@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.18

package/dist/chunk-LUFZPROB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/attestation/revoke.ts"],"sourcesContent":["import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { AttestationError, ConflictError } from '../../kernel/errors.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID } from './signer.js'\nimport { signRevocationList, type RevocationList } from '@noy-db/attestation'\n\n/** Everything the revoke core needs from the Vault, injected for testability. */\nexport interface RevokeContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK. */\n  getDEK(): Promise<EnclaveKey>\n}\n\ninterface RevokedSet {\n  docIds: string[]\n  updatedAt: string\n}\n\nfunction requireOwner(ctx: RevokeContext, op: string): void {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`)\n  }\n}\n\nasync function readSet(store: NoydbStore, vault: string, dek: EnclaveKey): Promise<{ docIds: Set<string>; version: number | undefined }> {\n  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID)\n  if (!env) return { docIds: new Set<string>(), version: undefined }\n  const set = JSON.parse(await openEnvelopeJson(env, dek)) as RevokedSet\n  return { docIds: new Set(set.docIds), version: env._v }\n}\n\n/** Read-modify-write the _revoked set with optimistic concurrency + one retry. */\nasync function mutateSet(ctx: RevokeContext, mutate: (ids: Set<string>) => void): Promise<void> {\n  const dek = await ctx.getDEK()\n  for (let attempt = 0; attempt < 2; attempt++) {\n    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek)\n    mutate(docIds)\n    const payload: RevokedSet = { docIds: [...docIds].sort(), updatedAt: new Date().toISOString() }\n    const { iv, data } = await encrypt(JSON.stringify(payload), dek)\n    const expectedVersion = version ?? 0\n    const env: EncryptedEnvelope = {\n      _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: payload.updatedAt, _iv: iv, _data: data,\n    }\n    try {\n      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion)\n      return\n    } catch (e) {\n      if (e instanceof ConflictError && attempt === 0) continue\n      throw e\n    }\n  }\n}\n\nexport async function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'revokeAttestation')\n  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId)\n  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`)\n  await mutateSet(ctx, (ids) => ids.add(docId))\n}\n\nexport async function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'unrevokeAttestation')\n  await mutateSet(ctx, (ids) => ids.delete(docId))\n}\n\nexport async function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]> {\n  const dek = await ctx.getDEK()\n  const { docIds } = await readSet(ctx.store, ctx.vault, dek)\n  return [...docIds].sort()\n}\n\nexport async function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList> {\n  requireOwner(ctx, 'publishRevocationList')\n  const docIds = await getRevokedDocIdsCore(ctx)\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK())\n  return signRevocationList(docIds, new Date().toISOString(), signer.keyId, signer.privateKeyPkcs8B64)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,SAAS,0BAA+C;AAgBxD,SAAS,aAAa,KAAoB,IAAkB;AAC1D,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,GAAG,EAAE,0CAA0C,IAAI,IAAI,iDAAiD;AAAA,EACrI;AACF;AAEA,eAAe,QAAQ,OAAmB,OAAe,KAAgF;AACvI,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,yBAAyB,iBAAiB;AAC7E,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,SAAS,OAAU;AACjE,QAAM,MAAM,KAAK,MAAM,MAAM,iBAAiB,KAAK,GAAG,CAAC;AACvD,SAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,IAAI,GAAG;AACxD;AAGA,eAAe,UAAU,KAAoB,QAAmD;AAC9F,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AACnE,WAAO,MAAM;AACb,UAAM,UAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC9F,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,GAAG;AAC/D,UAAM,kBAAkB,WAAW;AACnC,UAAM,MAAyB;AAAA,MAC7B,QAAQ;AAAA,MAAsB,IAAI,kBAAkB;AAAA,MAAG,KAAK,QAAQ;AAAA,MAAW,KAAK;AAAA,MAAI,OAAO;AAAA,IACjG;AACA,QAAI;AACF,YAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,mBAAmB,KAAK,eAAe;AAC/F;AAAA,IACF,SAAS,GAAG;AACV,UAAI,aAAa,iBAAiB,YAAY,EAAG;AACjD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,KAAoB,OAA8B;AACpF,eAAa,KAAK,mBAAmB;AACrC,QAAM,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,KAAK;AAC5E,MAAI,CAAC,OAAQ,OAAM,IAAI,iBAAiB,mCAAmC,KAAK,6CAA6C;AAC7H,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;AAC9C;AAEA,eAAsB,gBAAgB,KAAoB,OAA8B;AACtF,eAAa,KAAK,qBAAqB;AACvC,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC;AACjD;AAEA,eAAsB,qBAAqB,KAAuC;AAChF,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AAC1D,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK;AAC1B;AAEA,eAAsB,0BAA0B,KAA6C;AAC3F,eAAa,KAAK,uBAAuB;AACzC,QAAM,SAAS,MAAM,qBAAqB,GAAG;AAC7C,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,IAAI,OAAO,CAAC;AAChF,SAAO,mBAAmB,SAAQ,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,kBAAkB;AACrG;","names":[]}

package/dist/chunk-OAWVM5L6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/manifest/types.ts","../src/with-shape/manifest/storage.ts","../src/with-shape/manifest/derive.ts"],"sourcesContent":["/**\n * The pod-wide **schema manifest** record type (#941).\n *\n * This is an INDEX, not a full-inline manifest: `SchemaManifest.collections`\n * carries per-collection *metadata* (generation / content hash / field ids),\n * never the JSON Schema body itself. The JSON Schema stays the source of\n * truth at `_schemas/<collection>`, encrypted under that collection's own\n * DEK (see `with-shape/persisted-schemas`). Inlining full schemas into one\n * pod-wide manifest record would either leak every collection's schema to a\n * principal scoped to a single collection, or force the manifest itself\n * onto a collection-DEK it has no business holding — the index preserves\n * per-collection DEK isolation while still giving a single place to answer\n * \"what schema generation is this pod at, and does collection X's stored\n * schema match its declared content hash.\"\n *\n * `aggregateHash` binds the whole per-collection index's content: it is\n * `sha256Hex(canonicalJson(collections))`, so any change to any collection's\n * entry (a new generation, a changed hash, added/renamed field ids) changes\n * `aggregateHash` too. Canonical JSON (sorted object keys, no whitespace)\n * makes the hash independent of the map's key insertion order.\n *\n * @module\n */\n\n/** Per-collection entry inside a {@link SchemaManifest}'s `collections` index. */\nexport interface SchemaManifestEntry {\n  /** The vault-wide schema-fence generation this collection's schema was last written at. */\n  readonly generation: number\n  /** SHA-256 (hex) of the collection's canonicalised JSON Schema (see `persisted-schemas/derive.ts`). */\n  readonly contentHash: string\n  /** Stable per-field ids (#946), keyed by the field's current name. Absent when the collection has none. */\n  readonly fieldIds?: Record<string, string>\n}\n\n/**\n * The pod-wide schema manifest — one record per pod, stored at\n * `_manifest/schema` (see `storage.ts`). An INDEX over the per-collection\n * `_schemas/<collection>` entries, not the schemas themselves.\n */\nexport interface SchemaManifest {\n  readonly v: 1\n  readonly kind: 'schema'\n  /** Pod-wide schema-fence generation (`FenceDoc.currentSchemaVersion`) as of this manifest's derivation. */\n  readonly generation: number\n  /** Per-collection index: collection name → its manifest entry. */\n  readonly collections: Record<string, SchemaManifestEntry>\n  /** `sha256Hex(canonicalJson(collections))` — the pod-wide content binding over the index. */\n  readonly aggregateHash: string\n}\n\n/** The record id the schema manifest is stored under inside `_manifest`. */\nexport const MANIFEST_SCHEMA_RECORD_ID = 'schema' as const\n","/**\n * Read / write the pod-wide `_manifest/schema` envelope.\n *\n * Mirrors `with-shape/persisted-schemas/storage.ts`'s shape: the same\n * standard noy-db record envelope, AES-GCM encrypted with a collection DEK\n * (here, the `_manifest` collection's own DEK — the manifest INDEX\n * discloses collection names + hashes + generations + field ids, metadata\n * rather than schema bodies, so it gets the same encryption grain as\n * `_schemas` itself).\n *\n * Storage layout:\n *\n *   <vault>/_manifest/schema   →   EncryptedEnvelope\n *\n * Unlike `persisted-schemas/storage.ts` (which takes an already-resolved\n * `EnclaveKey`), these functions take a `getDEK` resolver and call\n * `getDEK(MANIFEST_COLLECTION)` themselves — there is exactly one manifest\n * record per pod, so there is no per-collection DEK the caller needs to\n * pick; resolving it here keeps every manifest call-site symmetric.\n *\n * @module\n */\n\nimport { openEnvelopeJson, writeEnvelopeBody, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { canonicalJson, sha256Hex } from '../../with-commit/history/ledger/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest, type SchemaManifestEntry } from './types.js'\n\n/** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */\nexport type GetManifestDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/**\n * A decrypted schema-manifest read paired with the wrapping envelope's `_v`\n * — the optimistic-concurrency token. Pass `version` back to\n * {@link saveSchemaManifest} (via `writeSchemaManifest`'s `expectedVersion`)\n * to make the write a strict CAS.\n */\nexport interface LoadedSchemaManifest {\n  /** Wrapping envelope `_v`. */\n  readonly version: number\n  /** Decrypted schema manifest. */\n  readonly manifest: SchemaManifest\n}\n\n/**\n * Read the `_manifest/schema` envelope together with its wrapping `_v`.\n * Returns `undefined` when no manifest has ever been written, when the\n * envelope fails to decrypt (wrong DEK), or when it doesn't parse as a\n * `v: 1, kind: 'schema'` manifest.\n */\nexport async function loadSchemaManifestEntry(\n  store: NoydbStore,\n  vault: string,\n  getDEK: GetManifestDEK,\n): Promise<LoadedSchemaManifest | undefined> {\n  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID)\n  if (!envelope) return undefined\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as SchemaManifest\n    if (parsed.v !== 1 || parsed.kind !== 'schema') return undefined\n    return { version: envelope._v, manifest: parsed }\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist the schema manifest as a strict CAS write:\n * `expectedVersion` must match the stored envelope's `_v` (0 when no\n * envelope exists yet) or `store.put` throws `ConflictError` — surfaced by\n * `writer.ts`'s `writeSchemaManifest` as `ManifestConflictError` rather than\n * retried.\n */\nexport async function saveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  manifest: SchemaManifest,\n  expectedVersion: number,\n  getDEK: GetManifestDEK,\n): Promise<void> {\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  const json = JSON.stringify(manifest)\n  const body = await writeEnvelopeBody(json, dek)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: expectedVersion + 1,\n    _ts: new Date().toISOString(),\n    ...body,\n  }\n  await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion)\n}\n\n/**\n * `sha256Hex(canonicalJson(collections))` — the pod-wide content binding\n * over a schema manifest's per-collection index. Canonical JSON sorts\n * object keys at every depth, so the result is independent of the map's\n * key insertion order. Shared by the writer's tests and (#941 Task 3) the\n * derivation path, so the hash is computed identically everywhere.\n */\nexport async function computeAggregateHash(\n  collections: Record<string, SchemaManifestEntry>,\n): Promise<string> {\n  return sha256Hex(canonicalJson(collections))\n}\n","/**\n * Derive the pod-wide {@link SchemaManifest} from the per-collection\n * `_schemas/<collection>` records — the source of truth (#941 Task 3).\n *\n * The manifest is an INDEX, never a cache with independent state: every\n * field in a {@link SchemaManifestEntry} is a direct projection of the\n * matching `PersistedSchemaEnvelope` (`hash` → `contentHash`, `fieldIds` →\n * `fieldIds`, `generation` → `generation`, falling back to the live fence's\n * `currentSchemaVersion` for a legacy pre-#946 envelope that never got a\n * generation stamp). Re-running this function against the same stored state\n * always produces the same manifest — that's what makes round-trip identity\n * (AC #2: dump → restore → re-derive matches the original) hold for free,\n * with no special-cased restore logic.\n *\n * A collection whose `_schemas/<collection>` envelope decrypts successfully\n * but has no derivable content (`hash === null` — a stub envelope for a\n * non-Zod validator) is legitimately omitted from the index: there is no\n * content hash to bind.\n *\n * ## Scoped principals: \"cannot decrypt\" is NOT \"doesn't exist\"\n *\n * A `_schemas/<collection>` envelope is encrypted under **that data\n * collection's own DEK** — the same key its records use — NOT a shared\n * `_schemas`-wide key. In a team vault, a collection-scoped grantee (e.g.\n * `grant(..., { role: 'operator', permissions: { invoices: 'rw' } })`) holds\n * only the DEKs their `permissions` name, plus every system-prefixed (`_*`)\n * collection's DEK — `_manifest` included, by `grant()`'s \"propagate system\n * collections to every role\" rule (`keyring.ts`). So a member scoped to\n * `invoices` CAN decrypt `_manifest/schema` (the pod-wide index) but CANNOT\n * decrypt a sibling's `_schemas/customers` envelope — even though that\n * envelope is right there in `store.list(vault, SCHEMAS_COLLECTION)`.\n *\n * `lookupDEK` (the {@link LookupDEK} passed in) reflects this: it returns\n * `undefined` for a collection name whose DEK the caller does not hold —\n * deliberately NEVER minting a fresh one (see the module doc on\n * `LookupDEK` for why). This function distinguishes that case\n * (`undecodableCollections`) from \"the schema envelope legitimately has no\n * derivable content\" (`hash === null`) — the caller (`sync.ts`) MUST treat\n * an incomplete view differently: writing a manifest derived from a\n * partial view would silently drop every collection this principal can't\n * see. See `sync.ts`'s module doc for how the sync path handles this.\n *\n * @module\n */\n\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { loadFence } from '../schema-update/fence.js'\nimport { loadPersistedSchema, SCHEMAS_COLLECTION } from '../persisted-schemas/storage.js'\nimport { computeAggregateHash } from './storage.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { SchemaManifest, SchemaManifestEntry } from './types.js'\n\n/**\n * A NON-MINTING DEK lookup: returns the collection's DEK if the caller\n * already holds it, `undefined` otherwise. Deliberately distinct from\n * `storage.ts`'s `GetManifestDEK` (which mints+persists a fresh DEK for an\n * absent collection — correct for a caller about to WRITE that collection,\n * e.g. `_manifest` itself). `deriveSchemaManifest` only ever READS sibling\n * collections it never created and has no business minting keys for — an\n * absent DEK here means \"not my collection to see,\" never \"new collection\n * that needs a key.\" Minting here would be worse than a no-op: it would\n * silently persist a garbage DEK into the caller's OWN `_keyring/<user>`\n * file (via `ensureCollectionDEK`'s `persistKeyring` side effect) that\n * still can't decrypt anything — see `sync.ts` / `with-pod/open.ts`'s\n * fix notes (#941 review).\n */\nexport type LookupDEK = (collectionName: string) => Promise<EnclaveKey | undefined>\n\nexport interface DeriveSchemaManifestResult {\n  /** The derived manifest — an index over every collection this principal could decrypt. */\n  readonly manifest: SchemaManifest\n  /**\n   * Names present in `_schemas` (per `store.list`) whose envelope this\n   * principal could NOT decrypt — either no DEK held for that collection,\n   * or the DEK held failed to decrypt/parse it (treated the same: the\n   * caller cannot verify what's there, so it cannot safely be omitted or\n   * asserted). Empty for a principal with full visibility (typically the\n   * owner/admin/custodian). Non-empty means `manifest.collections` is\n   * DEFINITELY INCOMPLETE relative to the pod's true collection set —\n   * see `sync.ts` for why that must gate whether the manifest gets written.\n   */\n  readonly undecodableCollections: readonly string[]\n}\n\n/**\n * Read the fence generation + every `_schemas/<collection>` envelope this\n * principal can decrypt, and project them into a fresh {@link SchemaManifest}.\n * `lookupDEK` is called once per collection found under `_schemas` (never\n * mints — see {@link LookupDEK}). Names whose DEK isn't held, or whose\n * envelope fails to decrypt/parse despite holding a DEK, are reported via\n * `undecodableCollections` rather than silently dropped from the result.\n */\nexport async function deriveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  lookupDEK: LookupDEK,\n): Promise<DeriveSchemaManifestResult> {\n  const fence = await loadFence(store, vault)\n  const collectionNames = await store.list(vault, SCHEMAS_COLLECTION)\n\n  const collections: Record<string, SchemaManifestEntry> = {}\n  const undecodableCollections: string[] = []\n  for (const name of collectionNames) {\n    const dek = await lookupDEK(name)\n    if (dek === undefined) {\n      undecodableCollections.push(name) // present in _schemas, but not decodable by this principal\n      continue\n    }\n\n    const payload = await loadPersistedSchema(store, vault, name, dek)\n    if (!payload) {\n      // Held a DEK but still couldn't decrypt/parse — cannot distinguish\n      // \"wrong key after all\" from real corruption from here; treat as\n      // undecodable (never silently drop) rather than \"no content.\"\n      undecodableCollections.push(name)\n      continue\n    }\n    if (payload.hash === null) continue // legitimately no derivable content (stub envelope)\n\n    const entry: SchemaManifestEntry = {\n      generation: payload.generation ?? fence.currentSchemaVersion,\n      contentHash: payload.hash,\n    }\n    collections[name] = payload.fieldIds !== undefined ? { ...entry, fieldIds: payload.fieldIds } : entry\n  }\n\n  const aggregateHash = await computeAggregateHash(collections)\n  const manifest: SchemaManifest = { v: 1, kind: 'schema', generation: fence.currentSchemaVersion, collections, aggregateHash }\n  return { manifest, undecodableCollections }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDO,IAAM,4BAA4B;;;ACCzC,eAAsB,wBACpB,OACA,OACA,QAC2C;AAC3C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,qBAAqB,yBAAyB;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,MAAM,KAAK,OAAO,SAAS,SAAU,QAAO;AACvD,WAAO,EAAE,SAAS,SAAS,IAAI,UAAU,OAAO;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,mBACpB,OACA,OACA,UACA,iBACA,QACe;AACf,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,QAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,QAAM,OAAO,MAAM,kBAAkB,MAAM,GAAG;AAC9C,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,IAAI,kBAAkB;AAAA,IACtB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,GAAG;AAAA,EACL;AACA,QAAM,MAAM,IAAI,OAAO,qBAAqB,2BAA2B,KAAK,eAAe;AAC7F;AASA,eAAsB,qBACpB,aACiB;AACjB,SAAO,UAAU,cAAc,WAAW,CAAC;AAC7C;;;ACfA,eAAsB,qBACpB,OACA,OACA,WACqC;AACrC,QAAM,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1C,QAAM,kBAAkB,MAAM,MAAM,KAAK,OAAO,kBAAkB;AAElE,QAAM,cAAmD,CAAC;AAC1D,QAAM,yBAAmC,CAAC;AAC1C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,MAAM,MAAM,UAAU,IAAI;AAChC,QAAI,QAAQ,QAAW;AACrB,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,oBAAoB,OAAO,OAAO,MAAM,GAAG;AACjE,QAAI,CAAC,SAAS;AAIZ,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAM;AAE3B,UAAM,QAA6B;AAAA,MACjC,YAAY,QAAQ,cAAc,MAAM;AAAA,MACxC,aAAa,QAAQ;AAAA,IACvB;AACA,gBAAY,IAAI,IAAI,QAAQ,aAAa,SAAY,EAAE,GAAG,OAAO,UAAU,QAAQ,SAAS,IAAI;AAAA,EAClG;AAEA,QAAM,gBAAgB,MAAM,qBAAqB,WAAW;AAC5D,QAAM,WAA2B,EAAE,GAAG,GAAG,MAAM,UAAU,YAAY,MAAM,sBAAsB,aAAa,cAAc;AAC5H,SAAO,EAAE,UAAU,uBAAuB;AAC5C;","names":[]}

package/dist/chunk-OXRPH6AR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/via/lookup/handle.ts"],"sourcesContent":["/**\n * `_dict_*` reserved-collection storage engine — `LookupHandle`.\n *\n * Verbatim move of `DictionaryHandle` out of `via/i18n/dictionary.ts`\n * (#650 Task 1 — via-lookup extraction, phase D). The class is renamed to\n * `LookupHandle` (the dict tier is one backing kind the eventual lookup\n * layer supports); `via/i18n/dictionary.ts` re-exports it as\n * `DictionaryHandle` for one release so existing importers compile\n * unchanged. `DictEntry` / `DictionaryOptions` / `DICT_COLLECTION_PREFIX` /\n * `dictCollectionName` move with it — they were exclusively consumed by\n * this class's constructor/methods.\n *\n * No behavior change from the pre-move class: same encryption door\n * (`reservedEnvelopes('_dict_')`, #629 Task 4), same ACL, same ledger\n * shape, same sync-cache/snapshot contract for dict joins.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { ViaCryptoCtx } from '../../kernel/via/index.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport { envelopePayloadHash } from '../../with-commit/history/ledger/hash.js'\nimport {\n  PermissionDeniedError,\n  DictKeyMissingError,\n} from '../../kernel/errors.js'\n\n/**\n * Delete-marker predicate, duplicated (not imported) from\n * `kernel/enclave/record-keys/tombstone.ts`'s `isDeleteMarker` (#647 fix wave 1).\n * `via/lookup/**` may not statically import `kernel/enclave/` — not even the barrel\n * (Check 15, `via-enclave-isolation`) — and this predicate carries zero crypto/protected-body\n * surface (just the `_del` protocol-header field, not `_iv`/`_data`), so duplicating it here\n * mirrors the same call `port/with/i18n-strategy.ts` already makes for `isDictCollectionName`\n * (see its doc comment). Keep the two in sync if the marker shape ever changes.\n *\n * `buildDeleteMarker` (which DOES construct the protected `_iv`/`_data` body fields — Check 11,\n * `enclave-body-only`) can't be duplicated the same way; it's injected via the constructor\n * instead, built from the real `kernel/enclave` function at the Vault call site.\n */\nfunction isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/** Reserved collection name prefix. Never collides with user collections. */\nexport const DICT_COLLECTION_PREFIX = '_dict_'\n\n/** Return the adapter collection name for a named dictionary. */\nexport function dictCollectionName(dictionaryName: string): string {\n  return `${DICT_COLLECTION_PREFIX}${dictionaryName}`\n}\n\n// ─── Dictionary entry shape ────────────────────────────────────────────\n\n/**\n * One entry in a `_dict_*` collection. The record `id` (adapter-side\n * key) IS the stable dictionary key (e.g. `'paid'`). The `labels`\n * record maps locale codes to display strings.\n */\nexport interface DictEntry {\n  /** Stable key — same as the record id in the adapter. */\n  readonly key: string\n  /** Locale → label map, e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`. */\n  readonly labels: Record<string, string>\n}\n\n// ─── Per-dictionary options ────────────────────────────────────────────\n\n/**\n * Options for `vault.dictionary(name, options?)`.\n *\n * `writableBy` controls the minimum role for write operations (put,\n * putAll, delete, rename). Defaults to `'admin'` to match the standard\n * \"dictionary contents are owned by admins\" convention; set to\n * `'operator'` for user-editable dictionaries like custom tags.\n */\nexport interface DictionaryOptions {\n  /** Minimum role allowed to write dictionary entries. Default: `'admin'`. */\n  readonly writableBy?: 'owner' | 'admin' | 'operator'\n}\n\n// ─── LookupHandle ───────────────────────────────────────────────────────\n\n/**\n * Handle to a named dictionary within a vault.\n *\n * Obtained via `vault.dictionary(name)`. Provides strongly-typed\n * CRUD for dictionary entries, plus the `rename()` operation that is the\n * only sanctioned mass-mutation path for dictKey fields.\n *\n * All writes are encrypted under the compartment's DEK for the\n * `_dict_<name>` collection. Adapters never see plaintext.\n */\nexport class LookupHandle<Keys extends string = string> {\n  private readonly collName: string\n\n  /**\n   * Synchronous write-through cache for dict-join support.\n   * Populated on every `put()`, `delete()`, and `rename()`. The snapshot\n   * is built from this cache by `snapshotEntries()` — the query executor\n   * calls this synchronously inside `.toArray()`.\n   *\n   * `null` means \"not yet initialized\" — callers should use `list()`\n   * to warm the cache before using dict joins on pre-existing data.\n   */\n  private readonly _syncCache = new Map<string, DictEntry>()\n\n  /**\n   * Return all cached entries as `{ key, labels, ...labels }` records —\n   * usable synchronously by the join executor's `snapshot()` call.\n   * Returns an empty array when the cache has never been populated.\n   */\n  snapshotEntries(): readonly Record<string, unknown>[] {\n    return Array.from(this._syncCache.values()).map((e) => ({\n      key: e.key,\n      labels: e.labels,\n      ...e.labels,\n    }))\n  }\n\n  constructor(\n    private readonly adapter: NoydbStore,\n    private readonly compartmentName: string,\n    private readonly dictionaryName: string,\n    private readonly keyring: UnlockedKeyring,\n    /**\n     * The `reservedEnvelopes('_dict_')` capability — this handle's sanctioned\n     * crypto door onto its `_dict_<name>` collection (#629 Task 4). Bound by\n     * the Vault; never a keyring, raw DEK, or enclave import.\n     */\n    private readonly reservedEnvelopes: ReturnType<ViaCryptoCtx['reservedEnvelopes']>,\n    private readonly encrypted: boolean,\n    private readonly ledger: LedgerStore | undefined,\n    private readonly options: DictionaryOptions,\n    /**\n     * Callback provided by the Vault to find and rewrite records\n     * in any registered collection that has a dictKeyField pointing at\n     * this dictionary, used by `rename()`.\n     */\n    private readonly findAndUpdateReferences:\n      | ((\n          dictionaryName: string,\n          oldKey: string,\n          newKey: string,\n        ) => Promise<void>)\n      | undefined,\n    private readonly emitter: NoydbEventEmitter,\n    /**\n     * #647 fix wave 1 — mints a version-ordered delete-marker envelope (the reserved-tier\n     * mirror of #589's ordinary-collection delete marker). Injected rather than imported:\n     * `buildDeleteMarker` constructs the envelope's protected-body fields (`_iv`/`_data`), and\n     * `via/lookup/**` may not reach `kernel/enclave/` directly (Check 11\n     * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real\n     * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.\n     */\n    private readonly buildDeleteMarker: (identity: { collection: string; id: string }, version: number, actor: string) => EncryptedEnvelope,\n    /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */\n    private readonly onDirty?: (collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>,\n    /** #650 Task 4 — thin `graphDispatch.collect`-equivalent; opens/collects/flushes a one-shot wave for this touch. */\n    private readonly onRecordMutated?: (collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>,\n    /** #650 Task 5 (#648) — the real reference check `delete()`'s strict branch calls: restrict\n     *  throws `DictKeyInUseError`, cascade/nullify apply their propagation. Vault-bound; a no-op\n     *  when the dimension has no declared lookup-referencing edges. */\n    private readonly checkReferencesOnDelete?: (key: string) => Promise<unknown>,\n  ) {\n    this.collName = dictCollectionName(dictionaryName)\n  }\n\n  // ─── Access checks ────────────────────────────────────────────────\n\n  private requireWriteAccess(): void {\n    const minRole = this.options.writableBy ?? 'admin'\n    const roleRank: Record<string, number> = {\n      client: 1,\n      viewer: 2,\n      operator: 3,\n      admin: 4,\n      owner: 5,\n    }\n    const callerRank = roleRank[this.keyring.role] ?? 0\n    const requiredRank = roleRank[minRole] ?? 4\n    if (callerRank < requiredRank) {\n      throw new PermissionDeniedError(\n        `Dictionary \"${this.dictionaryName}\" writes require \"${minRole}\" role or above. ` +\n          `Current role: \"${this.keyring.role}\".`,\n      )\n    }\n  }\n\n  // ─── Internal helpers ─────────────────────────────────────────────\n\n  private async encryptEntry(entry: DictEntry, version: number): Promise<EncryptedEnvelope> {\n    if (!this.encrypted) {\n      return {\n        _noydb: NOYDB_FORMAT_VERSION,\n        _v: version,\n        _ts: new Date().toISOString(),\n        _iv: '',\n        _data: JSON.stringify(entry),\n        _by: this.keyring.userId,\n      }\n    }\n    const envelope = await this.reservedEnvelopes.encrypt(this.collName, JSON.stringify(entry), version)\n    return { ...envelope, _by: this.keyring.userId }\n  }\n\n  private async decryptEntry(envelope: EncryptedEnvelope): Promise<DictEntry> {\n    if (!this.encrypted) {\n      return JSON.parse(envelope._data) as DictEntry\n    }\n    const json = await this.reservedEnvelopes.decrypt(this.collName, envelope)\n    return JSON.parse(json) as DictEntry\n  }\n\n  /** @internal #650 Task 4 — re-read `key`'s CURRENT adapter truth into `_syncCache` (delete the\n   *  cache entry when the key is now gone). Called by `Vault._invalidateSyncApplied` after a\n   *  reserved-lookup row applies via sync, so an already-warmed snapshot/membership/altIndex read\n   *  never sees a stale verdict for a pulled vocabulary edit — the same invalidation a local\n   *  put()/delete()/rename() already triggers via `_syncCache.set`/`delete` above. */\n  async _refreshSyncCache(key: string): Promise<void> {\n    const envelope = await this.adapter.get(this.compartmentName, this.collName, key)\n    if (!envelope || isDeleteMarker(envelope)) { this._syncCache.delete(key); return }\n    this._syncCache.set(key, await this.decryptEntry(envelope))\n  }\n\n  // ─── Public API ───────────────────────────────────────────────────\n\n  /**\n   * Add or overwrite a single dictionary entry.\n   *\n   * @param key    The stable key to store (e.g. `'paid'`).\n   * @param labels Locale → label map (e.g. `{ en: 'Paid', th: 'ชำระแล้ว' }`).\n   */\n  async put(key: Keys, labels: Record<string, string>): Promise<void> {\n    this.requireWriteAccess()\n\n    const entry: DictEntry = { key, labels }\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    const version = existing ? existing._v + 1 : 1\n    const envelope = await this.encryptEntry(entry, version)\n\n    await this.adapter.put(\n      this.compartmentName,\n      this.collName,\n      key,\n      envelope,\n      existing ? existing._v : undefined,\n    )\n\n    // Maintain synchronous cache for dict-join snapshot\n    this._syncCache.set(key, entry)\n\n    // #650 Task 4 (#647) — choke-point participation: dirty-log tracking BEFORE the emit (mirrors\n    // Collection._onRecordMutated's local-write order), then the wave-open hook AFTER.\n    await this.onDirty?.(this.collName, key, 'put', version)\n\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: key,\n      action: 'put',\n    })\n\n    await this.onRecordMutated?.(this.collName, key, 'put', version)\n\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'put',\n        collection: this.collName,\n        id: key,\n        version,\n        actor: this.keyring.userId,\n        //  — must be the real envelope hash so\n        // vault.verifyBackupIntegrity()'s data-cross-check matches.\n        payloadHash: await envelopePayloadHash(envelope),\n      })\n    }\n  }\n\n  /**\n   * Batch-add or overwrite multiple dictionary entries in one call.\n   *\n   * @param entries  `{ key: { locale: label } }` map.\n   */\n  async putAll(entries: Record<Keys, Record<string, string>>): Promise<void> {\n    this.requireWriteAccess()\n    for (const [key, labels] of Object.entries(entries) as [Keys, Record<string, string>][]) {\n      await this.put(key, labels)\n    }\n  }\n\n  /**\n   * Load the label map for a single key.\n   *\n   * @returns The label map, or `null` if the key doesn't exist.\n   */\n  async get(key: Keys): Promise<Record<string, string> | null> {\n    const envelope = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    if (!envelope || isDeleteMarker(envelope)) return null\n    const entry = await this.decryptEntry(envelope)\n    return entry.labels\n  }\n\n  /**\n   * Delete a dictionary key.\n   *\n   * Default mode is `'strict'` — throws `DictKeyInUseError` if any\n   * registered collection has a record referencing this key. Pass\n   * `{ mode: 'warn' }` to skip the check (dev-mode cleanup only).\n   *\n   * Under sync, deletion writes a version-ordered delete-marker row rather than removing the\n   * adapter key outright (#647 fix wave 1) — markers accumulate over time; GC is future work,\n   * acceptable for vocabulary-scale data.\n   */\n  async delete(key: Keys, opts: { mode?: 'strict' | 'warn' } = {}): Promise<void> {\n    this.requireWriteAccess()\n\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      key,\n    )\n    if (!existing || isDeleteMarker(existing)) {\n      throw new DictKeyMissingError(this.dictionaryName, key)\n    }\n\n    // #650 Task 5 (#648) — the real reference check: restrict throws `DictKeyInUseError` naming\n    // the referencing collection, cascade/nullify apply their propagation. `mode: 'warn'` skips\n    // this entirely (today's dev-mode-cleanup escape hatch, unconditional delete). A dimension\n    // with no declared lookup-referencing edges is a no-op (undeclared refs keep dangling).\n    const mode = opts.mode ?? 'strict'\n    if (mode === 'strict') {\n      await this.checkReferencesOnDelete?.(key)\n    }\n\n    // #647 fix wave 1 — mirrors Collection._doDelete's identical `this.onDirty`-gated branch\n    // (#589): under sync, a raw adapter.delete() is invisible to a peer's next pull (the key\n    // simply stops appearing in remote.list()) — a deleted key never propagates and can be\n    // silently resurrected by a later edit. Write a version-ordered DELETE-MARKER instead, so\n    // the removal round-trips like any other row. No-op (plain adapter.delete) when sync isn't wired.\n    const nextVersion = existing._v + 1\n    if (this.onDirty) {\n      await this.adapter.put(this.compartmentName, this.collName, key, this.buildDeleteMarker({ collection: this.collName, id: key }, nextVersion, this.keyring.userId))\n    } else {\n      await this.adapter.delete(this.compartmentName, this.collName, key)\n    }\n\n    // Maintain synchronous cache for dict-join snapshot\n    this._syncCache.delete(key)\n\n    // #650 Task 4 (#647) — same choke-point ordering as put() above.\n    // #647 fix wave 1: the dirty entry's ACTION is 'put' (not 'delete') — mirrors\n    // Collection._onRecordMutated's 'local-delete' case exactly: the marker rides push's\n    // CAS-put path, not push's raw remote.delete() path (which would strip the marker off the\n    // remote too and reopen this same hole). The version is the MARKER's version, so push's CAS\n    // (expectedVersion = entry.version - 1) matches the pre-delete remote copy.\n    await this.onDirty?.(this.collName, key, 'put', nextVersion)\n\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: key,\n      action: 'delete',\n    })\n\n    await this.onRecordMutated?.(this.collName, key, 'delete', nextVersion)\n\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'delete',\n        collection: this.collName,\n        id: key,\n        version: existing._v,\n        actor: this.keyring.userId,\n        //  — for delete the prior envelope is what was just\n        // removed; we hash it so the chain captures intent. The\n        // verifyBackupIntegrity data-cross-check skips delete\n        // entries entirely (the live record is gone), but the\n        // chain still benefits from a stable non-empty hash.\n        payloadHash: await envelopePayloadHash(existing),\n      })\n    }\n  }\n\n  /**\n   * Rename a dictionary key — the only sanctioned mass-mutation path.\n   *\n   * Atomically:\n   * 1. Adds the new key with the same labels as the old key.\n   * 2. Updates every registered record that stores the old key to\n   *    store the new key instead.\n   * 3. Deletes the old key.\n   * 4. Appends a single ledger entry recording the rename.\n   *\n   * Respects ACL: throws `PermissionDeniedError` before any mutation\n   * if the caller can't write. The cascade is best-effort atomic\n   * within this call — no two-phase commit across adapter calls.\n   *\n   * Cascade-on-delete is NOT supported. Use `rename()` when you need\n   * to change a key that records reference.\n   */\n  async rename(oldKey: Keys, newKey: string): Promise<void> {\n    this.requireWriteAccess()\n\n    // 1. Load old entry\n    const existing = await this.adapter.get(\n      this.compartmentName,\n      this.collName,\n      oldKey,\n    )\n    if (!existing || isDeleteMarker(existing)) {\n      throw new DictKeyMissingError(this.dictionaryName, oldKey)\n    }\n    const oldEntry = await this.decryptEntry(existing)\n\n    // 2. Write new key\n    const newEntry: DictEntry = { key: newKey, labels: oldEntry.labels }\n    const newEnvelope = await this.encryptEntry(newEntry, 1)\n    await this.adapter.put(\n      this.compartmentName,\n      this.collName,\n      newKey,\n      newEnvelope,\n    )\n\n    // #670 — publish newKey to the sync cache BEFORE step 3 rewrites referencing records: a\n    // vocabulary:'closed' referencing field's enforceWrite reads checkLookupMembership ->\n    // snapshotEntries() -> this._syncCache, so if newKey isn't a member yet, step 3's own write of\n    // newKey into those records self-refuses with UnknownLookupKeyError. Transition semantics:\n    // mid-rename BOTH oldKey and newKey are legitimately members (records are transitioning\n    // old->new during the rewrite) — oldKey stays a member until its removal completes below.\n    this._syncCache.set(newKey, newEntry)\n\n    // 3. Update all referencing records in registered collections\n    if (this.findAndUpdateReferences) {\n      await this.findAndUpdateReferences(this.dictionaryName, oldKey, newKey)\n    }\n\n    // 4. Remove old key — #647 fix wave 1: same delete-marker convention as delete() above, so\n    // the old key's removal propagates on sync instead of leaving a phantom stale row on a peer\n    // that only observes the new key arriving.\n    const oldKeyNextVersion = existing._v + 1\n    if (this.onDirty) {\n      await this.adapter.put(this.compartmentName, this.collName, oldKey, this.buildDeleteMarker({ collection: this.collName, id: oldKey }, oldKeyNextVersion, this.keyring.userId))\n    } else {\n      await this.adapter.delete(this.compartmentName, this.collName, oldKey)\n    }\n\n    // Maintain synchronous cache for dict-join snapshot — oldKey's removal from the cache lands\n    // here (after step 3), completing the old->new membership transition begun above.\n    this._syncCache.delete(oldKey)\n\n    // #650 Task 4 (#647) — same choke-point ordering as put()/delete() above, for BOTH touches.\n    // #647 fix wave 1: oldKey's dirty action is 'put' (not 'delete') — see delete()'s comment\n    // above for why the marker must ride push's CAS-put path, at the marker's version.\n    await this.onDirty?.(this.collName, oldKey, 'put', oldKeyNextVersion)\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: oldKey,\n      action: 'delete',\n    })\n    await this.onRecordMutated?.(this.collName, oldKey, 'delete', oldKeyNextVersion)\n\n    await this.onDirty?.(this.collName, newKey, 'put', 1)\n    this.emitter.emit('change', {\n      vault: this.compartmentName,\n      collection: this.collName,\n      id: newKey,\n      action: 'put',\n    })\n    await this.onRecordMutated?.(this.collName, newKey, 'put', 1)\n\n    // 5. Ledger — record the rename as delete(oldKey) + put(newKey)\n    // so verifyBackupIntegrity()'s data-cross-check matches reality\n    // (the oldKey envelope is gone; the newKey envelope is what was\n    // just written). Two entries instead of one — the chain still\n    // captures the rename intent via the matching ts + actor.\n    if (this.ledger) {\n      await this.ledger.append({\n        op: 'delete',\n        collection: this.collName,\n        id: oldKey,\n        version: existing._v,\n        actor: this.keyring.userId,\n        payloadHash: await envelopePayloadHash(existing),\n      })\n      await this.ledger.append({\n        op: 'put',\n        collection: this.collName,\n        id: newKey,\n        version: 1,\n        actor: this.keyring.userId,\n        payloadHash: await envelopePayloadHash(newEnvelope),\n      })\n    }\n  }\n\n  /**\n   * List all entries in this dictionary.\n   *\n   * @returns Array of `{ key, labels }` objects.\n   */\n  async list(): Promise<DictEntry[]> {\n    const keys = await this.adapter.list(this.compartmentName, this.collName)\n    const entries: DictEntry[] = []\n    for (const key of keys) {\n      const envelope = await this.adapter.get(\n        this.compartmentName,\n        this.collName,\n        key,\n      )\n      // #647 fix wave 1 — a delete-marker row is a removed key, not a live entry: exclude it\n      // from the listing and drop any stale cache entry a prior warm may have left under it.\n      if (!envelope || isDeleteMarker(envelope)) { this._syncCache.delete(key); continue }\n      const entry = await this.decryptEntry(envelope)\n      entries.push(entry)\n      // Warm the synchronous cache\n      this._syncCache.set(key, entry)\n    }\n    return entries\n  }\n\n  /**\n   * Resolve a key to its label for the given locale.\n   *\n   * Used by the collection's locale-aware read path to populate\n   * `<field>Label` virtual fields. Returns `undefined` when the\n   * key doesn't exist or has no label for the requested locale\n   * (after exhausting the fallback chain).\n   */\n  async resolveLabel(\n    key: string,\n    locale: string,\n    fallback?: string | readonly string[],\n  ): Promise<string | undefined> {\n    const labels = await this.get(key as Keys)\n    if (!labels) return undefined\n\n    // Try primary locale\n    if (labels[locale] !== undefined) return labels[locale]\n\n    // Try fallback chain\n    const chain = Array.isArray(fallback) ? (fallback as readonly string[]) : fallback ? [fallback as string] : []\n    for (const fb of chain) {\n      if (fb === 'any') {\n        // Return any available label\n        const any = Object.values(labels)[0]\n        if (any !== undefined) return any\n      } else if (labels[fb] !== undefined) {\n        return labels[fb]\n      }\n    }\n\n    return undefined\n  }\n}\n\n// Compat alias — existing importers of `DictionaryHandle` (the pre-#650\n// name) keep compiling unchanged. `via/i18n/dictionary.ts` re-exports\n// this same binding for one release.\nexport { LookupHandle as DictionaryHandle }\n"],"mappings":";;;;;;;;;;;;AA0CA,SAAS,eAAe,UAAsC;AAC5D,SAAO,SAAS,SAAS;AAC3B;AAGO,IAAM,yBAAyB;AAG/B,SAAS,mBAAmB,gBAAgC;AACjE,SAAO,GAAG,sBAAsB,GAAG,cAAc;AACnD;AA2CO,IAAM,eAAN,MAAiD;AAAA,EA2BtD,YACmB,SACA,iBACA,gBACA,SAMA,mBACA,WACA,QACA,SAMA,yBAOA,SASA,mBAEA,SAEA,iBAIA,yBACjB;AA3CiB;AACA;AACA;AACA;AAMA;AACA;AACA;AACA;AAMA;AAOA;AASA;AAEA;AAEA;AAIA;AAEjB,SAAK,WAAW,mBAAmB,cAAc;AAAA,EACnD;AAAA,EA7CmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAMA;AAAA,EAOA;AAAA,EASA;AAAA,EAEA;AAAA,EAEA;AAAA,EAIA;AAAA,EArEF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzD,kBAAsD;AACpD,WAAO,MAAM,KAAK,KAAK,WAAW,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MACtD,KAAK,EAAE;AAAA,MACP,QAAQ,EAAE;AAAA,MACV,GAAG,EAAE;AAAA,IACP,EAAE;AAAA,EACJ;AAAA;AAAA,EAoDQ,qBAA2B;AACjC,UAAM,UAAU,KAAK,QAAQ,cAAc;AAC3C,UAAM,WAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,UAAM,aAAa,SAAS,KAAK,QAAQ,IAAI,KAAK;AAClD,UAAM,eAAe,SAAS,OAAO,KAAK;AAC1C,QAAI,aAAa,cAAc;AAC7B,YAAM,IAAI;AAAA,QACR,eAAe,KAAK,cAAc,qBAAqB,OAAO,mCAC1C,KAAK,QAAQ,IAAI;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,aAAa,OAAkB,SAA6C;AACxF,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,IAAI;AAAA,QACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC5B,KAAK;AAAA,QACL,OAAO,KAAK,UAAU,KAAK;AAAA,QAC3B,KAAK,KAAK,QAAQ;AAAA,MACpB;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,kBAAkB,QAAQ,KAAK,UAAU,KAAK,UAAU,KAAK,GAAG,OAAO;AACnG,WAAO,EAAE,GAAG,UAAU,KAAK,KAAK,QAAQ,OAAO;AAAA,EACjD;AAAA,EAEA,MAAc,aAAa,UAAiD;AAC1E,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,KAAK,MAAM,SAAS,KAAK;AAAA,IAClC;AACA,UAAM,OAAO,MAAM,KAAK,kBAAkB,QAAQ,KAAK,UAAU,QAAQ;AACzE,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,KAA4B;AAClD,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,GAAG;AAChF,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AAAE,WAAK,WAAW,OAAO,GAAG;AAAG;AAAA,IAAO;AACjF,SAAK,WAAW,IAAI,KAAK,MAAM,KAAK,aAAa,QAAQ,CAAC;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAI,KAAW,QAA+C;AAClE,SAAK,mBAAmB;AAExB,UAAM,QAAmB,EAAE,KAAK,OAAO;AACvC,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,UAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,UAAM,WAAW,MAAM,KAAK,aAAa,OAAO,OAAO;AAEvD,UAAM,KAAK,QAAQ;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW,SAAS,KAAK;AAAA,IAC3B;AAGA,SAAK,WAAW,IAAI,KAAK,KAAK;AAI9B,UAAM,KAAK,UAAU,KAAK,UAAU,KAAK,OAAO,OAAO;AAEvD,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,kBAAkB,KAAK,UAAU,KAAK,OAAO,OAAO;AAE/D,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,KAAK,QAAQ;AAAA;AAAA;AAAA,QAGpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAA8D;AACzE,SAAK,mBAAmB;AACxB,eAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,OAAO,GAAuC;AACvF,YAAM,KAAK,IAAI,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAI,KAAmD;AAC3D,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,EAAG,QAAO;AAClD,UAAM,QAAQ,MAAM,KAAK,aAAa,QAAQ;AAC9C,WAAO,MAAM;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,OAAO,KAAW,OAAqC,CAAC,GAAkB;AAC9E,SAAK,mBAAmB;AAExB,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AACzC,YAAM,IAAI,oBAAoB,KAAK,gBAAgB,GAAG;AAAA,IACxD;AAMA,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,SAAS,UAAU;AACrB,YAAM,KAAK,0BAA0B,GAAG;AAAA,IAC1C;AAOA,UAAM,cAAc,SAAS,KAAK;AAClC,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,KAAK,KAAK,kBAAkB,EAAE,YAAY,KAAK,UAAU,IAAI,IAAI,GAAG,aAAa,KAAK,QAAQ,MAAM,CAAC;AAAA,IACnK,OAAO;AACL,YAAM,KAAK,QAAQ,OAAO,KAAK,iBAAiB,KAAK,UAAU,GAAG;AAAA,IACpE;AAGA,SAAK,WAAW,OAAO,GAAG;AAQ1B,UAAM,KAAK,UAAU,KAAK,UAAU,KAAK,OAAO,WAAW;AAE3D,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,KAAK,kBAAkB,KAAK,UAAU,KAAK,UAAU,WAAW;AAEtE,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS,SAAS;AAAA,QAClB,OAAO,KAAK,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,QAAc,QAA+B;AACxD,SAAK,mBAAmB;AAGxB,UAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,MAClC,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AACzC,YAAM,IAAI,oBAAoB,KAAK,gBAAgB,MAAM;AAAA,IAC3D;AACA,UAAM,WAAW,MAAM,KAAK,aAAa,QAAQ;AAGjD,UAAM,WAAsB,EAAE,KAAK,QAAQ,QAAQ,SAAS,OAAO;AACnE,UAAM,cAAc,MAAM,KAAK,aAAa,UAAU,CAAC;AACvD,UAAM,KAAK,QAAQ;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAQA,SAAK,WAAW,IAAI,QAAQ,QAAQ;AAGpC,QAAI,KAAK,yBAAyB;AAChC,YAAM,KAAK,wBAAwB,KAAK,gBAAgB,QAAQ,MAAM;AAAA,IACxE;AAKA,UAAM,oBAAoB,SAAS,KAAK;AACxC,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,IAAI,KAAK,iBAAiB,KAAK,UAAU,QAAQ,KAAK,kBAAkB,EAAE,YAAY,KAAK,UAAU,IAAI,OAAO,GAAG,mBAAmB,KAAK,QAAQ,MAAM,CAAC;AAAA,IAC/K,OAAO;AACL,YAAM,KAAK,QAAQ,OAAO,KAAK,iBAAiB,KAAK,UAAU,MAAM;AAAA,IACvE;AAIA,SAAK,WAAW,OAAO,MAAM;AAK7B,UAAM,KAAK,UAAU,KAAK,UAAU,QAAQ,OAAO,iBAAiB;AACpE,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,KAAK,kBAAkB,KAAK,UAAU,QAAQ,UAAU,iBAAiB;AAE/E,UAAM,KAAK,UAAU,KAAK,UAAU,QAAQ,OAAO,CAAC;AACpD,SAAK,QAAQ,KAAK,UAAU;AAAA,MAC1B,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,KAAK,kBAAkB,KAAK,UAAU,QAAQ,OAAO,CAAC;AAO5D,QAAI,KAAK,QAAQ;AACf,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS,SAAS;AAAA,QAClB,OAAO,KAAK,QAAQ;AAAA,QACpB,aAAa,MAAM,oBAAoB,QAAQ;AAAA,MACjD,CAAC;AACD,YAAM,KAAK,OAAO,OAAO;AAAA,QACvB,IAAI;AAAA,QACJ,YAAY,KAAK;AAAA,QACjB,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO,KAAK,QAAQ;AAAA,QACpB,aAAa,MAAM,oBAAoB,WAAW;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAA6B;AACjC,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,iBAAiB,KAAK,QAAQ;AACxE,UAAM,UAAuB,CAAC;AAC9B,eAAW,OAAO,MAAM;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ;AAAA,QAClC,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,MACF;AAGA,UAAI,CAAC,YAAY,eAAe,QAAQ,GAAG;AAAE,aAAK,WAAW,OAAO,GAAG;AAAG;AAAA,MAAS;AACnF,YAAM,QAAQ,MAAM,KAAK,aAAa,QAAQ;AAC9C,cAAQ,KAAK,KAAK;AAElB,WAAK,WAAW,IAAI,KAAK,KAAK;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,KACA,QACA,UAC6B;AAC7B,UAAM,SAAS,MAAM,KAAK,IAAI,GAAW;AACzC,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,OAAO,MAAM,MAAM,OAAW,QAAO,OAAO,MAAM;AAGtD,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAK,WAAiC,WAAW,CAAC,QAAkB,IAAI,CAAC;AAC7G,eAAW,MAAM,OAAO;AACtB,UAAI,OAAO,OAAO;AAEhB,cAAM,MAAM,OAAO,OAAO,MAAM,EAAE,CAAC;AACnC,YAAI,QAAQ,OAAW,QAAO;AAAA,MAChC,WAAW,OAAO,EAAE,MAAM,QAAW;AACnC,eAAO,OAAO,EAAE;AAAA,MAClB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-P5ARVLNW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nexport const FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner secret. */\n  readonly reKey?: { readonly secret: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: '', _data: body, _by: opts.actorUserId },\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBO,IAAM,8BAA8B;AAC3C,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,UAAU,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,YAAY;AAAA,IAClG;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}

package/dist/chunk-QJBXB4WU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/directory/storage.ts","../src/with-party/directory/visibility.ts","../src/with-party/directory/user-envelope/storage.ts"],"sourcesContent":["/**\n * Persistence helpers for the vault-level user-directory toggle\n * (`_meta/directory`). Mirrors the bypass-AES pattern used by\n * `_meta/policy` — the directory document is plain JSON, the\n * envelope's `_iv` field is left empty.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { DirectoryConfig } from './types.js'\n\n/** Reserved collection name for vault-level metadata documents. */\nexport const META_COLLECTION = '_meta'\n/** Reserved id for the vault-level directory document. */\nexport const DIRECTORY_RECORD_ID = 'directory'\n\n/**\n * Read the directory toggle from `_meta/directory`. Returns `undefined`\n * when no document has been persisted — callers treat that as the\n * default-on case (`{ enabled: true }`).\n *\n * Tolerates corrupted documents the same way `_meta/policy` does: a\n * JSON parse failure surfaces as `undefined`, not a thrown error, so a\n * bad write never permanently breaks team enumeration.\n */\nexport async function readDirectoryConfig(\n  store: NoydbStore,\n  vault: string,\n): Promise<DirectoryConfig | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, DIRECTORY_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isDirectoryConfig(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the directory toggle at `_meta/directory`. Idempotent — call\n * on every `db.setDirectoryEnabled()` invocation. Owner-only at the\n * caller site; this primitive does not check roles.\n */\nexport async function persistDirectoryConfig(\n  store: NoydbStore,\n  vault: string,\n  config: DirectoryConfig,\n): Promise<void> {\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify({ enabled: config.enabled }),\n  }\n  await store.put(vault, META_COLLECTION, DIRECTORY_RECORD_ID, envelope)\n}\n\nfunction isDirectoryConfig(x: unknown): x is DirectoryConfig {\n  if (x === null || typeof x !== 'object') return false\n  if (!('enabled' in x)) return false\n  return typeof (x as { enabled: unknown }).enabled === 'boolean'\n}\n","/**\n * Persistence helpers for the per-user visibility flag\n * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used\n * by `_meta/policy` — the visibility document is plain JSON, the\n * envelope's `_iv` field is left empty.\n *\n * Stored alongside the keyring file rather than inside the encrypted\n * user envelope (`_users/<keyringId>`) because:\n *\n *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not\n *    introspect or reserve any keys inside it. Adding `hidden` there\n *    would violate that contract.\n *  - `listUsersWithEnvelopes` filters by the flag, and the filter must\n *    work even when decryption fails (legacy keyrings predating the\n *    envelope feature, or a corrupted envelope).\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UserVisibility } from './types.js'\nimport { META_COLLECTION } from './storage.js'\n\n/** Prefix for per-user visibility records inside `_meta`. */\nexport const VISIBILITY_RECORD_PREFIX = 'visibility/'\n\n/** Compose the `_meta` record id for a keyring's visibility doc. */\nexport function visibilityRecordId(keyringId: string): string {\n  return VISIBILITY_RECORD_PREFIX + keyringId\n}\n\n/**\n * Read the visibility flag for `keyringId`. Returns `undefined` when no\n * document has been persisted — callers treat that as the default-visible\n * case (`{ hidden: false }`).\n */\nexport async function readUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<UserVisibility | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, visibilityRecordId(keyringId))\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isUserVisibility(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the visibility flag for `keyringId` at\n * `_meta/visibility/<keyringId>`. Idempotent — call on every\n * `vault.user.setMyVisibility()` invocation. Own-only at the caller\n * site; this primitive does not enforce keyring ownership.\n */\nexport async function persistUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  visibility: UserVisibility,\n): Promise<void> {\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify({ hidden: visibility.hidden }),\n  }\n  await store.put(vault, META_COLLECTION, visibilityRecordId(keyringId), envelope)\n}\n\n/**\n * Delete the visibility flag for `keyringId`. Called from `revoke()`\n * alongside `deleteUserEnvelope` so the sidecar does not leak to a\n * re-granted principal with the same `userId`. Idempotent — the store's\n * `delete()` is already a no-op when the record is absent.\n */\nexport async function deleteUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<void> {\n  await store.delete(vault, META_COLLECTION, visibilityRecordId(keyringId))\n}\n\nfunction isUserVisibility(x: unknown): x is UserVisibility {\n  if (x === null || typeof x !== 'object') return false\n  if (!('hidden' in x)) return false\n  return typeof (x as { hidden: unknown }).hidden === 'boolean'\n}\n","/**\n * Persistence helpers for per-principal user envelopes stored at\n * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).\n *\n * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user\n * envelopes carry user data and are encrypted with a dedicated\n * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and\n * propagated to every keyring via the system-collection DEK path in\n * `team/keyring.ts`).\n *\n * This module is the **storage primitive** layer. The public API\n * (`vault.user.*`) sits on top of this; permission gates, own-only\n * write enforcement, and presence-channel propagation live there.\n *\n * @see design-history/2026-05-05-user-envelope-design.md\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope, UserEnvelope } from '../../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../../kernel/enclave/index.js'\nimport { ConflictError, UserEnvelopeOversizedError } from '../../../kernel/errors.js'\nimport {\n  USER_ENVELOPE_COLLECTION,\n  USER_ENVELOPE_MAX_BYTES,\n} from '../../../kernel/constants.js'\n\n/**\n * Read and decrypt the user envelope for `keyringId`. Returns `null`\n * when no envelope has been persisted (either the principal has never\n * called `updateMe`, or the keyring predates this feature).\n *\n * Decryption errors propagate — a tampered or wrong-keyed envelope\n * surfaces as the underlying crypto error rather than masquerading as\n * \"not found\".\n */\nexport async function loadUserEnvelope<T = unknown>(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  dek: EnclaveKey,\n): Promise<UserEnvelope<T> | null> {\n  const envelope = await store.get(vault, USER_ENVELOPE_COLLECTION, keyringId)\n  if (!envelope) return null\n  const plaintext = await openEnvelopeJson(envelope, dek)\n  const data = JSON.parse(plaintext) as T\n  return {\n    keyringId,\n    data,\n    _v: envelope._v,\n    _ts: envelope._ts,\n  }\n}\n\n/**\n * Encrypt and persist the user envelope for `keyringId`. The new\n * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable\n * optimistic-concurrency checks: a mismatch with the stored version\n * throws {@link ConflictError} with the actual stored version.\n *\n * `expectedVersion: 0` means \"expect no prior envelope\"; the write\n * succeeds only if no envelope exists yet.\n *\n * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};\n * larger payloads throw {@link UserEnvelopeOversizedError}.\n */\nexport async function saveUserEnvelope<T>(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  payload: T,\n  dek: EnclaveKey,\n  expectedVersion?: number,\n): Promise<UserEnvelope<T>> {\n  const json = JSON.stringify(payload)\n  // TextEncoder counts bytes correctly for multi-byte UTF-8 (Thai text,\n  // emoji, etc.) — JSON.stringify().length would undercount.\n  const bytes = new TextEncoder().encode(json).byteLength\n  if (bytes > USER_ENVELOPE_MAX_BYTES) {\n    throw new UserEnvelopeOversizedError(bytes)\n  }\n\n  const prior = await store.get(vault, USER_ENVELOPE_COLLECTION, keyringId)\n  if (expectedVersion !== undefined) {\n    const priorVersion = prior?._v ?? 0\n    if (priorVersion !== expectedVersion) {\n      throw new ConflictError(\n        priorVersion,\n        `User envelope for \"${keyringId}\" expected version ${expectedVersion}, ` +\n          `actual ${priorVersion}`,\n      )\n    }\n  }\n\n  const nextVersion = (prior?._v ?? 0) + 1\n  const ts = new Date().toISOString()\n  const { iv, data } = await encrypt(json, dek)\n\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: nextVersion,\n    _ts: ts,\n    _iv: iv,\n    _data: data,\n  }\n  await store.put(vault, USER_ENVELOPE_COLLECTION, keyringId, envelope)\n\n  return {\n    keyringId,\n    data: payload,\n    _v: nextVersion,\n    _ts: ts,\n  }\n}\n\n/**\n * Delete the user envelope for `keyringId`. Idempotent — no error if\n * the envelope is already absent. Called from the keyring revoke path\n * (cascade-delete) and is a no-op for keyrings that never wrote.\n */\nexport async function deleteUserEnvelope(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<void> {\n  await store.delete(vault, USER_ENVELOPE_COLLECTION, keyringId)\n}\n\n/**\n * List the keyring ids that have a user envelope persisted in `vault`.\n * Order is store-defined — callers that need a stable order should sort.\n */\nexport async function listUserEnvelopeIds(\n  store: NoydbStore,\n  vault: string,\n): Promise<string[]> {\n  return store.list(vault, USER_ENVELOPE_COLLECTION)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgBO,IAAM,kBAAkB;AAExB,IAAM,sBAAsB;AAWnC,eAAsB,oBACpB,OACA,OACsC;AACtC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,mBAAmB;AAC5E,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,kBAAkB,MAAM,EAAG,QAAO;AACvC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,uBACpB,OACA,OACA,QACe;AACf,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,QAAQ,CAAC;AAAA,EACnD;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,qBAAqB,QAAQ;AACvE;AAEA,SAAS,kBAAkB,GAAkC;AAC3D,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,aAAa,GAAI,QAAO;AAC9B,SAAO,OAAQ,EAA2B,YAAY;AACxD;;;ACzCO,IAAM,2BAA2B;AAGjC,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,2BAA2B;AACpC;AAOA,eAAsB,mBACpB,OACA,OACA,WACqC;AACrC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,mBAAmB,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,sBACpB,OACA,OACA,WACA,YACe;AACf,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrD;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,mBAAmB,SAAS,GAAG,QAAQ;AACjF;AAQA,eAAsB,qBACpB,OACA,OACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,iBAAiB,mBAAmB,SAAS,CAAC;AAC1E;AAEA,SAAS,iBAAiB,GAAiC;AACzD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,YAAY,GAAI,QAAO;AAC7B,SAAO,OAAQ,EAA0B,WAAW;AACtD;;;AC3DA,eAAsB,iBACpB,OACA,OACA,WACA,KACiC;AACjC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,0BAA0B,SAAS;AAC3E,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,QAAM,OAAO,KAAK,MAAM,SAAS;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,IAAI,SAAS;AAAA,IACb,KAAK,SAAS;AAAA,EAChB;AACF;AAcA,eAAsB,iBACpB,OACA,OACA,WACA,SACA,KACA,iBAC0B;AAC1B,QAAM,OAAO,KAAK,UAAU,OAAO;AAGnC,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AAC7C,MAAI,QAAQ,yBAAyB;AACnC,UAAM,IAAI,2BAA2B,KAAK;AAAA,EAC5C;AAEA,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,0BAA0B,SAAS;AACxE,MAAI,oBAAoB,QAAW;AACjC,UAAM,eAAe,OAAO,MAAM;AAClC,QAAI,iBAAiB,iBAAiB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,sBAAsB,SAAS,sBAAsB,eAAe,YACxD,YAAY;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,OAAO,MAAM,KAAK;AACvC,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAE5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,OAAO,0BAA0B,WAAW,QAAQ;AAEpE,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AACF;AAOA,eAAsB,mBACpB,OACA,OACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,0BAA0B,SAAS;AAC/D;AAMA,eAAsB,oBACpB,OACA,OACmB;AACnB,SAAO,MAAM,KAAK,OAAO,wBAAwB;AACnD;","names":[]}

package/dist/chunk-QKRJUPAC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/team/deed.ts","../src/with-party/custody/liberate.ts"],"sourcesContent":["/**\n * FR-6 — Deed: sealed / hidden-owner provisioning.\n *\n * A **Deed** is a vault owned by a *latent* principal who never\n * authenticates. The owner credential (the random secret that\n * derives `KEK_owner`) is minted machine-side and sealed under a\n * **non-firm** {@link SealingKeyProvider} — that sealing boundary is\n * the cryptographic *inalienability anchor*: whoever holds the\n * provider (the client / their KMS) is the only party that can ever\n * re-derive `KEK_owner`. A firm-side custodian operates the vault\n * fully but can never reach the owner key — there is deliberately NO\n * firm-controlled fallback.\n *\n * Provisioning reuses the managed-mode seam:\n *   - {@link resolveManagedSecret} mints + seals + persists the random\n *     secret at `_meta/sealed-secret` (and unseals it on every\n *     subsequent open through the same provider).\n *   - {@link createOwnerKeyring} derives `KEK_owner` from that\n *     secret and writes the `_keyring/<ownerUserId>` file.\n *\n * On top of that, a Deed writes a `_meta/deed` **marker**. The marker\n * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH\n * sealing boundary protects them, so it must be readable without\n * unlocking the vault (a custodian or auditor inspecting the vault must\n * be able to see \"this is a Deed vault, owner = X, sealed under Y\"\n * without any key). The marker itself is therefore never sealed; only\n * the owner *credential* is.\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { createOwnerKeyring } from './keyring.js'\nimport type { SealingKeyProvider } from './managed-secret.js'\nimport { resolveManagedSecret } from './managed-secret.js'\n\n/** Reserved id for the Deed marker under `_meta`. */\nexport const DEED_RECORD_ID = 'deed' as const\n\n/**\n * Plaintext metadata recording a vault's latent-owner Deed. Persisted\n * at `_meta/deed`. Readable without unlocking the vault by design — it\n * carries no secret material, only the identity of the latent owner\n * and the sealing boundary that anchors inalienability.\n */\nexport interface DeedMarker {\n  /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */\n  readonly ownerUserId: string\n  /**\n   * The `SealingKeyProvider.id` the owner credential is sealed under.\n   * The inalienability anchor: only the holder of this (non-firm)\n   * provider can re-derive `KEK_owner`. Audit metadata — never secret.\n   */\n  readonly sealedUnder: string\n  /** Always `true` for a Deed — the owner never authenticates interactively. */\n  readonly latent: true\n  /** ISO-8601 timestamp the Deed was issued. */\n  readonly issuedAt: string\n  /**\n   * ISO-8601 timestamp the vault was liberated (a new owner claimed it\n   * via the audited Liberate ceremony), if any. Absent until liberation.\n   */\n  readonly liberatedAt?: string\n}\n\n/**\n * Wire-format payload stored inside the `_meta/deed` envelope. Carries\n * a magic marker for forensics + the {@link DeedMarker} fields. JSON,\n * AES-GCM bypassed (the marker is plaintext metadata by design).\n */\ninterface DeedEnvelopePayload extends DeedMarker {\n  readonly _noydb_deed: 1\n}\n\n/**\n * Provision a Deed: a latent owner whose credential is sealed under\n * `sealing` (a NON-firm provider). Mints + seals the owner secret\n * via {@link resolveManagedSecret}, derives the owner keyring via\n * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`\n * marker. Returns the unlocked owner keyring.\n *\n * The returned keyring is the only in-memory window onto `KEK_owner`\n * for this call; the persistent re-entry point is the sealing provider\n * (re-run {@link resolveManagedSecret} with the same provider to\n * re-resolve the secret, then {@link createOwnerKeyring}/load to\n * unlock — no interactive secret is ever required).\n *\n * There is deliberately no firm-controlled fallback: the marker's\n * `sealedUnder` is the single cryptographic anchor of ownership.\n */\nexport async function createDeedOwner(\n  store: NoydbStore,\n  vault: string,\n  ownerUserId: string,\n  sealing: SealingKeyProvider,\n): Promise<UnlockedKeyring> {\n  // 1. Mint + seal + persist the random owner secret under the\n  //    non-firm provider (writes _meta/sealed-secret).\n  const secret = await resolveManagedSecret(store, vault, sealing)\n\n  // 2. Derive KEK_owner from the (never-human-seen) secret and\n  //    write the owner keyring file.\n  const keyring = await createOwnerKeyring(store, vault, { userId: ownerUserId, secret: secret })\n\n  // 3. Write the plaintext Deed marker. NOT sealed — it is audit\n  //    metadata that must be readable without unlocking.\n  await saveDeedMarker(store, vault, {\n    ownerUserId,\n    sealedUnder: sealing.id,\n    latent: true,\n    issuedAt: new Date().toISOString(),\n  })\n\n  return keyring\n}\n\n/**\n * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault\n * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no\n * unlocking required.\n */\nexport async function loadDeedMarker(\n  store: NoydbStore,\n  vault: string,\n): Promise<DeedMarker | null> {\n  const envelope = await store.get(vault, '_meta', DEED_RECORD_ID)\n  if (!envelope) return null\n  let payload: unknown\n  try {\n    payload = JSON.parse(envelope._data)\n  } catch {\n    return null\n  }\n  if (typeof payload !== 'object' || payload === null) return null\n  const r = payload as Record<string, unknown>\n  if (r._noydb_deed !== 1) return null\n  if (\n    typeof r.ownerUserId !== 'string'\n    || typeof r.sealedUnder !== 'string'\n    || r.latent !== true\n    || typeof r.issuedAt !== 'string'\n  ) {\n    return null\n  }\n  const marker: DeedMarker = {\n    ownerUserId: r.ownerUserId,\n    sealedUnder: r.sealedUnder,\n    latent: true,\n    issuedAt: r.issuedAt,\n    ...(typeof r.liberatedAt === 'string' ? { liberatedAt: r.liberatedAt } : {}),\n  }\n  return marker\n}\n\n/** Whether `vault` carries a Deed marker (a sealed/latent owner). */\nexport async function isDeedVault(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  return (await loadDeedMarker(store, vault)) !== null\n}\n\n/**\n * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors\n * `saveSealedSecret`'s envelope shape: a standard\n * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the\n * payload stored as plaintext JSON in `_data`. The marker is metadata,\n * not a secret — sealing it would defeat its purpose (auditors /\n * custodians must read it without a key).\n *\n * @internal — used by `createDeedOwner` and (later) the Liberate\n * ceremony to stamp `liberatedAt`.\n */\nexport async function saveDeedMarker(\n  store: NoydbStore,\n  vault: string,\n  marker: DeedMarker,\n): Promise<void> {\n  const persisted: DeedEnvelopePayload = { _noydb_deed: 1, ...marker }\n  const prior = await store.get(vault, '_meta', DEED_RECORD_ID)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    // AES-GCM bypassed — the marker is plaintext audit metadata.\n    _iv: '',\n    _data: JSON.stringify(persisted),\n  }\n  await store.put(vault, '_meta', DEED_RECORD_ID, env)\n}\n","/**\n * `liberateVault` — the audited claim of ownership over a\n * sealed-owner (Deed) vault. The inverse of withdrawal.\n *\n * A **Deed** vault's owner credential is sealed under a non-firm provider, so\n * the firm-side **custodian** (which holds every collection DEK and operates\n * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route\n * by which a custodian assumes ownership, and it is deliberately a manual,\n * audited ceremony:\n *\n *   1. gate `'liberate-vault'` (fail-closed)\n *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)\n *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —\n *      but PRESERVE the live data for the new owner (see the freeze decision\n *      below)\n *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new\n *      owner's KEK\n *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`\n *   6. stamp the `_meta/deed` marker with `liberatedAt`\n *\n * ## Security: the inalienability floor\n *\n * Liberation **mints a new owner from the custodian's DEKs** — it does NOT\n * unseal the original sealed owner. The old sealed-owner credential is left\n * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still\n * sealed under the non-firm provider), never impersonated. The new owner is a\n * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This\n * preserves the inalienability floor: the act of claiming ownership is itself\n * auditable and produces a different principal, rather than silently assuming\n * the latent owner's identity.\n *\n * ## Freeze decision: snapshot-only, not freeze-and-delete\n *\n * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned\n * snapshot and THEN delete-closures the live records — correct for a\n * destructive withdrawal, WRONG for liberation. Liberation transfers\n * operational continuity; it must leave the live data intact for the new\n * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`\n * (factored out of that module; the freeze-AND-delete withdrawal path is\n * unchanged) to pin the evidence snapshot while preserving the records.\n *\n * @module\n */\n\nimport type { Vault } from '../../kernel/vault.js'\nimport type { FactorProofBundle, KeyringFile } from '../../kernel/types.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\nimport { wrapKey } from '../../kernel/enclave/index.js'\nimport { createOwnerKeyring } from '../team/keyring.js'\nimport type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js'\nimport { freezeSnapshotOnly } from '../../with-audit/portability/withdraw-accessible.js'\nimport { loadDeedMarker, saveDeedMarker } from '../team/deed.js'\n\nexport interface LiberateOptions {\n  /** The id of the new owner principal the custodian mints by claiming ownership. */\n  readonly newOwnerId: string\n  /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */\n  readonly newOwnerSecret: string\n  /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */\n  readonly legalBasis: string\n  readonly factors?: FactorProofBundle\n}\n\nexport interface LiberateResult {\n  /** The hash-pinned pre-liberation evidence snapshot. */\n  readonly snapshot: FrozenSnapshotRef\n}\n\n/**\n * Audited claim of ownership over a sealed-owner vault by its custodian. See\n * the module doc for the full ceremony + security rationale.\n */\nexport async function liberateVault(\n  vault: Vault,\n  opts: LiberateOptions,\n): Promise<LiberateResult> {\n  // 1. gate — fail-closed `liberate-vault`.\n  await vault.noydb.checkGate(vault.name, 'liberate-vault', opts.factors)\n\n  // 2. caller must be the custodian (the de-facto authority holding the DEKs).\n  const { name: vaultName, adapter, keyring } = vault._introspectState()\n  if (keyring.role !== 'custodian') {\n    throw new PermissionDeniedError(\n      'liberation is claimed only by the custodian (the de-facto authority holding the DEKs)',\n    )\n  }\n\n  // Refuse to clobber an existing principal: the new owner must be a FRESH id.\n  // (Checked before any side effect so a colliding id never leaves a half-run\n  //  ceremony — no orphan snapshot, no partial keyring overwrite.)\n  const existing = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (existing) {\n    throw new PermissionDeniedError(\n      `liberateVault: newOwnerId \"${opts.newOwnerId}\" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`,\n    )\n  }\n\n  // 3. Pre-liberation EVIDENCE snapshot of every operational collection —\n  //    snapshot-only (live data preserved for the new owner; liberation\n  //    transfers operational continuity, it does not erase).\n  const collections = await listOperationalCollections(vault)\n  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId })\n\n  // 4. Mint a NEW owner keyring, re-wrapping the incumbent DEKs under the new\n  //    owner's fresh KEK. The old sealed owner is NOT unsealed — a DISTINCT\n  //    principal is minted and the original owner credential is left orphaned\n  //    (inalienability floor). Mirrors adopt-partition.ts's DEK re-wrap.\n  const newOwner = await createOwnerKeyring(adapter, vaultName, { userId: opts.newOwnerId, secret: opts.newOwnerSecret })\n  if (!newOwner.kek) {\n    throw new PermissionDeniedError(\n      `new owner keyring for \"${opts.newOwnerId}\" has no KEK to re-wrap the incumbent DEKs under`,\n    )\n  }\n  const env = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (!env) {\n    throw new PermissionDeniedError(`new owner keyring for \"${opts.newOwnerId}\" did not persist`)\n  }\n  const keyringFile = JSON.parse(env._data) as KeyringFile\n  const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n  for (const [collection, dek] of keyring.deks) {\n    mergedDeks[collection] = await wrapKey(dek, newOwner.kek)\n  }\n  const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n  await adapter.put(vaultName, '_keyring', opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) })\n\n  // 5. Lifecycle ledger audit (no-op if the history strategy is absent).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.newOwnerId, payloadHash: '',\n    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`,\n  })\n\n  // 6. Stamp the Deed marker with `liberatedAt` (if a marker exists).\n  const marker = await loadDeedMarker(adapter, vaultName)\n  if (marker) {\n    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: new Date().toISOString() })\n  }\n\n  return { snapshot }\n}\n\n/**\n * Enumerate the vault's operational (user-facing) collections — those carried\n * by the caller's keyring DEK map, minus the reserved internal collections\n * (`_*`). These are the collections frozen into the evidence snapshot.\n */\nasync function listOperationalCollections(vault: Vault): Promise<readonly string[]> {\n  const { keyring } = vault._introspectState()\n  return [...keyring.deks.keys()].filter((c) => !c.startsWith('_'))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,iBAAiB;AAqD9B,eAAsB,gBACpB,OACA,OACA,aACA,SAC0B;AAG1B,QAAM,SAAS,MAAM,qBAAqB,OAAO,OAAO,OAAO;AAI/D,QAAM,UAAU,MAAM,mBAAmB,OAAO,OAAO,EAAE,QAAQ,aAAa,OAAe,CAAC;AAI9F,QAAM,eAAe,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,eACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,SAAS,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,IAAI;AACV,MAAI,EAAE,gBAAgB,EAAG,QAAO;AAChC,MACE,OAAO,EAAE,gBAAgB,YACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,WAAW,QACb,OAAO,EAAE,aAAa,UACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAqB;AAAA,IACzB,aAAa,EAAE;AAAA,IACf,aAAa,EAAE;AAAA,IACf,QAAQ;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,OAAO,EAAE,gBAAgB,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,OACA,OACkB;AAClB,SAAQ,MAAM,eAAe,OAAO,KAAK,MAAO;AAClD;AAaA,eAAsB,eACpB,OACA,OACA,QACe;AACf,QAAM,YAAiC,EAAE,aAAa,GAAG,GAAG,OAAO;AACnE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC5D,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA,IAE5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,SAAS;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,gBAAgB,GAAG;AACrD;;;ACvHA,eAAsB,cACpB,OACA,MACyB;AAEzB,QAAM,MAAM,MAAM,UAAU,MAAM,MAAM,kBAAkB,KAAK,OAAO;AAGtE,QAAM,EAAE,MAAM,WAAW,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AACrE,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACzE,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,KAAK,UAAU;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,2BAA2B,KAAK;AAC1D,QAAM,WAAW,MAAM,mBAAmB,OAAO,aAAa,EAAE,aAAa,QAAQ,OAAO,CAAC;AAM7F,QAAM,WAAW,MAAM,mBAAmB,SAAS,WAAW,EAAE,QAAQ,KAAK,YAAY,QAAQ,KAAK,eAAe,CAAC;AACtH,MAAI,CAAC,SAAS,KAAK;AACjB,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACpE,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,sBAAsB,0BAA0B,KAAK,UAAU,mBAAmB;AAAA,EAC9F;AACA,QAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,QAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,aAAW,CAAC,YAAY,GAAG,KAAK,QAAQ,MAAM;AAC5C,eAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AAAA,EAC1D;AACA,QAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,QAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,YAAY,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAGvG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAY,aAAa;AAAA,IAC1F,QAAQ,sBAAsB,KAAK,UAAU,IAAI,KAAK,UAAU;AAAA,EAClE,CAAC;AAGD,QAAM,SAAS,MAAM,eAAe,SAAS,SAAS;AACtD,MAAI,QAAQ;AACV,UAAM,eAAe,SAAS,WAAW,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAC/F;AAEA,SAAO,EAAE,SAAS;AACpB;AAOA,eAAe,2BAA2B,OAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,SAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE;","names":[]}

package/dist/chunk-RGPB25DB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/enclave/record-envelope.ts","../src/kernel/enclave/record-keys/tombstone.ts"],"sourcesContent":["/**\n * The one place an `EncryptedEnvelope` is constructed (#1051).\n *\n * ## Why this exists\n *\n * 49 files built envelopes with an object literal, bypassing\n * `RecordCodec.buildEnvelope` (which had 4 callers). That is **writer\n * fan-out**: N independent places each had to know the envelope contract, and\n * nothing checked that they agreed.\n *\n * It only became load-bearing with #1041. Binding a record's identity into the\n * AEAD requires every writer to supply that identity — and a writer that\n * doesn't produces data the reader rejects. Reader fan-out you fix by threading\n * an argument through call sites; **writer fan-out cannot be migrated\n * incrementally**, because the first migrated writer emits envelopes the\n * unmigrated readers refuse.\n *\n * ## Why adopting it is safe\n *\n * `identity` is **required but not yet used**. Output is byte-identical to the\n * literals it replaces, so every producer can migrate independently and the\n * existing suite verifies each step. The behaviour change happens **once**,\n * when AAD is switched on here — by which point every writer already supplies\n * identity, and the compiler proved it.\n *\n * That ordering is deliberate: a required-but-unused parameter converts \"did\n * we find every writer?\" from a question into a compile error, the same trick\n * that made the `NOYDB_FORMAT_VERSION` single-sourcing safe in #1048.\n *\n * @packageDocumentation\n */\nimport { NOYDB_FORMAT_VERSION } from '../types.js'\nimport type { EncryptedEnvelope } from '../types.js'\nimport type { RecordIdentity } from './record-aad.js'\n\n/** The body an envelope carries, independent of who is writing it. */\nexport interface RecordEnvelopeBody {\n  readonly version: number\n  /** AES-GCM IV, base64. Empty string for a plaintext or tombstone envelope. */\n  readonly iv: string\n  /** Ciphertext (or plaintext JSON when the collection stores plaintext). */\n  readonly data: string\n  /** ISO timestamp. Defaults to now — pass it when the caller has a real one. */\n  readonly ts?: string | undefined\n  readonly by?: string | undefined\n  /** Wrapped per-record CEK, when the record has one. */\n  readonly cek?: string | undefined\n  readonly provenance?: { readonly source: string; readonly sourceTs: string } | undefined\n  /** Slots the envelope may additionally carry. */\n  readonly extra?: Partial<Pick<EncryptedEnvelope, '_tier' | '_det' | '_sealed' | '_vdig' | '_bidx'>> | undefined\n}\n\n/**\n * Build an envelope for `identity`.\n *\n * `identity` is required and currently unused — see the module docs. Do not\n * \"simplify\" it away: its presence is what makes the eventual AAD binding a\n * one-line change here instead of a 49-site hunt.\n */\nexport function buildRecordEnvelope(\n  identity: RecordIdentity,\n  body: RecordEnvelopeBody,\n): EncryptedEnvelope {\n  void identity\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: body.version,\n    _ts: body.ts ?? new Date().toISOString(),\n    _iv: body.iv,\n    _data: body.data,\n    ...(body.by !== undefined ? { _by: body.by } : {}),\n    ...(body.cek !== undefined ? { _cek: body.cek } : {}),\n    ...(body.provenance !== undefined\n      ? { _source: body.provenance.source, _sourceTs: body.provenance.sourceTs }\n      : {}),\n    ...(body.extra ?? {}),\n  }\n}\n","/**\n * Tombstone shape + predicate for the per-record-key (CEK) layer.\n *\n * A *tombstone* is the residue a GDPR crypto-shred (`vault.forget()`)\n * leaves on disk: the live envelope rewritten to `{ _noydb, _v, _ts, _by,\n * _iv:'', _data:'' }`, dropping `_iv`/`_data`/`_cek`/`_det`. With the wrapped\n * per-record CEK gone, the body — and every history version under the same\n * CEK — is permanently undecryptable, while the record KEY survives so the\n * version counter and \"record existed and was erased\" persist for the audit\n * ledger.\n *\n * These two helpers are the pure, collection-independent core of that\n * contract: {@link buildTombstone} mints the shape, {@link isTombstone}\n * recognises it on the read path. The orchestration that *writes* a tombstone\n * (`_writeTombstone`) and drives `vault.forget()` lives with the collection /\n * vault; it calls into these.\n */\nimport { type EncryptedEnvelope } from '../../types.js'\nimport { buildRecordEnvelope } from '../record-envelope.js'\nimport type { RecordIdentity } from '../record-aad.js'\n\n/**\n * Shape-only tombstone recognition for layers that have no per-collection\n * context (the sync engine, #590): a tombstone carries an empty `_data` and\n * no wrapped CEK. No live envelope can match — record bodies never serialize\n * to the empty string (the `_sync` meta envelope carries non-empty `_data`,\n * and legacy migration envelopes carry non-empty `_iv`/`_data`).\n */\nexport function isTombstoneShape(envelope: EncryptedEnvelope): boolean {\n  return envelope._data === '' && envelope._cek === undefined && envelope._del !== true\n}\n\n/**\n * Is this envelope a crypto-shred tombstone?\n *\n * A tombstone carries no body (`_data` empty) and no wrapped CEK (`_cek`\n * absent) — decrypting it would call `decrypt('', '', dek)` → an AES-GCM\n * throw, so every read choke point must short-circuit to `null` instead.\n *\n * `encrypted` is the collection's encryption flag: on an unencrypted\n * collection there are no envelopes to shred, so nothing is ever a tombstone.\n * (Legacy migration envelopes carry non-empty `_iv`/`_data`, so they are not\n * tombstones and stay readable.)\n */\nexport function isTombstone(envelope: EncryptedEnvelope, encrypted: boolean): boolean {\n  if (!encrypted) return false\n  return isTombstoneShape(envelope)\n}\n\n/**\n * Mint a tombstone envelope from a record's live version + actor.\n *\n * Keeps `_v` (the displaced version) so the counter is monotonic across the\n * shred, stamps a fresh `_ts`, and records `_by` when an actor is supplied.\n * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the\n * erasure.\n */\nexport function buildTombstone(\n  identity: RecordIdentity,\n  version: number,\n  actor: string,\n): EncryptedEnvelope {\n  return buildRecordEnvelope(identity, {\n    version,\n    iv: '',\n    data: '',\n    ...(actor ? { by: actor } : {}),\n  })\n}\n\n/** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */\nexport function isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/**\n * Mint a delete marker from the deleted record's next version + actor (#589).\n * Minted at the NEXT version (`existing._v + 1`) — unlike `buildTombstone`, which\n * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a\n * re-create can still win over it at a higher version.\n */\nexport function buildDeleteMarker(\n  identity: RecordIdentity,\n  version: number,\n  actor: string,\n): EncryptedEnvelope {\n  // `_del` is not one of buildRecordEnvelope's declared slots — a delete marker\n  // is a distinct envelope class, not a record body — so it is stamped here.\n  return {\n    ...buildRecordEnvelope(identity, {\n      version,\n      iv: '',\n      data: '',\n      ...(actor ? { by: actor } : {}),\n    }),\n    _del: true,\n  }\n}\n"],"mappings":";;;;;AA2DO,SAAS,oBACd,UACA,MACmB;AACnB,OAAK;AACL,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI,KAAK;AAAA,IACT,KAAK,KAAK,OAAM,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvC,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,GAAI,KAAK,OAAO,SAAY,EAAE,KAAK,KAAK,GAAG,IAAI,CAAC;AAAA,IAChD,GAAI,KAAK,QAAQ,SAAY,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC;AAAA,IACnD,GAAI,KAAK,eAAe,SACpB,EAAE,SAAS,KAAK,WAAW,QAAQ,WAAW,KAAK,WAAW,SAAS,IACvE,CAAC;AAAA,IACL,GAAI,KAAK,SAAS,CAAC;AAAA,EACrB;AACF;;;ACjDO,SAAS,iBAAiB,UAAsC;AACrE,SAAO,SAAS,UAAU,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS;AACnF;AAcO,SAAS,YAAY,UAA6B,WAA6B;AACpF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,iBAAiB,QAAQ;AAClC;AAUO,SAAS,eACd,UACA,SACA,OACmB;AACnB,SAAO,oBAAoB,UAAU;AAAA,IACnC;AAAA,IACA,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC;AAAA,EAC/B,CAAC;AACH;AAGO,SAAS,eAAe,UAAsC;AACnE,SAAO,SAAS,SAAS;AAC3B;AAQO,SAAS,kBACd,UACA,SACA,OACmB;AAGnB,SAAO;AAAA,IACL,GAAG,oBAAoB,UAAU;AAAA,MAC/B;AAAA,MACA,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC;AAAA,IAC/B,CAAC;AAAA,IACD,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/chunk-RVTOCAHQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/via/index.ts"],"sourcesContent":["// kernel/via/index.ts — the ONLY kernel-resident via surface.\nimport { NoydbError } from '../errors.js'\nimport type { EncryptedEnvelope } from '../types.js'\n\n/** Awaitable type for potentially async results. */\ntype Awaitable<T> = T | Promise<T>\n\n/** Declared security posture — a property the kernel enforces (enforcement activates in phases B/C). */\nexport interface ViaPosture {\n  readonly encryptedAtRest: 'envelope' | 'sealed'\n  readonly queryable: 'none' | 'det-exact' | 'ordered' | 'full'\n  readonly exportable: boolean\n  readonly forgettable: boolean\n}\n\n/** Opaque marker every feature descriptor extends; the kernel never sees concrete descriptor types. */\nexport interface ViaDescriptor { readonly _viaBrand: string }\n\n/** Per-call write context (A: minimal; B/C extend). */\nexport interface ViaWriteCtx {\n  readonly id: string\n  /** Owning vault name (event payload identity — e.g. i18n:script-violation). */\n  readonly vault: string\n  /** Prior stored record (decoded), lazily resolved. Null when creating. */\n  readonly prior: () => Promise<Record<string, unknown> | null>\n  /** Typed event emission (e.g. i18n:script-violation). */\n  readonly emit: (event: string, payload: unknown) => void\n}\n\n/** Per-call read context — mirrors LocaleReadOptions loosely; features narrow. */\nexport interface ViaReadCtx {\n  readonly locale?: unknown\n  readonly fallback?: unknown\n  readonly layer: string\n}\n\n/** One sealed slot's ciphertext — matches the existing `iv:data` sealed map entries (seam map §2 step 2). */\nexport interface SealedSlotRef { readonly iv: string; readonly data: string }\n\n/**\n * A scoped crypto capability handed to a `via` feature's `encodeAtRest`/\n * `decodeAtRest`/`erase` hooks — never the keyring, never the enclave.\n * `sealedSlots` is pre-bound to one `(collection, recordId)`; `reservedEnvelopes`\n * is a whole-envelope encrypt/decrypt door scoped to collection names under a\n * declared prefix (e.g. `_dict_`).\n */\nexport interface ViaCryptoCtx {\n  readonly sealedSlots: {\n    seal(field: string, plaintext: unknown): Promise<SealedSlotRef>\n    unseal(field: string, ref: SealedSlotRef): Promise<unknown>\n    delete(field: string): Promise<void>\n  }\n  reservedEnvelopes(prefix: string): {\n    encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>\n    decrypt(collection: string, env: EncryptedEnvelope): Promise<string>\n  }\n}\n\n/** Per-call erase context — `forget()`'s per-ref participation door (phase C). */\nexport interface ViaEraseCtx { readonly id: string; readonly vault: string; readonly live: unknown /* EncryptedEnvelope */; readonly crypto: ViaCryptoCtx }\n/**\n * What an `erase` hook reports back to `forget()`'s summary ledger entry.\n * `retainedShared` is additive (#629 Task 10) — content NOT erased because\n * still referenced by another live record (blob's shared-chunk dual\n * accounting, `shredAllForRecord()`'s `retainedShared` count). Absent/0 for\n * bindings with no such concept (a sealed field is never \"shared\").\n */\nexport interface ViaEraseReport { readonly shredded: number; readonly residue: readonly unknown[]; readonly retainedShared?: number }\n\n/**\n * A feature bound to one collection's declared config. Record-grain hooks —\n * every hook receives the whole record (matches the real engine signatures,\n * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;\n * absent = passthrough. Query-participation hooks are SYNC (#553).\n */\nexport interface ViaBinding {\n  readonly brand: string\n  readonly posture: ViaPosture\n  /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future\n   *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,\n   *  reference declared fields) and graph-registers a derived edge for each covered\n   *  field at declare time, right after `compileViaBindings` builds the bindings\n   *  (unknown source field throws `ValidationError`). See\n   *  `kernel/collection-config.ts`'s `resolveViaBindingDepsEdges`. */\n  readonly deps?: readonly string[]\n  /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */\n  readonly reservedPrefixes?: readonly string[]\n  /**\n   * Does this binding own `field`? Backs `ViaPipeline.postureFor` (#629 Task\n   * 8's posture consumer) — a passive coverage check, independent of\n   * `buildClause`/`compareForOrder` (which some bindings, e.g. classified and\n   * blob, never define). SYNC, no side effects.\n   *\n   * Contract (documentation only — not enforced at runtime, future work):\n   * any binding declaring a non-default posture value — `queryable: 'none'`\n   * (#629 Task 8) or `exportable: false` (#629 Task 9's `redactForExport`)\n   * — MUST implement `covers()`. `postureFor`'s consumers only engage for\n   * fields a binding actively claims via `covers()`; a binding that omits\n   * it would silently fall through to the generic (unrefused/unredacted)\n   * path instead.\n   */\n  covers?(field: string): boolean\n  // NOTE: phase C adds a `derive` hook ADDITIVELY — do not stub it now.\n  // ── write pipeline ──\n  /** Refuse a write before crypto runs (classified step-3 slot: storage:'never' rejection + validators). Throws to refuse. */\n  enforceWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): void | Promise<void>\n  /** First pipeline stage (money canonicalizeIncomingMoney). SYNC. */\n  ingest?(record: Record<string, unknown>): Record<string, unknown>\n  /** Decode STORED form to canonical for internal boundaries (gates, derivations, patch bases). SYNC. */\n  canonicalizeStored?(record: Record<string, unknown>): Record<string, unknown>\n  /** Post-validation write encoding (money quantize; i18n translate→script→validate→densify). May be async. */\n  encodeWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): Awaitable<Record<string, unknown>>\n  /** Final write-pipeline stage: seal/encrypt declared fields via `crypto` before the envelope body is built (classified step-2 slot). */\n  encodeAtRest?(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }>\n  // ── read pipeline ──\n  /** First read-pipeline stage: unseal/decrypt declared fields via `crypto` before `present` runs (classified sealed-handle slot). */\n  decodeAtRest?(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: { asHandles: boolean }): Promise<Record<string, unknown>>\n  /** Read-time presentation (money decode+virtuals; i18n locale/labels/strip). May be async. */\n  present?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  /**\n   * Late read-time presentation (#669) — runs AFTER every binding's `present()` in the\n   * money+computed present-order segment (`ViaPipeline`'s `_presentOrder`, `kernel/via/\n   * pipeline.ts`), BEFORE the \"everything else\" segment (i18n/lookup dressing, taint\n   * redaction) runs. Exists for a binding that needs to react to a virtual computed\n   * field's fresh OWN-field output before anything dresses it (money's MAJOR-UNITS\n   * quantize-and-present for a field that is BOTH money AND `mode:'virtual'` computed) —\n   * `present()` alone can't express \"run after computed for THESE fields only, before\n   * computed for all others\", since it's a per-BINDING fold, not per-field. Folded over\n   * `bindings` in declaration order (mirrors every other per-binding fold), so lookup/\n   * i18n dressing and taint/redaction (both in the \"everything else\" segment) still see\n   * the already-dressed value.\n   */\n  presentLate?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  // ── query participation (ALL SYNC — #553) ──\n  /** Returns an opaque clause payload when this binding covers `field`, else undefined. */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  buildClause?(field: string, op: string, value: unknown): unknown | undefined\n  /** Evaluate a payload produced by buildClause against a raw stored value. */\n  evaluateClause?(actual: unknown, op: string, payload: unknown): boolean\n  /**\n   * Optional: the STORED-form operand for a direct secondary-index probe\n   * against a payload produced by `buildClause` (#625) — lets\n   * `candidateRecords()` (`query/builder.ts`) hit `CollectionIndexes.\n   * lookupEqual`/`lookupIn` for `==`/`in` clauses instead of falling back\n   * to a linear scan + per-record `evaluateClause`. Returning `undefined`\n   * means \"no sound probe for this op/payload\" (e.g. a comparison whose\n   * stored form isn't a single index-bucketable value, or an op the index\n   * can't serve) — the caller falls back to the scan. A binding that\n   * never implements this hook always falls back, unchanged from before\n   * this hook existed.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  indexProbe?(op: string, payload: unknown): unknown | undefined\n  /**\n   * Optional: canonicalize a raw STORED field value into the bucket key an\n   * eager index should use (#672) — lets `CollectionIndexes` group a\n   * pre-declaration / non-canonical stored value (e.g. a money field's\n   * leftover `'0100'` written before its `money()` declaration) under the\n   * SAME key a canonical write produces (`'100'`), so the index-probe fast\n   * path (`indexProbe` above) and the fallback scan (`evaluateClause`)\n   * agree on which records match. `undefined` means \"not mine / can't\n   * canonicalize this value\" — the caller buckets the raw stringified\n   * value, unchanged from before this hook existed. MUST agree with what\n   * this binding's own `evaluateClause`/`indexProbe` treat as equal, or\n   * the fast path and the scan will disagree.\n   */\n  canonicalizeIndexKey?(field: string, rawValue: unknown): string | undefined\n  /** Decode a raw stored record for query/scan results and callback views ('raw' — no virtuals). */\n  decodeResults?(record: unknown): unknown\n  /** Exact ordering for a covered field; undefined when the field is not covered. */\n  compareForOrder?(field: string, a: unknown, b: unknown): number | undefined\n  /**\n   * Per-key, PER-CALL-locale label resolution for `orderBy(field, dir,\n   * { by: 'label' })` (#650 Task 7) — the sibling `compareForOrder` above\n   * structurally cannot serve, since it carries no locale parameter.\n   * `locale` is the query's per-call locale (`undefined` for a locale-less\n   * query — a binding may fall back to its own descriptor-level default,\n   * mirroring `present`'s displayLocale hinge). `undefined` return = this\n   * binding doesn't resolve a label for `key` at `field` — caller falls\n   * back to the raw stored value, same graceful-degrade discipline every\n   * other via query hook uses. SYNC (#553 — query participation).\n   */\n  resolveOrderLabel?(field: string, key: string, locale: string | undefined): string | undefined\n  /** Rewrite an aggregate spec (money exact reducers). */\n  wrapReducers?(spec: unknown): unknown\n  // ── forget participation ──\n  /** `forget()`'s per-ref erasure door — shred/report this binding's residue for one record (classified/blob forget participation). */\n  erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>\n  // ── introspection ──\n  describeFragment?(): Record<string, unknown>\n}\n\n/** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */\nexport type ViaBinder = (config: unknown) => ViaBinding\n\nconst binders = new Map<string, ViaBinder>()\n\n/** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */\nexport function installViaBinder(brand: string, binder: ViaBinder): void {\n  if (!binders.has(brand)) binders.set(brand, binder)\n}\n\n/** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */\nexport function isViaInstalled(brand: string): boolean {\n  return binders.has(brand)\n}\n\n/** @internal — resolve a binder; throws when the declaration factory never ran (hand-rolled descriptors). */\nexport function viaBinder(brand: string): ViaBinder {\n  const b = binders.get(brand)\n  if (!b) {\n    throw new NoydbError(\n      'VIA_NOT_LINKED',\n      `via feature \"${brand}\" requires descriptors created via its declaration factory from @noy-db/hub`,\n    )\n  }\n  return b\n}\n"],"mappings":";;;;;AAmMA,IAAM,UAAU,oBAAI,IAAuB;AAGpC,SAAS,iBAAiB,OAAe,QAAyB;AACvE,MAAI,CAAC,QAAQ,IAAI,KAAK,EAAG,SAAQ,IAAI,OAAO,MAAM;AACpD;AAGO,SAAS,eAAe,OAAwB;AACrD,SAAO,QAAQ,IAAI,KAAK;AAC1B;AAGO,SAAS,UAAU,OAA0B;AAClD,QAAM,IAAI,QAAQ,IAAI,KAAK;AAC3B,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-SJOK23XT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../kernel/enclave/index.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadMVExecutor = lazy(() => import('./executor.js'))\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    executor ??= (await loadMVExecutor()).MaterializedViewExecutor\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;;;;AAeA,IAAM,iBAAiB,KAAK,MAAM,OAAO,wBAAe,CAAC;AA4BzD,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC;AACzE,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,kBAAc,MAAM,eAAe,GAAG;AAQtC,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}

package/dist/chunk-UNR6G3EJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-cargo/walk-closure.ts","../src/with-cargo/extract-partition.ts"],"sourcesContent":["/**\n * Transitive-closure FK walker. Computes the set of\n * (collection, id) tuples reachable from seed predicates, so a\n * partition extraction ships a referentially-complete subset.\n *\n * Two-phase, plaintext, read-only (runs inside the unlocked vault\n * session — see foundation §13.4 / spec invariant 7):\n *   1. INBOUND expansion: from selected records, pull every record\n *      that references them (children travel with parents), to a\n *      fixed point.\n *   2. OUTBOUND completion: pull every VISIBLE parent the selected set\n *      references, transitively, WITHOUT re-expanding inbound from those\n *      parents (bounds the closure). A tier-elevated (or missing) parent is\n *      excluded rather than admitted — see `danglingRefs` on the result.\n *\n * The FK graph is auto-derived from the vault's existing RefRegistry\n * (the `ref('target')` declarations on collections) — no hand-written\n * edge list.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { PartitionExtractionError } from '../kernel/errors.js'\n\n/** Seed predicate per collection. Records that return true become roots. */\nexport interface WalkClosureOptions {\n  readonly seeds: Record<\n    string,\n    (record: Record<string, unknown>) => boolean | Promise<boolean>\n  >\n  /** Max fixed-point iterations before throwing. Default 16. */\n  readonly maxDepth?: number\n}\n\n/**\n * #759: an outbound FK edge whose referenced parent was excluded from the\n * closure — either because it doesn't exist, or because it is tier-elevated\n * and therefore invisible (same \"elevated ≡ missing\" semantics as root\n * selection / inbound expansion). The child keeps its FK value; the parent\n * does not travel. Callers (extract-partition) surface this as a residue\n * notice rather than silently dropping it.\n */\nexport interface DanglingRefNotice {\n  /** Collection of the child record that holds the dangling FK. */\n  readonly collection: string\n  /** Id of the child record. */\n  readonly id: string\n  /** FK field on the child that references the missing/elevated parent. */\n  readonly field: string\n  /** Target collection the FK points at. */\n  readonly target: string\n  /** Id of the missing/elevated parent. */\n  readonly targetId: string\n  /**\n   * #772: distinguishes an intentional tier boundary (`'elevated'` — the\n   * parent exists but is above the caller's readable tier) from a genuine\n   * data-integrity gap (`'missing'` — no envelope for `targetId` at all).\n   */\n  readonly reason: 'missing' | 'elevated'\n}\n\nexport interface ClosureResult {\n  /** collection → set of record ids that travel together. */\n  readonly closure: Map<string, Set<string>>\n  readonly graph: {\n    /** Fixed-point iterations the walk needed to converge. */\n    readonly depth: number\n    /** True if an edge pointed back to an already-selected node. */\n    readonly cyclesDetected: boolean\n  }\n  /** #759: outbound FK edges whose parent was excluded (missing or elevated). */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\nexport async function walkClosure(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ClosureResult> {\n  const closure = new Map<string, Set<string>>()\n\n  // Records carry a string `id` by construction (Collection.put(id: string)).\n  // A non-string id during the walk means a malformed record — fail loud\n  // rather than silently dropping it from the closure (which would leave a\n  // dangling FK or a missing child in the extracted bundle).\n  const requireStringId = (collection: string, record: Record<string, unknown>): string => {\n    const id = record['id']\n    if (typeof id !== 'string') {\n      throw new PartitionExtractionError(\n        `walkClosure: record in collection \"${collection}\" has a non-string ` +\n          `id (${typeof id}); cannot include it in the partition closure.`,\n      )\n    }\n    return id\n  }\n\n  const add = (collection: string, id: string): boolean => {\n    let set = closure.get(collection)\n    if (!set) {\n      set = new Set<string>()\n      closure.set(collection, set)\n    }\n    if (set.has(id)) return false\n    set.add(id)\n    return true\n  }\n\n  // Phase 0: evaluate seed predicates.\n  for (const [collectionName, predicate] of Object.entries(opts.seeds)) {\n    const coll = vault.collection<Record<string, unknown>>(collectionName)\n    const records = await coll.list()\n    for (const record of records) {\n      if (await predicate(record)) {\n        add(collectionName, requireStringId(collectionName, record))\n      }\n    }\n  }\n\n  const { refRegistry, adapter, name: vaultName } = vault._introspectState()\n  const maxDepth = opts.maxDepth ?? 16\n  let cyclesDetected = false\n\n  // `depth` counts PRODUCTIVE expansion generations (rounds that added at\n  // least one new record), taken as the max over the two phases — i.e. the\n  // FK hop-distance the closure needed, not the raw loop-iteration count.\n  // The terminal draining pass that adds nothing does not count.\n  let inboundDepth = 0\n  let outboundDepth = 0\n\n  // Phase 1 — INBOUND expansion. Worklist of newly-added (collection,id)\n  // whose children we still need to pull.\n  let frontier: Array<[string, string]> = []\n  for (const [c, ids] of closure) for (const id of ids) frontier.push([c, id])\n\n  while (frontier.length > 0) {\n    const next: Array<[string, string]> = []\n    for (const [collectionName, id] of frontier) {\n      // Which collections reference THIS collection, and via which field?\n      for (const inbound of refRegistry.getInbound(collectionName)) {\n        const childColl = vault.collection<Record<string, unknown>>(inbound.collection)\n        // TODO(perf): re-scans the full inbound collection on every frontier\n        // element. O(frontier · inboundCollections · records) per depth. Fine\n        // at consumer-firm scale (foundation §13.4); revisit with an index or\n        // pagination if extraction over very large vaults gets slow.\n        const childRecords = await childColl.list()\n        for (const child of childRecords) {\n          const fk = child[inbound.field]\n          // Only scalar FK values can match an id; skip null/objects\n          // (mirrors checkIntegrity's scalar guard, vault.ts).\n          if (typeof fk !== 'string' && typeof fk !== 'number') continue\n          if (String(fk) !== id) continue\n          const childId = requireStringId(inbound.collection, child)\n          if (add(inbound.collection, childId)) {\n            next.push([inbound.collection, childId])\n          } else {\n            cyclesDetected = true\n          }\n        }\n      }\n    }\n    if (next.length > 0 && ++inboundDepth > maxDepth) {\n      throw new PartitionExtractionError(\n        `walkClosure exceeded maxDepth=${maxDepth}; the FK graph may be ` +\n          `unexpectedly deep or cyclic. Raise maxDepth or narrow the seeds.`,\n      )\n    }\n    frontier = next\n  }\n\n  // Phase 2 — OUTBOUND completion. Pull referenced parents so no FK\n  // dangles. Transitive over outbound edges only; parents are NOT\n  // inbound-expanded (that would drag in unrelated siblings).\n  let outboundFrontier: Array<[string, string]> = []\n  for (const [c, ids] of closure) for (const id of ids) outboundFrontier.push([c, id])\n\n  const danglingRefs: DanglingRefNotice[] = []\n\n  while (outboundFrontier.length > 0) {\n    const next: Array<[string, string]> = []\n    for (const [collectionName, id] of outboundFrontier) {\n      const outbound = refRegistry.getOutbound(collectionName)\n      if (Object.keys(outbound).length === 0) continue\n      const coll = vault.collection<Record<string, unknown>>(collectionName)\n      const record = await coll.get(id)\n      if (!record) continue\n      for (const [field, descriptor] of Object.entries(outbound)) {\n        const rawId = record[field]\n        // Only scalar FK values reference a parent id; skip null/objects.\n        if (typeof rawId !== 'string' && typeof rawId !== 'number') continue\n        const parentId = String(rawId)\n        // #759: verify the referenced parent is visible through the SAME\n        // tier-gated primitive root selection / inbound expansion use\n        // (`Collection.get()` → `#getRaw`, which returns null for both a\n        // missing record and a tier-elevated one). An elevated parent must\n        // be excluded exactly like an elevated root or inbound target —\n        // \"elevated ≡ invisible\" — rather than admitted into the closure,\n        // where `reKeyClosure`'s raw adapter read would later hit it and\n        // fail loud (the #748 canary). Record the resulting dangling FK\n        // instead of silently dropping it.\n        const parentColl = vault.collection<Record<string, unknown>>(descriptor.target)\n        const parentRecord = await parentColl.get(parentId)\n        if (!parentRecord) {\n          // #772: a raw (tier-unaware) read distinguishes the two cases the\n          // tier-gated `Collection.get()` above collapses to the same null —\n          // an envelope present with `_tier > 0` is an intentional tier\n          // boundary; no envelope at all is a genuine data-integrity gap.\n          const rawParentEnv = await adapter.get(vaultName, descriptor.target, parentId)\n          const reason: 'missing' | 'elevated' =\n            rawParentEnv && (rawParentEnv._tier ?? 0) > 0 ? 'elevated' : 'missing'\n          danglingRefs.push({\n            collection: collectionName, id, field, target: descriptor.target, targetId: parentId, reason,\n          })\n          continue\n        }\n        // Reaching an already-selected parent here is normal DAG\n        // convergence (a child referencing its in-scope parent), not a\n        // cycle — so do NOT flag cyclesDetected in the outbound phase.\n        if (add(descriptor.target, parentId)) {\n          next.push([descriptor.target, parentId])\n        }\n      }\n    }\n    if (next.length > 0 && ++outboundDepth > maxDepth) {\n      throw new PartitionExtractionError(\n        `walkClosure exceeded maxDepth=${maxDepth} during outbound completion.`,\n      )\n    }\n    outboundFrontier = next\n  }\n\n  const depth = Math.max(inboundDepth, outboundDepth)\n\n  return { closure, graph: { depth, cyclesDetected }, danglingRefs }\n}\n","/**\n * Partition extraction. Walks the FK closure, re-encrypts\n * the selected records under fresh per-collection DEKs, seals those DEKs\n * under a one-time transfer key, and serializes an unowned\n * `extracted-partition` bundle.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport type { EncryptedEnvelope, BlobObject, SlotRecord, VersionRecord } from '../kernel/types.js'\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport {\n  decrypt,\n  encrypt,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  generateDEK,\n  bufferToBase64,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  unwrapCek,\n  wrapCek,\n  type EnclaveKey,\n} from '../kernel/enclave/index.js'\nimport {\n  BLOB_COLLECTION,\n  BLOB_INDEX_COLLECTION,\n  BLOB_CHUNKS_COLLECTION,\n  BLOB_SLOTS_PREFIX,\n  BLOB_VERSIONS_PREFIX,\n} from '../with-shape/blobs/blob-set.js'\nimport { BLOB_INTENT_COLLECTION } from '../with-shape/blobs/blob-intent.js'\nimport { PartitionExtractionError } from '../kernel/errors.js'\nimport { walkClosure, type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js'\nimport { generateULID } from '../with-pod/ulid.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { canonicalJson, hashEntry } from '../with-commit/history/ledger/entry.js'\nimport type { LedgerEntry } from '../with-commit/history/ledger/entry.js'\nimport { envelopePayloadHash } from '../with-commit/history/ledger/hash.js'\nimport { buildRecordEnvelope } from '../kernel/enclave/index.js'\nimport {\n  assemblePodContainer,\n  buildExtractedPartitionWrapper,\n  type TransferSealPayload,\n} from '../with-pod/pod.js'\n\n/** Re-keyed collections snapshot + the fresh DEKs used. */\nexport interface ReKeyResult {\n  readonly collections: Record<string, Record<string, EncryptedEnvelope>>\n  readonly deks: Map<string, EnclaveKey>\n}\n\n/**\n * Re-encrypt every record in `closure` under a fresh per-collection DEK.\n * Reads raw source envelopes, decrypts under the source DEK, re-encrypts\n * under the new DEK. Plaintext-pipeline: requires an unlocked vault.\n */\nexport async function reKeyClosure(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<ReKeyResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const collections: Record<string, Record<string, EncryptedEnvelope>> = {}\n  const deks = new Map<string, EnclaveKey>()\n\n  for (const [collectionName, ids] of closure) {\n    const srcDek = await getDEK(collectionName)\n    const destDek = await generateDEK()\n    deks.set(collectionName, destDek)\n    const out: Record<string, EncryptedEnvelope> = {}\n    // FR-7 structural field projection: when this collection has a projection,\n    // narrow the plaintext body to `id` (always) + the listed fields BEFORE\n    // re-encryption, so excluded fields never travel in the bundle. Applied\n    // identically in both re-key branches; only the body changes — the `_cek`\n    // re-wrap order is untouched. Absent/empty projection → byte-identical to\n    // the un-projected path (`proj` is undefined and `project` is a no-op).\n    const projList = fieldProjection?.[collectionName]\n    const proj = projList ? new Set(projList) : undefined\n    const project = (plaintext: string): string => {\n      if (!proj) return plaintext\n      const rec = JSON.parse(plaintext) as Record<string, unknown>\n      const kept: Record<string, unknown> = {}\n      if ('id' in rec) kept['id'] = rec['id'] // id ALWAYS preserved\n      for (const f of proj) if (f in rec) kept[f] = rec[f]\n      return JSON.stringify(kept)\n    }\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) continue\n      // #748 defense-in-depth canary: `closure` is built exclusively through\n      // tier-gated `Collection.list()`/`get()` (collection.ts `ensureHydrated`\n      // / `#getRaw` both skip `_tier > 0` envelopes), so an elevated record\n      // can never reach this raw `adapter.get` fetch — this should be\n      // unreachable by construction. Not a user-facing guard; a cheap tripwire\n      // in case that invariant ever regresses.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyClosure fetched an elevated envelope (collection=\"${collectionName}\" id=\"${id}\" `\n          + `_tier=${env._tier}) — this is unreachable by construction (walkClosure only ever adds ids `\n          + `reachable through tier-gated Collection reads). Refusing to carry it into a partition.`,\n        )\n      }\n      if (env._cek !== undefined) {\n        // Per-record CEK: a naive `{ ...env }` spread would carry a\n        // SOURCE-DEK-wrapped CEK into a bundle re-keyed under a different\n        // destination DEK — silently undecryptable for the recipient.\n        // Re-wrap: unwrap the CEK under the source DEK, re-encrypt the body\n        // under the SAME CEK (decision 2 — CEK reused on re-key, preserving\n        // the history-chain identity), then wrap the CEK under the fresh\n        // destination DEK. The recipient gains access transitively once they\n        // re-wrap the collection DEK under their KEK on adopt.\n        const cek = await unwrapCek(env._cek, srcDek)\n        const plaintext = await decrypt(env._iv, env._data, cek)\n        const { iv, data } = await encrypt(project(plaintext), cek)\n        const wrapped = await wrapCek(cek, destDek)\n        out[id] = { ...env, _iv: iv, _data: data, _cek: wrapped }\n        continue\n      }\n      const plaintext = await openEnvelopeJson(env, srcDek)\n      const { iv, data } = await encrypt(project(plaintext), destDek)\n      out[id] = { ...env, _iv: iv, _data: data }\n    }\n    collections[collectionName] = out\n  }\n\n  return { collections, deks }\n}\n\n/**\n * Re-key the persisted JSON Schemas (`_schemas/<collection>`) for the\n * closure collections under the destination DEKs. Returns a\n * `{ collection: envelope }` map for the carried collections that actually\n * have a schema; collections without one are omitted.\n */\nexport async function reKeySchemas(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  destDeks: Map<string, EnclaveKey>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<Record<string, EncryptedEnvelope>> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const out: Record<string, EncryptedEnvelope> = {}\n\n  for (const collectionName of closure.keys()) {\n    // FR-7: skip a projected collection's schema — the narrowed shape no\n    // longer matches the stored JSON Schema, so carrying it would assert a\n    // contract the projected records violate (missing required fields).\n    if (fieldProjection?.[collectionName]) continue\n    const env = await adapter.get(vaultName, SCHEMAS_COLLECTION, collectionName)\n    if (!env) continue // collection has no persisted schema — skip\n    const destDek = destDeks.get(collectionName)\n    if (!destDek) continue\n    const srcDek = await getDEK(collectionName)\n    const plaintext = await openEnvelopeJson(env, srcDek)\n    const { iv, data } = await encrypt(plaintext, destDek)\n    out[collectionName] = { ...env, _iv: iv, _data: data }\n  }\n  return out\n}\n\nconst paddedIndex = (n: number): string => String(n).padStart(10, '0')\n\nexport interface ReKeyLedgerResult {\n  /** { paddedIndex: re-encrypted entry envelope } for backup._internal._ledger. */\n  readonly entries: Record<string, EncryptedEnvelope>\n  /** Recomputed ledgerHead for the carried chain (index -1 when empty). */\n  readonly head: { hash: string; index: number; ts: string }\n}\n\n/**\n * Build the carried `_ledger` chain for an extracted partition.\n * Filters source entries to the closure, RE-CHAINS them (fresh index + prevHash),\n * and re-encrypts under `ledgerDek`. The `payloadHash` is recomputed against the\n * re-keyed envelope ONLY for the latest `put` per (collection,id) — the entry\n * `verifyBackupIntegrity` cross-checks; earlier puts + deletes keep their source\n * `payloadHash` verbatim (recomputing an intermediate put would assert a false\n * hash for an older version). Amendments + out-of-closure entries are dropped;\n * `_ledger_deltas`/`_history` are deferred to slice 2.\n */\nexport async function reKeyLedger(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  reKeyedCollections: Record<string, Record<string, EncryptedEnvelope>>,\n  ledgerDek: EnclaveKey,\n): Promise<ReKeyLedgerResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const srcLedgerDek = await getDEK(LEDGER_COLLECTION)\n\n  // 1. Load + decrypt source entries in index order.\n  const ids = (await adapter.list(vaultName, LEDGER_COLLECTION)).sort()\n  const srcEntries: LedgerEntry[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, LEDGER_COLLECTION, id)\n    if (!env) continue\n    srcEntries.push(JSON.parse(await openEnvelopeJson(env, srcLedgerDek)) as LedgerEntry)\n  }\n\n  // 2. Keep closure put/delete entries (drop amendments + out-of-closure).\n  const kept = srcEntries.filter(\n    (e) => (e.op === 'put' || e.op === 'delete') && (closure.get(e.collection)?.has(e.id) ?? false),\n  )\n\n  // 3a. Reverse pass: index of the LATEST put per (collection,id).\n  const latestPutIndex = new Map<string, number>()\n  for (let i = kept.length - 1; i >= 0; i--) {\n    const e = kept[i]!\n    if (e.op !== 'put') continue\n    const key = `${e.collection}/${e.id}`\n    if (!latestPutIndex.has(key)) latestPutIndex.set(key, i)\n  }\n\n  // 3b. Forward re-chain + re-encrypt.\n  const entries: Record<string, EncryptedEnvelope> = {}\n  let prevHash = ''\n  let last: LedgerEntry | undefined\n  for (let i = 0; i < kept.length; i++) {\n    const src = kept[i]!\n    const key = `${src.collection}/${src.id}`\n    const isLatestPut = src.op === 'put' && latestPutIndex.get(key) === i\n    const reKeyedEnv = reKeyedCollections[src.collection]?.[src.id]\n    const payloadHash = isLatestPut && reKeyedEnv\n      ? await envelopePayloadHash(reKeyedEnv)\n      : src.payloadHash\n    const entry: LedgerEntry = {\n      index: i,\n      prevHash,\n      op: src.op,\n      collection: src.collection,\n      id: src.id,\n      version: src.version,\n      ts: src.ts,\n      actor: src.actor,\n      payloadHash,\n      ...(src.reason !== undefined ? { reason: src.reason } : {}),\n    }\n    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek)\n    entries[paddedIndex(i)] = buildRecordEnvelope(\n      { collection: LEDGER_COLLECTION, id: paddedIndex(i) },\n      { version: i + 1, ts: entry.ts, iv, data, by: entry.actor },\n    )\n    prevHash = await hashEntry(entry)\n    last = entry\n  }\n\n  return {\n    entries,\n    head: last ? { hash: prevHash, index: last.index, ts: last.ts } : { hash: '', index: -1, ts: '' },\n  }\n}\n\n/** Build the AAD binding for chunk integrity: \"{eTag}:{chunkIndex}:{chunkCount}\".\n * Mirrors `chunkAAD` in blob-set.ts — the eTag is preserved verbatim across\n * the transfer (see `reKeyBlobs`), so the same AAD that bound a chunk in the\n * source keeps binding it in the bundle. */\nfunction chunkAAD(eTag: string, chunkIndex: number, chunkCount: number): Uint8Array {\n  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`)\n}\n\n/** Carried blob internals + the fresh transfer `_blob` DEK (present only when\n * the closure references at least one chunk-based blob). */\nexport interface ReKeyBlobsResult {\n  /** `_blob_slots_<C>` / `_blob_versions_<C>` / `_blob_index` / `_blob_chunks`\n   * envelopes for the bundle's `_internal` map. */\n  readonly internal: Record<string, Record<string, EncryptedEnvelope>>\n  /** Fresh transfer `_blob` DEK — seal it so owner-creation wraps it under the\n   * recipient KEK. Undefined when no blob travels (source keyring untouched). */\n  readonly blobDek?: EnclaveKey\n}\n\n/**\n * Carry the FK-closed slice's blobs — HARDENED key handling (no master-key leak).\n *\n * The source vault's shared `_blob` DEK decrypts (or unwraps the content CEK of)\n * EVERY blob in the source. Sealing it into the transfer would hand the recipient\n * a key to blobs far outside their slice. Instead we mint a **fresh transfer\n * `_blob` DEK** and arrange every carried blob into per-blob-CEK mode under it:\n *\n *  - **erasable blob** (`_cek` present): unwrap the per-blob content CEK under the\n *    SOURCE `_blob` DEK, re-wrap it under the FRESH transfer DEK. Chunks travel\n *    **verbatim** (still ciphertext under that same content CEK — passthrough).\n *  - **legacy blob** (no `_cek`, chunks under the shared `_blob` DEK): promote it\n *    IN-BUNDLE — mint a fresh content CEK, decrypt each chunk under the source\n *    `_blob` DEK and re-encrypt under the content CEK (same AAD, so the eTag-bound\n *    integrity holds), then wrap the content CEK under the transfer DEK. The\n *    SOURCE is never mutated (non-destructive), and the bundle never holds\n *    plaintext blob bytes (zero-knowledge preserved).\n *\n * **eTag identity is preserved** (not re-HMAC'd). eTags are HMAC-keyed off the\n * `_blob` DEK, but they are stored as OPAQUE keys (`_blob_index/<eTag>`,\n * `_blob_chunks/<eTag>_<i>`) and never recomputed on read — only on a `put()`\n * for dedup. Keeping them verbatim keeps every slot/version/index/chunk key and\n * the chunk AAD coherent with zero chunk-key churn. The only consequence: a\n * future `put()` of identical bytes in the adopted vault computes a different\n * eTag (HMAC under the fresh DEK) and will NOT dedup against the carried blob —\n * an accepted, documented trade for hardened key isolation.\n *\n * Slots/versions are re-keyed under their parent collection's destination DEK\n * (honoring `fieldProjection` — projected-out blob fields' slots never travel);\n * `BlobObject.refCount` is recomputed from carried references only.\n *\n * `external` slots reference an unencrypted shared-bucket object that is not in\n * the bundle — their slot metadata travels (so the catalog entry survives) but\n * the bytes do not (a documented v1 limitation; their eTag is `''`).\n */\nexport async function reKeyBlobs(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  destDeks: Map<string, EnclaveKey>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<ReKeyBlobsResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const internal: Record<string, Record<string, EncryptedEnvelope>> = {}\n\n  // travel set: eTag → number of carried references (slots + versions) within\n  // the closure. Recomputed refCount, NOT the source's (which may count\n  // out-of-slice referrers, leaving the adopted blob un-GC-able).\n  const carriedRefs = new Map<string, number>()\n  const addRef = (eTag: string): void => {\n    if (!eTag) return // external slot — no chunk-based blob to carry\n    carriedRefs.set(eTag, (carriedRefs.get(eTag) ?? 0) + 1)\n  }\n\n  const place = (collection: string, id: string, env: EncryptedEnvelope): void => {\n    let bucket = internal[collection]\n    if (!bucket) { bucket = {}; internal[collection] = bucket }\n    bucket[id] = env\n  }\n\n  // ── Slots + versions (parent-collection-DEK keyed) ─────────────────\n  for (const [collectionName, ids] of closure) {\n    const destDek = destDeks.get(collectionName)\n    if (!destDek) continue\n    const srcDek = await getDEK(collectionName)\n    const projList = fieldProjection?.[collectionName]\n    const proj = projList ? new Set(projList) : undefined\n\n    // Slots: one envelope per record, a `{ slotName: SlotRecord }` map.\n    const slotsCollection = `${BLOB_SLOTS_PREFIX}${collectionName}`\n    for (const id of ids) {\n      // #767: carry any in-flight `_blob_intent` marker for this record,\n      // re-keyed under the SAME destination DEK as its owning collection\n      // (mirrors `dumpVault`'s backup allowlist, which carries `_blob_intent`\n      // for the identical crash-recovery reason — a partition extracted\n      // mid-shred/mid-rehome must carry the marker so resume-on-touch heals\n      // it post-restore). Checked independently of the slot-map fetch below:\n      // a marker can be present even when the slot map has already been\n      // touched or removed by the in-flight operation.\n      const intentId = `${collectionName}::${id}`\n      const intentEnv = await adapter.get(vaultName, BLOB_INTENT_COLLECTION, intentId)\n      if (intentEnv) {\n        const intentPlain = await openEnvelopeJson(intentEnv, srcDek)\n        const intentBody = await writeEnvelopeBody(intentPlain, destDek)\n        place(BLOB_INTENT_COLLECTION, intentId, { ...intentEnv, ...intentBody })\n      }\n\n      const env = await adapter.get(vaultName, slotsCollection, id)\n      if (!env) continue\n      // #748 defense-in-depth canary — see the matching one in `reKeyClosure`:\n      // `ids` comes from the same tier-gated `closure`, so an elevated\n      // record's slot map should never be reachable here. Unreachable by\n      // construction; a cheap tripwire, not a user-facing guard.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyBlobs fetched an elevated slot-map envelope (collection=\"${slotsCollection}\" `\n          + `id=\"${id}\" _tier=${env._tier}) — this is unreachable by construction. Refusing to carry it into a partition.`,\n        )\n      }\n      const slots = JSON.parse(await openEnvelopeJson(env, srcDek)) as Record<string, SlotRecord>\n      // FR-7: drop projected-out blob fields' slots (slot names are blob field\n      // names) — their eTags then never enter the travel set.\n      const kept: Record<string, SlotRecord> = {}\n      for (const [slotName, slot] of Object.entries(slots)) {\n        if (proj && !proj.has(slotName)) continue\n        // #769: strip the internal `pendingRelease` resume breadcrumb before\n        // it travels. It is a SOURCE-VAULT-LOCAL rehome marker (see\n        // `SlotRecord.pendingRelease`'s doc comment) pointing at an old eTag\n        // awaiting release — meaningless, and potentially misleading, once\n        // detached from the source vault (the eTag it names may be absent\n        // from the destination). Unlike `_blob_intent` above (carried, so\n        // resume-on-touch heals it post-restore), this breadcrumb must NOT\n        // travel into a cross-vault partition.\n        const { pendingRelease, ...strippedSlot } = slot\n        void pendingRelease\n        kept[slotName] = strippedSlot\n        addRef(slot.eTag)\n      }\n      if (Object.keys(kept).length === 0) continue\n      const { iv, data } = await encrypt(JSON.stringify(kept), destDek)\n      place(slotsCollection, id, { ...env, _iv: iv, _data: data })\n    }\n\n    // Versions: key = `${recordId}::${slotName}::${label}`; each an independent\n    // refCount hold on its eTag.\n    const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`\n    const versionKeys = await adapter.list(vaultName, versionsCollection)\n    for (const key of versionKeys) {\n      const [recordId, slotName] = key.split('::')\n      if (recordId === undefined || !ids.has(recordId)) continue\n      if (proj && slotName !== undefined && !proj.has(slotName)) continue\n      const env = await adapter.get(vaultName, versionsCollection, key)\n      if (!env) continue\n      // #748 defense-in-depth canary — see `reKeyClosure`'s. Unreachable by\n      // construction; a cheap tripwire, not a user-facing guard.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyBlobs fetched an elevated version-record envelope (collection=\"${versionsCollection}\" `\n          + `key=\"${key}\" _tier=${env._tier}) — this is unreachable by construction. Refusing to carry it into a partition.`,\n        )\n      }\n      const record = JSON.parse(await openEnvelopeJson(env, srcDek)) as VersionRecord\n      addRef(record.eTag)\n      const { iv, data } = await encrypt(JSON.stringify(record), destDek)\n      place(versionsCollection, key, { ...env, _iv: iv, _data: data })\n    }\n  }\n\n  // No chunk-based blob in the closure → carry nothing, mint nothing. Guarded\n  // so `getDEK('_blob')` does not auto-mint + persist a phantom DEK on the\n  // source keyring (mirrors the carryLedger non-destructive guard).\n  if (carriedRefs.size === 0) return { internal }\n\n  // ── Index + chunks (re-keyed under a FRESH transfer `_blob` DEK) ────\n  const srcBlobDek = await getDEK(BLOB_COLLECTION)\n  const transferBlobDek = await generateDEK()\n\n  for (const [eTag, refCount] of carriedRefs) {\n    const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag)\n    if (!idxEnv) continue // dangling slot reference — nothing to carry\n    const blob = JSON.parse(await openEnvelopeJson(idxEnv, srcBlobDek)) as BlobObject\n\n    // Resolve the per-blob content CEK; passthrough vs. in-bundle promotion.\n    let contentCek: EnclaveKey\n    let chunksPassthrough: boolean\n    if (blob._cek !== undefined) {\n      contentCek = await unwrapCek(blob._cek, srcBlobDek)\n      chunksPassthrough = true\n    } else {\n      // Legacy: promote to per-blob-CEK for the bundle (source untouched).\n      contentCek = await generateDEK()\n      chunksPassthrough = false\n    }\n\n    // Chunks: verbatim for an already-erasable blob; decrypt-then-re-encrypt\n    // under the fresh content CEK for a legacy blob (same eTag-bound AAD).\n    for (let i = 0; i < blob.chunkCount; i++) {\n      const chunkId = `${eTag}_${i}`\n      const chunkEnv = await adapter.get(vaultName, BLOB_CHUNKS_COLLECTION, chunkId)\n      if (!chunkEnv) {\n        throw new PartitionExtractionError(\n          `reKeyBlobs: blob chunk ${i}/${blob.chunkCount} missing for eTag \"${eTag}\"; `\n          + `cannot carry an incomplete blob into the partition.`,\n        )\n      }\n      if (chunksPassthrough) {\n        place(BLOB_CHUNKS_COLLECTION, chunkId, chunkEnv)\n      } else {\n        const aad = chunkAAD(eTag, i, blob.chunkCount)\n        const plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, srcBlobDek, aad)\n        const { iv, data } = await encryptBytesWithAAD(plain, contentCek, aad)\n        place(BLOB_CHUNKS_COLLECTION, chunkId, { ...chunkEnv, _iv: iv, _data: data })\n      }\n    }\n\n    // Index: per-blob-CEK mode under the transfer DEK, refCount corrected.\n    // Drop any transient `_cekPending` (never set on a settled blob — possible\n    // only if the source is mid-migration; we set a fresh settled `_cek`).\n    const { _cekPending, ...rest } = blob\n    void _cekPending\n    const carried: BlobObject = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) }\n    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek)\n    place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data })\n  }\n\n  return { internal, blobDek: transferBlobDek }\n}\n\n/** A minted transfer key (raw 32 bytes) + the seal carrying the DEK set. */\nexport interface SealResult {\n  readonly seal: TransferSealPayload\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Mint a random 32-byte transfer key, export each DEK to raw bytes, and\n * AES-256-GCM-seal the `{ collection: base64(rawDEK) }` map under the\n * transfer key. The transfer key is returned to the caller out-of-band;\n * only the sealed bytes travel in the bundle. Layout: iv(12) ‖ ct ‖ tag.\n */\nexport async function sealDeks(deks: Map<string, EnclaveKey>): Promise<SealResult> {\n  const dekMap: Record<string, string> = {}\n  for (const [collection, dek] of deks) {\n    const raw = await crypto.subtle.exportKey('raw', dek)\n    dekMap[collection] = bufferToBase64(raw)\n  }\n\n  const transferKey = crypto.getRandomValues(new Uint8Array(32))\n  const key = await crypto.subtle.importKey('raw', transferKey, 'AES-GCM', false, ['encrypt'])\n  const iv = crypto.getRandomValues(new Uint8Array(12))\n  const plaintext = new TextEncoder().encode(JSON.stringify(dekMap))\n  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext)\n\n  const combined = new Uint8Array(iv.byteLength + ct.byteLength)\n  combined.set(iv, 0)\n  combined.set(new Uint8Array(ct), iv.byteLength)\n\n  const sealId = bufferToBase64(crypto.getRandomValues(new Uint8Array(12)))\n  return {\n    seal: { v: 1, alg: 'aes-256-gcm-pre-shared', sealId, payload: bufferToBase64(combined) },\n    transferKey,\n  }\n}\n\nexport interface ExtractPartitionResult {\n  readonly bundleBytes: Uint8Array\n  /** Raw 32-byte transfer key — deliver out-of-band; required to adopt. */\n  readonly transferKey: Uint8Array\n  readonly sealId: string\n  /**\n   * #759: outbound FK edges whose referenced parent was excluded from the\n   * partition (missing, or tier-elevated and therefore invisible). The\n   * child record still carries its FK value; the parent did not travel —\n   * callers should surface this to the operator rather than assume\n   * referential completeness.\n   */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\n/**\n * Extract a re-keyed, transfer-sealed partition. Owner-only\n * (invariant 5): producing a standalone re-keyed vault is an\n * ownership operation. Non-destructive on the source.\n */\nexport type ExtractPartitionOptions = WalkClosureOptions & {\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n  readonly carrySchemas?: boolean\n  readonly carryLedger?: boolean\n  /**\n   * FR-7 structural field projection: per-collection allow-list of fields\n   * to keep. Non-listed fields are dropped from each record BEFORE\n   * re-encryption (so they never travel in the bundle); `id` is always\n   * preserved. A projected collection's persisted schema is NOT carried.\n   * Absent/empty → un-projected behavior (byte-identical to today).\n   */\n  readonly fieldProjection?: Record<string, readonly string[]>\n}\n\n/**\n * Public extract-partition entry — gated behind `cargoStrategy: withCargo()`\n * (S4). Routes through the source vault's cargo strategy so an un-opted-in\n * caller hits `NO_CARGO`'s throw; `withCargo()` dynamically imports and runs\n * {@link extractPartitionCore} (the crypto engine, kept out of the floor).\n */\nexport async function extractPartition(\n  vault: Vault,\n  opts: ExtractPartitionOptions,\n): Promise<ExtractPartitionResult> {\n  return vault.cargoStrategy.extractPartition(vault, opts)\n}\n\n/**\n * The extract-partition crypto engine — reached only when `withCargo()` is\n * opted in (via the lazy `with-cargo/active.ts` chunk). Body unchanged from the\n * hardened implementation; only the public gate wraps it.\n */\nexport async function extractPartitionCore(\n  vault: Vault,\n  opts: ExtractPartitionOptions,\n): Promise<ExtractPartitionResult> {\n  // FR-6: extract-and-sever is the inalienability-floor half — owner-only. A\n  // custodian operates fully but must NEVER produce a standalone re-keyed\n  // partition (that would let it sever a copy out from under the sealed owner).\n  // Explicit assertion so the security boundary is auditable at this site.\n  if (vault.role === 'custodian') {\n    throw new PartitionExtractionError(\n      'extractPartition is owner-only; a custodian cannot extract-and-sever '\n      + '(FR-6: producing a re-keyed standalone partition is an ownership operation; use the Deed owner).',\n    )\n  }\n  if (vault.role !== 'owner') {\n    throw new PartitionExtractionError(\n      `extractPartition requires the 'owner' role on the source vault; caller is '${vault.role}'. `\n      + `Producing a re-keyed standalone partition is an ownership operation.`,\n    )\n  }\n\n  // Persisted-schema writes (collection({ persistJsonSchema: true })) are fire-\n  // and-forget queued onto vault._pendingSchemaWrites — a caller that does\n  // `collection() → put() → extractPartition({ carrySchemas: true })` in quick\n  // succession can hit a window where _schemas/<col> is not yet on disk and\n  // reKeySchemas silently drops the row. Drain BEFORE reKeySchemas reads.\n  if (opts.carrySchemas) await vault._drainPendingSchemaWrites()\n\n  const { closure, danglingRefs } = await walkClosure(vault, opts)\n  const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection)\n\n  // carryLedger: mint a fresh _ledger DEK, build the carried chain, and\n  // SEAL the ledger DEK alongside the data DEKs so owner-creation wraps it into the\n  // recipient keyring (lets them decrypt + verify the chain). Must run BEFORE\n  // sealDeks.\n  let ledgerHead: { hash: string; index: number; ts: string } | undefined\n  let ledgerEntries: Record<string, EncryptedEnvelope> | undefined\n  if (opts.carryLedger && vault._getLedgerOrNull() !== null) {\n    // Skip when the source vault has no history strategy: reKeyLedger's first\n    // `getDEK(LEDGER_COLLECTION)` would auto-mint and persist a phantom\n    // _ledger DEK on the source keyring (contradicting \"non-destructive on\n    // the source\"), and there's nothing to carry anyway. Mirrors the same\n    // null-guard the source audit-append uses below.\n    const ledgerDek = await generateDEK()\n    const built = await reKeyLedger(vault, closure, collections, ledgerDek)\n    if (built.head.index >= 0) {\n      ledgerEntries = built.entries\n      ledgerHead = built.head\n      deks.set(LEDGER_COLLECTION, ledgerDek)\n    }\n  }\n\n  // Carry the slice's blobs — re-keyed under a FRESH transfer `_blob` DEK\n  // (HARDENED: never carries the source's shared blob DEK). Runs BEFORE\n  // sealDeks so the fresh DEK is sealed alongside the data DEKs; non-destructive\n  // on the source (mints + reads `_blob` only when the closure has blobs).\n  const blobs = await reKeyBlobs(vault, closure, deks, opts.fieldProjection)\n  if (blobs.blobDek) deks.set(BLOB_COLLECTION, blobs.blobDek)\n\n  // Build _internal (schemas + ledger + blobs). reKeySchemas reads data-\n  // collection DEKs only, so it is unaffected by the _ledger DEK added above.\n  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks, opts.fieldProjection) : {}\n  const internal: Record<string, Record<string, EncryptedEnvelope>> = {}\n  if (Object.keys(internalSchemas).length > 0) internal[SCHEMAS_COLLECTION] = internalSchemas\n  if (ledgerEntries) internal[LEDGER_COLLECTION] = ledgerEntries\n  for (const [collection, records] of Object.entries(blobs.internal)) internal[collection] = records\n  const hasInternal = Object.keys(internal).length > 0\n\n  const { seal, transferKey } = await sealDeks(deks)\n\n  // Source-side audit: record that a partition\n  // was handed over. Non-destructive — an audit append, no record touched.\n  // No-op when the source vault has no history strategy. append() fills\n  // index/prevHash/ts and (since actor is '') the ledger's configured actor.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle',\n    collection: '',\n    id: '',\n    version: 0,\n    actor: '',\n    payloadHash: '',\n    reason: `partition-handed-over:${seal.sealId}`,\n  })\n\n  // Build the dump JSON: unowned (empty keyrings), empty ledger (default),\n  // re-keyed collections only.\n  const { name: vaultName } = vault._introspectState()\n  const backup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: vaultName,\n    _exported_at: new Date().toISOString(),\n    _exported_by: '', // unowned — no source user travels\n    keyrings: {},\n    collections,\n    ...(hasInternal ? { _internal: internal } : {}),\n    ...(ledgerHead ? { ledgerHead: { hash: ledgerHead.hash, index: ledgerHead.index, ts: ledgerHead.ts } } : {}),\n  }\n  const bodyJsonStr = JSON.stringify(buildExtractedPartitionWrapper(JSON.stringify(backup), seal))\n\n  // An extracted partition is a NEW vault, not a re-export of the source —\n  // mint a fresh handle rather than reusing the source's stable ULID\n  // (which would collide if a recipient imports both source + partition).\n  const handle = generateULID()\n  const bundleBytes = await assemblePodContainer({\n    handle,\n    bodyJsonStr,\n    compression: opts.compression,\n    headerExtras: {\n      bundleKind: 'extracted-partition',\n      transferSeal: { v: seal.v, alg: seal.alg, sealId: seal.sealId }, // indicator only\n    },\n  })\n\n  return { bundleBytes, transferKey, sealId: seal.sealId, danglingRefs }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,YACpB,OACA,MACwB;AACxB,QAAM,UAAU,oBAAI,IAAyB;AAM7C,QAAM,kBAAkB,CAAC,YAAoB,WAA4C;AACvF,UAAM,KAAK,OAAO,IAAI;AACtB,QAAI,OAAO,OAAO,UAAU;AAC1B,YAAM,IAAI;AAAA,QACR,sCAAsC,UAAU,0BACvC,OAAO,EAAE;AAAA,MACpB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,CAAC,YAAoB,OAAwB;AACvD,QAAI,MAAM,QAAQ,IAAI,UAAU;AAChC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAY;AACtB,cAAQ,IAAI,YAAY,GAAG;AAAA,IAC7B;AACA,QAAI,IAAI,IAAI,EAAE,EAAG,QAAO;AACxB,QAAI,IAAI,EAAE;AACV,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,gBAAgB,SAAS,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACpE,UAAM,OAAO,MAAM,WAAoC,cAAc;AACrE,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,eAAW,UAAU,SAAS;AAC5B,UAAI,MAAM,UAAU,MAAM,GAAG;AAC3B,YAAI,gBAAgB,gBAAgB,gBAAgB,MAAM,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,aAAa,SAAS,MAAM,UAAU,IAAI,MAAM,iBAAiB;AACzE,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,iBAAiB;AAMrB,MAAI,eAAe;AACnB,MAAI,gBAAgB;AAIpB,MAAI,WAAoC,CAAC;AACzC,aAAW,CAAC,GAAG,GAAG,KAAK,QAAS,YAAW,MAAM,IAAK,UAAS,KAAK,CAAC,GAAG,EAAE,CAAC;AAE3E,SAAO,SAAS,SAAS,GAAG;AAC1B,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,gBAAgB,EAAE,KAAK,UAAU;AAE3C,iBAAW,WAAW,YAAY,WAAW,cAAc,GAAG;AAC5D,cAAM,YAAY,MAAM,WAAoC,QAAQ,UAAU;AAK9E,cAAM,eAAe,MAAM,UAAU,KAAK;AAC1C,mBAAW,SAAS,cAAc;AAChC,gBAAM,KAAK,MAAM,QAAQ,KAAK;AAG9B,cAAI,OAAO,OAAO,YAAY,OAAO,OAAO,SAAU;AACtD,cAAI,OAAO,EAAE,MAAM,GAAI;AACvB,gBAAM,UAAU,gBAAgB,QAAQ,YAAY,KAAK;AACzD,cAAI,IAAI,QAAQ,YAAY,OAAO,GAAG;AACpC,iBAAK,KAAK,CAAC,QAAQ,YAAY,OAAO,CAAC;AAAA,UACzC,OAAO;AACL,6BAAiB;AAAA,UACnB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAK,EAAE,eAAe,UAAU;AAChD,YAAM,IAAI;AAAA,QACR,iCAAiC,QAAQ;AAAA,MAE3C;AAAA,IACF;AACA,eAAW;AAAA,EACb;AAKA,MAAI,mBAA4C,CAAC;AACjD,aAAW,CAAC,GAAG,GAAG,KAAK,QAAS,YAAW,MAAM,IAAK,kBAAiB,KAAK,CAAC,GAAG,EAAE,CAAC;AAEnF,QAAM,eAAoC,CAAC;AAE3C,SAAO,iBAAiB,SAAS,GAAG;AAClC,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,gBAAgB,EAAE,KAAK,kBAAkB;AACnD,YAAM,WAAW,YAAY,YAAY,cAAc;AACvD,UAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACxC,YAAM,OAAO,MAAM,WAAoC,cAAc;AACrE,YAAM,SAAS,MAAM,KAAK,IAAI,EAAE;AAChC,UAAI,CAAC,OAAQ;AACb,iBAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,cAAM,QAAQ,OAAO,KAAK;AAE1B,YAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU;AAC5D,cAAM,WAAW,OAAO,KAAK;AAU7B,cAAM,aAAa,MAAM,WAAoC,WAAW,MAAM;AAC9E,cAAM,eAAe,MAAM,WAAW,IAAI,QAAQ;AAClD,YAAI,CAAC,cAAc;AAKjB,gBAAM,eAAe,MAAM,QAAQ,IAAI,WAAW,WAAW,QAAQ,QAAQ;AAC7E,gBAAM,SACJ,iBAAiB,aAAa,SAAS,KAAK,IAAI,aAAa;AAC/D,uBAAa,KAAK;AAAA,YAChB,YAAY;AAAA,YAAgB;AAAA,YAAI;AAAA,YAAO,QAAQ,WAAW;AAAA,YAAQ,UAAU;AAAA,YAAU;AAAA,UACxF,CAAC;AACD;AAAA,QACF;AAIA,YAAI,IAAI,WAAW,QAAQ,QAAQ,GAAG;AACpC,eAAK,KAAK,CAAC,WAAW,QAAQ,QAAQ,CAAC;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAK,EAAE,gBAAgB,UAAU;AACjD,YAAM,IAAI;AAAA,QACR,iCAAiC,QAAQ;AAAA,MAC3C;AAAA,IACF;AACA,uBAAmB;AAAA,EACrB;AAEA,QAAM,QAAQ,KAAK,IAAI,cAAc,aAAa;AAElD,SAAO,EAAE,SAAS,OAAO,EAAE,OAAO,eAAe,GAAG,aAAa;AACnE;;;AC9KA,eAAsB,aACpB,OACA,SACA,iBACsB;AACtB,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,cAAiE,CAAC;AACxE,QAAM,OAAO,oBAAI,IAAwB;AAEzC,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,UAAU,MAAM,YAAY;AAClC,SAAK,IAAI,gBAAgB,OAAO;AAChC,UAAM,MAAyC,CAAC;AAOhD,UAAM,WAAW,kBAAkB,cAAc;AACjD,UAAM,OAAO,WAAW,IAAI,IAAI,QAAQ,IAAI;AAC5C,UAAM,UAAU,CAAC,cAA8B;AAC7C,UAAI,CAAC,KAAM,QAAO;AAClB,YAAM,MAAM,KAAK,MAAM,SAAS;AAChC,YAAM,OAAgC,CAAC;AACvC,UAAI,QAAQ,IAAK,MAAK,IAAI,IAAI,IAAI,IAAI;AACtC,iBAAW,KAAK,KAAM,KAAI,KAAK,IAAK,MAAK,CAAC,IAAI,IAAI,CAAC;AACnD,aAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAEA,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,IAAK;AAOV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,gEAAgE,cAAc,SAAS,EAAE,WAC9E,IAAI,KAAK;AAAA,QAEtB;AAAA,MACF;AACA,UAAI,IAAI,SAAS,QAAW;AAS1B,cAAM,MAAM,MAAM,UAAU,IAAI,MAAM,MAAM;AAC5C,cAAMA,aAAY,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,GAAG;AACvD,cAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,QAAQF,UAAS,GAAG,GAAG;AAC1D,cAAM,UAAU,MAAM,QAAQ,KAAK,OAAO;AAC1C,YAAI,EAAE,IAAI,EAAE,GAAG,KAAK,KAAKC,KAAI,OAAOC,OAAM,MAAM,QAAQ;AACxD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,iBAAiB,KAAK,MAAM;AACpD,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,QAAQ,SAAS,GAAG,OAAO;AAC9D,UAAI,EAAE,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC3C;AACA,gBAAY,cAAc,IAAI;AAAA,EAChC;AAEA,SAAO,EAAE,aAAa,KAAK;AAC7B;AAQA,eAAsB,aACpB,OACA,SACA,UACA,iBAC4C;AAC5C,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,MAAyC,CAAC;AAEhD,aAAW,kBAAkB,QAAQ,KAAK,GAAG;AAI3C,QAAI,kBAAkB,cAAc,EAAG;AACvC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,oBAAoB,cAAc;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,UAAU,SAAS,IAAI,cAAc;AAC3C,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,YAAY,MAAM,iBAAiB,KAAK,MAAM;AACpD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,OAAO;AACrD,QAAI,cAAc,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,EACvD;AACA,SAAO;AACT;AAEA,IAAM,cAAc,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,IAAI,GAAG;AAmBrE,eAAsB,YACpB,OACA,SACA,oBACA,WAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,eAAe,MAAM,OAAO,iBAAiB;AAGnD,QAAM,OAAO,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG,KAAK;AACpE,QAAM,aAA4B,CAAC;AACnC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,mBAAmB,EAAE;AAC9D,QAAI,CAAC,IAAK;AACV,eAAW,KAAK,KAAK,MAAM,MAAM,iBAAiB,KAAK,YAAY,CAAC,CAAgB;AAAA,EACtF;AAGA,QAAM,OAAO,WAAW;AAAA,IACtB,CAAC,OAAO,EAAE,OAAO,SAAS,EAAE,OAAO,cAAc,QAAQ,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,EAAE,KAAK;AAAA,EAC3F;AAGA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,WAAS,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK;AACzC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,EAAE,OAAO,MAAO;AACpB,UAAM,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE;AACnC,QAAI,CAAC,eAAe,IAAI,GAAG,EAAG,gBAAe,IAAI,KAAK,CAAC;AAAA,EACzD;AAGA,QAAM,UAA6C,CAAC;AACpD,MAAI,WAAW;AACf,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,UAAM,MAAM,GAAG,IAAI,UAAU,IAAI,IAAI,EAAE;AACvC,UAAM,cAAc,IAAI,OAAO,SAAS,eAAe,IAAI,GAAG,MAAM;AACpE,UAAM,aAAa,mBAAmB,IAAI,UAAU,IAAI,IAAI,EAAE;AAC9D,UAAM,cAAc,eAAe,aAC/B,MAAM,oBAAoB,UAAU,IACpC,IAAI;AACR,UAAM,QAAqB;AAAA,MACzB,OAAO;AAAA,MACP;AAAA,MACA,IAAI,IAAI;AAAA,MACR,YAAY,IAAI;AAAA,MAChB,IAAI,IAAI;AAAA,MACR,SAAS,IAAI;AAAA,MACb,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX;AAAA,MACA,GAAI,IAAI,WAAW,SAAY,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,KAAK,GAAG,SAAS;AAClE,YAAQ,YAAY,CAAC,CAAC,IAAI;AAAA,MACxB,EAAE,YAAY,mBAAmB,IAAI,YAAY,CAAC,EAAE;AAAA,MACpD,EAAE,SAAS,IAAI,GAAG,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM;AAAA,IAC5D;AACA,eAAW,MAAM,UAAU,KAAK;AAChC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,OAAO,EAAE,MAAM,UAAU,OAAO,KAAK,OAAO,IAAI,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,OAAO,IAAI,IAAI,GAAG;AAAA,EAClG;AACF;AAMA,SAAS,SAAS,MAAc,YAAoB,YAAgC;AAClF,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,UAAU,EAAE;AACvE;AAgDA,eAAsB,WACpB,OACA,SACA,UACA,iBAC2B;AAC3B,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,WAA8D,CAAC;AAKrE,QAAM,cAAc,oBAAI,IAAoB;AAC5C,QAAM,SAAS,CAAC,SAAuB;AACrC,QAAI,CAAC,KAAM;AACX,gBAAY,IAAI,OAAO,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,EACxD;AAEA,QAAM,QAAQ,CAAC,YAAoB,IAAY,QAAiC;AAC9E,QAAI,SAAS,SAAS,UAAU;AAChC,QAAI,CAAC,QAAQ;AAAE,eAAS,CAAC;AAAG,eAAS,UAAU,IAAI;AAAA,IAAO;AAC1D,WAAO,EAAE,IAAI;AAAA,EACf;AAGA,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,UAAM,UAAU,SAAS,IAAI,cAAc;AAC3C,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,WAAW,kBAAkB,cAAc;AACjD,UAAM,OAAO,WAAW,IAAI,IAAI,QAAQ,IAAI;AAG5C,UAAM,kBAAkB,GAAG,iBAAiB,GAAG,cAAc;AAC7D,eAAW,MAAM,KAAK;AASpB,YAAM,WAAW,GAAG,cAAc,KAAK,EAAE;AACzC,YAAM,YAAY,MAAM,QAAQ,IAAI,WAAW,wBAAwB,QAAQ;AAC/E,UAAI,WAAW;AACb,cAAM,cAAc,MAAM,iBAAiB,WAAW,MAAM;AAC5D,cAAM,aAAa,MAAM,kBAAkB,aAAa,OAAO;AAC/D,cAAM,wBAAwB,UAAU,EAAE,GAAG,WAAW,GAAG,WAAW,CAAC;AAAA,MACzE;AAEA,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,iBAAiB,EAAE;AAC5D,UAAI,CAAC,IAAK;AAKV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,uEAAuE,eAAe,SAC7E,EAAE,WAAW,IAAI,KAAK;AAAA,QACjC;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,MAAM,MAAM,iBAAiB,KAAK,MAAM,CAAC;AAG5D,YAAM,OAAmC,CAAC;AAC1C,iBAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,EAAG;AASjC,cAAM,EAAE,gBAAgB,GAAG,aAAa,IAAI;AAC5C,aAAK;AACL,aAAK,QAAQ,IAAI;AACjB,eAAO,KAAK,IAAI;AAAA,MAClB;AACA,UAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG;AACpC,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,GAAG,OAAO;AAChE,YAAM,iBAAiB,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,IAC7D;AAIA,UAAM,qBAAqB,GAAG,oBAAoB,GAAG,cAAc;AACnE,UAAM,cAAc,MAAM,QAAQ,KAAK,WAAW,kBAAkB;AACpE,eAAW,OAAO,aAAa;AAC7B,YAAM,CAAC,UAAU,QAAQ,IAAI,IAAI,MAAM,IAAI;AAC3C,UAAI,aAAa,UAAa,CAAC,IAAI,IAAI,QAAQ,EAAG;AAClD,UAAI,QAAQ,aAAa,UAAa,CAAC,KAAK,IAAI,QAAQ,EAAG;AAC3D,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,oBAAoB,GAAG;AAChE,UAAI,CAAC,IAAK;AAGV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,6EAA6E,kBAAkB,UACrF,GAAG,WAAW,IAAI,KAAK;AAAA,QACnC;AAAA,MACF;AACA,YAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,KAAK,MAAM,CAAC;AAC7D,aAAO,OAAO,IAAI;AAClB,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,OAAO;AAClE,YAAM,oBAAoB,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AAKA,MAAI,YAAY,SAAS,EAAG,QAAO,EAAE,SAAS;AAG9C,QAAM,aAAa,MAAM,OAAO,eAAe;AAC/C,QAAM,kBAAkB,MAAM,YAAY;AAE1C,aAAW,CAAC,MAAM,QAAQ,KAAK,aAAa;AAC1C,UAAM,SAAS,MAAM,QAAQ,IAAI,WAAW,uBAAuB,IAAI;AACvE,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,KAAK,MAAM,MAAM,iBAAiB,QAAQ,UAAU,CAAC;AAGlE,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,mBAAa,MAAM,UAAU,KAAK,MAAM,UAAU;AAClD,0BAAoB;AAAA,IACtB,OAAO;AAEL,mBAAa,MAAM,YAAY;AAC/B,0BAAoB;AAAA,IACtB;AAIA,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,UAAU,GAAG,IAAI,IAAI,CAAC;AAC5B,YAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,wBAAwB,OAAO;AAC7E,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR,0BAA0B,CAAC,IAAI,KAAK,UAAU,sBAAsB,IAAI;AAAA,QAE1E;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,wBAAwB,SAAS,QAAQ;AAAA,MACjD,OAAO;AACL,cAAM,MAAM,SAAS,MAAM,GAAG,KAAK,UAAU;AAC7C,cAAM,QAAQ,MAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,YAAY,GAAG;AACrF,cAAM,EAAE,IAAAD,KAAI,MAAAC,MAAK,IAAI,MAAM,oBAAoB,OAAO,YAAY,GAAG;AACrE,cAAM,wBAAwB,SAAS,EAAE,GAAG,UAAU,KAAKD,KAAI,OAAOC,MAAK,CAAC;AAAA,MAC9E;AAAA,IACF;AAKA,UAAM,EAAE,aAAa,GAAG,KAAK,IAAI;AACjC,SAAK;AACL,UAAM,UAAsB,EAAE,GAAG,MAAM,UAAU,MAAM,MAAM,QAAQ,YAAY,eAAe,EAAE;AAClG,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,eAAe;AAC3E,UAAM,uBAAuB,MAAM,EAAE,GAAG,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,EACxE;AAEA,SAAO,EAAE,UAAU,SAAS,gBAAgB;AAC9C;AAcA,eAAsB,SAAS,MAAoD;AACjF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,YAAY,GAAG,KAAK,MAAM;AACpC,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,GAAG;AACpD,WAAO,UAAU,IAAI,eAAe,GAAG;AAAA,EACzC;AAEA,QAAM,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC7D,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAAa,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3F,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AACjE,QAAM,KAAK,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAE9E,QAAM,WAAW,IAAI,WAAW,GAAG,aAAa,GAAG,UAAU;AAC7D,WAAS,IAAI,IAAI,CAAC;AAClB,WAAS,IAAI,IAAI,WAAW,EAAE,GAAG,GAAG,UAAU;AAE9C,QAAM,SAAS,eAAe,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AACxE,SAAO;AAAA,IACL,MAAM,EAAE,GAAG,GAAG,KAAK,0BAA0B,QAAQ,SAAS,eAAe,QAAQ,EAAE;AAAA,IACvF;AAAA,EACF;AACF;AA0CA,eAAsB,iBACpB,OACA,MACiC;AACjC,SAAO,MAAM,cAAc,iBAAiB,OAAO,IAAI;AACzD;AAOA,eAAsB,qBACpB,OACA,MACiC;AAKjC,MAAI,MAAM,SAAS,aAAa;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR,8EAA8E,MAAM,IAAI;AAAA,IAE1F;AAAA,EACF;AAOA,MAAI,KAAK,aAAc,OAAM,MAAM,0BAA0B;AAE7D,QAAM,EAAE,SAAS,aAAa,IAAI,MAAM,YAAY,OAAO,IAAI;AAC/D,QAAM,EAAE,aAAa,KAAK,IAAI,MAAM,aAAa,OAAO,SAAS,KAAK,eAAe;AAMrF,MAAI;AACJ,MAAI;AACJ,MAAI,KAAK,eAAe,MAAM,iBAAiB,MAAM,MAAM;AAMzD,UAAM,YAAY,MAAM,YAAY;AACpC,UAAM,QAAQ,MAAM,YAAY,OAAO,SAAS,aAAa,SAAS;AACtE,QAAI,MAAM,KAAK,SAAS,GAAG;AACzB,sBAAgB,MAAM;AACtB,mBAAa,MAAM;AACnB,WAAK,IAAI,mBAAmB,SAAS;AAAA,IACvC;AAAA,EACF;AAMA,QAAM,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM,KAAK,eAAe;AACzE,MAAI,MAAM,QAAS,MAAK,IAAI,iBAAiB,MAAM,OAAO;AAI1D,QAAM,kBAAkB,KAAK,eAAe,MAAM,aAAa,OAAO,SAAS,MAAM,KAAK,eAAe,IAAI,CAAC;AAC9G,QAAM,WAA8D,CAAC;AACrE,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,UAAS,kBAAkB,IAAI;AAC5E,MAAI,cAAe,UAAS,iBAAiB,IAAI;AACjD,aAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,MAAM,QAAQ,EAAG,UAAS,UAAU,IAAI;AAC3F,QAAM,cAAc,OAAO,KAAK,QAAQ,EAAE,SAAS;AAEnD,QAAM,EAAE,MAAM,YAAY,IAAI,MAAM,SAAS,IAAI;AAMjD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAa;AAAA,IACb,QAAQ,yBAAyB,KAAK,MAAM;AAAA,EAC9C,CAAC;AAID,QAAM,EAAE,MAAM,UAAU,IAAI,MAAM,iBAAiB;AACnD,QAAM,SAAS;AAAA,IACb,eAAe;AAAA,IACf,cAAc;AAAA,IACd,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc;AAAA;AAAA,IACd,UAAU,CAAC;AAAA,IACX;AAAA,IACA,GAAI,cAAc,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,IAC7C,GAAI,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,MAAM,OAAO,WAAW,OAAO,IAAI,WAAW,GAAG,EAAE,IAAI,CAAC;AAAA,EAC5G;AACA,QAAM,cAAc,KAAK,UAAU,+BAA+B,KAAK,UAAU,MAAM,GAAG,IAAI,CAAC;AAK/F,QAAM,SAAS,aAAa;AAC5B,QAAM,cAAc,MAAM,qBAAqB;AAAA,IAC7C;AAAA,IACA;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,KAAK,QAAQ,KAAK,OAAO;AAAA;AAAA,IAChE;AAAA,EACF,CAAC;AAED,SAAO,EAAE,aAAa,aAAa,QAAQ,KAAK,QAAQ,aAAa;AACvE;","names":["plaintext","iv","data"]}

package/dist/chunk-URVL4EKU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `port/with/classified-strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;;;;AAwDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/chunk-V3OLO4TK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/links/link-set.ts"],"sourcesContent":["/**\n * `_links_*` reserved collections — managed bidirectional many-to-many\n * junctions (design B).\n *\n * Where `refArray` (design A) stores an id-array on one owning record,\n * `vault.link()` creates a first-class junction: a dedicated encrypted\n * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.\n * It is queryable from BOTH sides (`of(id)`), carries optional per-link\n * metadata, and cascades on endpoint delete.\n *\n * Each link is slot-typed: `a` is an id in the `a` endpoint collection,\n * `b` an id in the `b` endpoint collection (they may be the same\n * collection for self-links). A link's identity is the ordered pair\n * `(a, b)`; `of(id)` matches either slot.\n *\n * Rows are encrypted under a dedicated `_links_<name>` DEK — same\n * zero-knowledge stack as every other collection (the store sees only\n * ciphertext). Backup/restore rides the normal `loadAll` path.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\n\n// Naming helpers, declaration types, and LinkIntegrityError live in\n// `names.ts` (the always-loadable slice — #553); re-exported here so\n// existing import paths and the root barrel are unchanged.\nexport {\n  LINK_COLLECTION_PREFIX,\n  linkCollectionName,\n  isLinkCollectionName,\n  linkRowKey,\n  LinkIntegrityError,\n} from './names.js'\nexport type { LinkOnDelete, LinkSpec, LinkRow, LinkSetHandle } from './names.js'\nimport { linkCollectionName, linkRowKey } from './names.js'\nimport type { LinkSpec, LinkRow, LinkSetHandle } from './names.js'\n\n/** Stored form (also the row key derivation source). */\ninterface LinkEntry {\n  a: string\n  b: string\n  meta?: Record<string, unknown>\n}\n\n/**\n * @internal — the concrete handle. The Vault owns construction (one per\n * link name) and the cascade hooks; consumers use the {@link LinkSetHandle}\n * surface via `vault.links(name)`.\n */\nexport class LinkSet implements LinkSetHandle {\n  private readonly collName: string\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(\n    private readonly adapter: NoydbStore,\n    private readonly vault: string,\n    private readonly name: string,\n    private readonly spec: LinkSpec,\n    private readonly encrypted: boolean,\n    private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>,\n    private readonly actor: string,\n    private readonly emitter: NoydbEventEmitter,\n    /** Vault-provided existence check for endpoint validation on connect(). */\n    private readonly endpointExists: (collection: string, id: string) => Promise<boolean>,\n  ) {\n    this.collName = linkCollectionName(name)\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName)\n    return this.dekPromise\n  }\n\n  private async encryptEntry(entry: LinkEntry, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(entry)\n    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: new Date().toISOString(), _by: this.actor }\n    if (!this.encrypted) return { ...base, _iv: '', _data: json }\n    const { iv, data } = await encrypt(json, await this.dek())\n    return { ...base, _iv: iv, _data: data }\n  }\n\n  private async decryptEntry(env: EncryptedEnvelope): Promise<LinkEntry> {\n    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data\n    return JSON.parse(json) as LinkEntry\n  }\n\n  async connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void> {\n    if (!(await this.endpointExists(this.spec.a, aId))) {\n      throw new LinkEndpointError(this.name, this.spec.a, aId)\n    }\n    if (!(await this.endpointExists(this.spec.b, bId))) {\n      throw new LinkEndpointError(this.name, this.spec.b, bId)\n    }\n    const key = linkRowKey(aId, bId)\n    const entry: LinkEntry = meta !== undefined ? { a: aId, b: bId, meta } : { a: aId, b: bId }\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1)\n    await this.adapter.put(this.vault, this.collName, key, env, existing?._v)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'put' })\n  }\n\n  async disconnect(aId: string, bId: string): Promise<void> {\n    const key = linkRowKey(aId, bId)\n    const existing = await this.adapter.get(this.vault, this.collName, key)\n    if (!existing) return\n    await this.adapter.delete(this.vault, this.collName, key)\n    this.emitter.emit('change', { vault: this.vault, collection: this.collName, id: key, action: 'delete' })\n  }\n\n  async has(aId: string, bId: string): Promise<boolean> {\n    return (await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId))) !== null\n  }\n\n  async of(id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter((r) => r.a === id || r.b === id)\n  }\n\n  async list(): Promise<LinkRow[]> {\n    const keys = await this.adapter.list(this.vault, this.collName)\n    const out: LinkRow[] = []\n    for (const key of keys) {\n      const env = await this.adapter.get(this.vault, this.collName, key)\n      if (!env) continue\n      const e = await this.decryptEntry(env)\n      out.push(e.meta !== undefined ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b })\n    }\n    return out\n  }\n\n  // ── Vault-internal cascade helpers ──────────────────────────────────\n\n  /** @internal — rows where the deleted endpoint id matches the relevant slot. */\n  async _rowsTouchingEndpoint(collection: string, id: string): Promise<LinkRow[]> {\n    const rows = await this.list()\n    return rows.filter(\n      (r) => (this.spec.a === collection && r.a === id) || (this.spec.b === collection && r.b === id),\n    )\n  }\n\n  /** @internal — the storage collection name (for tx pre-image capture). */\n  get _collectionName(): string {\n    return this.collName\n  }\n}\n\n/** Thrown by `connect()` when an endpoint record does not exist. */\nexport class LinkEndpointError extends NoydbError {\n  readonly link: string\n  readonly endpoint: string\n  readonly missingId: string\n  constructor(link: string, endpoint: string, missingId: string) {\n    super(\n      'LINK_ENDPOINT',\n      `link(\"${link}\").connect: endpoint \"${endpoint}\" has no record \"${missingId}\".`,\n    )\n    this.name = 'LinkEndpointError'\n    this.link = link\n    this.endpoint = endpoint\n    this.missingId = missingId\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoDO,IAAM,UAAN,MAAuC;AAAA,EAI5C,YACmB,SACA,OACA,MACA,MACA,WACA,QACA,OACA,SAEA,gBACjB;AAViB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEjB,SAAK,WAAW,mBAAmB,IAAI;AAAA,EACzC;AAAA,EAZmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAbF;AAAA,EACT,aAAyC;AAAA,EAiBzC,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,KAAK,QAAQ;AACjE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,aAAa,OAAkB,SAA6C;AACxF,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAM,OAAO,EAAE,QAAQ,sBAAsB,IAAI,SAAS,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,KAAK,MAAM;AACzG,QAAI,CAAC,KAAK,UAAW,QAAO,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,KAAK;AAC5D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,CAAC;AACzD,WAAO,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,KAAK;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,KAA4C;AACrE,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAClF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAM,QAAQ,KAAa,KAAa,MAA+C;AACrF,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,QAAI,CAAE,MAAM,KAAK,eAAe,KAAK,KAAK,GAAG,GAAG,GAAI;AAClD,YAAM,IAAI,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG;AAAA,IACzD;AACA,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,QAAmB,SAAS,SAAY,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,GAAG,IAAI;AAC1F,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,UAAM,MAAM,MAAM,KAAK,aAAa,QAAQ,UAAU,MAAM,KAAK,CAAC;AAClE,UAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,KAAK,KAAK,UAAU,EAAE;AACxE,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,MAAM,CAAC;AAAA,EACtG;AAAA,EAEA,MAAM,WAAW,KAAa,KAA4B;AACxD,UAAM,MAAM,WAAW,KAAK,GAAG;AAC/B,UAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,KAAK,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,GAAG;AACxD,SAAK,QAAQ,KAAK,UAAU,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,UAAU,IAAI,KAAK,QAAQ,SAAS,CAAC;AAAA,EACzG;AAAA,EAEA,MAAM,IAAI,KAAa,KAA+B;AACpD,WAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,GAAG,CAAC,MAAO;AAAA,EACvF;AAAA,EAEA,MAAM,GAAG,IAAgC;AACvC,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,OAA2B;AAC/B,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,KAAK,QAAQ;AAC9D,UAAM,MAAiB,CAAC;AACxB,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,KAAK,UAAU,GAAG;AACjE,UAAI,CAAC,IAAK;AACV,YAAM,IAAI,MAAM,KAAK,aAAa,GAAG;AACrC,UAAI,KAAK,EAAE,SAAS,SAAY,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAoB,IAAgC;AAC9E,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,WAAO,KAAK;AAAA,MACV,CAAC,MAAO,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM,MAAQ,KAAK,KAAK,MAAM,cAAc,EAAE,MAAM;AAAA,IAC9F;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,kBAA0B;AAC5B,WAAO,KAAK;AAAA,EACd;AACF;AAGO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,MAAc,UAAkB,WAAmB;AAC7D;AAAA,MACE;AAAA,MACA,SAAS,IAAI,yBAAyB,QAAQ,oBAAoB,SAAS;AAAA,IAC7E;AACA,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,YAAY;AAAA,EACnB;AACF;","names":[]}