@noy-db/hub 0.6.0-pre.0 → 0.6.0-pre.10

package/dist/{chunk-SRGJET2F.js → chunk-NJDQ4YSV.js}

@@ -1,6 +1,6 @@
 import {
   ViaGraph
-} from "./chunk-T4GPR2IR.js";
+} from "./chunk-7TSYBD3E.js";
 import {
   sha256Hex
 } from "./chunk-VCETL77O.js";
@@ -172,4 +172,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-SRGJET2F.js.map
+//# sourceMappingURL=chunk-NJDQ4YSV.js.map

package/dist/{chunk-JEM2IGS3.js → chunk-NPP5R7FF.js}

@@ -1,18 +1,18 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-JSRU5W2M.js";
+} from "./chunk-FZ6NYJ7L.js";
 import {
   resolveManagedSecret
-} from "./chunk-MC2LFTQM.js";
+} from "./chunk-XWX7GL56.js";
 import {
   createOwnerKeyring
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   wrapKey
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   PermissionDeniedError
 } from "./chunk-HNGSV2YC.js";
@@ -131,4 +131,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-JEM2IGS3.js.map
+//# sourceMappingURL=chunk-NPP5R7FF.js.map

package/dist/{chunk-DPJTDNUF.js → chunk-O2ERS4UJ.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-NVU7ZMPN.js";
+} from "./chunk-3IXIU6FP.js";
 import {
   assertStrongEchoSecret,
   assertStrongSecret,
@@ -9,13 +9,13 @@ import {
   mintKeyringCanary,
   persistKeyring,
   readKeyringFile
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   dekKey
 } from "./chunk-AHLJSVRL.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -30,7 +30,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   DelegationTargetMissingError,
   InvalidKeyError,
@@ -936,4 +936,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-DPJTDNUF.js.map
+//# sourceMappingURL=chunk-O2ERS4UJ.js.map

package/dist/{chunk-F3GVO44K.js → chunk-PDLLCOGD.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-HNHCQ556.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   NoydbError
 } from "./chunk-HNGSV2YC.js";
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-F3GVO44K.js.map
+//# sourceMappingURL=chunk-PDLLCOGD.js.map

package/dist/{chunk-VBY6ZLJT.js → chunk-PL2GHSCM.js}

@@ -9,7 +9,7 @@ import {
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -3070,4 +3070,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-VBY6ZLJT.js.map
+//# sourceMappingURL=chunk-PL2GHSCM.js.map

package/dist/{chunk-DCMQR46R.js → chunk-PNKHAKQ7.js}

@@ -1,7 +1,7 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-ZWMO5GL5.js";
+} from "./chunk-JJNOLSG5.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -10,7 +10,7 @@ import {
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   AttestationError
 } from "./chunk-HNGSV2YC.js";
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-DCMQR46R.js.map
+//# sourceMappingURL=chunk-PNKHAKQ7.js.map

package/dist/{chunk-MXZ5TSTR.js → chunk-PPMBY7YS.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-3CLZY46Y.js";
+} from "./chunk-N3BI6P3J.js";
 import {
   deriveSchemaManifest
-} from "./chunk-HS7HNYBD.js";
+} from "./chunk-2DHSSLOD.js";
 import {
   loadFence
-} from "./chunk-MVOWXQHN.js";
+} from "./chunk-6BU3L4UE.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-EK7DT5BT.js";
+} from "./chunk-4VUPLMZ6.js";
 import {
   loadKeyring
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -290,4 +290,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-MXZ5TSTR.js.map
+//# sourceMappingURL=chunk-PPMBY7YS.js.map

package/dist/{chunk-ZK4CO2KZ.js → chunk-Q6TEJXBX.js}

@@ -7,16 +7,16 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-24UICKTB.js";
+} from "./chunk-6SAFL5YE.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   LedgerContentionError,
   isConflictError
@@ -717,4 +717,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-ZK4CO2KZ.js.map
+//# sourceMappingURL=chunk-Q6TEJXBX.js.map

package/dist/{chunk-GS5RT2KK.js → chunk-QULVCV3M.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-UHXCLPGC.js";
 import {
   SealedHandle
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
@@ -262,4 +262,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-GS5RT2KK.js.map
+//# sourceMappingURL=chunk-QULVCV3M.js.map

package/dist/chunk-QULVCV3M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/descriptor.ts","../src/via/classified/errors.ts","../src/via/classified/resolve.ts","../src/via/classified/write.ts","../src/via/classified/guards.ts","../src/via/classified/binding.ts","../src/port/with/classified-strategy.ts"],"sourcesContent":["/**\n * Classified fields — behavioral sensitive-field descriptors (stage 1).\n * Design: design-history/2026-07-04-classified-fields-design.md\n * Law: open on write, declarative on read — read-side behavior is this\n * closed vocabulary; there are no read-side callbacks.\n * @module\n */\n\nexport type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only'\n\nexport type ClassifiedList =\n  | { readonly kind: 'omit' }\n  | { readonly kind: 'mask'; readonly pattern: string }\n  | { readonly kind: 'rider'; readonly rider: string }\n\nexport type ClassifiedRider = (value: unknown) => unknown\n\nexport interface ClassifiedFieldSpec {\n  readonly _noydbClassified: true\n  /**\n   * Via port brand marker — lets a `ClassifiedFieldSpec` satisfy the\n   * kernel's opaque `ViaDescriptor` (#629 Task 5). Optional (unlike\n   * `MoneyDescriptor._viaBrand`/`I18nTextDescriptor._viaBrand`, which are\n   * required): every `classified.*()` preset factory stamps it, but the\n   * pre-existing test suite's hand-rolled `ClassifiedFieldSpec` fixtures\n   * (built without going through a preset) predate this field and would\n   * fail to compile if it were mandatory.\n   */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  readonly storage: ClassifiedStorage\n  readonly list: ClassifiedList\n  readonly sensitivity: 'pii' | 'secret'\n  /** Write-time safe projections; companion field name is `<field>_<rider>`. */\n  readonly riders?: Record<string, ClassifiedRider>\n  /** Write-time validator: error message, or null when valid. */\n  readonly validate?: (value: unknown) => string | null\n  /** Digest-only verify policy (stage 2). Mode both sides normalize under. */\n  readonly verifyNormalize?: 'password' | 'secret-answer'\n  /** Decorate ok:true verdicts with mustRotate after this many days (I1). */\n  readonly rotateDays?: number\n  /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */\n  readonly notLastN?: number\n  /** Member of the collection's matchGroup (secretAnswer preset). */\n  readonly verifyGroupMember?: true\n  /**\n   * Opt into a store-visible blind-index (`_bidx`) tag so equal values become\n   * queryable/joinable while staying digest-only. Digest-only knob (R7); gated\n   * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values\n   * produce equal tags — a partition leak a DEK holder can offline-dictionary\n   * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.\n   */\n  readonly equatable?: true\n}\n\nexport interface ClassifiedGroup {\n  readonly _noydbClassifiedGroup: true\n  /** Via port brand marker — see {@link ClassifiedFieldSpec._viaBrand}. */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  /** member record-field name -> spec (differential per-member policy). */\n  readonly members: Record<string, ClassifiedFieldSpec>\n}\n\nexport type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup\n\nexport function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassified?: unknown })._noydbClassified === true\n}\n\nexport function isClassifiedGroup(x: unknown): x is ClassifiedGroup {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassifiedGroup?: unknown })._noydbClassifiedGroup === true\n}\n","/**\n * Configuration/write errors for classified fields. @module\n *\n * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`\n * (stage 2) so `kernel/enclave/classify/*` can throw them without importing\n * with-*. Re-exported here under the same names so existing import paths\n * keep working.\n */\nexport { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js'\n\nexport class ClassifiedNeverStoredError extends Error {\n  constructor(public readonly collection: string, public readonly field: string) {\n    super(`Field \"${field}\" in collection \"${collection}\" is classified storage:'never' `\n      + `(e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`)\n    this.name = 'ClassifiedNeverStoredError'\n  }\n}\n\nexport class ClassifiedValidationError extends Error {\n  constructor(public readonly collection: string, public readonly field: string, detail: string) {\n    super(`Classified field \"${field}\" in collection \"${collection}\" failed validation: ${detail}`)\n    this.name = 'ClassifiedValidationError'\n  }\n}\n","/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */\n\nimport { isClassifiedGroup, type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from './errors.js'\n\nexport type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js'\nexport { ClassifiedConfigError } from './errors.js'\n\nexport interface ResolvedClassified {\n  readonly byField: Record<string, ClassifiedFieldSpec>\n  readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>\n}\n\nexport function resolveClassifiedFields(\n  collection: string,\n  config: Record<string, ClassifiedEntry>,\n): ResolvedClassified {\n  const byField: Record<string, ClassifiedFieldSpec> = {}\n  const claim = (field: string, spec: ClassifiedFieldSpec): void => {\n    if (byField[field] !== undefined) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is claimed twice — storage forms are mutually exclusive per field (R5): ` +\n        `a field is digest-only OR recoverable OR never, exactly one`)\n    }\n    byField[field] = spec\n  }\n  for (const [key, entry] of Object.entries(config)) {\n    if (isClassifiedGroup(entry)) {\n      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec)\n    } else {\n      claim(key, entry)\n    }\n  }\n  const riderComputed: Record<string, (record: Record<string, unknown>) => unknown> = {}\n  for (const [field, spec] of Object.entries(byField)) {\n    for (const [name, rider] of Object.entries(spec.riders ?? {})) {\n      const companion = `${field}_${name}`\n      if (byField[companion] !== undefined || riderComputed[companion] !== undefined) {\n        throw new ClassifiedConfigError(collection, `rider companion \"${companion}\" collides with a declared field`)\n      }\n      riderComputed[companion] = (record) =>\n        record[field] === undefined ? undefined : rider(record[field])\n    }\n  }\n  return { byField, riderComputed }\n}\n","/** Write-path enforcement: storage:'never' rejection + preset validators.\n *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */\n\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNeverStoredError, ClassifiedValidationError } from './errors.js'\n\nexport function enforceClassifiedWrite(\n  record: Record<string, unknown>,\n  byField: Record<string, ClassifiedFieldSpec>,\n  collection: string,\n): void {\n  for (const [field, spec] of Object.entries(byField)) {\n    const value = record[field]\n    if (value === undefined) continue\n    if (value === null && spec.storage === 'digest-only') continue // explicit clear (C6 branch 3)\n    if (spec.storage === 'never') throw new ClassifiedNeverStoredError(collection, field)\n    const problem = spec.validate?.(value) ?? null\n    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem)\n  }\n}\n","/**\n * Refusal matrix R1-R5 (spec) — ONE guard, run at BOTH doors:\n * `collection()` config resolution AND `_applyClassifiedFields` (the reconcile\n * seam), because crdt/conflictPolicy/perRecordKeys are construction-only\n * while classifiedFields can attach later (C5's lesson). @module\n */\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from '../../kernel/errors.js'\n\nexport interface ClassifiedGuardCtx {\n  readonly perRecordKeys: boolean\n  readonly crdt: boolean\n  readonly hasConflictPolicy: boolean\n  /** False on plaintext (`encrypt: false`) collections — no vdig/seal path exists. */\n  readonly storeCiphertext: boolean\n  readonly deterministicFields: ReadonlySet<string> | null\n  readonly indexedFields: ReadonlySet<string>\n  readonly textIndexFields: ReadonlySet<string>\n  readonly vectorSourceFields: ReadonlySet<string>\n  readonly subjectKeyField: string | undefined\n  readonly bareSensitiveFields: ReadonlySet<string>\n  /** Collection-level gate for the `equatable` knob (R8 double door). */\n  readonly acknowledgeEquatableRisk: boolean\n}\n\nexport function guardClassifiedCompat(\n  collection: string,\n  byField: Record<string, ClassifiedFieldSpec>,\n  ctx: ClassifiedGuardCtx,\n): void {\n  const digestOnly = Object.entries(byField)\n    .filter(([, s]) => s.storage === 'digest-only')\n  const protectedForms = Object.values(byField)\n    .filter((s) => s.storage === 'digest-only' || s.storage === 'recoverable')\n\n  // R2 — merge resolvers bypass the write pipeline entirely (C5): a merge\n  // could carry stale/foreign _vdig or resurrect plaintext (the CRDT put\n  // branch persists via encryptJsonString with no vdig backstop). Fail-loud.\n  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {\n    throw new ClassifiedConfigError(collection,\n      'digest-only/recoverable classified fields cannot combine with a crdt mode or a ' +\n      'conflictPolicy resolver — merge paths bypass write enforcement (R2)')\n  }\n  // R7 — `equatable` is a digest-only knob: it drives the `_bidx` blind-index\n  // slot, which only exists on the digest-only write path. A recoverable/never\n  // field carrying it would silently no-op (recoverable equality is `_det`'s\n  // job). Refuse rather than accept-and-ignore. Checked over ALL specs, before\n  // the digest-only early-return below, precisely to catch the non-digest case.\n  for (const [f, spec] of Object.entries(byField)) {\n    if (spec.equatable === true && spec.storage !== 'digest-only') {\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" declares equatable but storage is '${spec.storage}' — equatable is a ` +\n        `digest-only knob; recoverable equality is _det's job (R7)`)\n    }\n  }\n\n  // R8 — the equatable double door (mirrors deterministicFields ×\n  // acknowledgeDeterministicRisk): any field opting into `equatable` requires\n  // the collection to acknowledge the partition-leak risk. One-directional —\n  // `acknowledgeEquatableRisk: true` with ZERO equatable members is a silent\n  // no-op (never throws here), so the ack can sit on a collection config\n  // ahead of the field landing.\n  const hasEquatable = Object.values(byField).some((s) => s.equatable === true)\n  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {\n    throw new ClassifiedConfigError(collection,\n      `classified equatable fields require \\`acknowledgeEquatableRisk: true\\` — equal values ` +\n      `produce equal store-visible index tags (a partition leak a DEK holder can offline-` +\n      `dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`)\n  }\n\n  if (digestOnly.length === 0) return\n\n  // Digest-only on a plaintext collection: the codec's vdig block is gated on\n  // storeCiphertext, so the secret would persist as raw plaintext. Refuse.\n  if (!ctx.storeCiphertext) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires an encrypted collection — with encrypt: false the ` +\n      `write path skips the digest slot entirely and the secret would persist as raw plaintext`)\n  }\n  // R1 — vdig slot keys are CEK-only (I3); without perRecordKeys a digest\n  // would survive forget() in backups as offline-crackable material.\n  if (!ctx.perRecordKeys) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires perRecordKeys: true — vdig keys derive from the ` +\n      `per-record CEK so forget() shreds them (R1)`)\n  }\n  for (const [f, spec] of digestOnly) {\n    // notLastN cap: presets clamp this at construction, but a raw spec object\n    // bypasses the preset — enforce the same 0..8 cap in the policy projection.\n    const n = spec.notLastN ?? 0\n    if (!Number.isInteger(n) || n < 0 || n > 8) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" declares notLastN ${n} — must be an integer 0..8 ` +\n        `(write cost is n × 600K PBKDF2; ring blast radius is documented)`)\n    }\n    if (ctx.bareSensitiveFields.has(f)) {\n      // R5 — the sealed block runs before the vdig block in the codec, so the\n      // overlap would seal the value recoverably (silent downgrade + I4\n      // double-slot). Storage forms are mutually exclusive per field.\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" is digest-only AND listed in sensitive[] — storage forms are mutually exclusive per field (R5)`)\n    }\n    if (ctx.deterministicFields?.has(f)) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be deterministic — equality-correlatable ciphertext defeats per-write salts (R3)`)\n    }\n    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f)\n      || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`)\n    }\n  }\n}\n","/**\n * The classified `ViaBinding` (#629 Task 5, LIVE since Task 6) — wires\n * classified-fields declaration/write-enforcement/at-rest sealing/erasure\n * into the kernel's generic Via port. Mirrors `via/money/binding.ts`'s\n * inline declaration-time validation and `via/i18n/binding.ts`'s\n * `linkXVia` static-link pattern — except the link itself is EAGER\n * (`port/with/classified-strategy.ts` calls `linkClassifiedVia()` at module\n * load, not lazily from a `classified.*()` preset call): several fixtures\n * build a raw `ClassifiedFieldSpec` literal without ever calling a preset,\n * and the binder must be installed before `compileViaBindings` needs it\n * regardless.\n *\n * `compileViaBindings` (`kernel/collection-config.ts`) compiles this binding\n * in whenever a collection declares `classifiedFields` — money then i18n\n * then classified, order pinned. `kernel/collection.ts`'s `_putInternal`\n * runs `enforceClassifiedWrite`'s effect via the pipeline's `enforceWrite`\n * phase; the codec's `encodeAtRest`/`decodeAtRest` hooks (Task 3's boundary)\n * replace the inline `sensitiveFields` seal path for any collection this\n * binding is compiled into.\n *\n * `declare` — `classifiedBinding(cfg)` runs `resolveClassifiedFields` +\n * `guardClassifiedCompat` at CONSTRUCTION time (the same #553 pattern\n * `moneyBinding`'s `validateMoneyFieldPaths(moneyFields)` call uses) —\n * mirrors today's \"door 1\" (`collection-config.ts`'s\n * `resolveCollectionConfig`). Both may throw `ClassifiedConfigError`.\n */\nimport type { ViaBinding, ViaWriteCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport { SealedHandle } from '../../kernel/types.js'\nimport { resolveClassifiedFields, type ClassifiedEntry } from './resolve.js'\nimport { guardClassifiedCompat, type ClassifiedGuardCtx } from './guards.js'\nimport { enforceClassifiedWrite } from './write.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\n/**\n * One classified per-slot shred/residue verdict — mirrors\n * `RecordCodec.SealedShredSlot` (`kernel/enclave/record-keys/record-codec.ts`)\n * byte-for-byte. Duplicated here (not imported) so this binding never\n * reaches into `kernel/enclave/` (`via-enclave-isolation`, #629) — the\n * closure that PRODUCES real values of this shape is codec-owned and\n * injected via {@link ClassifiedViaConfig.classifySealedShred}.\n */\nexport interface ClassifiedShredSlot {\n  readonly field: string\n  readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups'\n}\n\n/**\n * Config a classified collection's declarations resolve to — the binding's\n * construction input. `entries`/`guardCtx` are the raw \"door 1\" inputs\n * (`resolveClassifiedFields`/`guardClassifiedCompat`'s own parameters);\n * `classifySealedShred`/`purgeSealedCekEnvelopes` are OPTIONAL codec/vault-\n * provided closures for the `erase` hook — undefined in this dormant task\n * (no caller wires them yet), wired for real in #629 Task 10 (\"posture\n * enforcement — forget + erase hooks live\").\n */\nexport interface ClassifiedViaConfig {\n  readonly entries: Record<string, ClassifiedEntry>\n  readonly collectionName: string\n  readonly guardCtx: ClassifiedGuardCtx\n  /**\n   * Codec-provided closure mirroring `RecordCodec.classifySealedShred` —\n   * classifies a live envelope's `_sealed` slots for crypto-shred\n   * completeness (see that method's doc comment for the shreddable/\n   * dekResidue/both-class semantics). `live` is `ViaEraseCtx.live`'s opaque\n   * envelope, passed straight through. NOT `readonly` (#629 Task 10):\n   * `compileViaBindings` builds this cfg before the owning `Collection`'s\n   * `RecordCodec` exists, so `Collection`'s constructor mutates this field\n   * in place once `this.codec` is available — the closure `eraseClassified`\n   * reads is looked up at CALL time, not at binding-construction time, so\n   * the late assignment is picked up correctly.\n   */\n  classifySealedShred?: (live: unknown) => Promise<{ readonly slots: readonly ClassifiedShredSlot[] }>\n  /**\n   * Vault-provided closure that purges every `_sealed_cek/<collection>/<id>/*`\n   * host-delivery envelope for one record (mirrors `rotateRecordCek`'s own\n   * prefix-delete) and returns the count purged. Deliberately left UNWIRED\n   * by `compileViaBindings` (#629 Task 10) — `forget-sealed-erasure.test.ts`\n   * proves this purge is UNCONDITIONAL on `sealRecordToHost` usage alone,\n   * independent of whether `classifiedFields` is declared (a bare\n   * `sensitive: [...]` collection exercises it with no classified binding\n   * at all) — vault.ts keeps owning it directly so that case stays correct.\n   */\n  readonly purgeSealedCekEnvelopes?: (id: string) => Promise<number>\n}\n\n/** Fields declared `storage: 'recoverable'` (digest-only stays codec-inline; `'never'` is rejected by `enforceWrite` before either hook runs). */\nfunction recoverableFields(byField: Record<string, ClassifiedFieldSpec>): string[] {\n  return Object.entries(byField).filter(([, spec]) => spec.storage === 'recoverable').map(([field]) => field)\n}\n\n/**\n * The full set this binding's `encodeAtRest`/`decodeAtRest` seal: declared\n * recoverable classified fields UNION bare `sensitive[]` fields — mirrors\n * `collection-config.ts`'s pre-cutover \"recoverable classified fields are\n * unioned into sensitiveFields... zero new crypto code\" semantics. Once this\n * binding is compiled into a collection's pipeline, `hasAtRestHooks` is true\n * and the codec's inline `sensitiveFields` seal path (record-codec.ts) is\n * DEAD for that collection — mutually exclusive with the hook path (#629\n * Task 3) — so bare `sensitive[]` fields MUST seal through here too, or\n * they'd silently stop being sealed at all (#629 Task 6 reconciliation).\n * `guardCtx.bareSensitiveFields` is the exact same `Set` the collection's\n * refusal-matrix guard already carries (`ClassifiedGuardCtx`).\n */\nfunction sealFieldNames(byField: Record<string, ClassifiedFieldSpec>, guardCtx: ClassifiedGuardCtx): string[] {\n  return [...recoverableFields(byField), ...guardCtx.bareSensitiveFields]\n}\n\n/**\n * Seal every named field present with a defined value into its own sealed\n * slot via `crypto.sealedSlots`, peeling it out of the record.\n */\nasync function encodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  crypto: ViaCryptoCtx,\n  fields: readonly string[],\n): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }> {\n  let open = record\n  let sealed: Record<string, SealedSlotRef> | undefined\n  for (const field of fields) {\n    if (!(field in record)) continue\n    const value = record[field]\n    if (value === undefined) continue\n    const ref = await crypto.sealedSlots.seal(field, value)\n    if (open === record) open = { ...record }\n    delete open[field]\n    sealed ??= {}\n    sealed[field] = ref\n  }\n  return sealed ? { record: open, sealed } : { record }\n}\n\n/**\n * Restore every named field's sealed slot back onto the record: an opaque\n * `SealedHandle` under `asHandles` (never materialises plaintext into the\n * cache — `SealedHandle.toJSON()` returns `'[sealed]'`, the export-redaction\n * guarantee `reveal()` alone can lift), the plaintext value otherwise.\n */\nasync function decodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  sealed: Record<string, SealedSlotRef>,\n  crypto: ViaCryptoCtx,\n  opts: { asHandles: boolean },\n  fields: readonly string[],\n): Promise<Record<string, unknown>> {\n  let out = record\n  for (const field of fields) {\n    const ref = sealed[field]\n    if (ref === undefined) continue\n    if (out === record) out = { ...record }\n    out[field] = opts.asHandles\n      ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref))\n      : await crypto.sealedSlots.unseal(field, ref)\n  }\n  return out\n}\n\n/**\n * `forget()`'s per-ref erasure participation: classify the live envelope's\n * sealed slots (via the codec-provided closure) and mark each shreddable\n * one deleted on this call's sealed-slots capability, then purge the\n * record's sealed-CEK host-delivery envelopes (via the vault-provided\n * closure). Both closures are optional — undefined (this dormant task's\n * only caller, its own unit tests) reports a zero-shredded, zero-residue\n * no-op rather than throwing.\n */\nasync function eraseClassified(\n  ctx: ViaEraseCtx,\n  cfg: ClassifiedViaConfig,\n): Promise<ViaEraseReport> {\n  let shredded = 0\n  const residue: unknown[] = []\n\n  if (cfg.classifySealedShred) {\n    const { slots } = await cfg.classifySealedShred(ctx.live)\n    for (const slot of slots) {\n      if (slot.class === 'shreddable' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        shredded += 1\n        await ctx.crypto.sealedSlots.delete(slot.field)\n      }\n      if (slot.class === 'dekResidue' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        residue.push({ kind: 'classified-sealed-dek-residue', field: slot.field })\n      }\n    }\n  }\n\n  if (cfg.purgeSealedCekEnvelopes) {\n    shredded += await cfg.purgeSealedCekEnvelopes(ctx.id)\n  }\n\n  return { shredded, residue }\n}\n\nfunction buildClassifiedDescribeFragment(byField: Record<string, ClassifiedFieldSpec>): Record<string, unknown> {\n  return {\n    classifiedFields: Object.fromEntries(\n      Object.entries(byField).map(([field, spec]) => [field, { storage: spec.storage, sensitivity: spec.sensitivity }]),\n    ),\n  }\n}\n\nexport function classifiedBinding(cfg: ClassifiedViaConfig): ViaBinding {\n  // declare — door 1: resolve + guard, exactly like collection-config.ts's\n  // resolveCollectionConfig does today. Throws ClassifiedConfigError on any\n  // R1-R8 refusal-matrix violation or field-collision.\n  const resolved = resolveClassifiedFields(cfg.collectionName, cfg.entries)\n  guardClassifiedCompat(cfg.collectionName, resolved.byField, cfg.guardCtx)\n  const byField = resolved.byField\n  const sealFields = sealFieldNames(byField, cfg.guardCtx)\n\n  return {\n    brand: 'classified',\n    posture: { encryptedAtRest: 'sealed', queryable: 'det-exact', exportable: false, forgettable: true },\n    covers: (field) => field in byField,\n    // async (rather than a bare passthrough) so a refusal is always a\n    // rejected Promise for direct callers, matching every other async-stack\n    // hook's calling convention — `enforceClassifiedWrite` itself stays sync.\n    enforceWrite: async (record: Record<string, unknown>, _ctx: ViaWriteCtx) =>\n      enforceClassifiedWrite(record, byField, cfg.collectionName),\n    encodeAtRest: (record, crypto) => encodeClassifiedAtRest(record, crypto, sealFields),\n    decodeAtRest: (record, sealed, crypto, opts) => decodeClassifiedAtRest(record, sealed, crypto, opts, sealFields),\n    erase: (ctx) => eraseClassified(ctx, cfg),\n    describeFragment: () => buildClassifiedDescribeFragment(byField),\n  }\n}\n\nexport function linkClassifiedVia(): void {\n  installViaBinder('classified', (c) => classifiedBinding(c as ClassifiedViaConfig))\n}\n","/**\n * Classified strategy seam (#629 Task 5 — moved out of\n * `via/classified/strategy.ts`, precedent: `port/with/i18n-strategy.ts`).\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`Vault` can hold the `NO_CLASSIFIED` default\n * without a spine→service static import.\n *\n * This file (unlike `via/classified/**`) is NOT subject to the\n * `via-enclave-isolation` architecture guard — it may import `EnclaveKey`\n * from the enclave barrel freely, the same way `port/with/i18n-strategy.ts`\n * did before #629 Task 4's DictionaryHandle cutover.\n *\n * The ② capability seam for classified read-egress ops (stage 1: reveal;\n * stage 2: verify).\n *\n * @internal\n */\nimport type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js'\nimport { ClassifiedNotEnabledError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { linkClassifiedVia } from '../../via/classified/binding.js'\n\n// #629 Task 10 — re-export the classified binding's erase-cfg TYPE (not\n// `via/classified/binding.js` directly) so the kernel spine can name\n// it for the post-construction `classifySealedShred` wiring, same rationale\n// as `resolveClassifiedFields`/`guardClassifiedCompat` above.\nexport type { ClassifiedViaConfig } from '../../via/classified/binding.js'\n\nexport type { ClassifiedVerdict } from '../../kernel/types.js'\nimport type { ClassifiedVerdict } from '../../kernel/types.js'\n\n// #629 Task 6 — the classified binding's construction-time resolve/guard,\n// re-exported here (not `via/classified/{resolve,guards}.js` directly)\n// so the kernel spine keeps importing only this one `/with` port seam, same\n// rationale as `NO_CLASSIFIED` below.\nexport { resolveClassifiedFields, type ClassifiedEntry, type ResolvedClassified } from '../../via/classified/resolve.js'\nexport { guardClassifiedCompat, type ClassifiedGuardCtx } from '../../via/classified/guards.js'\nexport type { ClassifiedFieldSpec }\n\n// Install the classified Via binder EAGERLY — unlike money()/i18nText(),\n// several classified fixtures (both hub tests and consumer code) build a raw\n// `ClassifiedFieldSpec` object literal without ever calling a\n// `classified.*()` preset (bypassing `via/classified/presets.ts`\n// entirely — an intentionally supported pattern, see that module's Task 5\n// doc comment). Linking lazily at preset-call time (the money/i18n pattern)\n// would leave `viaBinder('classified')` unlinked for those declarations.\n// This port module is already unconditionally imported by the kernel spine\n// (for the `NO_CLASSIFIED` strategy default below), so linking here\n// guarantees the binder is always installed before `compileViaBindings`\n// ever needs it, regardless of how a collection's classifiedFields were\n// constructed.\nlinkClassifiedVia()\n\nexport interface ClassifiedRevealCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  /** True on an encrypted collection — false selects the plaintext-body read. */\n  readonly encrypted: boolean\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedVerifyCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>       // raw envelope, NOT a decrypted view\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly now: () => number                                        // injected (Q7)\n  /** Group members resolved by the collection (matchGroup only). */\n  readonly groupMembers?: ReadonlyArray<{ readonly field: string; readonly spec: ClassifiedFieldSpec }>\n  readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedStrategy {\n  reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>\n  verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>,\n             opts: { readonly min: number }): Promise<{ readonly passed: boolean }>\n  computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>\n}\n\nexport const NO_CLASSIFIED: ClassifiedStrategy = {\n  async reveal() { throw new ClassifiedNotEnabledError() },\n  async verify() { throw new ClassifiedNotEnabledError() },\n  async verifyText() { throw new ClassifiedNotEnabledError() },\n  async matchGroup() { throw new ClassifiedNotEnabledError() },\n  async computeTarget() { throw new ClassifiedNotEnabledError() },\n}\n"],"mappings":";;;;;;;;;;;;AAkEO,SAAS,sBAAsB,GAAsC;AAC1E,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAAqC,qBAAqB;AAClE;AAEO,SAAS,kBAAkB,GAAkC;AAClE,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAA0C,0BAA0B;AAC5E;;;AChEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,OAAe;AAC7E,UAAM,UAAU,KAAK,oBAAoB,UAAU,0HAC2C;AAFpE;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAA4B,YAAoC,OAAe,QAAgB;AAC7F,UAAM,qBAAqB,KAAK,oBAAoB,UAAU,wBAAwB,MAAM,EAAE;AADpE;AAAoC;AAE9D,SAAK,OAAO;AAAA,EACd;AAAA,EAH4B;AAAA,EAAoC;AAIlE;;;ACVO,SAAS,wBACd,YACA,QACoB;AACpB,QAAM,UAA+C,CAAC;AACtD,QAAM,QAAQ,CAAC,OAAe,SAAoC;AAChE,QAAI,QAAQ,KAAK,MAAM,QAAW;AAChC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAC8C;AAAA,IACjE;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,kBAAkB,KAAK,GAAG;AAC5B,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9E,OAAO;AACL,YAAM,KAAK,KAAK;AAAA,IAClB;AAAA,EACF;AACA,QAAM,gBAA8E,CAAC;AACrF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;AAC7D,YAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,UAAI,QAAQ,SAAS,MAAM,UAAa,cAAc,SAAS,MAAM,QAAW;AAC9E,cAAM,IAAI,sBAAsB,YAAY,oBAAoB,SAAS,kCAAkC;AAAA,MAC7G;AACA,oBAAc,SAAS,IAAI,CAAC,WAC1B,OAAO,KAAK,MAAM,SAAY,SAAY,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACA,SAAO,EAAE,SAAS,cAAc;AAClC;;;ACvCO,SAAS,uBACd,QACA,SACA,YACM;AACN,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,UAAU,QAAQ,KAAK,YAAY,cAAe;AACtD,QAAI,KAAK,YAAY,QAAS,OAAM,IAAI,2BAA2B,YAAY,KAAK;AACpF,UAAM,UAAU,KAAK,WAAW,KAAK,KAAK;AAC1C,QAAI,YAAY,KAAM,OAAM,IAAI,0BAA0B,YAAY,OAAO,OAAO;AAAA,EACtF;AACF;;;ACMO,SAAS,sBACd,YACA,SACA,KACM;AACN,QAAM,aAAa,OAAO,QAAQ,OAAO,EACtC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,aAAa;AAChD,QAAM,iBAAiB,OAAO,OAAO,OAAO,EACzC,OAAO,CAAC,MAAM,EAAE,YAAY,iBAAiB,EAAE,YAAY,aAAa;AAK3E,MAAI,eAAe,SAAS,MAAM,IAAI,QAAQ,IAAI,oBAAoB;AACpE,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACqE;AAAA,EACzE;AAMA,aAAW,CAAC,GAAG,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,QAAI,KAAK,cAAc,QAAQ,KAAK,YAAY,eAAe;AAC7D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC,wCAAwC,KAAK,OAAO;AAAA,MACJ;AAAA,IAC/D;AAAA,EACF;AAQA,QAAM,eAAe,OAAO,OAAO,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,IAAI;AAC5E,MAAI,gBAAgB,IAAI,6BAA6B,MAAM;AACzD,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAE2F;AAAA,EAC/F;AAEA,MAAI,WAAW,WAAW,EAAG;AAI7B,MAAI,CAAC,IAAI,iBAAiB;AACxB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACyF;AAAA,EAC7F;AAGA,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAC6C;AAAA,EACjD;AACA,aAAW,CAAC,GAAG,IAAI,KAAK,YAAY;AAGlC,UAAM,IAAI,KAAK,YAAY;AAC3B,QAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG;AAC1C,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC,uBAAuB,CAAC;AAAA,MACmB;AAAA,IACtE;AACA,QAAI,IAAI,oBAAoB,IAAI,CAAC,GAAG;AAIlC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC;AAAA,MAAkG;AAAA,IACjH;AACA,QAAI,IAAI,qBAAqB,IAAI,CAAC,GAAG;AACnC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2F;AAAA,IACtH;AACA,QAAI,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,gBAAgB,IAAI,CAAC,KACpD,IAAI,mBAAmB,IAAI,CAAC,KAAK,IAAI,oBAAoB,GAAG;AAC/D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2E;AAAA,IACtG;AAAA,EACF;AACF;;;ACzBA,SAAS,kBAAkB,SAAwD;AACjF,SAAO,OAAO,QAAQ,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAC5G;AAeA,SAAS,eAAe,SAA8C,UAAwC;AAC5G,SAAO,CAAC,GAAG,kBAAkB,OAAO,GAAG,GAAG,SAAS,mBAAmB;AACxE;AAMA,eAAe,uBACb,QACA,QACA,QACsF;AACtF,MAAI,OAAO;AACX,MAAI;AACJ,aAAW,SAAS,QAAQ;AAC1B,QAAI,EAAE,SAAS,QAAS;AACxB,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,UAAM,MAAM,MAAM,OAAO,YAAY,KAAK,OAAO,KAAK;AACtD,QAAI,SAAS,OAAQ,QAAO,EAAE,GAAG,OAAO;AACxC,WAAO,KAAK,KAAK;AACjB,eAAW,CAAC;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,SAAO,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,EAAE,OAAO;AACtD;AAQA,eAAe,uBACb,QACA,QACA,QACA,MACA,QACkC;AAClC,MAAI,MAAM;AACV,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,QAAQ,OAAW;AACvB,QAAI,QAAQ,OAAQ,OAAM,EAAE,GAAG,OAAO;AACtC,QAAI,KAAK,IAAI,KAAK,YACd,IAAI,aAAa,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG,CAAC,IAC5D,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG;AAAA,EAChD;AACA,SAAO;AACT;AAWA,eAAe,gBACb,KACA,KACyB;AACzB,MAAI,WAAW;AACf,QAAM,UAAqB,CAAC;AAE5B,MAAI,IAAI,qBAAqB;AAC3B,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI,oBAAoB,IAAI,IAAI;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,oBAAY;AACZ,cAAM,IAAI,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA,MAChD;AACA,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,gBAAQ,KAAK,EAAE,MAAM,iCAAiC,OAAO,KAAK,MAAM,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,yBAAyB;AAC/B,gBAAY,MAAM,IAAI,wBAAwB,IAAI,EAAE;AAAA,EACtD;AAEA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,gCAAgC,SAAuE;AAC9G,SAAO;AAAA,IACL,kBAAkB,OAAO;AAAA,MACvB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,YAAY,CAAC,CAAC;AAAA,IAClH;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,KAAsC;AAItE,QAAM,WAAW,wBAAwB,IAAI,gBAAgB,IAAI,OAAO;AACxE,wBAAsB,IAAI,gBAAgB,SAAS,SAAS,IAAI,QAAQ;AACxE,QAAM,UAAU,SAAS;AACzB,QAAM,aAAa,eAAe,SAAS,IAAI,QAAQ;AAEvD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,UAAU,WAAW,aAAa,YAAY,OAAO,aAAa,KAAK;AAAA,IACnG,QAAQ,CAAC,UAAU,SAAS;AAAA;AAAA;AAAA;AAAA,IAI5B,cAAc,OAAO,QAAiC,SACpD,uBAAuB,QAAQ,SAAS,IAAI,cAAc;AAAA,IAC5D,cAAc,CAAC,QAAQ,WAAW,uBAAuB,QAAQ,QAAQ,UAAU;AAAA,IACnF,cAAc,CAAC,QAAQ,QAAQ,QAAQ,SAAS,uBAAuB,QAAQ,QAAQ,QAAQ,MAAM,UAAU;AAAA,IAC/G,OAAO,CAAC,QAAQ,gBAAgB,KAAK,GAAG;AAAA,IACxC,kBAAkB,MAAM,gCAAgC,OAAO;AAAA,EACjE;AACF;AAEO,SAAS,oBAA0B;AACxC,mBAAiB,cAAc,CAAC,MAAM,kBAAkB,CAAwB,CAAC;AACnF;;;AChLA,kBAAkB;AAkCX,IAAM,gBAAoC;AAAA,EAC/C,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,gBAAgB;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAChE;","names":[]}

package/dist/{chunk-KZ3KMDN3.js → chunk-RTAMLDWP.js}

@@ -21,7 +21,7 @@ function recordId(record) {
   return typeof id === "string" ? id : "";
 }
 function immutableGuard(config) {
-  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config;
+  const { collection, name, after, appendOnly, amendmentRoles, amendmentInvariant } = config;
   if (appendOnly && after !== void 0) {
     throw new ValidationError("immutableGuard: `after` and `appendOnly` are mutually exclusive");
   }
@@ -32,6 +32,10 @@ function immutableGuard(config) {
   const reason = appendOnly ? "append-only collection" : "record is immutable after issue";
   const spec = {
     collection,
+    // Pass-through only — omitting the key entirely (rather than setting
+    // it to `undefined`) keeps the positional-fallback path in
+    // `buildGuardEntries` reachable for callers who don't name a guard.
+    ...name !== void 0 ? { name } : {},
     // Block updates to an already-immutable record. Inserts (existing
     // null) and the transition write that first makes the record
     // immutable are allowed — `after` reads the prior state.
@@ -120,4 +124,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-KZ3KMDN3.js.map
+//# sourceMappingURL=chunk-RTAMLDWP.js.map

package/dist/chunk-RTAMLDWP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/guards/with-guard.ts","../src/with-audit/guards/immutable-guard.ts","../src/with-audit/guards/transition-guard.ts"],"sourcesContent":["import { ValidationError } from '../../kernel/errors.js'\nimport type { GuardSpec, GuardStrategy } from './types.js'\n\n/**\n * Register a guard for a collection. Guards run on every `put()` /\n * `delete()` for the named collection (after permissions, before\n * encryption) and may:\n *\n *   - `check` — block writes by throwing (typically `RecordLockedError`)\n *   - `frozenFields` — freeze specific fields once a condition is true\n *   - `amendment` — declare an authorized-override path with invariant\n *\n * Pass the returned handle to `createNoydb({ strategies: [...] })`.\n *\n * @see design-history/2026-05-18-guards-design.md\n */\nexport function withGuard<T extends Record<string, unknown>>(\n  strategy: GuardSpec<T>,\n): GuardStrategy<T> {\n  if (!strategy.collection || strategy.collection.length === 0) {\n    throw new ValidationError('withGuard: collection name is required')\n  }\n  return {\n    __noydb_strategy: 'guard',\n    spec: strategy,\n  }\n}\n","/**\n * `immutableGuard` — declarative WORM / append-only sugar over the guard\n * service.\n *\n * Issued fiscal documents (invoices, DDTs) must be immutable after issue.\n * That is expressible today with a hand-rolled `withGuard` (block on\n * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is\n * repetitive and easy to get subtly wrong. `immutableGuard` generates\n * exactly that guard from a declarative config, reusing the guard\n * machinery wholesale — `check`/`onDelete` rejection, the ledgered\n * `amendment` override, and composition with `periods`/`history`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   immutableGuard({\n *     collection: 'invoices',\n *     after: (r) => r.status === 'issued',   // immutable once issued\n *   }),\n * ] })\n * ```\n *\n * A record is mutable until `after(record)` holds; from then on, updates\n * and deletes throw `RecordLockedError` unless performed inside an\n * `amendment` transaction by an authorized role (the override is\n * ledgered by the guard amendment mechanism). `appendOnly: true` is\n * shorthand for `after: () => true` — immutable from creation.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { RecordLockedError, ValidationError } from '../../kernel/errors.js'\n\nexport interface ImmutableGuardConfig<T extends Record<string, unknown>> {\n  /** The collection to make WORM. */\n  collection: string\n  /**\n   * Optional stable per-vault identifier, forwarded verbatim to the\n   * underlying {@link GuardSpec.name} — `immutableGuard` is a wrapper\n   * around `withGuard` and grants the same identity affordance (#1006).\n   *\n   * Omit and `vault.listBehaviors()` falls back to a POSITIONAL\n   * `${collection}#${occurrence}` key, which renumbers when another\n   * guard on the same collection is registered ahead of this one. Pass\n   * a name whenever something joins to the behavior manifest by key —\n   * a generated rulebook, a diff between two vault versions, an audit\n   * report — so the identifier tracks the rule rather than its\n   * registration order.\n   */\n  readonly name?: string\n  /**\n   * A record becomes immutable once this predicate holds. Evaluated on\n   * the *existing* (already-persisted) record, so the write that first\n   * makes it true is still allowed; subsequent writes are blocked.\n   * Mutually exclusive with `appendOnly`.\n   */\n  after?: (record: T) => boolean\n  /** Shorthand for `after: () => true` — immutable from creation. */\n  appendOnly?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly: it receives every {before, after} pair touching this\n   * collection in the amendment plus the guard context; throwing reverts\n   * the whole amendment and surfaces as `InvariantError`.\n   *\n   * Use this to keep a constraint inviolable EVEN under amendment — e.g.\n   * forbid deleting an issued document by re-throwing on any\n   * `before !== null && after === null` change, or assert a cross-record\n   * sum is preserved. When omitted the amendment is unconditionally\n   * allowed (the amendment itself is the sanctioned, ledgered override) —\n   * this is the backward-compatible default.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\n/**\n * Build an immutability guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function immutableGuard<T extends Record<string, unknown>>(\n  config: ImmutableGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, name, after, appendOnly, amendmentRoles, amendmentInvariant } = config\n  if (appendOnly && after !== undefined) {\n    throw new ValidationError('immutableGuard: `after` and `appendOnly` are mutually exclusive')\n  }\n  if (!appendOnly && after === undefined) {\n    throw new ValidationError('immutableGuard: provide `after` or `appendOnly: true`')\n  }\n\n  const isImmutable: (record: T) => boolean = appendOnly ? () => true : after!\n  const reason = appendOnly ? 'append-only collection' : 'record is immutable after issue'\n\n  const spec: GuardSpec<T> = {\n    collection,\n    // Pass-through only — omitting the key entirely (rather than setting\n    // it to `undefined`) keeps the positional-fallback path in\n    // `buildGuardEntries` reachable for callers who don't name a guard.\n    ...(name !== undefined ? { name } : {}),\n    // Block updates to an already-immutable record. Inserts (existing\n    // null) and the transition write that first makes the record\n    // immutable are allowed — `after` reads the prior state.\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      if (ctx.existing !== null && isImmutable(ctx.existing)) {\n        throw new RecordLockedError(collection, recordId(incoming as Record<string, unknown>), reason)\n      }\n    },\n    // Block deletes of an immutable record.\n    onDelete: (existing: T) => {\n      if (isImmutable(existing)) {\n        throw new RecordLockedError(collection, recordId(existing as Record<string, unknown>), reason)\n      }\n    },\n    // The authorized override: inside an amendment transaction the\n    // check/onDelete are skipped and the change is ledgered. By default\n    // there is no extra invariant — the amendment itself is the\n    // sanctioned exception. Callers may supply `amendmentInvariant` to\n    // keep a constraint inviolable even under amendment (e.g. forbid\n    // deletes, or preserve a cross-record sum); a throw reverts the\n    // amendment and surfaces as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n","/**\n * `transitionGuard` — declarative state-machine sugar over the guard\n * service.\n *\n * Any record with a lifecycle field (invoice `status`, order state,\n * ticket workflow, subscription phase) needs transition validation: a\n * write may only move the field along a declared arc. That is expressible\n * with a hand-rolled `withGuard({ check })`, but every consumer\n * re-implements the same graph lookup + error. `transitionGuard`\n * generates exactly that guard from a state graph, reusing the guard\n * machinery wholesale — `check` rejection, the ledgered `amendment`\n * override, and composition with `periods`/`history`.\n *\n * It generalizes {@link immutableGuard}: WORM is the special case \"every\n * state has no outgoing arcs\", i.e. `transitions` mapping each state to `[]`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   transitionGuard<Sale>({\n *     collection: 'sales', field: 'status',\n *     transitions: {                          // absence of an arc = forbidden\n *       draft: ['to_verify', 'cancelled'],\n *       to_verify: ['proforma', 'draft', 'cancelled'],\n *       proforma: ['invoiced', 'cancelled'],\n *       invoiced: ['paid'], paid: [], cancelled: [],\n *     },\n *     initial: ['draft', 'to_verify'],        // allowed status on insert\n *   }),\n * ] })\n * ```\n *\n * Semantics:\n * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in\n *   `initial`. When `initial` is omitted, any value is allowed on insert.\n * - **Update**: the arc `(existing[field] → incoming[field])` must be\n *   listed in `transitions[from]`, else `IllegalTransitionError`. A\n *   same-value write (`from === to`) is allowed when `allowIdempotent`\n *   (default `true`) — so writes that touch other fields without moving\n *   state pass.\n * - **Override**: inside an `amendment` transaction by an authorized role\n *   the check is skipped and the change is ledgered (mirrors every guard).\n *\n * The status graph is caller-supplied data — no UI, no domain logic.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { IllegalTransitionError, ValidationError } from '../../kernel/errors.js'\n\nexport interface TransitionGuardConfig<T extends Record<string, unknown>> {\n  /** The collection whose state field is governed. */\n  collection: string\n  /** The state field on the record (e.g. `'status'`). */\n  field: keyof T & string\n  /**\n   * The transition graph: each state maps to the states it may move to.\n   * A state absent from the map (or mapped to `[]`) is terminal — no\n   * outgoing arc, so any non-idempotent write from it is rejected.\n   */\n  transitions: Readonly<Record<string, readonly string[]>>\n  /**\n   * States allowed as the initial value on insert (`existing === null`).\n   * Omit to allow any value on insert.\n   */\n  initial?: readonly string[]\n  /**\n   * Allow a same-value write (`from === to`) on update. Default `true` —\n   * lets a put that changes other fields, but not the state, through.\n   */\n  allowIdempotent?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly. When omitted the amendment is unconditionally allowed (the\n   * amendment itself is the sanctioned, ledgered override) — the\n   * backward-compatible default. Mirrors {@link immutableGuard}.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\nfunction stateOf(record: Record<string, unknown>, field: string): string {\n  const v = record[field]\n  return typeof v === 'string' ? v : String(v)\n}\n\n/**\n * Build a state-machine transition guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function transitionGuard<T extends Record<string, unknown>>(\n  config: TransitionGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config\n  const allowIdempotent = config.allowIdempotent ?? true\n\n  if (!field) {\n    throw new ValidationError('transitionGuard: `field` is required')\n  }\n  if (transitions === undefined || typeof transitions !== 'object') {\n    throw new ValidationError('transitionGuard: `transitions` must be a state→states map')\n  }\n\n  const spec: GuardSpec<T> = {\n    collection,\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      const rec = incoming as Record<string, unknown>\n      const to = stateOf(rec, field)\n\n      // Insert — gate on the allowed initial set (any value if unset).\n      if (ctx.existing === null) {\n        if (initial !== undefined && !initial.includes(to)) {\n          throw new IllegalTransitionError(collection, recordId(rec), '(none)', to)\n        }\n        return\n      }\n\n      // Update — the arc (from → to) must be a declared edge.\n      const from = stateOf(ctx.existing as Record<string, unknown>, field)\n      if (from === to) {\n        if (allowIdempotent) return\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n      const allowed = transitions[from] ?? []\n      if (!allowed.includes(to)) {\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n    },\n    // The authorized override: inside an amendment transaction the check\n    // is skipped and the change is ledgered. By default no extra invariant\n    // — the amendment itself is the sanctioned exception. Callers may\n    // supply `amendmentInvariant` to keep a constraint inviolable even\n    // under amendment; a throw reverts the amendment as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n"],"mappings":";;;;;;;AAgBO,SAAS,UACd,UACkB;AAClB,MAAI,CAAC,SAAS,cAAc,SAAS,WAAW,WAAW,GAAG;AAC5D,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,MAAM;AAAA,EACR;AACF;;;ACsDA,SAAS,SAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAMO,SAAS,eACd,QACkB;AAClB,QAAM,EAAE,YAAY,MAAM,OAAO,YAAY,gBAAgB,mBAAmB,IAAI;AACpF,MAAI,cAAc,UAAU,QAAW;AACrC,UAAM,IAAI,gBAAgB,iEAAiE;AAAA,EAC7F;AACA,MAAI,CAAC,cAAc,UAAU,QAAW;AACtC,UAAM,IAAI,gBAAgB,uDAAuD;AAAA,EACnF;AAEA,QAAM,cAAsC,aAAa,MAAM,OAAO;AACtE,QAAM,SAAS,aAAa,2BAA2B;AAEvD,QAAM,OAAqB;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIrC,OAAO,CAAC,UAAa,QAAyB;AAC5C,UAAI,IAAI,aAAa,QAAQ,YAAY,IAAI,QAAQ,GAAG;AACtD,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA,IAEA,UAAU,CAAC,aAAgB;AACzB,UAAI,YAAY,QAAQ,GAAG;AACzB,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;;;ACtDA,SAASA,UAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEA,SAAS,QAAQ,QAAiC,OAAuB;AACvE,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AAC7C;AAMO,SAAS,gBACd,QACkB;AAClB,QAAM,EAAE,YAAY,OAAO,aAAa,SAAS,gBAAgB,mBAAmB,IAAI;AACxF,QAAM,kBAAkB,OAAO,mBAAmB;AAElD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EAClE;AACA,MAAI,gBAAgB,UAAa,OAAO,gBAAgB,UAAU;AAChE,UAAM,IAAI,gBAAgB,gEAA2D;AAAA,EACvF;AAEA,QAAM,OAAqB;AAAA,IACzB;AAAA,IACA,OAAO,CAAC,UAAa,QAAyB;AAC5C,YAAM,MAAM;AACZ,YAAM,KAAK,QAAQ,KAAK,KAAK;AAG7B,UAAI,IAAI,aAAa,MAAM;AACzB,YAAI,YAAY,UAAa,CAAC,QAAQ,SAAS,EAAE,GAAG;AAClD,gBAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,UAAU,EAAE;AAAA,QAC1E;AACA;AAAA,MACF;AAGA,YAAM,OAAO,QAAQ,IAAI,UAAqC,KAAK;AACnE,UAAI,SAAS,IAAI;AACf,YAAI,gBAAiB;AACrB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AACA,YAAM,UAAU,YAAY,IAAI,KAAK,CAAC;AACtC,UAAI,CAAC,QAAQ,SAAS,EAAE,GAAG;AACzB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;","names":["recordId"]}

package/dist/{chunk-MZ5ZFO2D.js → chunk-RXYYFSBB.js}

@@ -339,6 +339,40 @@ function quantizeValue(field, raw, desc) {
   const scale = desc.scaleFor(currency);
   return { amount: quantizeAmount(field, amount, scale, desc.rounding), currency };
 }
+function canonicalizeMoneyFieldsAsDecimal(record, moneyFields) {
+  const out = { ...record };
+  for (const [field, desc] of Object.entries(moneyFields)) {
+    if (!isSimpleMoneyPath(field)) continue;
+    const raw = out[field];
+    if (raw === null || raw === void 0) continue;
+    let amount;
+    let scale;
+    if (desc.mode === "fixed") {
+      amount = raw;
+      scale = desc.scaleFor(desc.fixedCurrency);
+    } else if (isMoneyValueObject(raw)) {
+      amount = raw.amount;
+      scale = desc.scaleFor(String(raw.currency));
+    } else {
+      const sole = desc.soleCurrency();
+      if (sole === void 0) {
+        throw new TypeError(
+          `money: field "${field}" is multi-currency \u2014 a derived value must be { amount, currency }, not a bare amount`
+        );
+      }
+      amount = raw;
+      scale = desc.scaleFor(sole);
+    }
+    const r = parseToScaledInt(amount, scale, desc.rounding);
+    if (!r.ok) {
+      if (r.reason === "precision") throw new MoneyPrecisionError(field, amount, scale);
+      throw new TypeError(`money: field "${field}" value ${JSON.stringify(amount)} is not a finite decimal`);
+    }
+    const decimal = formatScaledInt(r.value, scale);
+    out[field] = desc.mode === "fixed" || !isMoneyValueObject(raw) ? decimal : { amount: decimal, currency: String(raw.currency) };
+  }
+  return out;
+}
 function quantizeMoneyFields(record, moneyFields) {
   let out = { ...record };
   for (const [path, desc] of Object.entries(moneyFields)) {
@@ -423,7 +457,7 @@ function decodeValue(stored, desc) {
 }
 function presentVirtualMoneyFields(record, moneyFields, virtualMoney, locale) {
   let out = record;
-  const format = locale !== "raw";
+  const format2 = locale !== "raw";
   const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
   for (const field of virtualMoney) {
     const desc = moneyFields[field];
@@ -438,7 +472,7 @@ function presentVirtualMoneyFields(record, moneyFields, virtualMoney, locale) {
     if (out === record) out = { ...record };
     const decimal = formatScaledInt(r.value, scale);
     out[field] = decimal;
-    if (format) {
+    if (format2) {
       out[`${field}Formatted`] = formatCurrency(decimal, currency, scale, fmtLocale);
       out[`${field}Number`] = Number(decimal);
     }
@@ -447,7 +481,7 @@ function presentVirtualMoneyFields(record, moneyFields, virtualMoney, locale) {
 }
 function decodeMoneyFields(record, moneyFields, locale) {
   let out = { ...record };
-  const format = locale !== "raw";
+  const format2 = locale !== "raw";
   const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
   for (const [path, desc] of Object.entries(moneyFields)) {
     if (isSimpleMoneyPath(path)) {
@@ -456,7 +490,7 @@ function decodeMoneyFields(record, moneyFields, locale) {
       const r = decodeValue(stored, desc);
       if (r === null) continue;
       out[path] = r.decoded;
-      if (format) {
+      if (format2) {
         out[`${path}Formatted`] = formatCurrency(r.decimal, r.currency, r.scale, fmtLocale);
         out[`${path}Number`] = Number(r.decimal);
       }
@@ -473,7 +507,7 @@ function decodeMoneyFields(record, moneyFields, locale) {
         const r = decodeValue(stored, desc);
         if (r === null) return;
         container[key] = r.decoded;
-        if (format && typeof key === "string" && !Array.isArray(container)) {
+        if (format2 && typeof key === "string" && !Array.isArray(container)) {
           container[`${key}Formatted`] = formatCurrency(r.decimal, r.currency, r.scale, fmtLocale);
           container[`${key}Number`] = Number(r.decimal);
         }
@@ -952,124 +986,62 @@ function isMoneyDescriptor(x) {
   return typeof x === "object" && x !== null && x._noydbMoney === true;
 }
 
-// src/via/money/arith.ts
-function parseAmount(label, amount, scale, rounding) {
-  const r = parseToScaledInt(amount, scale, rounding);
-  if (!r.ok) {
-    throw new MoneyUnsupportedError(
-      r.reason === "precision" ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured` : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`
+// src/via/money/exact.ts
+var DECIMAL = /^[+-]?\d+(\.\d+)?$/;
+function parse(operand, op) {
+  if (typeof operand === "bigint") return { value: operand, scale: 0 };
+  const text = typeof operand === "number" ? String(operand) : operand.trim();
+  if (!DECIMAL.test(text)) {
+    throw new ValidationError(
+      `exact.${op}: "${text}" is not a decimal value. Pass a decimal string (the shape money fields carry), a number, or a bigint.`
     );
   }
-  return r.value;
-}
-function resolveScale(label, amount, explicit) {
-  if (explicit !== void 0) {
-    if (!Number.isInteger(explicit) || explicit < 0) {
-      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`);
-    }
-    return explicit;
-  }
-  const inferred = decimalScaleOf(amount);
-  if (inferred === null) {
-    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`);
-  }
-  return inferred;
+  const [whole, fraction = ""] = text.split(".");
+  const digits = `${whole}${fraction}`;
+  return { value: BigInt(digits), scale: fraction.length };
 }
-function mulRate(amount, rate, opts = {}) {
-  const scale = resolveScale("mulRate", amount, opts.scale);
-  const rounding = opts.rounding ?? "half-up";
-  const a = parseAmount("mulRate", amount, scale, rounding);
-  const rateScale = decimalScaleOf(rate);
-  if (rateScale === null) {
-    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
-  }
-  const r = parseToScaledInt(rate, rateScale);
-  if (!r.ok) {
-    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
-  }
-  const product = a * r.value;
-  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale);
-}
-function allocate(amount, weights, opts = {}) {
-  if (weights.length === 0) {
-    throw new MoneyUnsupportedError("allocate: weights must not be empty");
-  }
-  const scale = resolveScale("allocate", amount, opts.scale);
-  const a = parseAmount("allocate", amount, scale);
-  let weightScale = 0;
-  for (const w of weights) {
-    const s = decimalScaleOf(w);
-    if (s === null) {
-      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`);
-    }
-    if (s > weightScale) weightScale = s;
-  }
-  const scaledWeights = weights.map((w) => {
-    const r = parseToScaledInt(w, weightScale);
-    if (!r.ok || r.value < 0n) {
-      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`);
-    }
-    return r.value;
-  });
-  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n);
-  if (sumW === 0n) {
-    throw new MoneyUnsupportedError("allocate: weights must not all be zero");
-  }
-  const negative = a < 0n;
-  const mag = negative ? -a : a;
-  const base = [];
-  const remainders = [];
-  let distributed = 0n;
-  for (let i = 0; i < scaledWeights.length; i++) {
-    const product = mag * scaledWeights[i];
-    const share = product / sumW;
-    base.push(share);
-    distributed += share;
-    remainders.push({ index: i, rem: product % sumW });
-  }
-  let leftover = mag - distributed;
-  remainders.sort((x, y) => y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index);
-  for (const { index } of remainders) {
-    if (leftover === 0n) break;
-    base[index] = base[index] + 1n;
-    leftover -= 1n;
-  }
-  return base.map((p) => formatScaledInt(negative && p !== 0n ? -p : p, scale));
+function align(a, b) {
+  const scale = Math.max(a.scale, b.scale);
+  const lift = (s) => s.value * 10n ** BigInt(scale - s.scale);
+  return { a: lift(a), b: lift(b), scale };
 }
-
-// src/via/money/branded.ts
-function asMoney(value) {
-  if (!isMoneyLike(value)) {
-    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`);
-  }
-  return String(value).trim();
+function format({ value, scale }) {
+  if (scale === 0) return value.toString();
+  const negative = value < 0n;
+  const digits = (negative ? -value : value).toString().padStart(scale + 1, "0");
+  const whole = digits.slice(0, digits.length - scale);
+  const fraction = digits.slice(digits.length - scale);
+  return `${negative ? "-" : ""}${whole}.${fraction}`;
 }
-function isMoneyString(value) {
-  return typeof value === "string" && isMoneyLike(value);
+function binary(op, a, b, f) {
+  const aligned = align(parse(a, op), parse(b, op));
+  return format({ value: f(aligned.a, aligned.b), scale: aligned.scale });
 }
-function moneyNumber(value) {
-  if (!isMoneyLike(value)) {
-    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`);
+var exactMath = {
+  add: (a, b) => binary("add", a, b, (x, y) => x + y),
+  sub: (a, b) => binary("sub", a, b, (x, y) => x - y),
+  neg: (a) => binary("neg", 0, a, (x, y) => x - y),
+  max: (a, b) => binary("max", a, b, (x, y) => x > y ? x : y),
+  min: (a, b) => binary("min", a, b, (x, y) => x < y ? x : y),
+  cmp: (a, b) => {
+    const { a: x, b: y } = align(parse(a, "cmp"), parse(b, "cmp"));
+    return x < y ? -1 : x > y ? 1 : 0;
   }
-  return Number(value);
-}
-function isMoneyLike(value) {
-  if (typeof value === "number") return Number.isFinite(value);
-  if (typeof value !== "string") return false;
-  return decimalScaleOf(value) !== null;
-}
+};
 
 export {
+  parseToScaledInt,
+  decimalScaleOf,
+  rescaleScaledInt,
+  formatScaledInt,
   scaleForCurrency,
   MoneyPrecisionError,
   MoneyCurrencyError,
   MoneyUnsupportedError,
   money,
   isMoneyDescriptor,
-  mulRate,
-  allocate,
-  asMoney,
-  isMoneyString,
-  moneyNumber
+  canonicalizeMoneyFieldsAsDecimal,
+  decodeMoneyFields,
+  exactMath
 };
-//# sourceMappingURL=chunk-MZ5ZFO2D.js.map
+//# sourceMappingURL=chunk-RXYYFSBB.js.map