@noy-db/hub 0.6.0-pre.12 → 0.6.0-pre.14

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-UFM3WVIF.js";
+} from "../chunk-C6MI5OCF.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-TJCRCCPT.js";
-import "../chunk-UHXCLPGC.js";
-import "../chunk-NSRITINN.js";
+} from "../chunk-XHX3NTRP.js";
+import "../chunk-RVTOCAHQ.js";
+import "../chunk-6ZFTVY3O.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,

package/dist/{classified-marker-EHRSGBM7.js → classified-marker-3STDEUFT.js}

@@ -13,11 +13,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-OXUXXIWT.js");
+  const { persistClassifiedMarker } = await import("./register-UTMPUAQW.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-M7L2EK3F.js");
+  const { loadPersistedSchema } = await import("./storage-EWWIFB43.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -25,4 +25,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-EHRSGBM7.js.map
+//# sourceMappingURL=classified-marker-3STDEUFT.js.map

package/dist/collection-facade-SGTS3TRS.js

@@ -0,0 +1,45 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+} from "./chunk-JBMSNYOS.js";
+import "./chunk-7J6YERYT.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-PJ5TGJ7U.js";
+import "./chunk-FMZV43QY.js";
+import "./chunk-SZZEDEIU.js";
+import "./chunk-RVTOCAHQ.js";
+import "./chunk-AMKCY454.js";
+import "./chunk-A4JJUWSV.js";
+import "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-SGTS3TRS.js.map

package/dist/{computed-6G5M3UPH.js → computed-5E2OM6EN.js}

@@ -1,11 +1,11 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-VMCCGUQB.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-YGJZLOSR.js";
+import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-6G5M3UPH.js.map
+//# sourceMappingURL=computed-5E2OM6EN.js.map

package/dist/consent/index.js

@@ -2,20 +2,20 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-SYFEJFIO.js";
+} from "../chunk-GBTLOHJM.js";
 import {
   NO_CONSENT
 } from "../chunk-PEOZ34EM.js";
-import "../chunk-ZJADGNYF.js";
-import "../chunk-4X5Z5SRV.js";
-import "../chunk-2APC6HS6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+import "../chunk-4AOERLTV.js";
+import "../chunk-ZWPUYBNK.js";
+import "../chunk-IMYGJ5HU.js";
+import "../chunk-FSZPQCDR.js";
+import "../chunk-HVR74IBG.js";
+import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-NSRITINN.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-QTDAPDDV.js";
+import "../chunk-6ZFTVY3O.js";
+import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/cover/index.js

@@ -14,9 +14,9 @@ import {
   saveCover,
   validateCoverInput,
   validateCoverSize
-} from "../chunk-Z7SMBVNM.js";
-import "../chunk-NSRITINN.js";
-import "../chunk-HNGSV2YC.js";
+} from "../chunk-GE2AGI67.js";
+import "../chunk-6ZFTVY3O.js";
+import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {
   COVER_FIELDS,

package/dist/custody/index.js

@@ -2,20 +2,20 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-XXVIHJZY.js";
-import "../chunk-7BEHYALK.js";
-import "../chunk-G4VQSGXL.js";
-import "../chunk-4X5Z5SRV.js";
-import "../chunk-2APC6HS6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-QQP5KJMS.js";
+import "../chunk-Y7MJSOZ7.js";
+import "../chunk-CK7IRIRY.js";
+import "../chunk-ZWPUYBNK.js";
+import "../chunk-IMYGJ5HU.js";
+import "../chunk-FSZPQCDR.js";
+import "../chunk-HVR74IBG.js";
+import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-NSRITINN.js";
+import "../chunk-QTDAPDDV.js";
+import "../chunk-6ZFTVY3O.js";
 import {
   CustodyNotEnabledError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {
   CustodyApi,

package/dist/{dead-filter-ANPRM2LD.js → dead-filter-ZNWVGV5U.js}

@@ -5,7 +5,7 @@ import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-M7L2EK3F.js");
+  const { loadPersistedSchema } = await import("./storage-EWWIFB43.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +25,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-ANPRM2LD.js.map
+//# sourceMappingURL=dead-filter-ZNWVGV5U.js.map

package/dist/debug/index.js

@@ -1,7 +1,7 @@
 import {
   DebugPlaintextError,
   DebugReservedFieldError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/debug.ts

package/dist/{delegation-6NUQCURX.js → delegation-LZWFOST7.js}

@@ -1,26 +1,28 @@
 import {
   dekKey
-} from "./chunk-AHLJSVRL.js";
+} from "./chunk-YVOW35HH.js";
 import {
   generateULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
 import {
   openEnvelopeJson
-} from "./chunk-4X5Z5SRV.js";
-import "./chunk-2APC6HS6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-VCETL77O.js";
-import "./chunk-NSRITINN.js";
+} from "./chunk-QTDAPDDV.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-6ZFTVY3O.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/team/delegation.ts
@@ -54,7 +56,7 @@ async function issueDelegation(store, vault, grantor, targetKek, delegationsDek,
   const plaintext = JSON.stringify(token);
   const { iv, data } = await encrypt(plaintext, delegationsDek);
   const envelope = {
-    _noydb: 1,
+    _noydb: NOYDB_FORMAT_VERSION,
     _v: 1,
     _ts: token.createdAt,
     _iv: iv,
@@ -102,4 +104,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-6NUQCURX.js.map
+//# sourceMappingURL=delegation-LZWFOST7.js.map

package/dist/delegation-LZWFOST7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const { iv, data } = await encrypt(plaintext, delegationsDek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: token.createdAt,\n    _iv: iv,\n    _data: data,\n    _by: grantor.userId,\n  }\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson(env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,cAAc;AAC5D,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,KAAK,cAAc;AAC5D,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derivations/index.js

@@ -1,29 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-6HFM7EIT.js";
+} from "../chunk-5NKSNW25.js";
 import {
   DerivationRegistry
-} from "../chunk-NJDQ4YSV.js";
+} from "../chunk-Z3U2YVNM.js";
 import {
   DerivationExecutor
-} from "../chunk-YAWK6AWF.js";
-import "../chunk-7TSYBD3E.js";
-import "../chunk-4X5Z5SRV.js";
-import "../chunk-2APC6HS6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-YDJXGYYA.js";
+import "../chunk-YH65A6WM.js";
+import "../chunk-ZWPUYBNK.js";
+import "../chunk-IMYGJ5HU.js";
+import "../chunk-FSZPQCDR.js";
+import "../chunk-HVR74IBG.js";
+import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-NSRITINN.js";
+import "../chunk-QTDAPDDV.js";
+import "../chunk-6ZFTVY3O.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-BWXA2L7D.js

@@ -0,0 +1,22 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-HNOBRU24.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-BWXA2L7D.js.map

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-PK3URBVU.js";
+} from "../chunk-CAJ7QAPC.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,16 +16,16 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-G4VQSGXL.js";
-import "../chunk-4X5Z5SRV.js";
-import "../chunk-2APC6HS6.js";
-import "../chunk-HXGUIPQB.js";
-import "../chunk-AR2JDFAE.js";
-import "../chunk-747LRSOO.js";
+} from "../chunk-CK7IRIRY.js";
+import "../chunk-ZWPUYBNK.js";
+import "../chunk-IMYGJ5HU.js";
+import "../chunk-FSZPQCDR.js";
+import "../chunk-HVR74IBG.js";
+import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-VCETL77O.js";
-import "../chunk-NSRITINN.js";
-import "../chunk-HNGSV2YC.js";
+import "../chunk-QTDAPDDV.js";
+import "../chunk-6ZFTVY3O.js";
+import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DIRECTORY_RECORD_ID,

package/dist/{dispatch-EO2QHEXK.js → dispatch-S34AUC43.js}

@@ -1,26 +1,26 @@
 import {
   markStale
-} from "./chunk-4HDYQL3J.js";
+} from "./chunk-MVG67SMN.js";
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-GV2EFYNV.js";
+} from "./chunk-YODIXNV4.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-5GMMIDJX.js";
-import "./chunk-7G6VDWXB.js";
-import "./chunk-UHXCLPGC.js";
-import "./chunk-AZQVFXJF.js";
-import "./chunk-4X5Z5SRV.js";
-import "./chunk-2APC6HS6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+import "./chunk-FMZV43QY.js";
+import "./chunk-SZZEDEIU.js";
+import "./chunk-RVTOCAHQ.js";
+import "./chunk-A4JJUWSV.js";
+import "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-NSRITINN.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
 import {
   DerivationCapExceededError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/dispatch.ts
@@ -28,7 +28,7 @@ async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = f
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-3Q6BWNSS.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-BVFOEJTP.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -114,7 +114,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
     }
     if (executorClass === null) {
       ;
-      ({ DerivationExecutor: executorClass } = await import("./executor-S4QIKEHW.js"));
+      ({ DerivationExecutor: executorClass } = await import("./executor-PCZN2LTY.js"));
     }
     for (const run of runs) {
       const ctx2 = { vault: derivationSource.getReadOnlyFacade() };
@@ -134,7 +134,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
         const outputCollection = derivationSource.getCollection(outSpec.collection);
         const txCtx = derivationSource.getActiveTxContext();
         if (out.kind === "array") {
-          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-3Q6BWNSS.js");
+          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BVFOEJTP.js");
           const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
           const prevKeys = new Set(prior?.keys ?? []);
           const newKeysList = out.entries.map((e) => e.key);
@@ -191,4 +191,4 @@ export {
   dispatchArrayDerivationsOnDelete,
   dispatchDerivations
 };
-//# sourceMappingURL=dispatch-EO2QHEXK.js.map
+//# sourceMappingURL=dispatch-S34AUC43.js.map

package/dist/{dispatch-UGU775MV.js → dispatch-TIYW3UDN.js}

@@ -15,7 +15,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-AB4BCJO4.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-JDMH2IGK.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -24,7 +24,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-3FW6U4OU.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-OT5NMBXU.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -44,7 +44,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-AB4BCJO4.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-JDMH2IGK.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -57,7 +57,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-3FW6U4OU.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-OT5NMBXU.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -69,4 +69,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-UGU775MV.js.map
+//# sourceMappingURL=dispatch-TIYW3UDN.js.map

package/dist/{enclave-3Z7VTJAW.js → enclave-Y6GMYQMS.js}

@@ -2,6 +2,7 @@ import {
   RecordCodec,
   SEALED_CEK_NS,
   applyRewrappedBody,
+  buildRecordAad,
   computeBrokerProof,
   deriveBrokerProofBits,
   deriveBrokerProofKey,
@@ -22,26 +23,26 @@ import {
   sealRecordToHost,
   verifyBrokerProof,
   writeEnvelopeBody
-} from "./chunk-4X5Z5SRV.js";
+} from "./chunk-ZWPUYBNK.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-2APC6HS6.js";
+} from "./chunk-IMYGJ5HU.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
+} from "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-747LRSOO.js";
+} from "./chunk-RBTZLXZJ.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -74,9 +75,9 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-VCETL77O.js";
-import "./chunk-NSRITINN.js";
-import "./chunk-HNGSV2YC.js";
+} from "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
+import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -85,6 +86,7 @@ export {
   base64ToBuffer,
   bufferToBase64,
   buildDeleteMarker,
+  buildRecordAad,
   buildTombstone,
   computeBidxTarget,
   computeBrokerProof,
@@ -144,4 +146,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-3Z7VTJAW.js.map
+//# sourceMappingURL=enclave-Y6GMYQMS.js.map

package/dist/executor-JDMH2IGK.js

@@ -0,0 +1,29 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-HVPQ5QIZ.js";
+import "./chunk-C66T4W5P.js";
+import "./chunk-JU3JKOY5.js";
+import "./chunk-ESABIXMQ.js";
+import "./chunk-YODIXNV4.js";
+import "./chunk-QI2KXQOM.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-CADUYBQD.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-FMZV43QY.js";
+import "./chunk-SZZEDEIU.js";
+import "./chunk-RVTOCAHQ.js";
+import "./chunk-A4JJUWSV.js";
+import "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-JDMH2IGK.js.map

package/dist/executor-PCZN2LTY.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-YDJXGYYA.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-PCZN2LTY.js.map

package/dist/executor-WFTHIDT7.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-RWPNRCK2.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-WFTHIDT7.js.map

package/dist/export-accessible-U6GXZZMQ.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-CNA3QRLM.js";
+import "./chunk-4LNFXGNW.js";
+import "./chunk-GE2AGI67.js";
+import "./chunk-ZWPUYBNK.js";
+import "./chunk-IMYGJ5HU.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-6ZFTVY3O.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-U6GXZZMQ.js.map