAAA,MACpB,GAAI,KAAK,cAAc,KAAK,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7D,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQ3D,GAAI,KAAK,SAAS,SACd,EAAE,MAAM,KAAK,KAAK,IAClB,KAAK,YAAY,YAAY,KAAK,UAAU,SAAY,EAAE,MAAM,OAAO,KAAK,KAAK,KAAK,EAAE,IAAI,CAAC;AAAA,IACnG;AAAA,EACF;AACA,SAAO,EAAE,aAAa;AACxB;AAcA,SAAS,mBAAmB,OAAe,MAAwB,KAAuD;AACxH,MAAI;AACF,WAAO,IAAI,cAAc,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR,uBAAuB,KAAK,qCAAqC,KAAK,SAAS;AAAA,MAEjF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAyBA,SAAS,gBAAgB,QAAiC,KAA+C;AACvG,QAAM,cAAc,OAAO,QAAQ,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,UAAU,KAAK,CAAC;AACnG,MAAI,YAAY,WAAW,EAAG,QAAO;AAErC,MAAI,SAAS;AACb,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa;AACvC,UAAM,UAAU,mBAAmB,OAAO,MAAM,GAAG;AACnD,QAAI,CAAC,WAAW,QAAQ,SAAS,SAAS,EAAG;AAE7C,QAAI,MAAM,SAAS,KAAK,GAAG;AACzB,YAAM,CAAC,UAAU,IAAI,IAAI,MAAM,MAAM,KAAK;AAC1C,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,YAAM,MAAM,OAAO,QAAS;AAC5B,UAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,UAAI,UAAU;AACd,YAAM,aAAa,IAAI,IAAI,CAAC,SAAS;AACnC,YAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,cAAMA,SAAS,KAAiC,IAAI;AACpD,YAAI,OAAOA,WAAU,SAAU,QAAO;AACtC,cAAMC,aAAY,QAAQ,SAAS,IAAID,MAAK;AAC5C,YAAIC,eAAc,UAAaA,eAAcD,OAAO,QAAO;AAC3D,kBAAU;AACV,eAAO,EAAE,GAAI,MAAkC,CAAC,IAAI,GAAGC,WAAU;AAAA,MACnE,CAAC;AACD,UAAI,CAAC,QAAS;AACd,UAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,aAAO,QAAS,IAAI;AACpB;AAAA,IACF;AAEA,UAAM,SAAS,UAAU,QAAQ,KAAK;AACtC,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,QAAQ,OAAO,CAAC;AAMtB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,MAAM,WAAW,EAAG;AACxB,UAAI,UAAU;AACd,YAAM,aAAa,MAAM,IAAI,CAAC,OAAO;AACnC,YAAI,OAAO,OAAO,SAAU,QAAO;AACnC,cAAMA,aAAY,QAAQ,SAAS,IAAI,EAAE;AACzC,YAAIA,eAAc,UAAaA,eAAc,GAAI,QAAO;AACxD,kBAAU;AACV,eAAOA;AAAA,MACT,CAAC;AACD,UAAI,CAAC,QAAS;AACd,UAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,uBAAiB,QAAQ,OAAO,UAAU;AAC1C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,YAAY,QAAQ,SAAS,IAAI,KAAK;AAC5C,QAAI,cAAc,UAAa,cAAc,MAAO;AACpD,QAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,qBAAiB,QAAQ,OAAO,SAAS;AAAA,EAC3C;AACA,SAAO;AACT;AAUA,eAAe,sBAAsB,QAAiC,KAAqC;AACzG,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC5D,QAAI,KAAK,eAAe,SAAU;AAMlC,eAAW,SAAS,UAAU,QAAQ,KAAK,GAAG;AAO5C,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,mBAAW,MAAM,OAAO;AACtB,cAAI,OAAO,OAAO,SAAU;AAC5B,gBAAMC,SAAQ,IAAI,aAAa,MAAM,IAAI,WAAW,OAAO,EAAE,IAAI;AACjE,cAAI,CAACA,OAAO,OAAM,IAAI,sBAAsB,KAAK,WAAW,OAAO,EAAE;AAAA,QACvE;AACA;AAAA,MACF;AACA,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,QAAQ,IAAI,aAAa,MAAM,IAAI,WAAW,OAAO,KAAK,IAAI;AACpE,UAAI,CAAC,MAAO,OAAM,IAAI,sBAAsB,KAAK,WAAW,OAAO,KAAK;AAAA,IAC1E;AAAA,EACF;AACF;AAsBA,SAAS,mBAAmB,OAAe,GAAY,GAAY,KAA0C;AAC3G,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,QAAM,OAAO,IAAI,aAAa,KAAK;AACnC,MAAI,CAAC,QAAQ,KAAK,WAAW,OAAW,QAAO;AAC/C,QAAM,OAAO,KAAK,YAAY,WACzB,KAAK,QAAQ,IAAI,IAAI,OAAO,QAAQ,KAAK,KAAK,CAAC,IAAI,SACpD,IAAI,cAAc,IAAI;AAC1B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,oBAAoB,KAAK,WAAW,MAAM,IAAI,EAAE,YAAY,GAAG,GAAG,KAAK,iBAAiB,EAAE;AACnG;AAkBA,SAAS,wBAAwB,OAAe,KAAa,QAA4B,KAA0C;AACjI,QAAM,OAAO,IAAI,aAAa,KAAK;AACnC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK,YAAY,WACzB,KAAK,QAAQ,IAAI,IAAI,OAAO,QAAQ,KAAK,KAAK,CAAC,IAAI,SACpD,IAAI,cAAc,IAAI;AAC1B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,oBAAoB,KAAK,WAAW,MAAM,IAAI,EAAE,MAAM,KAAK,UAAU,KAAK,iBAAiB,EAAE;AACtG;AAEO,SAAS,cAAc,KAAkC;AAC9D,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,MAAM;AAAA,IAChG,kBAAkB,CAAC,UAAU,UAAU;AAAA,IACvC,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,QAAQ,CAAC,WAAW,gBAAgB,QAAQ,GAAG;AAAA,IAC/C,cAAc,CAAC,WAAW,sBAAsB,QAAQ,GAAG;AAAA,IAC3D,SAAS,OAAO,QAAQ,QAAQ,iBAAiB,QAAQ,KAAK,GAAG;AAAA,IACjE,iBAAiB,CAAC,OAAO,GAAG,MAAM,mBAAmB,OAAO,GAAG,GAAG,GAAG;AAAA,IACrE,mBAAmB,CAAC,OAAO,KAAK,WAAW,wBAAwB,OAAO,KAAK,QAAQ,GAAG;AAAA,IAC1F,kBAAkB,MAAM,4BAA4B,GAAG;AAAA,EACzD;AACF;AAEO,SAAS,gBAAsB;AACpC,mBAAiB,UAAU,CAAC,MAAM,cAAc,CAAoB,CAAC;AACvE;;;AC9YA,SAAS,+BACP,WACA,MACM;AACN,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,OAAO,UAAa,KAAK,kBAAkB,QAAW;AACpG,YAAQ;AAAA,MACN,oBAAoB,SAAS,eAAe,KAAK,MAAM;AAAA,IAIzD;AAAA,EACF;AACF;AAsBO,SAAS,OACd,WACA,MAewB;AACxB,gBAAc;AACd,iCAA+B,WAAW,IAAI;AAC9C,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,KAAK,MAAM,OAAO;AAAA,IAClB,YAAY,MAAM,cAAc;AAAA,IAChC,SAAS,MAAM,WAAW;AAAA,IAC1B,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC5D,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACzD,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,IACjF,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACrE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACxE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAMO,SAAS,OAA6C,MAA4C;AACvG,gBAAc;AACd,SAAO;AAAA,IACL,WAAW;AAAA,IACX,WAAW;AAAA,IACX,KAAK;AAAA,IACL,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,UAAU;AAAA,IACV;AAAA,EACF;AACF;AAaO,SAAS,KACd,WACA,MAQwB;AACxB,gBAAc;AACd,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,KAAK;AAAA,IACL,YAAY,MAAM,cAAc;AAAA,IAChC,SAAS;AAAA,IACT,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACrE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EAC1E;AACF;;;ACpHA,SAAS,mBAAmB,SAAgC;AAM1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,gEAAgE,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAYA,eAAsB,cACpB,SACA,OACA,SACA,YACe;AACf,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,UAAU,GAAG,GAAG;AAElE,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,WAAW,SAAS;AAC3F,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAE7C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,WAAW,SAAS,KAAK;AAAA,EAC3B;AACF;AAQA,eAAsB,cACpB,SACA,OACA,SACA,WACgC;AAChC,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,SAAS;AAChF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,SAAO,KAAK,MAAM,SAAS;AAC7B;AAOA,eAAsB,iBACpB,SACA,OACA,SACA,WACe;AACf,qBAAmB,OAAO;AAC1B,QAAM,QAAQ,OAAO,OAAO,6BAA6B,SAAS;AACpE;AASA,eAAsB,gBACpB,SACA,OACA,SACmB;AACnB,qBAAmB,OAAO;AAC1B,SAAO,QAAQ,KAAK,OAAO,2BAA2B;AACxD;AASA,eAAsB,iBACpB,SACA,OACA,SACA,WACiE;AACjE,QAAM,aAAa,MAAM,cAAc,SAAS,OAAO,SAAS,SAAS;AACzE,MAAI,CAAC,WAAY,QAAO,EAAE,QAAQ,MAAM;AAExC,QAAM,UAAU,WAAW,YACvB,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,SAAS,EAAE,QAAQ,IACpD;AAEJ,SAAO,EAAE,QAAQ,MAAM,QAAQ;AACjC;","names":["value","canonical","known"]}
1	+ {"version":3,"sources":["../src/with-commit/numbering/descriptor.ts","../src/via/computed/binding.ts","../src/via/computed/descriptor.ts","../src/via/lookup/binding.ts","../src/via/lookup/descriptor.ts","../src/with-sync/credentials.ts"],"sourcesContent":["/*\n @category capability\n * Deferred-numbering config descriptor. See\n * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.\n /\n\n/* A registered deferred-numbering series. /\nexport interface DeferredNumberingConfig {\n /* Series name — the key passed to `vault.sequence(series)`. /\n readonly series: string\n /* Collection holding the records to number. /\n readonly collection: string\n /* Field on each record where the assigned serial is written. /\n readonly field: string\n /\n Minimum wall-clock age (ms) before an entry is eligible at a pass, in\n * addition to the interval commit-wait. Default 0 — the store-clock\n * interval (`storeLatest ≤ now.earliest`) is the correctness mechanism.\n /\n readonly settleWindowMs: number\n}\n\n/\n Options for {@link withDeferredNumbering} (#844b — was an inline literal, so\n * unnameable). Same shape as {@link DeferredNumberingConfig} except\n * `settleWindowMs` is optional; the factory defaults it to 0.\n /\nexport interface WithDeferredNumberingOptions {\n /* Series name — the key passed to `vault.sequence(series)`. /\n readonly series: string\n /* Collection holding the records to number. /\n readonly collection: string\n /* Field on each record where the assigned serial is written. /\n readonly field: string\n /* See {@link DeferredNumberingConfig.settleWindowMs}. Default 0. /\n readonly settleWindowMs?: number\n}\n\n/* Declare a deferred-numbering series. Pass the result in `createNoydb({ numbering: [...] })`. /\nexport function withDeferredNumbering(opts: WithDeferredNumberingOptions): DeferredNumberingConfig {\n return {\n series: opts.series,\n collection: opts.collection,\n field: opts.field,\n settleWindowMs: opts.settleWindowMs ?? 0,\n }\n}\n","/\n The `computed` via-binding (#638 Task 7) — covers ONLY `mode: 'virtual'`\n * fields. Materialized entries never reach here: they compile into\n * `mergedComputed` (`kernel/collection-config.ts`) and run through the\n * EXISTING stage-5 `evalComputedFields` write path, byte-for-byte unchanged\n * (the behavior lock).\n \n A virtual field is computed on READ, inside `present()` — the money-\n * `Formatted`/i18n-`Label` precedent (seam map Part 4) generalized to a\n * user-declared function. It is NEVER stored (no `encodeAtRest`/\n * `decodeAtRest` — the field never appears in `_data` or any `_sealed`\n * slot), and its posture is fixed `queryable: 'none'` — there is no stored/\n * indexed form to query against, regardless of what its sources would\n * otherwise permit (`ViaGraph`'s grain-'virtual' clamp, `kernel/via/graph.ts`,\n * is the belt; this binding's own static posture is the suspenders for a\n * depsless virtual field, which registers no graph edge at all).\n \n Export/read redaction for a TAINTED virtual field (sourced from a\n * classified/sealed field) is NOT this binding's job — it stays ignorant of\n * taint, exactly like `evalComputedFields` stays ignorant of it for\n * materialized fields. `kernel/via/taint-binding.ts#taintBinding` (appended\n * to the pipeline by `via/graph-wiring.ts#applyTaintOverlay`, AFTER this\n * binding) overwrites a tainted virtual field's value with the same\n * `EXPORT_REDACTION_MARKER` on every present() — the one enforcement seam\n * every via feature's taint already routes through.\n /\nimport type { ViaBinding, ViaPosture } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { ComputedDescriptor } from './descriptor.js'\n\nexport interface ComputedViaConfig {\n /* field name -> its virtual-mode descriptor. Materialized entries are never present here. /\n readonly virtualFields: ReadonlyMap<string, ComputedDescriptor>\n}\n\nconst VIRTUAL_POSTURE: ViaPosture = { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: false }\n\nexport function computedBinding(cfg: ComputedViaConfig): ViaBinding {\n const fields = cfg.virtualFields\n return {\n brand: 'computed',\n posture: VIRTUAL_POSTURE,\n covers: (field) => fields.has(field),\n present: (record) => {\n let r = record\n for (const [field, desc] of fields) {\n if (r === record) r = { ...record }\n r[field] = desc.fn(r)\n }\n return r\n },\n }\n}\n\nexport function linkComputedVia(): void {\n installViaBinder('computed', (cfg) => computedBinding(cfg as ComputedViaConfig))\n}\n","/\n computed() — the declaration factory for a field whose value is DERIVED\n * from other fields on the same record (#638 Task 7, spec §6). Composes\n * with `via()` (the locked grammar since phase A: `via(computed(fn, { deps,\n * mode }), money('EUR'))`), grouped by `_viaBrand` like every other via\n * feature (`kernel/via/compose.ts#mergeViaFields`).\n \n `mode` picks where the function runs:\n * - `'materialized'` (default) — TODAY's stage-5 write-time eager compute\n * (`with-formula/computed/index.ts#evalComputedFields`), stored like any\n * other field. Byte-for-byte the existing `computed: { field: fn }` sugar.\n * - `'virtual'` — rides the `present` read phase (the money-`Formatted`/\n * i18n-`Label` precedent, seam map Part 4): computed fresh on every\n * read, NEVER stored, `queryable: 'none'`, excluded from export unless\n * its declared `deps` permit (identical taint rule to materialized —\n * see `via/computed/binding.ts`).\n \n `deps` names the OTHER fields `fn` reads — feeds `ViaGraph` (Task 1/2) so\n * a source's taint (e.g. a classified field) propagates to this derived\n * field. A depsless entry is fine UNLESS the collection also declares\n * classified fields (`kernel/collection-config.ts#resolveComputedEdges`\n * refuses it — closes the #636 opaque-function leak).\n /\nimport type { ViaDescriptor } from '../../kernel/via/index.js'\nimport { linkComputedVia } from './binding.js'\n\nexport interface ComputedDescriptor extends ViaDescriptor {\n readonly _viaBrand: 'computed'\n readonly fn: (record: Record<string, unknown>) => unknown\n readonly deps?: readonly string[]\n readonly mode: 'materialized' \| 'virtual'\n}\n\nexport function computed(\n fn: (record: Record<string, unknown>) => unknown,\n opts?: { readonly deps?: readonly string[]; readonly mode?: 'materialized' \| 'virtual' },\n): ComputedDescriptor {\n // Self-link, exactly as `money()` and `lookup()` do (#813). Until this call\n // existed, `computed` was the only via feature whose binder was installed by a\n // DIFFERENT module — `port/with/computed-strategy.ts` — rather than by its own\n // declaration factory. That works whenever the kernel spine and the consumer's\n // `computed` import resolve to one module instance, and fails when they do not:\n // under vitest's `server.deps.inline`, a consumer got the descriptor from one\n // transformed instance while the binder registry consulted at bind time lived in\n // another, producing `VIA_NOT_LINKED` for a descriptor `isComputedDescriptor()`\n // accepted. money/i18n/lookup were immune precisely because they self-link.\n //\n // Constructing a descriptor is the binding's opt-in unit, so linking here makes\n // the guarantee local: whatever instance produced the descriptor also has the\n // binder. `installViaBinder` is idempotent + first-wins, so the eager call in\n // `port/with/computed-strategy.ts` stays harmless.\n linkComputedVia()\n return {\n _viaBrand: 'computed',\n fn,\n ...(opts?.deps !== undefined ? { deps: opts.deps } : {}),\n mode: opts?.mode ?? 'materialized',\n }\n}\n\nexport function isComputedDescriptor(x: unknown): x is ComputedDescriptor {\n return typeof x === 'object' && x !== null && (x as { _viaBrand?: unknown })._viaBrand === 'computed'\n}\n","/\n The `'lookup'` `ViaBinding` — wires the lookup engine (present-time label\n * dressing across all three backing tiers) into the kernel's generic Via\n * port. Mirrors `via/i18n/binding.ts`'s #553 static-link pattern; the\n * present-time label-dressing algorithm below is adapted from\n * `via-i18n/binding.ts:253-337` (the same wildcard/array/scalar handling,\n * the same `onMissing`/`substitute` policy engine), generalized to branch on\n * `backing` instead of a static-vs-dynamic descriptor-shape check. For the\n * `'static'` and `'reserved'` tiers this delegates to `cfg.lookupLabelResolver`\n * — the SAME vault-built closure the i18n binding's `dictLabelResolver` uses\n * (static table first, else the `vault.dictionary()` handle) — so a native\n * `dict()`/`lookup(static)` field resolves through the identical label data\n * as its `dictKey()`/`staticDict()` alias (the byte-equivalence lock).\n \n `lookup()`/`enumOf()`/`dict()` each call {@link linkLookupVia} first — the\n * same #553 pattern `money()`/`dictKey()` use.\n \n `buildClause` (label-predicate queries) is still undeclared — out of scope\n * for #650. `compareForOrder` (#650 Task 6, spec §5; matrix tier added Task\n * 7) resolves a `sortBy`-declared field's ordering via `cfg.snapshotFor`'s\n * sync snapshot; the hook signature is UNCHANGED (`via/index.ts:128-129` — no\n * locale param), so it closes over each descriptor's own `displayLocale`\n * (the same locale-less-hinge default `runLookupPresent`'s\n * `hasStaticDisplay` branch already uses). `resolveOrderLabel` (#650 Task\n * 7) is the PER-CALL-locale sibling `orderBy(..., {by:'label'})` needs —\n * see its own doc comment below. `describeFragment` (#650 Task 7) is the\n * first-ever consumed `ViaBinding.describeFragment` implementation — see\n * `with-shape/introspection/describe.ts`'s `buildDescription`.\n /\nimport type { ViaBinding, ViaReadCtx } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { LookupDescriptor, LookupBacking, Vocabulary, OnDelete } from './descriptor.js'\nimport { resolvePolicy, type Layer } from '../i18n/policy.js'\nimport { LocaleNotSpecifiedError, UnknownLookupKeyError, ValidationError } from '../../kernel/errors.js'\nimport { getAtPath, setAtPathInPlace } from '../../kernel/paths.js'\nimport type { MaterializedBacking } from './registry.js'\nimport { buildLookupSnapshot } from './snapshot.js'\n\n/\n Config a collection's lookup declarations resolve to — the binding's\n * construction input. `lookupLabelResolver`/`getLookupBacking`/`membership`/\n * `snapshotFor` are vault-built closures (never a `Collection` handle,\n * keyring, or DEK/CEK — the zero-knowledge boundary).\n /\nexport interface LookupViaConfig {\n readonly lookupFields: Record<string, LookupDescriptor>\n readonly lookupLabelResolver?: (dimension: string, key: string, locale: string, fallback?: unknown) => Promise<string \| undefined>\n /\n The matrix (collection) tier's present-time backing-row source, keyed by the full\n * descriptor (not a bare dimension name) so the closure can resolve by `descriptor.key`,\n * not the backing row's PUT-id (#651 Task 3 — the same descriptor-gaining dispatch Task 7\n * already applied to `snapshotFor`).\n /\n readonly getLookupBacking?: (descriptor: LookupDescriptor) => (key: string) => Promise<Record<string, unknown> \| undefined>\n /* Closed-vocabulary write-time membership test (#650 Task 3) — `(field, key) => known?`. /\n readonly membership?: (field: string, key: string) => boolean \| Promise<boolean>\n /* Sync per-descriptor altKey index — `ingest`'s normalization source (#650 Task 3). /\n readonly getAltIndex?: (desc: LookupDescriptor) => MaterializedBacking \| undefined\n /\n Sync materialized `key -> row` rows for a lookup descriptor (#650 Task\n * 6, spec §5; matrix-tier routing added #650 Task 7) — `compareForOrder`\n * and `resolveOrderLabel` below, and `snapshot.ts`'s `presentForJoin`\n * builder, all read this same vault-built closure. Reserved AND\n * collection (matrix) tier route here (the vault wires\n * `dimension -> LookupHandle.snapshotEntries()` / `dimension ->\n * collection.querySourceForJoin().snapshot()` respectively, keyed by\n * `descriptor.key` for the matrix case — see `registry.ts`'s\n * `buildLookupSnapshotRows`); static tier is resolved locally from\n * `descriptor.table` without calling this.\n /\n readonly snapshotFor?: (descriptor: LookupDescriptor) => ReadonlyMap<string, Record<string, unknown>> \| undefined\n readonly collectionName: string\n}\n\n/* Enum tier (`backing:'static'`, no `table`) has no label source at all — never dressed. /\nfunction hasLabelSource(desc: LookupDescriptor): boolean {\n return !(desc.backing === 'static' && desc.table === undefined)\n}\n\n/\n Resolve one key's label. `'static'`/`'reserved'` both go through\n * `cfg.lookupLabelResolver` (mirrors `dictLabelResolver`'s own static-table-\n * first-else-reserved-handle branching — the SAME closure is reused, see\n * `kernel/vault.ts`). `'collection'` (matrix tier) reads the declared\n * `present.label` off the backing row via `cfg.getLookupBacking`; when\n * `present.by` is set, that field's value is a `{ locale -> label }` map\n * indexed by the effective locale.\n /\nasync function fetchLookupLabel(\n desc: LookupDescriptor,\n key: string,\n effLocale: string,\n fieldFallback: string \| readonly string[] \| undefined,\n cfg: LookupViaConfig,\n): Promise<string \| undefined> {\n if (desc.backing === 'collection') {\n const getRow = cfg.getLookupBacking?.(desc)\n const row = getRow ? await getRow(key) : undefined\n const labelField = desc.present?.label\n if (!row \|\| labelField === undefined) return undefined\n const raw = row[labelField]\n if (desc.present?.by !== undefined) {\n return raw && typeof raw === 'object' ? (raw as Record<string, unknown>)[effLocale] as string \| undefined : undefined\n }\n return typeof raw === 'string' ? raw : undefined\n }\n return cfg.lookupLabelResolver?.(desc.dimension, key, effLocale, fieldFallback)\n}\n\n/* `present` — resolve `<field>Label` for every declared lookup field. Adapted from `via-i18n/binding.ts:253-337`. /\nasync function runLookupPresent(\n record: Record<string, unknown>,\n ctx: ViaReadCtx,\n cfg: LookupViaConfig,\n): Promise<Record<string, unknown>> {\n const fields = Object.entries(cfg.lookupFields).filter(([, d]) => hasLabelSource(d))\n if (fields.length === 0) return record\n\n const locale = typeof ctx.locale === 'string' ? ctx.locale : undefined\n const fallback = ctx.fallback as string \| readonly string[] \| undefined\n const layer = ctx.layer as Layer\n\n // `{ locale: 'raw' }` wants the untouched record — mirrors\n // `via-i18n/binding.ts`'s `locale !== 'raw'` dict-label gate exactly (no\n // synthetic `<field>Label` derivative on a raw read).\n if (locale === 'raw') return record\n\n // Static-display hybrid hinge: a `backing:'static'` field with a declared\n // `displayLocale` resolves its `<field>Label` even under a locale-less\n // read (mirrors staticDict's `hasStaticDisplay` gate).\n const hasStaticDisplay = fields.some(([, d]) => d.backing === 'static' && d.displayLocale !== undefined)\n if (!locale && !hasStaticDisplay) return record\n\n let result = record\n const withLabels = { ...result }\n\n for (const [field, desc] of fields) {\n const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : 'null'\n const fieldFallback = policy === 'substitute' ? (fallback ?? desc.substitute) : fallback\n const effLocale = locale ?? (desc.backing === 'static' ? desc.displayLocale : undefined)\n\n const resolveKey = async (key: string): Promise<string \| null> => {\n if (!effLocale) {\n if (policy === 'throw') {\n throw new LocaleNotSpecifiedError(field, `lookup \"${field}\": no locale active to resolve key \"${key}\".`)\n }\n return null\n }\n const label = await fetchLookupLabel(desc, key, effLocale, fieldFallback, cfg)\n if (label === undefined) {\n if (policy === 'throw') {\n throw new LocaleNotSpecifiedError(field, `lookup \"${field}\": no label for key \"${key}\" in locale \"${effLocale}\".`)\n }\n return null\n }\n return label\n }\n\n if (field.includes('[].')) {\n const parts = field.split('[].')\n const arrayKey = parts[0]!\n const leaf = parts[1]\n if (!leaf \|\| leaf.includes('.')) continue\n const arr = (withLabels as Record<string, unknown>)[arrayKey]\n if (!Array.isArray(arr)) continue\n const labelKey = `${leaf}Label`\n ;(withLabels as Record<string, unknown>)[arrayKey] = await Promise.all(\n arr.map(async (el) => {\n if (!el \|\| typeof el !== 'object' \|\| Array.isArray(el)) return el\n const k = (el as Record<string, unknown>)[leaf]\n if (typeof k !== 'string') return el\n return { ...(el as Record<string, unknown>), [labelKey]: await resolveKey(k) }\n }),\n )\n continue\n }\n\n const val = result[field]\n if (Array.isArray(val)) {\n withLabels[`${field}Label`] = await Promise.all(\n val.map(async (k) => ({ key: k, label: typeof k === 'string' ? await resolveKey(k) : null })),\n )\n } else if (typeof val === 'string') {\n const label = await resolveKey(val)\n if (label !== null) withLabels[`${field}Label`] = label\n }\n }\n\n result = withLabels\n return result\n}\n\n/\n One field's `lookup` descriptor as it appears on a `ViaBinding.\n * describeFragment()` payload (#650 Task 7 — the first real consumer,\n * `with-shape/introspection/describe.ts`'s `buildDescription`, imports this\n * type directly; `describe.ts` is NOT under `kernel/*`, so it's free to\n import concrete via/ types the way it already does for\n * `LookupDescriptor`/`MoneyDescriptor`/etc.). `dimension` is OMITTED (not\n * emitted as `''`) for a bare `enumOf()` descriptor — the #650 Task 2\n * `dimension:''` sentinel resolved: no dimension name means no `dimension`\n * key, not a meaningless empty string (T2 carry, #650 Task 7).\n /\nexport interface LookupDescribeFragmentEntry {\n readonly dimension?: string\n readonly backing: LookupBacking\n readonly vocabulary: Vocabulary\n readonly key: string\n readonly altKeys?: readonly string[]\n readonly present?: { readonly label: string; readonly by?: string }\n readonly sortBy?: string\n readonly onDelete: OnDelete\n /* Statically-known closed-vocabulary key set (declared `keys`, or a static table's own keys). Omitted when membership lives only in the backing collection/dictionary (open vocabulary, or closed with no declared `keys`). /\n readonly keys?: readonly string[]\n}\n\n/* The `'lookup'` binding's `describeFragment()` payload shape. /\nexport interface LookupDescribeFragment {\n readonly lookupFields: Record<string, LookupDescribeFragmentEntry>\n}\n\nfunction buildLookupDescribeFragment(cfg: LookupViaConfig): Record<string, unknown> {\n const lookupFields: Record<string, LookupDescribeFragmentEntry> = {}\n for (const [field, desc] of Object.entries(cfg.lookupFields)) {\n lookupFields[field] = {\n ...(desc.dimension !== '' ? { dimension: desc.dimension } : {}),\n backing: desc.backing,\n vocabulary: desc.vocabulary,\n key: desc.key,\n onDelete: desc.onDelete,\n ...(desc.altKeys !== undefined ? { altKeys: desc.altKeys } : {}),\n ...(desc.present !== undefined ? { present: desc.present } : {}),\n ...(desc.sortBy !== undefined ? { sortBy: desc.sortBy } : {}),\n // #657 — static tier: when no `keys` was explicitly declared but a\n // `table` was (the staticDict()-equivalent `lookup(dim, {backing:\n // 'static', table})` shape), the table's own key set IS the\n // statically-known closed-vocabulary set the DescribedField.lookup\n // docblock promises (\"declared `keys`, OR a static table's own\n // keys\"). Reserved/matrix tiers never carry `table`, so this branch\n // never fires for them — their `keys` emission is unchanged.\n ...(desc.keys !== undefined\n ? { keys: desc.keys }\n : desc.backing === 'static' && desc.table !== undefined ? { keys: Object.keys(desc.table) } : {}),\n }\n }\n return { lookupFields }\n}\n\n/\n `cfg.getAltIndex(desc)` (matrix tier) reads the backing collection's cache\n * via `querySourceForJoin()` (`buildLookupAltIndex`, registry.ts) — which\n * throws a `.join()`-branded message when that collection was opened\n * `{prefetch:false}` (lazy mode is unsupported for altKey normalization).\n * Normalization must never silently not happen (the banned silent-no-op\n * class, #650 Task 3 review, Important 2) — detect that specific failure\n * and surface a CLEAR, lookup-branded `ValidationError` at the point of\n * failure instead of letting the confusing join-branded one leak onto an\n * unrelated `put()`. Any OTHER error (e.g. `materializeBackingTable`'s own\n * altKey-collision `ValidationError`) propagates unchanged.\n /\nfunction getAltIndexOrThrow(field: string, desc: LookupDescriptor, cfg: LookupViaConfig): MaterializedBacking \| undefined {\n try {\n return cfg.getAltIndex?.(desc)\n } catch (err) {\n if (err instanceof Error && err.message.includes('lazy-mode')) {\n throw new ValidationError(\n `lookup: altKeys on \"${field}\" require the backing collection \"${desc.dimension}\" to be ` +\n `prefetch-enabled (lazy mode unsupported); open it without {prefetch:false} or drop altKeys.`,\n )\n }\n throw err\n }\n}\n\n/\n `ingest` — altKey candidate values normalize to the canonical key (#650\n * Task 3, spec §3). Pure, sync, idempotent (a canonical key maps to\n * itself); no store read — consults the pre-materialized\n * `cfg.getAltIndex(desc)`. The money `canonicalizeIncomingMoney` precedent\n * (`via/index.ts:108`).\n \n A `[].`-wildcard multi-value path (`getAtPath` resolves >1 entries — an\n * array of nested objects, e.g. `'lines[].country'`, the same wildcard\n * convention `runLookupPresent` above already handles) normalizes EVERY\n * element's leaf value, not just a lone scalar (#652 fix — this used to bail\n * out entirely here while `runLookupEnforceWrite` below validated every\n * value unnormalized, so a legitimate altKey in an array position was\n * wrongly refused by closed-vocabulary enforcement). `setAtPathInPlace`\n * can't write into a `[].`-wildcard path, so the array is reconstructed\n * immutably instead, mirroring `runLookupPresent`'s own `field.includes\n * ('[].')` branch. A plain field whose OWN value is a bare top-level array\n * (not a `[].`-wildcard path) gets the SAME element-wise normalization\n * against `backing.altIndex` (#661 fix — `getAtPath` resolves it to one\n * opaque value, so the array itself is `values[0]`; a non-string element is\n * left untouched, mirroring the scalar branch's own `typeof !== 'string'`\n * skip — no parallel coercion invented for this shape).\n /\nfunction runLookupIngest(record: Record<string, unknown>, cfg: LookupViaConfig): Record<string, unknown> {\n const withAltKeys = Object.entries(cfg.lookupFields).filter(([, d]) => (d.altKeys?.length ?? 0) > 0)\n if (withAltKeys.length === 0) return record\n\n let result = record\n for (const [field, desc] of withAltKeys) {\n const backing = getAltIndexOrThrow(field, desc, cfg)\n if (!backing \|\| backing.altIndex.size === 0) continue\n\n if (field.includes('[].')) {\n const [arrayKey, leaf] = field.split('[].')\n if (!leaf \|\| leaf.includes('.')) continue\n const arr = record[arrayKey!]\n if (!Array.isArray(arr)) continue\n let changed = false\n const normalized = arr.map((item) => {\n if (!item \|\| typeof item !== 'object' \|\| Array.isArray(item)) return item\n const value = (item as Record<string, unknown>)[leaf]\n if (typeof value !== 'string') return item\n const canonical = backing.altIndex.get(value)\n if (canonical === undefined \|\| canonical === value) return item\n changed = true\n return { ...(item as Record<string, unknown>), [leaf]: canonical }\n })\n if (!changed) continue\n if (result === record) result = { ...record }\n result[arrayKey!] = normalized\n continue\n }\n\n const values = getAtPath(record, field)\n if (values.length !== 1) continue\n const value = values[0]\n\n // `getAtPath`/`setAtPathInPlace` resolve `field` generically, dotted\n // paths included (e.g. 'meta.tags') — do not rewrite this branch to a\n // direct `record[field]` bracket access, which would silently stop\n // normalizing/enforcing a dotted-non-wildcard bare-array field (#661).\n if (Array.isArray(value)) {\n if (value.length === 0) continue\n let changed = false\n const normalized = value.map((el) => {\n if (typeof el !== 'string') return el\n const canonical = backing.altIndex.get(el)\n if (canonical === undefined \|\| canonical === el) return el\n changed = true\n return canonical\n })\n if (!changed) continue\n if (result === record) result = { ...record }\n setAtPathInPlace(result, field, normalized)\n continue\n }\n\n if (typeof value !== 'string') continue\n const canonical = backing.altIndex.get(value)\n if (canonical === undefined \|\| canonical === value) continue\n if (result === record) result = { ...record }\n setAtPathInPlace(result, field, canonical)\n }\n return result\n}\n\n/\n `enforceWrite` — closed-vocabulary write refusal (#650 Task 3, spec §3).\n * Runs only for `vocabulary:'closed'` fields; `'open'` (the dictKey/dict\n * default) skips the check entirely, so #649's fix is additive — existing\n * dictKey/staticDict collections are unaffected. `ctx` carries no\n * cross-collection door (`id`/`vault`/`prior`/`emit` only, unchanged) —\n * membership is a vault-built closure on `cfg`, per spec.\n /\nasync function runLookupEnforceWrite(record: Record<string, unknown>, cfg: LookupViaConfig): Promise<void> {\n for (const [field, desc] of Object.entries(cfg.lookupFields)) {\n if (desc.vocabulary !== 'closed') continue\n // Checks every value `getAtPath` returns — for a `[].`-wildcard\n // multi-value path, that's every element's leaf value.\n // `runLookupIngest` above now normalizes each of those elements first\n // (#652), so what lands here for a `[].`-wildcard field is already\n // canonical; this loop's job stays membership, not normalization.\n for (const value of getAtPath(record, field)) {\n // A plain field whose OWN value is a bare top-level array (#661) —\n // `runLookupIngest` above has already normalized its elements'\n // altKeys, so membership-check each element through the SAME\n // `cfg.membership` closure the scalar branch below uses, refusing on\n // the first unknown one. A non-string element is skipped, mirroring\n // the scalar branch's own skip.\n if (Array.isArray(value)) {\n for (const el of value) {\n if (typeof el !== 'string') continue\n const known = cfg.membership ? await cfg.membership(field, el) : true\n if (!known) throw new UnknownLookupKeyError(desc.dimension, field, el)\n }\n continue\n }\n if (typeof value !== 'string') continue\n const known = cfg.membership ? await cfg.membership(field, value) : true\n if (!known) throw new UnknownLookupKeyError(desc.dimension, field, value)\n }\n }\n}\n\n/\n `compareForOrder` — exact ordering for a `sortBy`-declared lookup field\n * against the sync snapshot (#650 Task 6, spec §5, conflict resolution 4;\n * matrix-tier coverage added #650 Task 7). Opt-in: undeclared `sortBy`\n * (every dictKey/staticDict alias and every lookup field declared before\n * Task 6) returns `undefined` — falls through to the generic stored-value\n * comparator, byte-identical to today. Static tier reads `descriptor.table`\n * directly; reserved AND matrix (collection) tier both read `cfg.snapshotFor`\n * (the SAME live cache `presentForJoin`'s lookup half reads — see\n * `snapshot.ts`'s file header). The hook has no locale parameter\n * (`via/index.ts:128-129`, unchanged) — closes over the descriptor's own\n * `displayLocale` (the same locale-less-hinge default `runLookupPresent`\n * already uses); a `sortBy` field whose value isn't locale-keyed\n * (`present.by` undefined) never needs one. A `by`-keyed `sortBy` field\n * with NO declared `displayLocale` degrades to comparing the raw canonical\n * keys (silent — `LookupSnapshot.compareKeys` never throws; declare-time\n * warning at `descriptor.ts`'s `lookup()` factory; use\n * `orderBy(field, dir, {by:'label'})` — `resolveOrderLabel` below — for a\n * PER-CALL locale instead).\n /\nfunction compareLookupOrder(field: string, a: unknown, b: unknown, cfg: LookupViaConfig): number \| undefined {\n if (typeof a !== 'string' \|\| typeof b !== 'string') return undefined\n const desc = cfg.lookupFields[field]\n if (!desc \|\| desc.sortBy === undefined) return undefined\n const rows = desc.backing === 'static'\n ? (desc.table ? new Map(Object.entries(desc.table)) : undefined)\n : cfg.snapshotFor?.(desc)\n if (!rows) return undefined\n return buildLookupSnapshot(desc.dimension, rows, desc).compareKeys(a, b, desc.displayLocale ?? '')\n}\n\n/\n `resolveOrderLabel` — per-key, PER-CALL-locale label resolution for\n * `orderBy(field, dir, { by: 'label' })` (#650 Task 7, spec §6 / seam map\n * Part 10 surprise 6's option (b)) — the channel `compareForOrder` above\n * structurally cannot serve, since `ViaBinding.compareForOrder` carries no\n * locale parameter. Consumed by `kernel/query/builder.ts`'s\n * `buildOrderLabelMaps` as the fallback for lookup fields the legacy dict\n * registries don't bridge (matrix tier; reserved/static tier already\n * resolves via that bridge — `JoinContext.resolveDictSource` — tried\n * FIRST by the caller, see `registry.ts`'s `collectLookupDictCompat` doc\n * comment). Reuses the exact same `cfg.snapshotFor`/`buildLookupSnapshot`\n * machinery as `compareLookupOrder` above, just with the per-call `locale`\n * in place of the descriptor's own `displayLocale` — falling back to\n * `displayLocale` only when the call itself is locale-less, the same\n * hinge order `runLookupPresent` already uses.\n /\nfunction resolveLookupOrderLabel(field: string, key: string, locale: string \| undefined, cfg: LookupViaConfig): string \| undefined {\n const desc = cfg.lookupFields[field]\n if (!desc) return undefined\n const rows = desc.backing === 'static'\n ? (desc.table ? new Map(Object.entries(desc.table)) : undefined)\n : cfg.snapshotFor?.(desc)\n if (!rows) return undefined\n return buildLookupSnapshot(desc.dimension, rows, desc).label(key, locale ?? desc.displayLocale ?? '')\n}\n\nexport function lookupBinding(cfg: LookupViaConfig): ViaBinding {\n return {\n brand: 'lookup',\n posture: { encryptedAtRest: 'envelope', queryable: 'full', exportable: true, forgettable: false },\n reservedPrefixes: ['_dict_', '_lookup_'],\n covers: (field) => field in cfg.lookupFields,\n ingest: (record) => runLookupIngest(record, cfg),\n enforceWrite: (record) => runLookupEnforceWrite(record, cfg),\n present: async (record, ctx) => runLookupPresent(record, ctx, cfg),\n compareForOrder: (field, a, b) => compareLookupOrder(field, a, b, cfg),\n resolveOrderLabel: (field, key, locale) => resolveLookupOrderLabel(field, key, locale, cfg),\n describeFragment: () => buildLookupDescribeFragment(cfg),\n }\n}\n\nexport function linkLookupVia(): void {\n installViaBinder('lookup', (c) => lookupBinding(c as LookupViaConfig))\n}\n","/\n `lookup()` / `enumOf()` / `dict()` descriptors — the three declaration\n * surfaces for the `'lookup'` via binding (#650 Task 2, phase D of the Via\n * port). One `LookupDescriptor` shape; the tiers are `backing` details:\n \n - `lookup(dimension, opts?)` — matrix tier: first-class collection backing\n * (default `backing:'collection'`) — a reference-collection dimension\n * (e.g. `countries`), open vocabulary by default.\n * - `enumOf(keys)` — enum tier: static in-config table, CLOSED\n * vocabulary, no backing store at all (no dimension name — pure inline\n * keys). Exported as `enumOf`; the barrel (`index.ts`) re-exports it as\n * `enum` (`enum` is a reserved word, so it can't be the function's own\n * name).\n * - `dict(dimension, opts?)` — dict tier: reserved `_dict_<dimension>`\n * micro-collection backing (the `vault.dictionary(name)` engine), open\n * vocabulary by default.\n \n Each factory calls {@link linkLookupVia} first — the declaration IS the\n * via binding's opt-in unit (#553), same pattern as `money()`/`i18nText()`/\n * `dictKey()`.\n /\n\nimport type { OnMissingPolicy } from '../i18n/policy.js'\nimport { linkLookupVia } from './binding.js'\n\n/* `'closed'` = enum semantics (membership enforced, Task 3); `'open'` permits unknown keys. /\nexport type Vocabulary = 'open' \| 'closed'\n\n/* Where a dimension's rows live: static in-config table / reserved micro-collection / first-class collection. /\nexport type LookupBacking = 'static' \| 'reserved' \| 'collection'\n\n/* Delete-time referential policy for the backing dimension (default `'restrict'`, enforced in Task 5). /\nexport type OnDelete = 'restrict' \| 'cascade' \| 'nullify'\n\n/* The one descriptor shape every tier compiles to — tiers differ only by `backing`. /\nexport interface LookupDescriptor<Keys extends string = string> {\n readonly _viaBrand: 'lookup'\n /* Dimension/dictionary/target name. Empty for a bare `enumOf()` (no backing store, no name). /\n readonly dimension: string\n /* Canonical key field on the row (default `'id'`). /\n readonly key: string\n /* Candidate keys normalized to `key` on ingest (Task 3). /\n readonly altKeys?: readonly string[]\n readonly vocabulary: Vocabulary\n /* Dressing dimension: which backing-row field supplies `<field>Label`, optionally keyed `by` a sub-field (e.g. locale). /\n readonly present?: { readonly label: string; readonly by?: string }\n /* Field to sort by against the snapshot (Task 6). /\n readonly sortBy?: string\n readonly backing: LookupBacking\n readonly onDelete: OnDelete\n /* Static/enum inline key set. /\n readonly keys?: readonly Keys[]\n /* Static tier only: in-code `key -> { locale -> label }` table. /\n readonly table?: Readonly<Record<string, Readonly<Record<string, string>>>>\n /* Static hybrid hinge (the `staticDict` alias) — locale-less `<field>Label`. /\n readonly displayLocale?: string\n readonly onMissing?: OnMissingPolicy\n readonly substitute?: readonly string[]\n /* Inline display labels (value -> label), the dict-tier sync fallback (mirrors `dictKey`'s `labels`). /\n readonly labels?: Record<string, string>\n}\n\n/\n `sortBy`/`present.by` coupling warning (#650 Task 7, T6 minor — task-6-\n * report.md Concern #4). A `by`-keyed `present` (locale-map) field used as\n * `sortBy` needs a declared `displayLocale` for the locale-less\n * `compareForOrder` sort hook (a plain `orderBy(field)`, no `{by:'label'}`)\n * to resolve anything — without one it silently degrades to comparing the\n * raw canonical keys (never throws — `LookupSnapshot.compareKeys`'s\n * contract). `orderBy(field, dir, {by:'label'})` doesn't need this (it\n * carries its own per-call locale via `ViaBinding.resolveOrderLabel`,\n * #650 Task 7) — only a sortBy-driven PLAIN orderBy does. Warn once at\n * declare time rather than degrade silently at query time.\n /\nfunction warnIfSortByNeedsDisplayLocale(\n dimension: string,\n opts?: { sortBy?: string; present?: { by?: string }; displayLocale?: string },\n): void {\n if (opts?.sortBy !== undefined && opts.present?.by !== undefined && opts.displayLocale === undefined) {\n console.warn(\n `[noy-db] lookup(\"${dimension}\"): sortBy \"${opts.sortBy}\" is locale-keyed (present.by is set) but no ` +\n `displayLocale is declared — a locale-less orderBy() will silently sort by the raw stored key instead ` +\n `of the resolved label. Declare displayLocale, or sort via orderBy(field, dir, { by: 'label' }), which ` +\n `resolves at the query's own per-call locale.`,\n )\n }\n}\n\n/\n Matrix tier — first-class collection backing (default `backing:'collection'`).\n * `dimension` names the backing collection (e.g. `'countries'`).\n \n `backing` may be overridden to construct any tier through this one\n * factory — e.g. `lookup(name, { backing:'static', table, displayLocale })`\n * is the table-bearing static tier `staticDict()` compiles onto. The\n * `table`/`displayLocale`/`keys`/`onMissing`/`substitute`/`labels` options\n * are a superset of the brief's literal opts list: `LookupDescriptor`\n * already carries these fields for exactly this purpose, and without them\n * `backing:'static'` would be unreachable stand-alone through `lookup()`\n * (see task-2-report.md's \"Design decisions\").\n \n `altKeys` caveat (matrix tier only): normalizing an altKey candidate\n * to its canonical `key` requires the backing `dimension` collection to be\n * open in EAGER mode (the default; `{ prefetch: false }` — lazy mode — is\n * unsupported). A `put()` on a field with `altKeys` whose backing collection\n * is lazy throws a `ValidationError` naming the field and dimension; open\n * the backing collection without `{ prefetch: false }`, or drop `altKeys`.\n /\nexport function lookup<Keys extends string>(\n dimension: string,\n opts?: {\n key?: string\n altKeys?: readonly string[]\n vocabulary?: Vocabulary\n present?: { label: string; by?: string }\n sortBy?: string\n backing?: LookupBacking\n onDelete?: OnDelete\n keys?: readonly Keys[]\n table?: Readonly<Record<string, Readonly<Record<string, string>>>>\n displayLocale?: string\n onMissing?: OnMissingPolicy\n substitute?: readonly string[]\n labels?: Record<string, string>\n },\n): LookupDescriptor<Keys> {\n linkLookupVia()\n warnIfSortByNeedsDisplayLocale(dimension, opts)\n return {\n _viaBrand: 'lookup',\n dimension,\n key: opts?.key ?? 'id',\n vocabulary: opts?.vocabulary ?? 'open',\n backing: opts?.backing ?? 'collection',\n onDelete: opts?.onDelete ?? 'restrict',\n ...(opts?.altKeys !== undefined ? { altKeys: opts.altKeys } : {}),\n ...(opts?.present !== undefined ? { present: opts.present } : {}),\n ...(opts?.sortBy !== undefined ? { sortBy: opts.sortBy } : {}),\n ...(opts?.keys !== undefined ? { keys: opts.keys } : {}),\n ...(opts?.table !== undefined ? { table: opts.table } : {}),\n ...(opts?.displayLocale !== undefined ? { displayLocale: opts.displayLocale } : {}),\n ...(opts?.onMissing !== undefined ? { onMissing: opts.onMissing } : {}),\n ...(opts?.substitute !== undefined ? { substitute: opts.substitute } : {}),\n ...(opts?.labels !== undefined ? { labels: opts.labels } : {}),\n }\n}\n\n/\n Enum tier — static in-config table, CLOSED vocabulary, no backing store.\n * No dimension name (pure inline keys) — `dimension` is `''`.\n /\nexport function enumOf<const Keys extends readonly string[]>(keys: Keys): LookupDescriptor<Keys[number]> {\n linkLookupVia()\n return {\n _viaBrand: 'lookup',\n dimension: '',\n key: 'id',\n vocabulary: 'closed',\n backing: 'static',\n onDelete: 'restrict',\n keys,\n }\n}\n\n/\n Dict tier — reserved `_dict_<dimension>` micro-collection backing (the\n * `vault.dictionary(dimension)` engine), open vocabulary by default. The\n * native equivalent of `dictKey()`.\n \n Unlike `lookup()`'s matrix tier, `dict()` has no `altKeys` option — its\n * `_dict_<dimension>` backing is the always-synchronous `LookupHandle`\n * write-through cache, never a `vault.collection()` that can be opened\n * `{ prefetch: false }`, so the matrix tier's lazy-mode altKeys restriction\n * does not apply here.\n /\nexport function dict<Keys extends string>(\n dimension: string,\n opts?: {\n keys?: readonly Keys[]\n vocabulary?: Vocabulary\n present?: { label: string; by?: string }\n onDelete?: OnDelete\n onMissing?: OnMissingPolicy\n substitute?: readonly string[]\n },\n): LookupDescriptor<Keys> {\n linkLookupVia()\n return {\n _viaBrand: 'lookup',\n dimension,\n key: 'id',\n vocabulary: opts?.vocabulary ?? 'open',\n backing: 'reserved',\n onDelete: opts?.onDelete ?? 'restrict',\n ...(opts?.keys !== undefined ? { keys: opts.keys } : {}),\n ...(opts?.present !== undefined ? { present: opts.present } : {}),\n ...(opts?.onMissing !== undefined ? { onMissing: opts.onMissing } : {}),\n ...(opts?.substitute !== undefined ? { substitute: opts.substitute } : {}),\n }\n}\n","/\n _sync_credentials reserved collection —\n \n Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as\n * encrypted records inside the vault itself. Tokens are wrapped with the\n * compartment's own DEK, live on disk as ciphertext like any other record, and\n * are accessed only through the dedicated API in this module — never via\n * `vault.collection('_sync_credentials')`.\n \n Design decisions\n * ────────────────\n \n Why a reserved collection, not a separate store?\n * The compartment's existing encryption stack (AES-256-GCM + collection DEK)\n * is exactly the right primitive for protecting OAuth tokens at rest. Using a\n * separate store would require a new encryption surface, new adapter calls,\n * and a new backup/restore path — all of which already exist for collections.\n \n Why not exposed as a regular collection?\n * The same reason `_keyring` and `_ledger` aren't: they have invariants that\n * must be enforced (naming scheme, no cross-user leakage, no schema\n * validation, no history/ledger writes for privacy). Routing through a\n * dedicated API enforces those invariants.\n \n Token lifecycle:\n * - `putCredential(vault, adapterId, token)` — store or overwrite\n * - `getCredential(vault, adapterId)` — load and decrypt\n * - `deleteCredential(vault, adapterId)` — remove\n * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)\n \n The `adapterId` is the record ID within the `_sync_credentials` collection.\n * It should be a stable, human-readable identifier for the adapter instance\n * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).\n \n ACL: only `owner` and `admin` roles can read/write sync credentials.\n * Operators, viewers, and clients cannot call this API. The check is made\n * against the caller's keyring role at call time.\n /\n\nimport type { NoydbStore, EncryptedEnvelope } from '../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../kernel/types.js'\nimport type { UnlockedKeyring } from '../with-party/team/keyring.js'\nimport { encrypt, openEnvelopeJson } from '../kernel/enclave/index.js'\nimport { ensureCollectionDEK } from '../with-party/team/keyring.js'\nimport { PermissionDeniedError } from '../kernel/errors.js'\n\n/\n The reserved collection name. Never collides with user collections.\n * Canonical definition lives in `reserved-secret-collections.ts` (shared with\n * the `vault.collection()` guard and grant DEK-propagation); re-exported here\n * for existing consumers.\n /\nexport { SYNC_CREDENTIALS_COLLECTION } from '../with-party/team/reserved-secret-collections.js'\nimport { SYNC_CREDENTIALS_COLLECTION } from '../with-party/team/reserved-secret-collections.js'\n\n// ─── Token types ──────────────────────────────────────────────────────\n\n/\n An OAuth/auth token stored in `_sync_credentials`.\n \n Fields mirror the OAuth2 token response shape. `customData` is an escape\n * hatch for adapter-specific secrets (API keys, connection strings, etc.)\n * that don't fit the OAuth2 shape.\n /\nexport interface SyncCredential {\n /* Stable identifier for the adapter instance (e.g. 'google-drive'). /\n readonly adapterId: string\n /* OAuth token type, usually 'Bearer'. /\n readonly tokenType: string\n /* The access token. Expires at `expiresAt` if set. /\n readonly accessToken: string\n /* Long-lived refresh token for renewing the access token. /\n readonly refreshToken?: string\n /* ISO timestamp when `accessToken` expires. Absent means \"no expiry\". /\n readonly expiresAt?: string\n /* Space-separated OAuth scopes. /\n readonly scopes?: string\n /* Adapter-specific opaque data (API keys, endpoints, etc.). /\n readonly customData?: Record<string, string>\n}\n\n// ─── Access check ─────────────────────────────────────────────────────\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n // FR-6: custodian is INTENTIONALLY excluded. Sync credentials are the\n // firm's hosting/infrastructure secrets (OAuth tokens, connection strings) —\n // not the custodian's operational scope. A custodian operates the DATA but\n // must never mint or read transport credentials that could be used to\n // re-home or impersonate the firm's vault. Do NOT add 'custodian' here.\n if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n throw new PermissionDeniedError(\n `Sync credentials require owner or admin role. Current role: \"${keyring.role}\"`,\n )\n }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/\n Store or overwrite a sync credential for the given adapter.\n \n The credential is encrypted with the `_sync_credentials` collection DEK\n * (auto-generated on first use). The record ID is the `adapterId`.\n \n Requires owner or admin role.\n /\nexport async function putCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n credential: SyncCredential,\n): Promise<void> {\n requireAdminAccess(keyring)\n\n const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n const { iv, data } = await encrypt(JSON.stringify(credential), dek)\n\n const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId)\n const version = existing ? existing._v + 1 : 1\n\n const envelope: EncryptedEnvelope = {\n _noydb: NOYDB_FORMAT_VERSION,\n _v: version,\n _ts: new Date().toISOString(),\n _iv: iv,\n _data: data,\n _by: keyring.userId,\n }\n\n await adapter.put(\n vault,\n SYNC_CREDENTIALS_COLLECTION,\n credential.adapterId,\n envelope,\n existing ? existing._v : undefined,\n )\n}\n\n/\n Load and decrypt a sync credential for the given adapter ID.\n \n Returns `null` if no credential exists for this adapter.\n * Requires owner or admin role.\n /\nexport async function getCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<SyncCredential \| null> {\n requireAdminAccess(keyring)\n\n const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n if (!envelope) return null\n\n const plaintext = await openEnvelopeJson(envelope, dek)\n return JSON.parse(plaintext) as SyncCredential\n}\n\n/\n Delete a sync credential by adapter ID.\n \n No-op if the credential doesn't exist. Requires owner or admin role.\n /\nexport async function deleteCredential(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<void> {\n requireAdminAccess(keyring)\n await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n}\n\n/\n List all adapter IDs that have stored credentials.\n \n Returns only the IDs, never the credential payloads. Useful for\n * displaying \"connected adapters\" in UI without decrypting tokens.\n * Requires owner or admin role.\n /\nexport async function listCredentials(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n): Promise<string[]> {\n requireAdminAccess(keyring)\n return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION)\n}\n\n/\n Check whether a credential exists and whether its access token has expired.\n \n Returns `{ exists: false }` if no credential is stored, or\n * `{ exists: true, expired: boolean }` based on the `expiresAt` field.\n * Requires owner or admin role.\n */\nexport async function credentialStatus(\n adapter: NoydbStore,\n vault: string,\n keyring: UnlockedKeyring,\n adapterId: string,\n): Promise<{ exists: false } \| { exists: true; expired: boolean }> {\n const credential = await getCredential(adapter, vault, keyring, adapterId)\n if (!credential) return { exists: false }\n\n const expired = credential.expiresAt\n ? Date.now() > new Date(credential.expiresAt).getTime()\n : false\n\n return { exists: true, expired }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCO,SAAS,sBAAsB,MAA6D;AACjG,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,gBAAgB,KAAK,kBAAkB;AAAA,EACzC;AACF;;;ACXA,IAAM,kBAA8B,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,MAAM;AAEpH,SAAS,gBAAgB,KAAoC;AAClE,QAAM,SAAS,IAAI;AACnB,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,CAAC,UAAU,OAAO,IAAI,KAAK;AAAA,IACnC,SAAS,CAAC,WAAW;AACnB,UAAI,IAAI;AACR,iBAAW,CAAC,OAAO,IAAI,KAAK,QAAQ;AAClC,YAAI,MAAM,OAAQ,KAAI,EAAE,GAAG,OAAO;AAClC,UAAE,KAAK,IAAI,KAAK,GAAG,CAAC;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,kBAAwB;AACtC,mBAAiB,YAAY,CAAC,QAAQ,gBAAgB,GAAwB,CAAC;AACjF;;;ACvBO,SAAS,SACd,IACA,MACoB;AAepB,kBAAgB;AAChB,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,MAAM,MAAM,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB,GAAqC;AACxE,SAAO,OAAO,MAAM,YAAY,MAAM,QAAS,EAA8B,cAAc;AAC7F;;;ACaA,SAAS,eAAe,MAAiC;AACvD,SAAO,EAAE,KAAK,YAAY,YAAY,KAAK,UAAU;AACvD;AAWA,eAAe,iBACb,MACA,KACA,WACA,eACA,KAC6B;AAC7B,MAAI,KAAK,YAAY,cAAc;AACjC,UAAM,SAAS,IAAI,mBAAmB,IAAI;AAC1C,UAAM,MAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACzC,UAAM,aAAa,KAAK,SAAS;AACjC,QAAI,CAAC,OAAO,eAAe,OAAW,QAAO;AAC7C,UAAM,MAAM,IAAI,UAAU;AAC1B,QAAI,KAAK,SAAS,OAAO,QAAW;AAClC,aAAO,OAAO,OAAO,QAAQ,WAAY,IAAgC,SAAS,IAA0B;AAAA,IAC9G;AACA,WAAO,OAAO,QAAQ,WAAW,MAAM;AAAA,EACzC;AACA,SAAO,IAAI,sBAAsB,KAAK,WAAW,KAAK,WAAW,aAAa;AAChF;AAGA,eAAe,iBACb,QACA,KACA,KACkC;AAClC,QAAM,SAAS,OAAO,QAAQ,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,eAAe,CAAC,CAAC;AACnF,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAC7D,QAAM,WAAW,IAAI;AACrB,QAAM,QAAQ,IAAI;AAKlB,MAAI,WAAW,MAAO,QAAO;AAK7B,QAAM,mBAAmB,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,YAAY,EAAE,kBAAkB,MAAS;AACvG,MAAI,CAAC,UAAU,CAAC,iBAAkB,QAAO;AAEzC,MAAI,SAAS;AACb,QAAM,aAAa,EAAE,GAAG,OAAO;AAE/B,aAAW,CAAC,OAAO,IAAI,KAAK,QAAQ;AAClC,UAAM,SAAS,KAAK,YAAY,cAAc,KAAK,WAAW,KAAK,IAAI;AACvE,UAAM,gBAAgB,WAAW,eAAgB,YAAY,KAAK,aAAc;AAChF,UAAM,YAAY,WAAW,KAAK,YAAY,WAAW,KAAK,gBAAgB;AAE9E,UAAM,aAAa,OAAO,QAAwC;AAChE,UAAI,CAAC,WAAW;AACd,YAAI,WAAW,SAAS;AACtB,gBAAM,IAAI,wBAAwB,OAAO,WAAW,KAAK,uCAAuC,GAAG,IAAI;AAAA,QACzG;AACA,eAAO;AAAA,MACT;AACA,YAAM,QAAQ,MAAM,iBAAiB,MAAM,KAAK,WAAW,eAAe,GAAG;AAC7E,UAAI,UAAU,QAAW;AACvB,YAAI,WAAW,SAAS;AACtB,gBAAM,IAAI,wBAAwB,OAAO,WAAW,KAAK,wBAAwB,GAAG,gBAAgB,SAAS,IAAI;AAAA,QACnH;AACA,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,SAAS,KAAK,GAAG;AACzB,YAAM,QAAQ,MAAM,MAAM,KAAK;AAC/B,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,OAAO,MAAM,CAAC;AACpB,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,YAAM,MAAO,WAAuC,QAAQ;AAC5D,UAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,YAAM,WAAW,GAAG,IAAI;AACvB,MAAC,WAAuC,QAAQ,IAAI,MAAM,QAAQ;AAAA,QACjE,IAAI,IAAI,OAAO,OAAO;AACpB,cAAI,CAAC,MAAM,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,EAAG,QAAO;AAC/D,gBAAM,IAAK,GAA+B,IAAI;AAC9C,cAAI,OAAO,MAAM,SAAU,QAAO;AAClC,iBAAO,EAAE,GAAI,IAAgC,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE;AAAA,QAC/E,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,iBAAW,GAAG,KAAK,OAAO,IAAI,MAAM,QAAQ;AAAA,QAC1C,IAAI,IAAI,OAAO,OAAO,EAAE,KAAK,GAAG,OAAO,OAAO,MAAM,WAAW,MAAM,WAAW,CAAC,IAAI,KAAK,EAAE;AAAA,MAC9F;AAAA,IACF,WAAW,OAAO,QAAQ,UAAU;AAClC,YAAM,QAAQ,MAAM,WAAW,GAAG;AAClC,UAAI,UAAU,KAAM,YAAW,GAAG,KAAK,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAEA,WAAS;AACT,SAAO;AACT;AA+BA,SAAS,4BAA4B,KAA+C;AAClF,QAAM,eAA4D,CAAC;AACnE,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC5D,iBAAa,KAAK,IAAI;AAAA,MACpB,GAAI,KAAK,cAAc,KAAK,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7D,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQ3D,GAAI,KAAK,SAAS,SACd,EAAE,MAAM,KAAK,KAAK,IAClB,KAAK,YAAY,YAAY,KAAK,UAAU,SAAY,EAAE,MAAM,OAAO,KAAK,KAAK,KAAK,EAAE,IAAI,CAAC;AAAA,IACnG;AAAA,EACF;AACA,SAAO,EAAE,aAAa;AACxB;AAcA,SAAS,mBAAmB,OAAe,MAAwB,KAAuD;AACxH,MAAI;AACF,WAAO,IAAI,cAAc,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR,uBAAuB,KAAK,qCAAqC,KAAK,SAAS;AAAA,MAEjF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAyBA,SAAS,gBAAgB,QAAiC,KAA+C;AACvG,QAAM,cAAc,OAAO,QAAQ,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,UAAU,KAAK,CAAC;AACnG,MAAI,YAAY,WAAW,EAAG,QAAO;AAErC,MAAI,SAAS;AACb,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa;AACvC,UAAM,UAAU,mBAAmB,OAAO,MAAM,GAAG;AACnD,QAAI,CAAC,WAAW,QAAQ,SAAS,SAAS,EAAG;AAE7C,QAAI,MAAM,SAAS,KAAK,GAAG;AACzB,YAAM,CAAC,UAAU,IAAI,IAAI,MAAM,MAAM,KAAK;AAC1C,UAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,YAAM,MAAM,OAAO,QAAS;AAC5B,UAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,UAAI,UAAU;AACd,YAAM,aAAa,IAAI,IAAI,CAAC,SAAS;AACnC,YAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,cAAMA,SAAS,KAAiC,IAAI;AACpD,YAAI,OAAOA,WAAU,SAAU,QAAO;AACtC,cAAMC,aAAY,QAAQ,SAAS,IAAID,MAAK;AAC5C,YAAIC,eAAc,UAAaA,eAAcD,OAAO,QAAO;AAC3D,kBAAU;AACV,eAAO,EAAE,GAAI,MAAkC,CAAC,IAAI,GAAGC,WAAU;AAAA,MACnE,CAAC;AACD,UAAI,CAAC,QAAS;AACd,UAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,aAAO,QAAS,IAAI;AACpB;AAAA,IACF;AAEA,UAAM,SAAS,UAAU,QAAQ,KAAK;AACtC,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,QAAQ,OAAO,CAAC;AAMtB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,MAAM,WAAW,EAAG;AACxB,UAAI,UAAU;AACd,YAAM,aAAa,MAAM,IAAI,CAAC,OAAO;AACnC,YAAI,OAAO,OAAO,SAAU,QAAO;AACnC,cAAMA,aAAY,QAAQ,SAAS,IAAI,EAAE;AACzC,YAAIA,eAAc,UAAaA,eAAc,GAAI,QAAO;AACxD,kBAAU;AACV,eAAOA;AAAA,MACT,CAAC;AACD,UAAI,CAAC,QAAS;AACd,UAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,uBAAiB,QAAQ,OAAO,UAAU;AAC1C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,YAAY,QAAQ,SAAS,IAAI,KAAK;AAC5C,QAAI,cAAc,UAAa,cAAc,MAAO;AACpD,QAAI,WAAW,OAAQ,UAAS,EAAE,GAAG,OAAO;AAC5C,qBAAiB,QAAQ,OAAO,SAAS;AAAA,EAC3C;AACA,SAAO;AACT;AAUA,eAAe,sBAAsB,QAAiC,KAAqC;AACzG,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC5D,QAAI,KAAK,eAAe,SAAU;AAMlC,eAAW,SAAS,UAAU,QAAQ,KAAK,GAAG;AAO5C,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,mBAAW,MAAM,OAAO;AACtB,cAAI,OAAO,OAAO,SAAU;AAC5B,gBAAMC,SAAQ,IAAI,aAAa,MAAM,IAAI,WAAW,OAAO,EAAE,IAAI;AACjE,cAAI,CAACA,OAAO,OAAM,IAAI,sBAAsB,KAAK,WAAW,OAAO,EAAE;AAAA,QACvE;AACA;AAAA,MACF;AACA,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,QAAQ,IAAI,aAAa,MAAM,IAAI,WAAW,OAAO,KAAK,IAAI;AACpE,UAAI,CAAC,MAAO,OAAM,IAAI,sBAAsB,KAAK,WAAW,OAAO,KAAK;AAAA,IAC1E;AAAA,EACF;AACF;AAsBA,SAAS,mBAAmB,OAAe,GAAY,GAAY,KAA0C;AAC3G,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,QAAM,OAAO,IAAI,aAAa,KAAK;AACnC,MAAI,CAAC,QAAQ,KAAK,WAAW,OAAW,QAAO;AAC/C,QAAM,OAAO,KAAK,YAAY,WACzB,KAAK,QAAQ,IAAI,IAAI,OAAO,QAAQ,KAAK,KAAK,CAAC,IAAI,SACpD,IAAI,cAAc,IAAI;AAC1B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,oBAAoB,KAAK,WAAW,MAAM,IAAI,EAAE,YAAY,GAAG,GAAG,KAAK,iBAAiB,EAAE;AACnG;AAkBA,SAAS,wBAAwB,OAAe,KAAa,QAA4B,KAA0C;AACjI,QAAM,OAAO,IAAI,aAAa,KAAK;AACnC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK,YAAY,WACzB,KAAK,QAAQ,IAAI,IAAI,OAAO,QAAQ,KAAK,KAAK,CAAC,IAAI,SACpD,IAAI,cAAc,IAAI;AAC1B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,oBAAoB,KAAK,WAAW,MAAM,IAAI,EAAE,MAAM,KAAK,UAAU,KAAK,iBAAiB,EAAE;AACtG;AAEO,SAAS,cAAc,KAAkC;AAC9D,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,MAAM;AAAA,IAChG,kBAAkB,CAAC,UAAU,UAAU;AAAA,IACvC,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,QAAQ,CAAC,WAAW,gBAAgB,QAAQ,GAAG;AAAA,IAC/C,cAAc,CAAC,WAAW,sBAAsB,QAAQ,GAAG;AAAA,IAC3D,SAAS,OAAO,QAAQ,QAAQ,iBAAiB,QAAQ,KAAK,GAAG;AAAA,IACjE,iBAAiB,CAAC,OAAO,GAAG,MAAM,mBAAmB,OAAO,GAAG,GAAG,GAAG;AAAA,IACrE,mBAAmB,CAAC,OAAO,KAAK,WAAW,wBAAwB,OAAO,KAAK,QAAQ,GAAG;AAAA,IAC1F,kBAAkB,MAAM,4BAA4B,GAAG;AAAA,EACzD;AACF;AAEO,SAAS,gBAAsB;AACpC,mBAAiB,UAAU,CAAC,MAAM,cAAc,CAAoB,CAAC;AACvE;;;AC9YA,SAAS,+BACP,WACA,MACM;AACN,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,OAAO,UAAa,KAAK,kBAAkB,QAAW;AACpG,YAAQ;AAAA,MACN,oBAAoB,SAAS,eAAe,KAAK,MAAM;AAAA,IAIzD;AAAA,EACF;AACF;AAsBO,SAAS,OACd,WACA,MAewB;AACxB,gBAAc;AACd,iCAA+B,WAAW,IAAI;AAC9C,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,KAAK,MAAM,OAAO;AAAA,IAClB,YAAY,MAAM,cAAc;AAAA,IAChC,SAAS,MAAM,WAAW;AAAA,IAC1B,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC5D,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACzD,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,IACjF,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACrE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACxE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAMO,SAAS,OAA6C,MAA4C;AACvG,gBAAc;AACd,SAAO;AAAA,IACL,WAAW;AAAA,IACX,WAAW;AAAA,IACX,KAAK;AAAA,IACL,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,UAAU;AAAA,IACV;AAAA,EACF;AACF;AAaO,SAAS,KACd,WACA,MAQwB;AACxB,gBAAc;AACd,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,KAAK;AAAA,IACL,YAAY,MAAM,cAAc;AAAA,IAChC,SAAS;AAAA,IACT,UAAU,MAAM,YAAY;AAAA,IAC5B,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACtD,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC/D,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACrE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EAC1E;AACF;;;ACpHA,SAAS,mBAAmB,SAAgC;AAM1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,gEAAgE,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAYA,eAAsB,cACpB,SACA,OACA,SACA,YACe;AACf,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,UAAU,GAAG,GAAG;AAElE,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,WAAW,SAAS;AAC3F,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAE7C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,WAAW,SAAS,KAAK;AAAA,EAC3B;AACF;AAQA,eAAsB,cACpB,SACA,OACA,SACA,WACgC;AAChC,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,SAAS;AAChF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,SAAO,KAAK,MAAM,SAAS;AAC7B;AAOA,eAAsB,iBACpB,SACA,OACA,SACA,WACe;AACf,qBAAmB,OAAO;AAC1B,QAAM,QAAQ,OAAO,OAAO,6BAA6B,SAAS;AACpE;AASA,eAAsB,gBACpB,SACA,OACA,SACmB;AACnB,qBAAmB,OAAO;AAC1B,SAAO,QAAQ,KAAK,OAAO,2BAA2B;AACxD;AASA,eAAsB,iBACpB,SACA,OACA,SACA,WACiE;AACjE,QAAM,aAAa,MAAM,cAAc,SAAS,OAAO,SAAS,SAAS;AACzE,MAAI,CAAC,WAAY,QAAO,EAAE,QAAQ,MAAM;AAExC,QAAM,UAAU,WAAW,YACvB,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,SAAS,EAAE,QAAQ,IACpD;AAEJ,SAAO,EAAE,QAAQ,MAAM,QAAQ;AACjC;","names":["value","canonical","known"]}

package/dist/indexing/index.js CHANGED Viewed

@@ -8,12 +8,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-L3YYLT4E.js";
+} from "../chunk-ALUVACKT.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-QZWTRENR.js";
+import "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 // src/with-lookup/indexing/active.ts

package/dist/introspection/index.js CHANGED Viewed

@@ -1,24 +1,24 @@
 import {
   dumpVaultSchema
-} from "../chunk-467SWYT5.js";
+} from "../chunk-ECGDJU5R.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import {
   jsonSchemaToFields
 } from "../chunk-VYYM3MEN.js";
-import "../chunk-6ZNSB3H6.js";
+import "../chunk-3LYMOSY7.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-KD4HGBJV.js";
-import "../chunk-SU6SGWXM.js";
+import "../chunk-Q6MXHDSE.js";
+import "../chunk-623QEHDB.js";
 import "../chunk-EFJAAFBW.js";
-import "../chunk-35NMVJ7I.js";
-import "../chunk-NFZGZ4AK.js";
-import "../chunk-QJNCB5SK.js";
+import "../chunk-MYSNNMJ3.js";
+import "../chunk-L67H6FAQ.js";
+import "../chunk-GIGLOQL7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-AKKRXT23.js";
+import "../chunk-RPWMDIGK.js";
 import "../chunk-77AEMXFA.js";
-import "../chunk-QZWTRENR.js";
+import "../chunk-AR5D76T2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   applyListProjection,

package/dist/issue-6TIJYWKS.js ADDED Viewed

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-LQVRK2XJ.js";
+import "./chunk-NZEGQWQ5.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-6TIJYWKS.js.map

package/dist/kernel/collection-config.d.ts CHANGED Viewed

@@ -187,6 +187,8 @@ export interface CollectionOpts<T> {
     refEnforcer?: {
         enforceRefsOnPut(collectionName: string, record: unknown): Promise<void>;
         enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+        /** #922 — see `Vault._deleteCascadesPossible`; consulted by `_txAtomicSafe('delete')`. */
+        _deleteCascadesPossible(collectionName: string): boolean;
     } | undefined;
     /**
      * Optional back-reference to the owning compartment's join
@@ -666,6 +668,8 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     refEnforcer: {
         enforceRefsOnPut(collectionName: string, record: unknown): Promise<void>;
         enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+        /** #922 — see `Vault._deleteCascadesPossible`; consulted by `_txAtomicSafe('delete')`. */
+        _deleteCascadesPossible(collectionName: string): boolean;
     } | undefined;
     joinResolver: {
         resolveSource(collectionName: string): JoinableSource | null;

package/dist/kernel/collection.d.ts CHANGED Viewed

@@ -987,8 +987,11 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * **True tx-atomic putMany** — pass `{ atomic: true }` to switch
      * to the  transaction executor: pre-flight CAS against every
      * item's `expectedVersion`, then commit all ops with best-effort
-     * revert on mid-batch failure. Atomic mode throws on failure rather
-     * than returning a mixed-results object.
+     * revert on mid-batch failure. On a store that declares `txAtomic`
+     * the whole batch is instead submitted as ONE `store.tx()` call with
+     * per-leg CAS (#921) — genuinely all-or-nothing, with history/ledger/
+     * change events firing after the batch is durable. Atomic mode throws
+     * on failure rather than returning a mixed-results object.
      *
      * ## Change events
      *
@@ -997,10 +1000,12 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      */
     putMany(entries: ReadonlyArray<readonly [id: string, record: T, opts?: PutManyItemOptions]>, options?: PutManyOptions): Promise<PutManyResult>;
     /**
-     * Atomic-mode implementation of {@link putMany}. Pre-flights every
-     * `expectedVersion`, executes all puts in declaration order, and
-     * reverts executed ops via the raw adapter on mid-batch failure.
-     * See `runTransaction` for the shared semantics + crash-window caveat.
+     * Atomic-mode implementation of {@link putMany} — both branches live in
+     * `kernel/put-many-atomic.ts`: #921 delegates the batch through ONE
+     * `store.tx()` on a `txAtomic` store when the single-collection
+     * reduction of the #906 gate admits it (store bits + no duplicate ids +
+     * `_txAtomicSafe('put')`); anything else keeps the sequential pre-flight
+     * → execute → best-effort-revert loop.
      *
      * @internal
      */
@@ -1575,6 +1580,19 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         lookupFields: Record<string, LookupDescriptor> | undefined;
     };
     _assertWriteGates(): Promise<void>;
+    /**
+     * @internal #931 — the after-write OBSERVERS `put()`/`delete()` fire in
+     * their wrappers (user `onAfterWrite` hooks, then the `afterPut`/
+     * `afterDelete` observe bus), replayed for one atomic-path leg after its
+     * finalize. Neither can refuse a completed write, so since #931 they no
+     * longer gate `_txAtomicSafe`; skipping them silently would still be a
+     * policy hole (forget's subject index and the cross-tab write relay are
+     * both wired this way), so the atomic path calls this per leg. The
+     * WriteEvent is built from the prepared carrier — same prior basis the
+     * wrappers use — and the same re-entrancy guards apply (`runAfter`
+     * suppresses nested hook firing; the bus gate checks `dispatching`).
+     */
+    _fireAtomicAfterWrite(opType: 'put' | 'delete', prepared: PreparedPut<T> | PreparedDelete<T>): Promise<void>;
     _txAtomicSafe(opType: 'put' | 'delete'): boolean;
     _reconcileReadState(patch: {
         dictKeyFields?: Record<string, DictKeyDescriptor | StaticDictDescriptor>;

package/dist/kernel/errors.d.ts CHANGED Viewed

@@ -617,6 +617,21 @@ export declare class ConflictError extends NoydbError {
     readonly version: number;
     constructor(version: number, message?: string);
 }
+/**
+ * #935 — identity-safe ConflictError detection for store-boundary catches.
+ *
+ * A store may bind a DIFFERENT copy of `@noy-db/hub/to` than the caller
+ * (npm failing to dedupe hub within the peer range in production;
+ * src-vs-dist inside the workspace), so its ConflictError is a foreign
+ * class identity and a bare `instanceof` silently misses it — CAS retry
+ * loops rethrow instead of retrying, and the sync engine misfiles the
+ * conflict under `errors` with no resolution run. Every site that catches
+ * an error a STORE may have thrown must use this predicate; `instanceof`
+ * stays correct only for errors that never cross the store seam.
+ * The name check is the contract: every copy sets `name = 'ConflictError'`
+ * in its constructor, and the structural `version` field rides along.
+ */
+export declare function isConflictError(err: unknown): err is ConflictError;
 /**
  * Thrown by `LedgerStore.append()` after exhausting its CAS retry
  * budget under multi-writer contention. Two browser tabs, a

package/dist/kernel/put-many-atomic.d.ts ADDED Viewed

@@ -0,0 +1,45 @@
+import type { PreparedPut } from './prepared-write.js';
+import type { EncryptedEnvelope, NoydbStore, PutManyItemOptions, PutManyResult } from './types.js';
+/** @internal Structural view of one executed op on a transaction context. */
+interface BulkExecutedOp {
+    readonly op: {
+        readonly type: 'put' | 'delete';
+        readonly vaultName: string;
+        readonly collectionName: string;
+        readonly id: string;
+    };
+    readonly priorEnvelope: EncryptedEnvelope | null;
+}
+/** @internal Structural slice of `with-commit`'s `TxContext` this module drives. */
+interface BulkTxContext {
+    readonly _executed: BulkExecutedOp[];
+}
+/** @internal The slice of `Collection` both branches drive. */
+export interface PutManyAtomicHost<T> {
+    put(id: string, record: T): Promise<void>;
+    _preparePut(id: string, record: T): Promise<PreparedPut<T>>;
+    _finalizePut(prepared: PreparedPut<T>): Promise<void>;
+    _fireAtomicAfterWrite(opType: 'put', prepared: PreparedPut<T>): Promise<void>;
+    _assertWriteGates(): Promise<void>;
+    _txAtomicSafe(opType: 'put' | 'delete'): boolean;
+    _invalidateCacheEntry(id: string): Promise<void>;
+}
+/** @internal The owning collection's private coordinates + wiring. */
+export interface PutManyAtomicContext<T> {
+    readonly host: PutManyAtomicHost<T>;
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly name: string;
+    readonly derivationSource?: {
+        createTxContext(): BulkTxContext;
+        setActiveTxContext(ctx: BulkTxContext): void;
+        clearActiveTxContext(ctx: BulkTxContext): void;
+        getCollection(name: string): {
+            _invalidateCacheEntry(id: string): Promise<void>;
+        };
+    } | undefined;
+}
+type PutManyEntries<T> = ReadonlyArray<readonly [id: string, record: T, opts?: PutManyItemOptions]>;
+/** @internal Atomic-mode implementation of `Collection.putMany`. */
+export declare function runPutManyAtomic<T>(ctx: PutManyAtomicContext<T>, entries: PutManyEntries<T>): Promise<PutManyResult>;
+export {};

package/dist/kernel/vault.d.ts CHANGED Viewed

@@ -766,6 +766,20 @@ export declare class Vault {
      * cascade guard. See `with-shape/links/vault-facade.ts`.
      */
     enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+    /**
+     * #922 — can a delete on `collectionName` trigger ANY cross-record work in
+     * `enforceRefsOnDelete` above? Unions ALL THREE of its cascade sources —
+     * lookup-ref edges (`graph.referencingEdgesOf`), classic inbound refs
+     * (`refRegistry.getInbound`), and managed link sets whose either endpoint
+     * is this collection. `Collection._txAtomicSafe('delete')` consults this
+     * instead of the pre-#922 blanket enforcer-presence check: `_prepareDelete`
+     * runs those cascades DURING prepare (not abortable), so a delete may take
+     * the atomic tx path only when all three sources are provably absent.
+     * Registry state only — no store reads, safe to call at commit time.
+     *
+     * @internal
+     */
+    _deleteCascadesPossible(collectionName: string): boolean;
     /**
      * Look up the `RefDescriptor` the left collection declared for a
      * given field name. Returns `null` when the field has no ref

package/dist/{ledger-XE7JF2I2.js → ledger-BLYDYRTQ.js} RENAMED Viewed

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-YGK2HMLR.js";
+} from "./chunk-JLBCK7XM.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-DQZXPGGZ.js";
-import "./chunk-SU6SGWXM.js";
+} from "./chunk-V3EGXDFN.js";
+import "./chunk-623QEHDB.js";
 import "./chunk-EFJAAFBW.js";
-import "./chunk-35NMVJ7I.js";
-import "./chunk-NFZGZ4AK.js";
-import "./chunk-QJNCB5SK.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-AKKRXT23.js";
+import "./chunk-RPWMDIGK.js";
 import "./chunk-77AEMXFA.js";
-import "./chunk-QZWTRENR.js";
+import "./chunk-AR5D76T2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-XE7JF2I2.js.map
+//# sourceMappingURL=ledger-BLYDYRTQ.js.map

package/dist/liberate-TSOW7IG5.js ADDED Viewed

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-GTQF32TP.js";
+import "./chunk-CLE3TMIS.js";
+import "./chunk-G3ORJ3IQ.js";
+import "./chunk-J7YVY7TW.js";
+import "./chunk-KDWBVCIX.js";
+import "./chunk-FHK6WWUE.js";
+import "./chunk-FZAP4JNC.js";
+import "./chunk-6PFST3FC.js";
+import "./chunk-623QEHDB.js";
+import "./chunk-EFJAAFBW.js";
+import "./chunk-MYSNNMJ3.js";
+import "./chunk-L67H6FAQ.js";
+import "./chunk-GIGLOQL7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-RPWMDIGK.js";
+import "./chunk-77AEMXFA.js";
+import "./chunk-AR5D76T2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-TSOW7IG5.js.map