@noy-db/hub 0.5.0 → 0.6.0-pre.0

package/dist/chunk-HNHCQ556.js

@@ -0,0 +1,63 @@
+import {
+  NoydbError,
+  ValidationError
+} from "./chunk-HNGSV2YC.js";
+
+// src/with-shape/links/names.ts
+var LINK_COLLECTION_PREFIX = "_links_";
+function linkCollectionName(name) {
+  return `${LINK_COLLECTION_PREFIX}${name}`;
+}
+function isLinkCollectionName(name) {
+  return name.startsWith(LINK_COLLECTION_PREFIX);
+}
+function declareLink(linkRegistry, name, spec) {
+  const a = typeof spec.a === "string" ? spec.a : spec.a.target;
+  const b = typeof spec.b === "string" ? spec.b : spec.b.target;
+  for (const [slot, target] of [["a", a], ["b", b]]) {
+    if (!target || target.startsWith("_") || target.includes("/")) {
+      throw new ValidationError(
+        `vault.link("${name}"): endpoint "${slot}" must be a simple collection name, got "${target}".`
+      );
+    }
+  }
+  const resolved = { a, b, ...spec.onDelete ? { onDelete: spec.onDelete } : {} };
+  const existing = linkRegistry.get(name);
+  if (existing) {
+    if (existing.a !== resolved.a || existing.b !== resolved.b || (existing.onDelete ?? "cascade") !== (resolved.onDelete ?? "cascade")) {
+      throw new ValidationError(`vault.link("${name}"): conflicting re-declaration.`);
+    }
+    return;
+  }
+  linkRegistry.set(name, resolved);
+}
+function linkRowKey(aId, bId) {
+  return `${encodeURIComponent(aId)}|${encodeURIComponent(bId)}`;
+}
+var LinkIntegrityError = class extends NoydbError {
+  link;
+  endpoint;
+  id;
+  count;
+  constructor(link, endpoint, id, count) {
+    super(
+      "LINK_INTEGRITY",
+      `Cannot delete "${endpoint}"/"${id}": ${count} link(s) in "${link}" still reference it (onDelete: 'strict').`
+    );
+    this.name = "LinkIntegrityError";
+    this.link = link;
+    this.endpoint = endpoint;
+    this.id = id;
+    this.count = count;
+  }
+};
+
+export {
+  LINK_COLLECTION_PREFIX,
+  linkCollectionName,
+  isLinkCollectionName,
+  declareLink,
+  linkRowKey,
+  LinkIntegrityError
+};
+//# sourceMappingURL=chunk-HNHCQ556.js.map

package/dist/chunk-HNHCQ556.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/links/names.ts"],"sourcesContent":["/**\n * Link-set naming helpers, declaration types, and errors — the tiny,\n * always-loadable slice of the links feature (#553).\n *\n * Split out of `link-set.ts` so the kernel floor (reserved-name guard in\n * `vault.collection()`, the lazy `vault.links()` handle) and the ref/link\n * enforcement facade can bind these few lines WITHOUT statically pulling\n * the `LinkSet` storage engine; that class now loads via dynamic import\n * on first link I/O. `link-set.ts` re-exports everything here, so import\n * paths and class identities are unchanged for existing consumers.\n */\n\nimport { NoydbError, ValidationError } from '../../kernel/errors.js'\nimport type { RefDescriptor } from '../../kernel/refs.js'\n\nexport const LINK_COLLECTION_PREFIX = '_links_'\n\n/** Storage collection name for a logical link set. */\nexport function linkCollectionName(name: string): string {\n  return `${LINK_COLLECTION_PREFIX}${name}`\n}\n\n/** True for any reserved link-collection name. */\nexport function isLinkCollectionName(name: string): boolean {\n  return name.startsWith(LINK_COLLECTION_PREFIX)\n}\n\n/** What happens to a link's rows when one of its endpoint records is deleted. */\nexport type LinkOnDelete = 'cascade' | 'strict' | 'warn'\n\n/**\n * Declaration for a link set, passed to `vault.link(name, spec)`. `a` and\n * `b` are the endpoint collection names (slot-typed). `onDelete` governs\n * what happens to link rows when an endpoint record is deleted:\n * `'cascade'` (default) removes the touching link rows, `'strict'` blocks\n * the endpoint delete while links exist, `'warn'` leaves orphan rows\n * (surfaced by `vault.checkIntegrity()`).\n */\nexport interface LinkSpec {\n  readonly a: string\n  readonly b: string\n  readonly onDelete?: LinkOnDelete\n}\n\n/**\n * Validate + register a `vault.link(name, spec)` declaration. `a`/`b`\n * accept either a collection name or a `ref(target)` descriptor (only\n * `target` is used). Idempotent for an identical re-declaration; throws\n * `ValidationError` for an invalid endpoint or a conflicting\n * re-declaration. Body extracted out of `Vault.link()` (shrink-first,\n * #947) — the kernel floor keeps a thin delegator.\n */\nexport function declareLink(\n  linkRegistry: Map<string, LinkSpec>,\n  name: string,\n  spec: { a: string | RefDescriptor; b: string | RefDescriptor; onDelete?: LinkSpec['onDelete'] },\n): void {\n  const a = typeof spec.a === 'string' ? spec.a : spec.a.target\n  const b = typeof spec.b === 'string' ? spec.b : spec.b.target\n  for (const [slot, target] of [['a', a], ['b', b]] as const) {\n    if (!target || target.startsWith('_') || target.includes('/')) {\n      throw new ValidationError(\n        `vault.link(\"${name}\"): endpoint \"${slot}\" must be a simple collection name, got \"${target}\".`,\n      )\n    }\n  }\n  const resolved: LinkSpec = { a, b, ...(spec.onDelete ? { onDelete: spec.onDelete } : {}) }\n  const existing = linkRegistry.get(name)\n  if (existing) {\n    if (existing.a !== resolved.a || existing.b !== resolved.b || (existing.onDelete ?? 'cascade') !== (resolved.onDelete ?? 'cascade')) {\n      throw new ValidationError(`vault.link(\"${name}\"): conflicting re-declaration.`)\n    }\n    return\n  }\n  linkRegistry.set(name, resolved)\n}\n\n/** One link tuple as returned by `of()` / `list()`. */\nexport interface LinkRow {\n  readonly a: string\n  readonly b: string\n  readonly meta?: Record<string, unknown>\n}\n\n/**\n * Compose the row key for an ordered `(a, b)` pair. Each id is\n * URI-encoded and joined with `|` — encodeURIComponent escapes `|`, so the\n * key is unambiguous regardless of id contents.\n */\nexport function linkRowKey(aId: string, bId: string): string {\n  return `${encodeURIComponent(aId)}|${encodeURIComponent(bId)}`\n}\n\n/** Public handle returned by `vault.links(name)`. */\nexport interface LinkSetHandle {\n  /** Create (or overwrite the metadata of) the link `(aId, bId)`. Validates both endpoints exist. */\n  connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void>\n  /** Remove the link `(aId, bId)`. Idempotent — a no-op if it doesn't exist. */\n  disconnect(aId: string, bId: string): Promise<void>\n  /** Whether the link `(aId, bId)` exists. */\n  has(aId: string, bId: string): Promise<boolean>\n  /** All links touching `id` on EITHER endpoint. */\n  of(id: string): Promise<LinkRow[]>\n  /** All links in the set. */\n  list(): Promise<LinkRow[]>\n}\n\n/** Thrown when a `strict` link blocks deletion of an endpoint that still has links. */\nexport class LinkIntegrityError extends NoydbError {\n  readonly link: string\n  readonly endpoint: string\n  readonly id: string\n  readonly count: number\n  constructor(link: string, endpoint: string, id: string, count: number) {\n    super(\n      'LINK_INTEGRITY',\n      `Cannot delete \"${endpoint}\"/\"${id}\": ${count} link(s) in \"${link}\" still reference it (onDelete: 'strict').`,\n    )\n    this.name = 'LinkIntegrityError'\n    this.link = link\n    this.endpoint = endpoint\n    this.id = id\n    this.count = count\n  }\n}\n"],"mappings":";;;;;;AAeO,IAAM,yBAAyB;AAG/B,SAAS,mBAAmB,MAAsB;AACvD,SAAO,GAAG,sBAAsB,GAAG,IAAI;AACzC;AAGO,SAAS,qBAAqB,MAAuB;AAC1D,SAAO,KAAK,WAAW,sBAAsB;AAC/C;AA2BO,SAAS,YACd,cACA,MACA,MACM;AACN,QAAM,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,IAAI,KAAK,EAAE;AACvD,QAAM,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,IAAI,KAAK,EAAE;AACvD,aAAW,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAY;AAC1D,QAAI,CAAC,UAAU,OAAO,WAAW,GAAG,KAAK,OAAO,SAAS,GAAG,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR,eAAe,IAAI,iBAAiB,IAAI,4CAA4C,MAAM;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAqB,EAAE,GAAG,GAAG,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,EAAG;AACzF,QAAM,WAAW,aAAa,IAAI,IAAI;AACtC,MAAI,UAAU;AACZ,QAAI,SAAS,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,MAAM,SAAS,YAAY,gBAAgB,SAAS,YAAY,YAAY;AACnI,YAAM,IAAI,gBAAgB,eAAe,IAAI,iCAAiC;AAAA,IAChF;AACA;AAAA,EACF;AACA,eAAa,IAAI,MAAM,QAAQ;AACjC;AAcO,SAAS,WAAW,KAAa,KAAqB;AAC3D,SAAO,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,GAAG,CAAC;AAC9D;AAiBO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,MAAc,UAAkB,IAAY,OAAe;AACrE;AAAA,MACE;AAAA,MACA,kBAAkB,QAAQ,MAAM,EAAE,MAAM,KAAK,gBAAgB,IAAI;AAAA,IACnE;AACA,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,KAAK;AACV,SAAK,QAAQ;AAAA,EACf;AACF;","names":[]}

package/dist/chunk-HS7HNYBD.js

@@ -0,0 +1,91 @@
+import {
+  MANIFEST_COLLECTION
+} from "./chunk-EPFF7LOX.js";
+import {
+  loadFence
+} from "./chunk-MVOWXQHN.js";
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema
+} from "./chunk-V5C5NNBR.js";
+import {
+  canonicalJson,
+  sha256Hex
+} from "./chunk-24UICKTB.js";
+import {
+  openEnvelopeJson,
+  writeEnvelopeBody
+} from "./chunk-FY343IZR.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-24ZLWWEO.js";
+
+// src/with-shape/manifest/types.ts
+var MANIFEST_SCHEMA_RECORD_ID = "schema";
+
+// src/with-shape/manifest/storage.ts
+async function loadSchemaManifestEntry(store, vault, getDEK) {
+  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID);
+  if (!envelope) return void 0;
+  const dek = await getDEK(MANIFEST_COLLECTION);
+  try {
+    const plaintext = await openEnvelopeJson(envelope, dek);
+    const parsed = JSON.parse(plaintext);
+    if (parsed.v !== 1 || parsed.kind !== "schema") return void 0;
+    return { version: envelope._v, manifest: parsed };
+  } catch {
+    return void 0;
+  }
+}
+async function saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK) {
+  const dek = await getDEK(MANIFEST_COLLECTION);
+  const json = JSON.stringify(manifest);
+  const body = await writeEnvelopeBody(json, dek);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: expectedVersion + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    ...body
+  };
+  await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion);
+}
+async function computeAggregateHash(collections) {
+  return sha256Hex(canonicalJson(collections));
+}
+
+// src/with-shape/manifest/derive.ts
+async function deriveSchemaManifest(store, vault, lookupDEK) {
+  const fence = await loadFence(store, vault);
+  const collectionNames = await store.list(vault, SCHEMAS_COLLECTION);
+  const collections = {};
+  const undecodableCollections = [];
+  for (const name of collectionNames) {
+    const dek = await lookupDEK(name);
+    if (dek === void 0) {
+      undecodableCollections.push(name);
+      continue;
+    }
+    const payload = await loadPersistedSchema(store, vault, name, dek);
+    if (!payload) {
+      undecodableCollections.push(name);
+      continue;
+    }
+    if (payload.hash === null) continue;
+    const entry = {
+      generation: payload.generation ?? fence.currentSchemaVersion,
+      contentHash: payload.hash
+    };
+    collections[name] = payload.fieldIds !== void 0 ? { ...entry, fieldIds: payload.fieldIds } : entry;
+  }
+  const aggregateHash = await computeAggregateHash(collections);
+  const manifest = { v: 1, kind: "schema", generation: fence.currentSchemaVersion, collections, aggregateHash };
+  return { manifest, undecodableCollections };
+}
+
+export {
+  MANIFEST_SCHEMA_RECORD_ID,
+  loadSchemaManifestEntry,
+  saveSchemaManifest,
+  deriveSchemaManifest
+};
+//# sourceMappingURL=chunk-HS7HNYBD.js.map

package/dist/chunk-HS7HNYBD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/manifest/types.ts","../src/with-shape/manifest/storage.ts","../src/with-shape/manifest/derive.ts"],"sourcesContent":["/**\n * The pod-wide **schema manifest** record type (#941).\n *\n * This is an INDEX, not a full-inline manifest: `SchemaManifest.collections`\n * carries per-collection *metadata* (generation / content hash / field ids),\n * never the JSON Schema body itself. The JSON Schema stays the source of\n * truth at `_schemas/<collection>`, encrypted under that collection's own\n * DEK (see `with-shape/persisted-schemas`). Inlining full schemas into one\n * pod-wide manifest record would either leak every collection's schema to a\n * principal scoped to a single collection, or force the manifest itself\n * onto a collection-DEK it has no business holding — the index preserves\n * per-collection DEK isolation while still giving a single place to answer\n * \"what schema generation is this pod at, and does collection X's stored\n * schema match its declared content hash.\"\n *\n * `aggregateHash` binds the whole per-collection index's content: it is\n * `sha256Hex(canonicalJson(collections))`, so any change to any collection's\n * entry (a new generation, a changed hash, added/renamed field ids) changes\n * `aggregateHash` too. Canonical JSON (sorted object keys, no whitespace)\n * makes the hash independent of the map's key insertion order.\n *\n * @module\n */\n\n/** Per-collection entry inside a {@link SchemaManifest}'s `collections` index. */\nexport interface SchemaManifestEntry {\n  /** The vault-wide schema-fence generation this collection's schema was last written at. */\n  readonly generation: number\n  /** SHA-256 (hex) of the collection's canonicalised JSON Schema (see `persisted-schemas/derive.ts`). */\n  readonly contentHash: string\n  /** Stable per-field ids (#946), keyed by the field's current name. Absent when the collection has none. */\n  readonly fieldIds?: Record<string, string>\n}\n\n/**\n * The pod-wide schema manifest — one record per pod, stored at\n * `_manifest/schema` (see `storage.ts`). An INDEX over the per-collection\n * `_schemas/<collection>` entries, not the schemas themselves.\n */\nexport interface SchemaManifest {\n  readonly v: 1\n  readonly kind: 'schema'\n  /** Pod-wide schema-fence generation (`FenceDoc.currentSchemaVersion`) as of this manifest's derivation. */\n  readonly generation: number\n  /** Per-collection index: collection name → its manifest entry. */\n  readonly collections: Record<string, SchemaManifestEntry>\n  /** `sha256Hex(canonicalJson(collections))` — the pod-wide content binding over the index. */\n  readonly aggregateHash: string\n}\n\n/** The record id the schema manifest is stored under inside `_manifest`. */\nexport const MANIFEST_SCHEMA_RECORD_ID = 'schema' as const\n","/**\n * Read / write the pod-wide `_manifest/schema` envelope.\n *\n * Mirrors `with-shape/persisted-schemas/storage.ts`'s shape: the same\n * standard noy-db record envelope, AES-GCM encrypted with a collection DEK\n * (here, the `_manifest` collection's own DEK — the manifest INDEX\n * discloses collection names + hashes + generations + field ids, metadata\n * rather than schema bodies, so it gets the same encryption grain as\n * `_schemas` itself).\n *\n * Storage layout:\n *\n *   <vault>/_manifest/schema   →   EncryptedEnvelope\n *\n * Unlike `persisted-schemas/storage.ts` (which takes an already-resolved\n * `EnclaveKey`), these functions take a `getDEK` resolver and call\n * `getDEK(MANIFEST_COLLECTION)` themselves — there is exactly one manifest\n * record per pod, so there is no per-collection DEK the caller needs to\n * pick; resolving it here keeps every manifest call-site symmetric.\n *\n * @module\n */\n\nimport { openEnvelopeJson, writeEnvelopeBody, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { canonicalJson, sha256Hex } from '../../with-commit/history/ledger/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest, type SchemaManifestEntry } from './types.js'\n\n/** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */\nexport type GetManifestDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/**\n * A decrypted schema-manifest read paired with the wrapping envelope's `_v`\n * — the optimistic-concurrency token. Pass `version` back to\n * {@link saveSchemaManifest} (via `writeSchemaManifest`'s `expectedVersion`)\n * to make the write a strict CAS.\n */\nexport interface LoadedSchemaManifest {\n  /** Wrapping envelope `_v`. */\n  readonly version: number\n  /** Decrypted schema manifest. */\n  readonly manifest: SchemaManifest\n}\n\n/**\n * Read the `_manifest/schema` envelope together with its wrapping `_v`.\n * Returns `undefined` when no manifest has ever been written, when the\n * envelope fails to decrypt (wrong DEK), or when it doesn't parse as a\n * `v: 1, kind: 'schema'` manifest.\n */\nexport async function loadSchemaManifestEntry(\n  store: NoydbStore,\n  vault: string,\n  getDEK: GetManifestDEK,\n): Promise<LoadedSchemaManifest | undefined> {\n  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID)\n  if (!envelope) return undefined\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as SchemaManifest\n    if (parsed.v !== 1 || parsed.kind !== 'schema') return undefined\n    return { version: envelope._v, manifest: parsed }\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist the schema manifest as a strict CAS write:\n * `expectedVersion` must match the stored envelope's `_v` (0 when no\n * envelope exists yet) or `store.put` throws `ConflictError` — surfaced by\n * `writer.ts`'s `writeSchemaManifest` as `ManifestConflictError` rather than\n * retried.\n */\nexport async function saveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  manifest: SchemaManifest,\n  expectedVersion: number,\n  getDEK: GetManifestDEK,\n): Promise<void> {\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  const json = JSON.stringify(manifest)\n  const body = await writeEnvelopeBody(json, dek)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: expectedVersion + 1,\n    _ts: new Date().toISOString(),\n    ...body,\n  }\n  await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion)\n}\n\n/**\n * `sha256Hex(canonicalJson(collections))` — the pod-wide content binding\n * over a schema manifest's per-collection index. Canonical JSON sorts\n * object keys at every depth, so the result is independent of the map's\n * key insertion order. Shared by the writer's tests and (#941 Task 3) the\n * derivation path, so the hash is computed identically everywhere.\n */\nexport async function computeAggregateHash(\n  collections: Record<string, SchemaManifestEntry>,\n): Promise<string> {\n  return sha256Hex(canonicalJson(collections))\n}\n","/**\n * Derive the pod-wide {@link SchemaManifest} from the per-collection\n * `_schemas/<collection>` records — the source of truth (#941 Task 3).\n *\n * The manifest is an INDEX, never a cache with independent state: every\n * field in a {@link SchemaManifestEntry} is a direct projection of the\n * matching `PersistedSchemaEnvelope` (`hash` → `contentHash`, `fieldIds` →\n * `fieldIds`, `generation` → `generation`, falling back to the live fence's\n * `currentSchemaVersion` for a legacy pre-#946 envelope that never got a\n * generation stamp). Re-running this function against the same stored state\n * always produces the same manifest — that's what makes round-trip identity\n * (AC #2: dump → restore → re-derive matches the original) hold for free,\n * with no special-cased restore logic.\n *\n * A collection whose `_schemas/<collection>` envelope decrypts successfully\n * but has no derivable content (`hash === null` — a stub envelope for a\n * non-Zod validator) is legitimately omitted from the index: there is no\n * content hash to bind.\n *\n * ## Scoped principals: \"cannot decrypt\" is NOT \"doesn't exist\"\n *\n * A `_schemas/<collection>` envelope is encrypted under **that data\n * collection's own DEK** — the same key its records use — NOT a shared\n * `_schemas`-wide key. In a team vault, a collection-scoped grantee (e.g.\n * `grant(..., { role: 'operator', permissions: { invoices: 'rw' } })`) holds\n * only the DEKs their `permissions` name, plus every system-prefixed (`_*`)\n * collection's DEK — `_manifest` included, by `grant()`'s \"propagate system\n * collections to every role\" rule (`keyring.ts`). So a member scoped to\n * `invoices` CAN decrypt `_manifest/schema` (the pod-wide index) but CANNOT\n * decrypt a sibling's `_schemas/customers` envelope — even though that\n * envelope is right there in `store.list(vault, SCHEMAS_COLLECTION)`.\n *\n * `lookupDEK` (the {@link LookupDEK} passed in) reflects this: it returns\n * `undefined` for a collection name whose DEK the caller does not hold —\n * deliberately NEVER minting a fresh one (see the module doc on\n * `LookupDEK` for why). This function distinguishes that case\n * (`undecodableCollections`) from \"the schema envelope legitimately has no\n * derivable content\" (`hash === null`) — the caller (`sync.ts`) MUST treat\n * an incomplete view differently: writing a manifest derived from a\n * partial view would silently drop every collection this principal can't\n * see. See `sync.ts`'s module doc for how the sync path handles this.\n *\n * @module\n */\n\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { loadFence } from '../schema-update/fence.js'\nimport { loadPersistedSchema, SCHEMAS_COLLECTION } from '../persisted-schemas/storage.js'\nimport { computeAggregateHash } from './storage.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { SchemaManifest, SchemaManifestEntry } from './types.js'\n\n/**\n * A NON-MINTING DEK lookup: returns the collection's DEK if the caller\n * already holds it, `undefined` otherwise. Deliberately distinct from\n * `storage.ts`'s `GetManifestDEK` (which mints+persists a fresh DEK for an\n * absent collection — correct for a caller about to WRITE that collection,\n * e.g. `_manifest` itself). `deriveSchemaManifest` only ever READS sibling\n * collections it never created and has no business minting keys for — an\n * absent DEK here means \"not my collection to see,\" never \"new collection\n * that needs a key.\" Minting here would be worse than a no-op: it would\n * silently persist a garbage DEK into the caller's OWN `_keyring/<user>`\n * file (via `ensureCollectionDEK`'s `persistKeyring` side effect) that\n * still can't decrypt anything — see `sync.ts` / `with-pod/open.ts`'s\n * fix notes (#941 review).\n */\nexport type LookupDEK = (collectionName: string) => Promise<EnclaveKey | undefined>\n\nexport interface DeriveSchemaManifestResult {\n  /** The derived manifest — an index over every collection this principal could decrypt. */\n  readonly manifest: SchemaManifest\n  /**\n   * Names present in `_schemas` (per `store.list`) whose envelope this\n   * principal could NOT decrypt — either no DEK held for that collection,\n   * or the DEK held failed to decrypt/parse it (treated the same: the\n   * caller cannot verify what's there, so it cannot safely be omitted or\n   * asserted). Empty for a principal with full visibility (typically the\n   * owner/admin/custodian). Non-empty means `manifest.collections` is\n   * DEFINITELY INCOMPLETE relative to the pod's true collection set —\n   * see `sync.ts` for why that must gate whether the manifest gets written.\n   */\n  readonly undecodableCollections: readonly string[]\n}\n\n/**\n * Read the fence generation + every `_schemas/<collection>` envelope this\n * principal can decrypt, and project them into a fresh {@link SchemaManifest}.\n * `lookupDEK` is called once per collection found under `_schemas` (never\n * mints — see {@link LookupDEK}). Names whose DEK isn't held, or whose\n * envelope fails to decrypt/parse despite holding a DEK, are reported via\n * `undecodableCollections` rather than silently dropped from the result.\n */\nexport async function deriveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  lookupDEK: LookupDEK,\n): Promise<DeriveSchemaManifestResult> {\n  const fence = await loadFence(store, vault)\n  const collectionNames = await store.list(vault, SCHEMAS_COLLECTION)\n\n  const collections: Record<string, SchemaManifestEntry> = {}\n  const undecodableCollections: string[] = []\n  for (const name of collectionNames) {\n    const dek = await lookupDEK(name)\n    if (dek === undefined) {\n      undecodableCollections.push(name) // present in _schemas, but not decodable by this principal\n      continue\n    }\n\n    const payload = await loadPersistedSchema(store, vault, name, dek)\n    if (!payload) {\n      // Held a DEK but still couldn't decrypt/parse — cannot distinguish\n      // \"wrong key after all\" from real corruption from here; treat as\n      // undecodable (never silently drop) rather than \"no content.\"\n      undecodableCollections.push(name)\n      continue\n    }\n    if (payload.hash === null) continue // legitimately no derivable content (stub envelope)\n\n    const entry: SchemaManifestEntry = {\n      generation: payload.generation ?? fence.currentSchemaVersion,\n      contentHash: payload.hash,\n    }\n    collections[name] = payload.fieldIds !== undefined ? { ...entry, fieldIds: payload.fieldIds } : entry\n  }\n\n  const aggregateHash = await computeAggregateHash(collections)\n  const manifest: SchemaManifest = { v: 1, kind: 'schema', generation: fence.currentSchemaVersion, collections, aggregateHash }\n  return { manifest, undecodableCollections }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDO,IAAM,4BAA4B;;;ACCzC,eAAsB,wBACpB,OACA,OACA,QAC2C;AAC3C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,qBAAqB,yBAAyB;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,MAAM,KAAK,OAAO,SAAS,SAAU,QAAO;AACvD,WAAO,EAAE,SAAS,SAAS,IAAI,UAAU,OAAO;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,mBACpB,OACA,OACA,UACA,iBACA,QACe;AACf,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,QAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,QAAM,OAAO,MAAM,kBAAkB,MAAM,GAAG;AAC9C,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,IAAI,kBAAkB;AAAA,IACtB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,GAAG;AAAA,EACL;AACA,QAAM,MAAM,IAAI,OAAO,qBAAqB,2BAA2B,KAAK,eAAe;AAC7F;AASA,eAAsB,qBACpB,aACiB;AACjB,SAAO,UAAU,cAAc,WAAW,CAAC;AAC7C;;;ACfA,eAAsB,qBACpB,OACA,OACA,WACqC;AACrC,QAAM,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1C,QAAM,kBAAkB,MAAM,MAAM,KAAK,OAAO,kBAAkB;AAElE,QAAM,cAAmD,CAAC;AAC1D,QAAM,yBAAmC,CAAC;AAC1C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,MAAM,MAAM,UAAU,IAAI;AAChC,QAAI,QAAQ,QAAW;AACrB,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,oBAAoB,OAAO,OAAO,MAAM,GAAG;AACjE,QAAI,CAAC,SAAS;AAIZ,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAM;AAE3B,UAAM,QAA6B;AAAA,MACjC,YAAY,QAAQ,cAAc,MAAM;AAAA,MACxC,aAAa,QAAQ;AAAA,IACvB;AACA,gBAAY,IAAI,IAAI,QAAQ,aAAa,SAAY,EAAE,GAAG,OAAO,UAAU,QAAQ,SAAS,IAAI;AAAA,EAClG;AAEA,QAAM,gBAAgB,MAAM,qBAAqB,WAAW;AAC5D,QAAM,WAA2B,EAAE,GAAG,GAAG,MAAM,UAAU,YAAY,MAAM,sBAAsB,aAAa,cAAc;AAC5H,SAAO,EAAE,UAAU,uBAAuB;AAC5C;","names":[]}

package/dist/{chunk-FT5Y4VSP.js → chunk-HVQGCKY4.js}

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-shape/satellites/validate.ts
 function validateSatelliteDeclaration(input) {
@@ -47,4 +47,4 @@ export {
   validateSatelliteDeclaration,
   hashFields
 };
-//# sourceMappingURL=chunk-FT5Y4VSP.js.map
+//# sourceMappingURL=chunk-HVQGCKY4.js.map

package/dist/{chunk-MYSNNMJ3.js → chunk-HXGUIPQB.js}

@@ -2,10 +2,10 @@ import {
   base64ToBuffer,
   decryptBytesWithAAD,
   encryptBytesWithAAD
-} from "./chunk-RPWMDIGK.js";
+} from "./chunk-VCETL77O.js";
 import {
   TamperedError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/kernel/enclave/classify/compare.ts
 var subtle = globalThis.crypto.subtle;
@@ -92,4 +92,4 @@ export {
   openVdigPayload,
   evaluateKofN
 };
-//# sourceMappingURL=chunk-MYSNNMJ3.js.map
+//# sourceMappingURL=chunk-HXGUIPQB.js.map

package/dist/{chunk-GTQF32TP.js → chunk-JEM2IGS3.js}

@@ -1,21 +1,21 @@
-import {
-  resolveManagedSecret
-} from "./chunk-CLE3TMIS.js";
 import {
   freezeSnapshotOnly
-} from "./chunk-G3ORJ3IQ.js";
+} from "./chunk-JSRU5W2M.js";
+import {
+  resolveManagedSecret
+} from "./chunk-MC2LFTQM.js";
 import {
   createOwnerKeyring
-} from "./chunk-FZAP4JNC.js";
+} from "./chunk-RLWY6Z44.js";
 import {
   wrapKey
-} from "./chunk-RPWMDIGK.js";
+} from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-77AEMXFA.js";
+} from "./chunk-24ZLWWEO.js";
 import {
   PermissionDeniedError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -131,4 +131,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-GTQF32TP.js.map
+//# sourceMappingURL=chunk-JEM2IGS3.js.map

package/dist/chunk-JH3OHQM4.js

@@ -0,0 +1,260 @@
+import {
+  computeSchemaDelta,
+  evaluateStrategies
+} from "./chunk-ZVF37PKE.js";
+import {
+  MANIFEST_SCHEMA_RECORD_ID,
+  deriveSchemaManifest,
+  loadSchemaManifestEntry,
+  saveSchemaManifest
+} from "./chunk-HS7HNYBD.js";
+import {
+  MANIFEST_COLLECTION
+} from "./chunk-EPFF7LOX.js";
+import {
+  loadFence,
+  saveFence
+} from "./chunk-MVOWXQHN.js";
+import {
+  derivePersistedSchema
+} from "./chunk-2LGDCNFJ.js";
+import {
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-V5C5NNBR.js";
+import {
+  envelopePayloadHash
+} from "./chunk-24UICKTB.js";
+import {
+  ManifestConflictError,
+  isConflictError
+} from "./chunk-HNGSV2YC.js";
+
+// src/with-shape/persisted-schemas/field-ids.ts
+var BASE32URL_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+function encodeBase32Url(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32URL_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    out += BASE32URL_ALPHABET[value << 5 - bits & 31];
+  }
+  return out;
+}
+function mintFieldId() {
+  const bytes = new Uint8Array(12);
+  crypto.getRandomValues(bytes);
+  return encodeBase32Url(bytes);
+}
+function topLevelFieldNames(jsonSchema) {
+  if (jsonSchema === null) return [];
+  const props = jsonSchema.properties;
+  if (props === null || typeof props !== "object") return [];
+  return Object.keys(props);
+}
+function resolveFieldIds(freshJsonSchema, priorFieldIds, renamed) {
+  const names = topLevelFieldNames(freshJsonSchema);
+  if (names.length === 0) return void 0;
+  const priorNameFor = /* @__PURE__ */ new Map();
+  if (renamed) for (const { from, to } of renamed) priorNameFor.set(to, from);
+  const out = {};
+  for (const name of names) {
+    const priorName = priorNameFor.get(name) ?? name;
+    out[name] = priorFieldIds?.[priorName] ?? mintFieldId();
+  }
+  return out;
+}
+
+// src/with-shape/manifest/writer.ts
+async function writeSchemaManifest(store, vault, manifest, expectedVersion, getDEK) {
+  try {
+    await saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK);
+  } catch (err) {
+    if (isConflictError(err)) {
+      throw new ManifestConflictError(err.version, expectedVersion);
+    }
+    throw err;
+  }
+}
+
+// src/with-shape/manifest/sync.ts
+var MAX_SYNC_ATTEMPTS = 16;
+async function syncSchemaManifest(store, vault, deps) {
+  for (let attempt = 0; attempt < MAX_SYNC_ATTEMPTS; attempt++) {
+    const { manifest: derived, undecodableCollections } = await deriveSchemaManifest(store, vault, deps.lookupDEK);
+    if (undecodableCollections.length > 0) {
+      return;
+    }
+    const existing = await loadSchemaManifestEntry(store, vault, deps.getDEK);
+    if (existing && existing.manifest.generation === derived.generation && existing.manifest.aggregateHash === derived.aggregateHash) {
+      return;
+    }
+    const expectedVersion = existing?.version ?? 0;
+    try {
+      await writeSchemaManifest(store, vault, derived, expectedVersion, deps.getDEK);
+    } catch (err) {
+      if (err instanceof ManifestConflictError) continue;
+      throw err;
+    }
+    await auditManifestWrite(store, vault, deps, derived, expectedVersion);
+    const recheck = await deriveSchemaManifest(store, vault, deps.lookupDEK);
+    if (recheck.undecodableCollections.length > 0) return;
+    if (recheck.manifest.generation === derived.generation && recheck.manifest.aggregateHash === derived.aggregateHash) {
+      return;
+    }
+  }
+  console.warn(
+    `[noy-db] schema-manifest sync did not converge after ${MAX_SYNC_ATTEMPTS} attempts; the persisted manifest may be stale until the next schema write or open()'s re-derive.`
+  );
+}
+async function auditManifestWrite(store, vault, deps, derived, expectedVersion) {
+  const ledger = deps.getLedgerOrNull?.();
+  if (!ledger) return;
+  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID);
+  await ledger.append({
+    op: "migration",
+    collection: MANIFEST_COLLECTION,
+    id: MANIFEST_SCHEMA_RECORD_ID,
+    version: expectedVersion + 1,
+    actor: "",
+    payloadHash: await envelopePayloadHash(envelope),
+    reason: `schema-manifest-sync:generation=${derived.generation}`
+  });
+}
+
+// src/with-shape/persisted-schemas/register.ts
+var MAX_SCHEMA_CAS_RETRIES = 5;
+async function persistSchemaIfNeeded(opts) {
+  const fresh = await derivePersistedSchema(opts.validator);
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored && isEquivalent(stored, fresh)) {
+      return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
+    }
+    let decision = { action: "allow" };
+    const strategies = opts.strategies ?? [];
+    let delta;
+    if (stored && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
+      delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
+      if (strategies.length > 0) {
+        decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
+      }
+    }
+    if (decision.action !== "allow") {
+      return { written: false, skipped: false, envelope: stored ?? fresh, decision };
+    }
+    let toSave = fresh;
+    if (stored?.classified !== void 0) toSave = { ...toSave, classified: stored.classified };
+    if (stored?.satellite !== void 0) toSave = { ...toSave, satellite: stored.satellite };
+    const fieldIds = resolveFieldIds(fresh.jsonSchema, stored?.fieldIds, delta?.renamed);
+    if (fieldIds !== void 0) toSave = { ...toSave, fieldIds };
+    const fence = await loadFence(opts.store, opts.vault);
+    toSave = { ...toSave, generation: fence.currentSchemaVersion };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version);
+      if (toSave.hash !== null) {
+        const freshFence = await loadFence(opts.store, opts.vault);
+        await saveFence(opts.store, opts.vault, { ...freshFence, schemaHash: toSave.hash });
+      }
+      if (opts.manifestSync) {
+        await syncSchemaManifest(opts.store, opts.vault, opts.manifestSync);
+      }
+      return { written: true, skipped: false, envelope: toSave, decision };
+    } catch (err) {
+      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistClassifiedMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.classified !== void 0 && markersEqual(stored.classified, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, classified: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      classified: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+async function persistSatelliteMarker(opts) {
+  for (let attempt = 0; ; attempt++) {
+    const { version, payload: stored } = await loadPersistedSchemaEntry(
+      opts.store,
+      opts.vault,
+      opts.collectionName,
+      opts.dek
+    );
+    if (stored?.satellite !== void 0 && satelliteMarkersEqual(stored.satellite, opts.marker)) return;
+    const payload = stored !== void 0 ? { ...stored, satellite: opts.marker } : {
+      _noydb_schema: 1,
+      kind: "Unknown",
+      jsonSchema: null,
+      hash: null,
+      derivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      satellite: opts.marker
+    };
+    try {
+      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version);
+      return;
+    } catch (err) {
+      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue;
+      throw err;
+    }
+  }
+}
+function satelliteMarkersEqual(a, b) {
+  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null);
+}
+function markersEqual(a, b) {
+  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable);
+}
+function sameSet(a, b) {
+  if (a.length !== b.length) return false;
+  const s = new Set(a);
+  return b.every((x) => s.has(x));
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isEquivalent(a, b) {
+  if (a.kind !== b.kind) return false;
+  if (a.hash && b.hash) return a.hash === b.hash;
+  if (a.hash === null && b.hash === null) return true;
+  return false;
+}
+
+export {
+  persistSchemaIfNeeded,
+  persistClassifiedMarker,
+  persistSatelliteMarker
+};
+//# sourceMappingURL=chunk-JH3OHQM4.js.map

package/dist/chunk-JH3OHQM4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/field-ids.ts","../src/with-shape/manifest/writer.ts","../src/with-shape/manifest/sync.ts","../src/with-shape/persisted-schemas/register.ts"],"sourcesContent":["/**\n * Stable field-identifier minting (#946).\n *\n * A field's `id` is opaque and permanent — minted once, from randomness\n * only, with no timestamp and no name-derivation. A name-derived id would\n * change when the field is renamed, defeating the whole point (identity\n * must survive a rename). See `PersistedSchemaEnvelope.fieldIds`.\n *\n * @module\n */\n\nconst BASE32URL_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567'\n\n/** Unpadded RFC 4648 §7 base32url encoding of an arbitrary byte string. */\nfunction encodeBase32Url(bytes: Uint8Array): string {\n  let bits = 0\n  let value = 0\n  let out = ''\n  for (const byte of bytes) {\n    value = (value << 8) | byte\n    bits += 8\n    while (bits >= 5) {\n      out += BASE32URL_ALPHABET[(value >>> (bits - 5)) & 31]\n      bits -= 5\n    }\n  }\n  if (bits > 0) {\n    out += BASE32URL_ALPHABET[(value << (5 - bits)) & 31]\n  }\n  return out\n}\n\n/**\n * Mint a fresh opaque field id: 12 random bytes (96 bits) from\n * `crypto.getRandomValues`, encoded as a 20-character base32url token.\n * Not exported — Task 2/3 (#946) may need to export this later; keep it\n * module-internal until an external consumer exists.\n */\nfunction mintFieldId(): string {\n  const bytes = new Uint8Array(12)\n  crypto.getRandomValues(bytes)\n  return encodeBase32Url(bytes)\n}\n\n/** Top-level property names of a Draft 2020-12 object JSON Schema, or `[]` when not an object schema. */\nfunction topLevelFieldNames(jsonSchema: object | null): readonly string[] {\n  if (jsonSchema === null) return []\n  const props = (jsonSchema as { properties?: unknown }).properties\n  if (props === null || typeof props !== 'object') return []\n  return Object.keys(props as Record<string, unknown>)\n}\n\n/**\n * Resolve the `fieldIds` map for a freshly-derived schema against the\n * previously-stored envelope's map (if any). Existing ids are preserved by\n * name — a field keeps its id across re-derivation as long as its name is\n * unchanged; a genuinely new field name mints a fresh id. Returns\n * `undefined` when the fresh schema has no derivable top-level field set\n * (e.g. a stub envelope, or a non-object root schema).\n *\n * `renamed` (#946 Task 2) — unambiguous rename pairs from\n * `computeSchemaDelta`'s `SchemaDelta.renamed`. When the fresh name is a\n * rename target (`to`), the id is looked up under its OLD name (`from`)\n * instead of the fresh name itself — the whole point of a stable field id\n * is that it survives exactly this case; without it, a rename would mint a\n * fresh id for the new name and silently drop the old one.\n */\nexport function resolveFieldIds(\n  freshJsonSchema: object | null,\n  priorFieldIds: Record<string, string> | undefined,\n  renamed?: readonly { readonly from: string; readonly to: string }[],\n): Record<string, string> | undefined {\n  const names = topLevelFieldNames(freshJsonSchema)\n  if (names.length === 0) return undefined\n  const priorNameFor = new Map<string, string>()\n  if (renamed) for (const { from, to } of renamed) priorNameFor.set(to, from)\n  const out: Record<string, string> = {}\n  for (const name of names) {\n    const priorName = priorNameFor.get(name) ?? name\n    out[name] = priorFieldIds?.[priorName] ?? mintFieldId()\n  }\n  return out\n}\n","/**\n * Strict-CAS schema-manifest writer (#941, AC #1).\n *\n * Every other reserved-collection writer in the hub (`persisted-schemas`'s\n * `savePersistedSchema` callers, the classified/satellite marker writers)\n * retries on a CAS conflict: re-read, re-apply, try again. The schema\n * manifest deliberately does NOT — two concurrent *direct* edits to the\n * manifest must be refused and surfaced, never silently merged or\n * retry-resolved, because a manifest write encodes a specific point-in-time\n * claim about the pod's schema generation/content-hash set. A caller that\n * lost the race must re-derive against the fresh state and decide what to\n * do, not have its stale write quietly re-applied on top of someone else's.\n *\n * Ledger audit: this writer does not have a `LedgerStore` handle at this\n * seam (mirroring `persisted-schemas`, whose `_schemas/<collection>` writes\n * are likewise not ledger-audited today). Wiring `LedgerStore.append({ op:\n * 'migration', ... })` around a manifest write belongs at the call site\n * where a ledger handle is already in scope (the open/write integration —\n * #941 Task 3/4), not here.\n *\n * @module\n */\n\nimport { isConflictError, ManifestConflictError } from '../../kernel/errors.js'\nimport { saveSchemaManifest, type GetManifestDEK } from './storage.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { SchemaManifest } from './types.js'\n\n/**\n * Write the schema manifest as a strict CAS: `expectedVersion` must match\n * the stored envelope's `_v` (0 when no manifest exists yet). On a\n * conflict, throws {@link ManifestConflictError} — this function never\n * retries.\n */\nexport async function writeSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  manifest: SchemaManifest,\n  expectedVersion: number,\n  getDEK: GetManifestDEK,\n): Promise<void> {\n  try {\n    await saveSchemaManifest(store, vault, manifest, expectedVersion, getDEK)\n  } catch (err) {\n    if (isConflictError(err)) {\n      throw new ManifestConflictError(err.version, expectedVersion)\n    }\n    throw err\n  }\n}\n","/**\n * Keep the persisted `_manifest/schema` record in sync with the\n * per-collection `_schemas/<collection>` source of truth (#941 Task 3).\n *\n * Called from `persisted-schemas/register.ts`'s `persistSchemaIfNeeded`\n * right after a `_schemas/<collection>` write succeeds.\n *\n * ## Reconciling strict-CAS-refuse with the derived nature of the manifest\n *\n * `writer.ts`'s `writeSchemaManifest` is deliberately strict-CAS: a\n * concurrent *direct* edit to the manifest is refused, never retried (AC\n * #1). But this call site is not a direct edit — it is a re-derivation\n * from the source of truth, triggered as a side effect of a `_schemas`\n * write that has ALREADY succeeded. When N collections are declared\n * together (one `openVault()` call registering several `persistJsonSchema:\n * true` collections), their `persistSchemaIfNeeded` calls run CONCURRENTLY\n * — each one's own `_schemas/<collection>` write lands independently, and\n * each then calls this function. A single derive-then-write with no\n * feedback loop is NOT enough here: a call whose `deriveSchemaManifest`\n * snapshot ran before a sibling's `_schemas` write landed would persist a\n * manifest that's missing that sibling forever (nothing re-triggers it) —\n * this was a REAL bug (not a test-isolation artifact — reproduced with 0\n * shared state, purely from concurrent `_schemas` writes racing the derive\n * snapshot; see #941 flake fix commit). `syncSchemaManifest` therefore\n * loops (bounded by {@link MAX_SYNC_ATTEMPTS}):\n *\n *   1. Derive fresh, compare to what's persisted. Already converged → done.\n *   2. Write via strict-CAS. `ManifestConflictError` (another writer moved\n *      the manifest first) → loop: re-derive against the NEW state and\n *      retry, exactly like a normal optimistic-CAS retry.\n *   3. On a successful write, derive ONE more time. If a sibling's\n *      `_schemas` write landed while we were deriving/writing, the state\n *      has already moved past what we just wrote — loop again to catch it\n *      up. If the re-derive matches what we wrote, we're the last writer\n *      and the manifest is provably converged: return.\n *\n * This guarantees that whichever collection's `_schemas` write is the LAST\n * to land (in real wall-clock order — there is always exactly one, even\n * though no single caller knows which) ends up running a sync whose own\n * derive sees every sibling's write already committed, and whose\n * recheck-after-write confirms nothing moved further — so it converges the\n * manifest deterministically, regardless of interleaving. If attempts are\n * exhausted under pathological contention, the loop gives up — with a\n * `console.warn` (see cap-exhaustion note below), not silently — leaving\n * the last successful write in place; the manifest is a derivable cache\n * (not a correctness invariant), so a next schema write or `open()`'s\n * re-derive still converges it, matching how `persistSchemaIfNeeded`\n * already treats its own write failures.\n * Any error OTHER than `ManifestConflictError` (store failure, DEK\n * resolution failure, etc.) is NOT swallowed — it propagates to the\n * caller immediately, matching how `persistSchemaIfNeeded` already treats\n * its own write failures as a visible (not silently discarded) fingerprint\n * failure.\n *\n * ## CRITICAL fix (#941 review): a scoped principal must never write a\n * partial manifest\n *\n * `deriveSchemaManifest` returns `undecodableCollections` for any\n * `_schemas/<collection>` entry this principal's `lookupDEK` couldn't\n * resolve — e.g. a member `grant()`-scoped to one collection can decrypt\n * `_manifest` itself (system-prefixed DEKs propagate to every role) but\n * NOT a sibling data collection's `_schemas/<sibling>` entry. Before this\n * fix, `deriveSchemaManifest` silently treated \"can't decrypt\" the same as\n * \"no derivable content\" and omitted the sibling — so a scoped member's\n * OWN schema declare would derive a manifest missing every collection they\n * can't see, load the real (complete) persisted manifest as a valid CAS\n * token, observe a hash mismatch, and OVERWRITE it — permanently dropping\n * the siblings, silently, ledger-audited as a legitimate migration. The\n * converging recheck loop above made this WORSE, not better: re-deriving\n * from the same restricted view just re-confirms the same partial result\n * and declares it \"stable.\"\n *\n * Fix: if `undecodableCollections` is non-empty, `syncSchemaManifest`\n * `SKIP`s entirely — no read-compare, no write, no audit, no loop. It does\n * NOT try to merge-preserve the undecodable entries from what's currently\n * persisted: an `aggregateHash` computed over entries this principal can't\n * verify would be a hash asserting something it never actually checked,\n * which is worse than not writing at all. This is safe because:\n *\n *   - The source of truth, `_schemas/<their-collection>`, was ALREADY\n *     updated by their declare — nothing about their own change is lost.\n *   - The pod-wide `_manifest` cache simply isn't rewritten by a principal\n *     who'd corrupt it by omission — it stays whatever a full-visibility\n *     principal (owner/admin/custodian) last wrote.\n *   - `open()` re-derives from `_schemas` directly (not from the cached\n *     manifest) for whoever opens it, so a stale cache is never load-bearing.\n *   - The NEXT full-visibility principal's declare (or any subsequent sync\n *     by someone with complete access) naturally refreshes the cache,\n *     including the scoped member's own just-landed change.\n *\n * ## Ledger audit (AC #5)\n *\n * Schema-generation transitions are not ledger-audited anywhere else today\n * (neither the `_schemas/<collection>` write in `register.ts` nor the fence\n * bump in `schema-update/fence-controller.ts#runCutover`). This is the\n * first ledger-audited signal for a schema change: every manifest write\n * that actually happens (i.e. every time the derived manifest differs from\n * what's stored) appends an `op: 'migration'` entry via the optional\n * `getLedgerOrNull` callback — `null`/absent when the history strategy\n * isn't opted in, matching every other optional-ledger call site\n * (`vault._getLedgerOrNull()?.append(...)`, see `liberate.ts`,\n * `with-audit/periods/vault-facade.ts`). No audit fires on the no-op path\n * (derived manifest unchanged), on a swallowed conflict (the winning\n * writer's own sync already audits its write), or on the scoped-principal\n * SKIP path above (nothing was written).\n *\n * @module\n */\n\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport { envelopePayloadHash } from '../../with-commit/history/ledger/hash.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { ManifestConflictError } from '../../kernel/errors.js'\nimport { deriveSchemaManifest, type LookupDEK } from './derive.js'\nimport { loadSchemaManifestEntry, type GetManifestDEK } from './storage.js'\nimport { writeSchemaManifest } from './writer.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest } from './types.js'\n\nexport interface ManifestSyncDeps {\n  /** Resolver for `_manifest`'s OWN DEK — mints if absent (this principal's declare is about to write it). */\n  readonly getDEK: GetManifestDEK\n  /**\n   * NON-MINTING lookup for every OTHER (sibling data) collection's DEK,\n   * used by `deriveSchemaManifest` to build the index — see `derive.ts`'s\n   * `LookupDEK` doc for why minting here would be actively harmful.\n   */\n  readonly lookupDEK: LookupDEK\n  /** Optional ledger handle — absent when the history strategy isn't opted in (no-op audit). */\n  readonly getLedgerOrNull?: () => LedgerStore | null\n}\n\n/**\n * Bound on the derive→write→recheck loop (see module doc). Headroom above\n * what any realistic `openVault()` batch (a handful of collections) needs —\n * a 40-way concurrent-declare stress repro converged within single digits.\n */\nconst MAX_SYNC_ATTEMPTS = 16\n\n/**\n * Re-derive the schema manifest and write it if it changed, looping until\n * the write is provably stable against concurrent sibling `_schemas`\n * writes (see module doc). SKIPS entirely (no write, no audit) when this\n * principal's view is incomplete (`undecodableCollections` non-empty) —\n * see the module doc's CRITICAL fix section. Swallows a\n * {@link ManifestConflictError} by retrying against the fresher state; any\n * other error propagates. Ledger-audits (`op: 'migration'`) once per\n * successful write.\n */\nexport async function syncSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  deps: ManifestSyncDeps,\n): Promise<void> {\n  for (let attempt = 0; attempt < MAX_SYNC_ATTEMPTS; attempt++) {\n    const { manifest: derived, undecodableCollections } = await deriveSchemaManifest(store, vault, deps.lookupDEK)\n    if (undecodableCollections.length > 0) {\n      // Scoped principal — see module doc's CRITICAL fix. Never write a\n      // manifest we know is missing collections we couldn't decrypt.\n      return\n    }\n\n    const existing = await loadSchemaManifestEntry(store, vault, deps.getDEK)\n\n    if (\n      existing &&\n      existing.manifest.generation === derived.generation &&\n      existing.manifest.aggregateHash === derived.aggregateHash\n    ) {\n      return // already converged — no write, no audit\n    }\n\n    const expectedVersion = existing?.version ?? 0\n    try {\n      await writeSchemaManifest(store, vault, derived, expectedVersion, deps.getDEK)\n    } catch (err) {\n      if (err instanceof ManifestConflictError) continue // another writer moved it first — re-derive + retry\n      throw err\n    }\n\n    await auditManifestWrite(store, vault, deps, derived, expectedVersion)\n\n    // A sibling's `_schemas` write can land while WE were deriving/writing\n    // (#941 flake fix — see module doc). Re-derive once more: if the truth\n    // has already moved past what we just wrote, loop again to catch it up\n    // instead of leaving a permanently-partial manifest. (A principal with\n    // full visibility at the top of this iteration cannot lose that\n    // visibility mid-call — the keyring doesn't change during one sync —\n    // so this recheck is never itself subject to the undecodable-skip; the\n    // `for` loop's own guard covers it defensively regardless.)\n    const recheck = await deriveSchemaManifest(store, vault, deps.lookupDEK)\n    if (recheck.undecodableCollections.length > 0) return // defensive — see comment above\n    if (recheck.manifest.generation === derived.generation && recheck.manifest.aggregateHash === derived.aggregateHash) {\n      return // stable — we were the last writer\n    }\n  }\n  // Attempts exhausted under pathological contention — see module doc:\n  // the manifest is a derivable cache, not a correctness invariant, so a\n  // later schema write or open()'s re-derive still converges it. Warn\n  // rather than fail silently — a silent give-up on a completeness\n  // invariant is exactly what hid the original concurrent-declare race.\n  console.warn(\n    `[noy-db] schema-manifest sync did not converge after ${MAX_SYNC_ATTEMPTS} attempts; ` +\n      'the persisted manifest may be stale until the next schema write or open()\\'s re-derive.',\n  )\n}\n\nasync function auditManifestWrite(\n  store: NoydbStore,\n  vault: string,\n  deps: ManifestSyncDeps,\n  derived: SchemaManifest,\n  expectedVersion: number,\n): Promise<void> {\n  const ledger = deps.getLedgerOrNull?.()\n  if (!ledger) return\n  // `_manifest/schema` has a real, individually-addressable envelope (unlike\n  // a `lifecycle` entry's empty collection/id) — `verifyBackupIntegrity`'s\n  // data cross-check (`with-pod/backup.ts`) treats any non-amendment,\n  // non-lifecycle entry's `collection`/`id` as \"the latest write to this\n  // record\" and recomputes+compares its ciphertext hash, so `payloadHash`\n  // must be the real `envelopePayloadHash` of the just-written envelope\n  // (ciphertext domain), NOT `derived.aggregateHash` (plaintext domain) —\n  // using the wrong domain here trips a false-positive tamper failure on\n  // restore.\n  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID)\n  await ledger.append({\n    op: 'migration',\n    collection: MANIFEST_COLLECTION,\n    id: MANIFEST_SCHEMA_RECORD_ID,\n    version: expectedVersion + 1,\n    actor: '',\n    payloadHash: await envelopePayloadHash(envelope),\n    reason: `schema-manifest-sync:generation=${derived.generation}`,\n  })\n}\n","/**\n * Orchestrate the derive → hash → skip-or-write cycle for a collection's\n * persisted JSON Schema. Called by the Vault at collection-registration\n * time when the developer opts in via `collection({ persistJsonSchema:\n * true })`.\n *\n * Skip semantics:\n *\n *   - Zod validators: skip when the new hash equals the stored hash.\n *   - Non-Zod (stub envelopes have hash=null): skip when the stored\n *     envelope's `kind` matches the freshly-detected kind (since there's\n *     no body to compare yet — a kind change is the only signal).\n *\n * @module\n */\n\nimport { derivePersistedSchema } from './derive.js'\nimport { loadPersistedSchemaEntry, savePersistedSchema } from './storage.js'\nimport { resolveFieldIds } from './field-ids.js'\nimport { computeSchemaDelta } from '../schema-update/delta.js'\nimport { evaluateStrategies } from '../schema-update/dispatch.js'\nimport { loadFence, saveFence } from '../schema-update/fence.js'\nimport { isConflictError } from '../../kernel/errors.js'\nimport { syncSchemaManifest, type ManifestSyncDeps } from '../manifest/sync.js'\nimport type { SchemaUpdateStrategy, UpdateDecision, SchemaDelta } from '../schema-update/types.js'\nimport type { NoydbStore, ClassifiedMarker } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\nimport type { PairingMarker } from '../satellites/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Max optimistic-CAS retries for the shared `_schemas/<collection>` record\n * (#583). Only two writers ever contend (the JSON-Schema writer and the\n * classified-marker writer), so one retry suffices; the headroom covers a\n * pathological re-order. Exhausting it rethrows the {@link ConflictError}\n * rather than silently losing a write.\n */\nconst MAX_SCHEMA_CAS_RETRIES = 5\n\nexport interface PersistSchemaResult {\n  /** True when a fresh envelope was written to storage. */\n  readonly written: boolean\n  /** True when an existing envelope matched and the write was skipped. */\n  readonly skipped: boolean\n  /** The envelope that was either written or matched. */\n  readonly envelope: PersistedSchemaEnvelope\n  /** The update-strategy decision, present when strategies ran. */\n  readonly decision?: UpdateDecision\n}\n\nexport async function persistSchemaIfNeeded(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly validator: unknown\n  readonly dek: EnclaveKey\n  readonly strategies?: readonly SchemaUpdateStrategy[]\n  /** #941 Task 3: re-derive + sync the `_manifest/schema` INDEX after a write. Omitted → no sync (e.g. tests that don't care). */\n  readonly manifestSync?: ManifestSyncDeps\n}): Promise<PersistSchemaResult> {\n  const fresh = await derivePersistedSchema(opts.validator)\n\n  // The `_schemas/<collection>` record is shared with the classified-marker\n  // writer, so a plain load→save loses whichever writer put first (#583). Read\n  // the version at load time and CAS on it; on conflict re-read (picking up the\n  // other writer's field), re-evaluate, and retry.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n\n    if (stored && isEquivalent(stored, fresh)) {\n      return { written: false, skipped: true, envelope: stored, decision: { action: 'allow' } }\n    }\n\n    // Changed (or first registration). Compute the delta whenever we have a\n    // comparable JSON-Schema baseline — independent of whether strategies\n    // were registered (#946: the rename pairing it carries feeds the\n    // fieldIds id-carry below even on a bare re-declare with no\n    // `schemaUpdate` strategies configured). Strategies only run when\n    // registered.\n    let decision: UpdateDecision = { action: 'allow' }\n    const strategies = opts.strategies ?? []\n    let delta: SchemaDelta | undefined\n    if (\n      stored &&\n      stored.kind === fresh.kind &&\n      isPlainObject(stored.jsonSchema) &&\n      isPlainObject(fresh.jsonSchema)\n    ) {\n      delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName)\n      if (strategies.length > 0) {\n        decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName })\n      }\n    }\n\n    if (decision.action !== 'allow') {\n      // reject (or cutover): do NOT overwrite the baseline — the\n      // old schema stays the source of truth until the change is resolved.\n      return { written: false, skipped: false, envelope: stored ?? fresh, decision }\n    }\n\n    // Preserve a previously-persisted classified marker (C-A / R10) and\n    // satellite pairing marker (R-S9) — the schema derivation knows nothing\n    // about them, so a naive overwrite here would drop the config-drift\n    // guards' cross-session signals.\n    let toSave: PersistedSchemaEnvelope = fresh\n    if (stored?.classified !== undefined) toSave = { ...toSave, classified: stored.classified }\n    if (stored?.satellite !== undefined) toSave = { ...toSave, satellite: stored.satellite }\n\n    // #946: mint/preserve stable per-field ids (by name, carrying a\n    // detected rename's id from its old name — see `delta.renamed`) and\n    // stamp the vault-wide schema-fence generation this write happened at —\n    // binds \"generation N\" to this envelope's content hash\n    // (schemaFenceState() + loadPersistedSchema agree).\n    const fieldIds = resolveFieldIds(fresh.jsonSchema, stored?.fieldIds, delta?.renamed)\n    if (fieldIds !== undefined) toSave = { ...toSave, fieldIds }\n    const fence = await loadFence(opts.store, opts.vault)\n    toSave = { ...toSave, generation: fence.currentSchemaVersion }\n\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, toSave, version)\n      if (toSave.hash !== null) {\n        // This is the FIRST non-barrier writer to `_meta/schema-fence` —\n        // previously only SchemaFenceController.#setState wrote it, and only\n        // sequentially, under the drain barrier. There is no CAS on the fence\n        // doc (out of scope to add here), so re-read it immediately before\n        // writing rather than reusing the `fence` snapshot captured above\n        // (before the potentially-slow `savePersistedSchema` call): spreading\n        // a stale snapshot here would roll back `currentSchemaVersion`/\n        // `fenceState` if a concurrent cutover (on a different collection)\n        // advanced the fence in between — corrupting the vault-wide gate the\n        // whole barrier + MigrationRequiredError check depends on. Re-reading\n        // narrows (does not eliminate) that window to just this one overlay.\n        const freshFence = await loadFence(opts.store, opts.vault)\n        await saveFence(opts.store, opts.vault, { ...freshFence, schemaHash: toSave.hash })\n      }\n      // #941 Task 3: keep the `_manifest/schema` INDEX in sync with the\n      // `_schemas/<collection>` write that just landed. Opt-in via\n      // `opts.manifestSync` (threaded from vault.ts, which is the only\n      // caller with a general-purpose `getDEK` resolver + ledger handle).\n      if (opts.manifestSync) {\n        await syncSchemaManifest(opts.store, opts.vault, opts.manifestSync)\n      }\n      return { written: true, skipped: false, envelope: toSave, decision }\n    } catch (err) {\n      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the C-A / R10 classified marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on the first classified write so a\n * later naive handle can detect the drift cross-session.\n */\nexport async function persistClassifiedMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: ClassifiedMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.classified !== undefined && markersEqual(stored.classified, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, classified: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            classified: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n/**\n * Persist (or refresh) the R-S9 satellite pairing marker into the collection's\n * `_schemas/<collection>` record, preserving any existing derived JSON-Schema\n * body. Idempotent — a no-op when an equivalent marker is already stored.\n * Independent of `persistJsonSchema`: called on satellite declaration so a\n * later divergent re-declaration can be detected cross-session.\n */\nexport async function persistSatelliteMarker(opts: {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collectionName: string\n  readonly dek: EnclaveKey\n  readonly marker: PairingMarker\n}): Promise<void> {\n  // Shares the `_schemas/<collection>` record with the JSON-Schema writer;\n  // CAS on the loaded version so a concurrent schema (re)registration can't\n  // silently drop the marker (and vice-versa) — see #583.\n  for (let attempt = 0; ; attempt++) {\n    const { version, payload: stored } = await loadPersistedSchemaEntry(\n      opts.store, opts.vault, opts.collectionName, opts.dek,\n    )\n    if (stored?.satellite !== undefined && satelliteMarkersEqual(stored.satellite, opts.marker)) return\n    const payload: PersistedSchemaEnvelope =\n      stored !== undefined\n        ? { ...stored, satellite: opts.marker }\n        : {\n            _noydb_schema: 1,\n            kind: 'Unknown',\n            jsonSchema: null,\n            hash: null,\n            derivedAt: new Date().toISOString(),\n            satellite: opts.marker,\n          }\n    try {\n      await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, payload, version)\n      return\n    } catch (err) {\n      if (isConflictError(err) && attempt < MAX_SCHEMA_CAS_RETRIES) continue\n      throw err\n    }\n  }\n}\n\n// #597: both equality checks below deliberately do NOT compare `epoch`. A\n// live collection re-opening itself computes a fresh epoch candidate on\n// every declare (marker.ts / config-drift.ts) that must still be treated as\n// \"the same marker\" so the no-op fast path fires and the already-persisted\n// epoch is left untouched — that's what makes epoch stable across re-opens.\n// Comparing epoch here would break that fast path today, with no\n// corresponding benefit: there is no delete-collection API yet, so a\n// mismatched epoch can't (yet) mean \"this name was reused for a genuinely\n// new collection.\" Wiring an epoch-mismatch REJECTION is a deferred\n// follow-up for whenever collection deletion ships.\n\nfunction satelliteMarkersEqual(a: PairingMarker, b: PairingMarker): boolean {\n  return a.base === b.base && a.fieldsHash === b.fieldsHash && (a.joined ?? null) === (b.joined ?? null)\n}\n\nfunction markersEqual(a: ClassifiedMarker, b: ClassifiedMarker): boolean {\n  return sameSet(a.digestOnly, b.digestOnly) && sameSet(a.equatable, b.equatable)\n}\n\nfunction sameSet(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false\n  const s = new Set(a)\n  return b.every((x) => s.has(x))\n}\n\nfunction isPlainObject(v: unknown): v is object {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n}\n\nfunction isEquivalent(a: PersistedSchemaEnvelope, b: PersistedSchemaEnvelope): boolean {\n  if (a.kind !== b.kind) return false\n  // Zod path: real hashes — compare directly.\n  if (a.hash && b.hash) return a.hash === b.hash\n  // Stub path: both have hash=null. Kind equality is the only signal we have.\n  if (a.hash === null && b.hash === null) return true\n  // Mixed (one has a hash, the other doesn't) — treat as changed.\n  return false\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,IAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAA2B;AAClD,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,mBAAoB,UAAW,OAAO,IAAM,EAAE;AACrD,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,WAAO,mBAAoB,SAAU,IAAI,OAAS,EAAE;AAAA,EACtD;AACA,SAAO;AACT;AAQA,SAAS,cAAsB;AAC7B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAGA,SAAS,mBAAmB,YAA8C;AACxE,MAAI,eAAe,KAAM,QAAO,CAAC;AACjC,QAAM,QAAS,WAAwC;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,CAAC;AACzD,SAAO,OAAO,KAAK,KAAgC;AACrD;AAiBO,SAAS,gBACd,iBACA,eACA,SACoC;AACpC,QAAM,QAAQ,mBAAmB,eAAe;AAChD,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,eAAe,oBAAI,IAAoB;AAC7C,MAAI,QAAS,YAAW,EAAE,MAAM,GAAG,KAAK,QAAS,cAAa,IAAI,IAAI,IAAI;AAC1E,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,aAAa,IAAI,IAAI,KAAK;AAC5C,QAAI,IAAI,IAAI,gBAAgB,SAAS,KAAK,YAAY;AAAA,EACxD;AACA,SAAO;AACT;;;AChDA,eAAsB,oBACpB,OACA,OACA,UACA,iBACA,QACe;AACf,MAAI;AACF,UAAM,mBAAmB,OAAO,OAAO,UAAU,iBAAiB,MAAM;AAAA,EAC1E,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,YAAM,IAAI,sBAAsB,IAAI,SAAS,eAAe;AAAA,IAC9D;AACA,UAAM;AAAA,EACR;AACF;;;ACwFA,IAAM,oBAAoB;AAY1B,eAAsB,mBACpB,OACA,OACA,MACe;AACf,WAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,UAAM,EAAE,UAAU,SAAS,uBAAuB,IAAI,MAAM,qBAAqB,OAAO,OAAO,KAAK,SAAS;AAC7G,QAAI,uBAAuB,SAAS,GAAG;AAGrC;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,wBAAwB,OAAO,OAAO,KAAK,MAAM;AAExE,QACE,YACA,SAAS,SAAS,eAAe,QAAQ,cACzC,SAAS,SAAS,kBAAkB,QAAQ,eAC5C;AACA;AAAA,IACF;AAEA,UAAM,kBAAkB,UAAU,WAAW;AAC7C,QAAI;AACF,YAAM,oBAAoB,OAAO,OAAO,SAAS,iBAAiB,KAAK,MAAM;AAAA,IAC/E,SAAS,KAAK;AACZ,UAAI,eAAe,sBAAuB;AAC1C,YAAM;AAAA,IACR;AAEA,UAAM,mBAAmB,OAAO,OAAO,MAAM,SAAS,eAAe;AAUrE,UAAM,UAAU,MAAM,qBAAqB,OAAO,OAAO,KAAK,SAAS;AACvE,QAAI,QAAQ,uBAAuB,SAAS,EAAG;AAC/C,QAAI,QAAQ,SAAS,eAAe,QAAQ,cAAc,QAAQ,SAAS,kBAAkB,QAAQ,eAAe;AAClH;AAAA,IACF;AAAA,EACF;AAMA,UAAQ;AAAA,IACN,wDAAwD,iBAAiB;AAAA,EAE3E;AACF;AAEA,eAAe,mBACb,OACA,OACA,MACA,SACA,iBACe;AACf,QAAM,SAAS,KAAK,kBAAkB;AACtC,MAAI,CAAC,OAAQ;AAUb,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,qBAAqB,yBAAyB;AACtF,QAAM,OAAO,OAAO;AAAA,IAClB,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS,kBAAkB;AAAA,IAC3B,OAAO;AAAA,IACP,aAAa,MAAM,oBAAoB,QAAQ;AAAA,IAC/C,QAAQ,mCAAmC,QAAQ,UAAU;AAAA,EAC/D,CAAC;AACH;;;ACtMA,IAAM,yBAAyB;AAa/B,eAAsB,sBAAsB,MASX;AAC/B,QAAM,QAAQ,MAAM,sBAAsB,KAAK,SAAS;AAMxD,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AAEA,QAAI,UAAU,aAAa,QAAQ,KAAK,GAAG;AACzC,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,UAAU,QAAQ,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAC1F;AAQA,QAAI,WAA2B,EAAE,QAAQ,QAAQ;AACjD,UAAM,aAAa,KAAK,cAAc,CAAC;AACvC,QAAI;AACJ,QACE,UACA,OAAO,SAAS,MAAM,QACtB,cAAc,OAAO,UAAU,KAC/B,cAAc,MAAM,UAAU,GAC9B;AACA,cAAQ,mBAAmB,OAAO,YAAY,MAAM,YAAY,KAAK,cAAc;AACnF,UAAI,WAAW,SAAS,GAAG;AACzB,mBAAW,MAAM,mBAAmB,OAAO,YAAY,EAAE,YAAY,KAAK,eAAe,CAAC;AAAA,MAC5F;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,SAAS;AAG/B,aAAO,EAAE,SAAS,OAAO,SAAS,OAAO,UAAU,UAAU,OAAO,SAAS;AAAA,IAC/E;AAMA,QAAI,SAAkC;AACtC,QAAI,QAAQ,eAAe,OAAW,UAAS,EAAE,GAAG,QAAQ,YAAY,OAAO,WAAW;AAC1F,QAAI,QAAQ,cAAc,OAAW,UAAS,EAAE,GAAG,QAAQ,WAAW,OAAO,UAAU;AAOvF,UAAM,WAAW,gBAAgB,MAAM,YAAY,QAAQ,UAAU,OAAO,OAAO;AACnF,QAAI,aAAa,OAAW,UAAS,EAAE,GAAG,QAAQ,SAAS;AAC3D,UAAM,QAAQ,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK;AACpD,aAAS,EAAE,GAAG,QAAQ,YAAY,MAAM,qBAAqB;AAE7D,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,QAAQ,OAAO;AAChG,UAAI,OAAO,SAAS,MAAM;AAYxB,cAAM,aAAa,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK;AACzD,cAAM,UAAU,KAAK,OAAO,KAAK,OAAO,EAAE,GAAG,YAAY,YAAY,OAAO,KAAK,CAAC;AAAA,MACpF;AAKA,UAAI,KAAK,cAAc;AACrB,cAAM,mBAAmB,KAAK,OAAO,KAAK,OAAO,KAAK,YAAY;AAAA,MACpE;AACA,aAAO,EAAE,SAAS,MAAM,SAAS,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrE,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,wBAAwB,MAM5B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,eAAe,UAAa,aAAa,OAAO,YAAY,KAAK,MAAM,EAAG;AACtF,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,YAAY,KAAK,OAAO,IACrC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,YAAY,KAAK;AAAA,IACnB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASA,eAAsB,uBAAuB,MAM3B;AAIhB,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,EAAE,SAAS,SAAS,OAAO,IAAI,MAAM;AAAA,MACzC,KAAK;AAAA,MAAO,KAAK;AAAA,MAAO,KAAK;AAAA,MAAgB,KAAK;AAAA,IACpD;AACA,QAAI,QAAQ,cAAc,UAAa,sBAAsB,OAAO,WAAW,KAAK,MAAM,EAAG;AAC7F,UAAM,UACJ,WAAW,SACP,EAAE,GAAG,QAAQ,WAAW,KAAK,OAAO,IACpC;AAAA,MACE,eAAe;AAAA,MACf,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,WAAW,KAAK;AAAA,IAClB;AACN,QAAI;AACF,YAAM,oBAAoB,KAAK,OAAO,KAAK,OAAO,KAAK,gBAAgB,KAAK,KAAK,SAAS,OAAO;AACjG;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,UAAU,uBAAwB;AAC9D,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAaA,SAAS,sBAAsB,GAAkB,GAA2B;AAC1E,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,UAAU;AACnG;AAEA,SAAS,aAAa,GAAqB,GAA8B;AACvE,SAAO,QAAQ,EAAE,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,WAAW,EAAE,SAAS;AAChF;AAEA,SAAS,QAAQ,GAAsB,GAA+B;AACpE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,IAAI,IAAI,IAAI,CAAC;AACnB,SAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChC;AAEA,SAAS,cAAc,GAAyB;AAC9C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAChE;AAEA,SAAS,aAAa,GAA4B,GAAqC;AACrF,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO;AAE9B,MAAI,EAAE,QAAQ,EAAE,KAAM,QAAO,EAAE,SAAS,EAAE;AAE1C,MAAI,EAAE,SAAS,QAAQ,EAAE,SAAS,KAAM,QAAO;AAE/C,SAAO;AACT;","names":[]}

package/dist/{chunk-ALUVACKT.js → chunk-JIUVJ4M7.js}

@@ -5,7 +5,7 @@ import {
 import {
   FieldNotQueryableError,
   IndexRequiredError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
@@ -534,4 +534,4 @@ export {
   PersistedCollectionIndex,
   LazyQuery
 };
-//# sourceMappingURL=chunk-ALUVACKT.js.map
+//# sourceMappingURL=chunk-JIUVJ4M7.js.map

package/dist/{chunk-NJHQE4LT.js → chunk-JRCYZEHU.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-AR5D76T2.js";
+} from "./chunk-HNGSV2YC.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-NJHQE4LT.js.map
+//# sourceMappingURL=chunk-JRCYZEHU.js.map