@noy-db/hub 0.6.0-pre.4 → 0.6.0-pre.7

package/codemods/0.4.0-pre.json

@@ -654,6 +654,46 @@
       "safeGlobalReplace": true,
       "section": "§3",
       "note": "Pod-write option; refused rather than ignored as of 0.6.0-pre.3 (#991)."
+    },
+    {
+      "from": "sum",
+      "to": "@noy-db/hub/reduce",
+      "kind": "import-move",
+      "safeGlobalReplace": false,
+      "section": "§5",
+      "note": "Same name, new home: the reducer factories were pruned off the root barrel and republished at `@noy-db/hub/reduce` in the 0.4.0-pre line (§5). Edit the import, not the identifier — and note these names are ordinary English, so this row is NOT safe to replace globally."
+    },
+    {
+      "from": "count",
+      "to": "@noy-db/hub/reduce",
+      "kind": "import-move",
+      "safeGlobalReplace": false,
+      "section": "§5",
+      "note": "Same name, new home: the reducer factories were pruned off the root barrel and republished at `@noy-db/hub/reduce` in the 0.4.0-pre line (§5). Edit the import, not the identifier — and note these names are ordinary English, so this row is NOT safe to replace globally."
+    },
+    {
+      "from": "avg",
+      "to": "@noy-db/hub/reduce",
+      "kind": "import-move",
+      "safeGlobalReplace": false,
+      "section": "§5",
+      "note": "Same name, new home: the reducer factories were pruned off the root barrel and republished at `@noy-db/hub/reduce` in the 0.4.0-pre line (§5). Edit the import, not the identifier — and note these names are ordinary English, so this row is NOT safe to replace globally."
+    },
+    {
+      "from": "min",
+      "to": "@noy-db/hub/reduce",
+      "kind": "import-move",
+      "safeGlobalReplace": false,
+      "section": "§5",
+      "note": "Same name, new home: the reducer factories were pruned off the root barrel and republished at `@noy-db/hub/reduce` in the 0.4.0-pre line (§5). Edit the import, not the identifier — and note these names are ordinary English, so this row is NOT safe to replace globally."
+    },
+    {
+      "from": "max",
+      "to": "@noy-db/hub/reduce",
+      "kind": "import-move",
+      "safeGlobalReplace": false,
+      "section": "§5",
+      "note": "Same name, new home: the reducer factories were pruned off the root barrel and republished at `@noy-db/hub/reduce` in the 0.4.0-pre line (§5). Edit the import, not the identifier — and note these names are ordinary English, so this row is NOT safe to replace globally."
     }
   ]
 }

package/dist/broker/index.js

@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-NPF3BZGQ.js");
+      const { enrollSeed } = await import("../seed-GDV5PT4R.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-NPF3BZGQ.js");
+      const { rotateSeed } = await import("../seed-GDV5PT4R.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-NPF3BZGQ.js");
+          const { mintStoreCredentials } = await import("../seed-GDV5PT4R.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -6,7 +6,7 @@ import {
   diffVault,
   unsealDeks,
   withCargo
-} from "../chunk-HY6Y2P4Y.js";
+} from "../chunk-WNFZI3I5.js";
 import {
   extractPartition,
   walkClosure
@@ -16,7 +16,7 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-WDDHMAAO.js";
+} from "../chunk-NPP5R7FF.js";
 import "../chunk-FZ6NYJ7L.js";
 import "../chunk-FFDNKRCY.js";
 import "../chunk-PL2GHSCM.js";
@@ -33,7 +33,7 @@ import "../chunk-XWX7GL56.js";
 import "../chunk-CDB2HVQW.js";
 import {
   CustodyApi
-} from "../chunk-XMC2ZTRD.js";
+} from "../chunk-ADW22QSB.js";
 import "../chunk-4VUPLMZ6.js";
 import "../chunk-2BMRJ6LQ.js";
 import {
@@ -46,7 +46,7 @@ import {
 } from "../chunk-IGJCYUT5.js";
 import "../chunk-7G6VDWXB.js";
 import "../chunk-UHXCLPGC.js";
-import "../chunk-RW3XKAF3.js";
+import "../chunk-JRKZTEZZ.js";
 import "../chunk-5JY5TSVY.js";
 import "../chunk-AHLJSVRL.js";
 import {

package/dist/{chunk-AHCSWNVL.js → chunk-4R55OPT2.js}

@@ -1,6 +1,6 @@
 import {
   createNoydb
-} from "./chunk-7V2OGKES.js";
+} from "./chunk-YM75S6N6.js";
 import {
   deriveSchemaManifest
 } from "./chunk-2DHSSLOD.js";
@@ -16,7 +16,7 @@ import {
 } from "./chunk-4VUPLMZ6.js";
 import {
   loadKeyring
-} from "./chunk-RW3XKAF3.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -290,4 +290,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-AHCSWNVL.js.map
+//# sourceMappingURL=chunk-4R55OPT2.js.map

package/dist/{chunk-XMC2ZTRD.js → chunk-ADW22QSB.js}

@@ -1,7 +1,7 @@
 import {
   grant,
   revoke
-} from "./chunk-RW3XKAF3.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   CustodyNotEnabledError
 } from "./chunk-HNGSV2YC.js";
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-BAHOP2TQ.js");
+      const { liberateVault } = await import("./liberate-GFN4C7RR.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-XMC2ZTRD.js.map
+//# sourceMappingURL=chunk-ADW22QSB.js.map

package/dist/chunk-GOLN6LQ5.js

@@ -0,0 +1,123 @@
+import {
+  MoneyUnsupportedError,
+  decimalScaleOf,
+  formatScaledInt,
+  parseToScaledInt,
+  rescaleScaledInt
+} from "./chunk-NNYENE7N.js";
+
+// src/via/money/arith.ts
+function parseAmount(label, amount, scale, rounding) {
+  const r = parseToScaledInt(amount, scale, rounding);
+  if (!r.ok) {
+    throw new MoneyUnsupportedError(
+      r.reason === "precision" ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured` : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`
+    );
+  }
+  return r.value;
+}
+function resolveScale(label, amount, explicit) {
+  if (explicit !== void 0) {
+    if (!Number.isInteger(explicit) || explicit < 0) {
+      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`);
+    }
+    return explicit;
+  }
+  const inferred = decimalScaleOf(amount);
+  if (inferred === null) {
+    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`);
+  }
+  return inferred;
+}
+function mulRate(amount, rate, opts = {}) {
+  const scale = resolveScale("mulRate", amount, opts.scale);
+  const rounding = opts.rounding ?? "half-up";
+  const a = parseAmount("mulRate", amount, scale, rounding);
+  const rateScale = decimalScaleOf(rate);
+  if (rateScale === null) {
+    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
+  }
+  const r = parseToScaledInt(rate, rateScale);
+  if (!r.ok) {
+    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
+  }
+  const product = a * r.value;
+  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale);
+}
+function allocate(amount, weights, opts = {}) {
+  if (weights.length === 0) {
+    throw new MoneyUnsupportedError("allocate: weights must not be empty");
+  }
+  const scale = resolveScale("allocate", amount, opts.scale);
+  const a = parseAmount("allocate", amount, scale);
+  let weightScale = 0;
+  for (const w of weights) {
+    const s = decimalScaleOf(w);
+    if (s === null) {
+      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`);
+    }
+    if (s > weightScale) weightScale = s;
+  }
+  const scaledWeights = weights.map((w) => {
+    const r = parseToScaledInt(w, weightScale);
+    if (!r.ok || r.value < 0n) {
+      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`);
+    }
+    return r.value;
+  });
+  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n);
+  if (sumW === 0n) {
+    throw new MoneyUnsupportedError("allocate: weights must not all be zero");
+  }
+  const negative = a < 0n;
+  const mag = negative ? -a : a;
+  const base = [];
+  const remainders = [];
+  let distributed = 0n;
+  for (let i = 0; i < scaledWeights.length; i++) {
+    const product = mag * scaledWeights[i];
+    const share = product / sumW;
+    base.push(share);
+    distributed += share;
+    remainders.push({ index: i, rem: product % sumW });
+  }
+  let leftover = mag - distributed;
+  remainders.sort((x, y) => y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index);
+  for (const { index } of remainders) {
+    if (leftover === 0n) break;
+    base[index] = base[index] + 1n;
+    leftover -= 1n;
+  }
+  return base.map((p) => formatScaledInt(negative && p !== 0n ? -p : p, scale));
+}
+
+// src/via/money/branded.ts
+function asMoney(value) {
+  if (!isMoneyLike(value)) {
+    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`);
+  }
+  return String(value).trim();
+}
+function isMoneyString(value) {
+  return typeof value === "string" && isMoneyLike(value);
+}
+function moneyNumber(value) {
+  if (!isMoneyLike(value)) {
+    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`);
+  }
+  return Number(value);
+}
+function isMoneyLike(value) {
+  if (typeof value === "number") return Number.isFinite(value);
+  if (typeof value !== "string") return false;
+  return decimalScaleOf(value) !== null;
+}
+
+export {
+  mulRate,
+  allocate,
+  asMoney,
+  isMoneyString,
+  moneyNumber
+};
+//# sourceMappingURL=chunk-GOLN6LQ5.js.map

package/dist/chunk-GOLN6LQ5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/money/arith.ts","../src/via/money/branded.ts"],"sourcesContent":["/**\n * Exact money arithmetic helpers — `mulRate` and `allocate`.\n *\n * Both operate on the canonical decoded string form that `get()`\n * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no\n * floating-point step anywhere, exact past 2^53. They are pure\n * functions with no vault or descriptor dependency: the working scale\n * is inferred from the amount's fractional digits (a canonical money\n * string always carries exactly the field's scale) or pinned with\n * `opts.scale`.\n *\n * Why these two: app-side invariants of the form\n * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)\n * carry ±0.01 tolerances ONLY because the math is major-unit floats +\n * round2. `mulRate` (VAT-style rate application with explicit\n * rounding) and `allocate` (largest-remainder split — parts sum to the\n * input EXACTLY, by construction) make those tolerances zero.\n */\n\nimport {\n  parseToScaledInt,\n  formatScaledInt,\n  rescaleScaledInt,\n  decimalScaleOf,\n  type RoundingMode,\n} from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\nexport interface MulRateOptions {\n  /**\n   * Output scale (fraction digits). Defaults to the amount's own\n   * fractional digits — for a canonical money string that IS the\n   * field's scale.\n   */\n  readonly scale?: number\n  /** Rounding for the final re-scale. Default `'half-up'`. */\n  readonly rounding?: RoundingMode\n}\n\nexport interface AllocateOptions {\n  /** Working scale. Defaults to the amount's own fractional digits. */\n  readonly scale?: number\n}\n\n/** Parse `amount` at `scale` or throw the standard money TypeError. */\nfunction parseAmount(label: string, amount: number | string, scale: number, rounding?: RoundingMode): bigint {\n  const r = parseToScaledInt(amount, scale, rounding)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(\n      r.reason === 'precision'\n        ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured`\n        : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`,\n    )\n  }\n  return r.value\n}\n\nfunction resolveScale(label: string, amount: number | string, explicit: number | undefined): number {\n  if (explicit !== undefined) {\n    if (!Number.isInteger(explicit) || explicit < 0) {\n      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`)\n    }\n    return explicit\n  }\n  const inferred = decimalScaleOf(amount)\n  if (inferred === null) {\n    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`)\n  }\n  return inferred\n}\n\n/**\n * Multiply a money amount by a decimal rate, exactly.\n *\n * The rate is parsed at its OWN full precision (`0.07` → `7` at scale\n * 2), the product computed in `BigInt` at `amountScale + rateScale`,\n * then re-scaled back to the output scale with the requested rounding —\n * one rounding step, at the very end.\n *\n * ```ts\n * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)\n * mulRate('33.33', '0.07')                        // '2.33'    (half-up)\n * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'\n * mulRate(100, 0.07, { scale: 2 })                // '7.00'\n * ```\n */\nexport function mulRate(\n  amount: number | string,\n  rate: number | string,\n  opts: MulRateOptions = {},\n): string {\n  const scale = resolveScale('mulRate', amount, opts.scale)\n  const rounding = opts.rounding ?? 'half-up'\n  const a = parseAmount('mulRate', amount, scale, rounding)\n\n  const rateScale = decimalScaleOf(rate)\n  if (rateScale === null) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n  const r = parseToScaledInt(rate, rateScale)\n  if (!r.ok) {\n    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`)\n  }\n\n  const product = a * r.value // scaled at scale + rateScale\n  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale)\n}\n\n/**\n * Split a money amount across weighted buckets with ZERO drift: the\n * returned parts sum to the input exactly, by construction\n * (largest-remainder method).\n *\n * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover\n * minor units (always fewer than the bucket count) go one each to the\n * buckets with the largest truncated remainders — ties broken by\n * position, earlier bucket first. Weights are parsed as exact decimals\n * (no float division anywhere); they must be non-negative with a\n * positive sum.\n *\n * ```ts\n * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']\n * allocate('0.05', [3, 7])        // ['0.02', '0.03']\n * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']\n * ```\n */\nexport function allocate(\n  amount: number | string,\n  weights: ReadonlyArray<number | string>,\n  opts: AllocateOptions = {},\n): string[] {\n  if (weights.length === 0) {\n    throw new MoneyUnsupportedError('allocate: weights must not be empty')\n  }\n  const scale = resolveScale('allocate', amount, opts.scale)\n  const a = parseAmount('allocate', amount, scale)\n\n  // Parse every weight as an exact decimal at a common scale, so the\n  // proportion arithmetic below is pure BigInt.\n  let weightScale = 0\n  for (const w of weights) {\n    const s = decimalScaleOf(w)\n    if (s === null) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`)\n    }\n    if (s > weightScale) weightScale = s\n  }\n  const scaledWeights = weights.map(w => {\n    const r = parseToScaledInt(w, weightScale)\n    if (!r.ok || r.value < 0n) {\n      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`)\n    }\n    return r.value\n  })\n  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n)\n  if (sumW === 0n) {\n    throw new MoneyUnsupportedError('allocate: weights must not all be zero')\n  }\n\n  // Largest-remainder over the MAGNITUDE; a negative amount negates the\n  // parts at the end, so Σparts === amount holds for both signs.\n  const negative = a < 0n\n  const mag = negative ? -a : a\n\n  const base: bigint[] = []\n  const remainders: Array<{ index: number; rem: bigint }> = []\n  let distributed = 0n\n  for (let i = 0; i < scaledWeights.length; i++) {\n    const product = mag * scaledWeights[i]!\n    const share = product / sumW\n    base.push(share)\n    distributed += share\n    remainders.push({ index: i, rem: product % sumW })\n  }\n\n  // Leftover minor units: strictly fewer than the bucket count.\n  let leftover = mag - distributed\n  remainders.sort((x, y) => (y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index))\n  for (const { index } of remainders) {\n    if (leftover === 0n) break\n    base[index] = base[index]! + 1n\n    leftover -= 1n\n  }\n\n  return base.map(p => formatScaledInt(negative && p !== 0n ? -p : p, scale))\n}\n","/**\n * Branded money output type.\n *\n * The decoded read shape of a money field is an exact decimal STRING\n * (`'10000.00'`) — but a hand-written schema types it `string | number`,\n * which is honest about the input side and unhelpful on the output\n * side: every read site hand-coerces, and a missed coercion passes\n * typecheck silently (then surfaces as a runtime template warning, or\n * worse, as `'10000.00' * 100` arithmetic).\n *\n * {@link MoneyString} is the output-side brand: a `string` that has\n * been through noy-db's decode (or {@link asMoney}'s guard). Branding\n * is type-level only — zero runtime cost on the read path.\n *\n * ## Wiring the brand through a validator (the input/output asymmetry)\n *\n * Keep the permissive `string | number` on the INPUT side so write\n * sites are untouched, and brand the OUTPUT side. With Zod:\n *\n * ```ts\n * import type { MoneyString } from '@noy-db/hub'\n *\n * const moneyValue = z.union([z.number(), z.string()]) as unknown as\n *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>\n *\n * const Invoice = z.object({ id: z.string(), total: moneyValue })\n * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString\n * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number\n * ```\n *\n * The cast is sound for fields declared in `moneyFields`: reads pass\n * through `decodeMoneyFields`, which always produces the canonical\n * decimal string.\n */\n\nimport { decimalScaleOf } from './fixed-point.js'\nimport { MoneyUnsupportedError } from './descriptor.js'\n\ndeclare const MONEY_BRAND: unique symbol\n\n/**\n * An exact decimal string produced by noy-db's money decode\n * (`'10000.00'`). The brand exists only at the type level — at runtime\n * a `MoneyString` is a plain string.\n */\nexport type MoneyString = string & { readonly [MONEY_BRAND]: true }\n\n/**\n * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string\n * or a number, returns the canonical decimal string branded — throws\n * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at\n * trust boundaries (deserialized JSON, route params); values read\n * through `get()`/`list()` are already canonical.\n */\nexport function asMoney(value: string | number): MoneyString {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return String(value).trim() as MoneyString\n}\n\n/** Type guard: is `value` a decimal string acceptable as money? */\nexport function isMoneyString(value: unknown): value is MoneyString {\n  return typeof value === 'string' && isMoneyLike(value)\n}\n\n/**\n * The ONE sanctioned escape hatch to a JS `number` — explicit because\n * the conversion is lossy past 2^53. For display math and chart axes;\n * never feed the result back into stored amounts (use `mulRate` /\n * `allocate` for exact arithmetic).\n */\nexport function moneyNumber(value: MoneyString | string | number): number {\n  if (!isMoneyLike(value)) {\n    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`)\n  }\n  return Number(value)\n}\n\nfunction isMoneyLike(value: unknown): boolean {\n  if (typeof value === 'number') return Number.isFinite(value)\n  if (typeof value !== 'string') return false\n  return decimalScaleOf(value) !== null\n}\n"],"mappings":";;;;;;;;;AA6CA,SAAS,YAAY,OAAe,QAAyB,OAAe,UAAiC;AAC3G,QAAM,IAAI,iBAAiB,QAAQ,OAAO,QAAQ;AAClD,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI;AAAA,MACR,EAAE,WAAW,cACT,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,kCAAkC,KAAK,wCACjF,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO,EAAE;AACX;AAEA,SAAS,aAAa,OAAe,QAAyB,UAAsC;AAClG,MAAI,aAAa,QAAW;AAC1B,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAC/C,YAAM,IAAI,sBAAsB,GAAG,KAAK,wCAAwC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,eAAe,MAAM;AACtC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,sBAAsB,GAAG,KAAK,YAAY,KAAK,UAAU,MAAM,CAAC,0BAA0B;AAAA,EACtG;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,MACA,OAAuB,CAAC,GAChB;AACR,QAAM,QAAQ,aAAa,WAAW,QAAQ,KAAK,KAAK;AACxD,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,IAAI,YAAY,WAAW,QAAQ,OAAO,QAAQ;AAExD,QAAM,YAAY,eAAe,IAAI;AACrC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AACA,QAAM,IAAI,iBAAiB,MAAM,SAAS;AAC1C,MAAI,CAAC,EAAE,IAAI;AACT,UAAM,IAAI,sBAAsB,iBAAiB,KAAK,UAAU,IAAI,CAAC,0BAA0B;AAAA,EACjG;AAEA,QAAM,UAAU,IAAI,EAAE;AACtB,SAAO,gBAAgB,iBAAiB,SAAS,QAAQ,WAAW,OAAO,QAAQ,GAAG,KAAK;AAC7F;AAoBO,SAAS,SACd,QACA,SACA,OAAwB,CAAC,GACf;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,sBAAsB,qCAAqC;AAAA,EACvE;AACA,QAAM,QAAQ,aAAa,YAAY,QAAQ,KAAK,KAAK;AACzD,QAAM,IAAI,YAAY,YAAY,QAAQ,KAAK;AAI/C,MAAI,cAAc;AAClB,aAAW,KAAK,SAAS;AACvB,UAAM,IAAI,eAAe,CAAC;AAC1B,QAAI,MAAM,MAAM;AACd,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,0BAA0B;AAAA,IACjG;AACA,QAAI,IAAI,YAAa,eAAc;AAAA,EACrC;AACA,QAAM,gBAAgB,QAAQ,IAAI,OAAK;AACrC,UAAM,IAAI,iBAAiB,GAAG,WAAW;AACzC,QAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI;AACzB,YAAM,IAAI,sBAAsB,oBAAoB,KAAK,UAAU,CAAC,CAAC,iCAAiC;AAAA,IACxG;AACA,WAAO,EAAE;AAAA,EACX,CAAC;AACD,QAAM,OAAO,cAAc,OAAO,CAAC,KAAK,MAAM,MAAM,GAAG,EAAE;AACzD,MAAI,SAAS,IAAI;AACf,UAAM,IAAI,sBAAsB,wCAAwC;AAAA,EAC1E;AAIA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,WAAW,CAAC,IAAI;AAE5B,QAAM,OAAiB,CAAC;AACxB,QAAM,aAAoD,CAAC;AAC3D,MAAI,cAAc;AAClB,WAAS,IAAI,GAAG,IAAI,cAAc,QAAQ,KAAK;AAC7C,UAAM,UAAU,MAAM,cAAc,CAAC;AACrC,UAAM,QAAQ,UAAU;AACxB,SAAK,KAAK,KAAK;AACf,mBAAe;AACf,eAAW,KAAK,EAAE,OAAO,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,EACnD;AAGA,MAAI,WAAW,MAAM;AACrB,aAAW,KAAK,CAAC,GAAG,MAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,QAAQ,EAAE,KAAM;AACtF,aAAW,EAAE,MAAM,KAAK,YAAY;AAClC,QAAI,aAAa,GAAI;AACrB,SAAK,KAAK,IAAI,KAAK,KAAK,IAAK;AAC7B,gBAAY;AAAA,EACd;AAEA,SAAO,KAAK,IAAI,OAAK,gBAAgB,YAAY,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;AAC5E;;;ACnIO,SAAS,QAAQ,OAAqC;AAC3D,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,YAAY,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EAC7F;AACA,SAAO,OAAO,KAAK,EAAE,KAAK;AAC5B;AAGO,SAAS,cAAc,OAAsC;AAClE,SAAO,OAAO,UAAU,YAAY,YAAY,KAAK;AACvD;AAQO,SAAS,YAAY,OAA8C;AACxE,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,sBAAsB,gBAAgB,KAAK,UAAU,KAAK,CAAC,0BAA0B;AAAA,EACjG;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,eAAe,KAAK,MAAM;AACnC;","names":[]}

package/dist/{chunk-RW3XKAF3.js → chunk-JRKZTEZZ.js}

@@ -449,6 +449,12 @@ async function grant(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot grant role "${options.role}"`
     );
   }
+  const secret = options.secret;
+  if (typeof secret !== "string" || secret.trim() === "") {
+    throw new ValidationError(
+      `grant: \`secret\` is required and must be a non-empty string (got ${secret === void 0 ? "undefined" : typeof secret === "string" ? "an empty string" : typeof secret}). The grantee's key is derived from it, so a missing secret produces a keyring slot nobody can unlock. Note the 0.4.0-pre rename: the option is \`secret\`, not \`passphrase\`.`
+    );
+  }
   if (options.validateSecret && !options.allowWeakSecret) {
     assertStrongSecret(options.secret);
   }
@@ -456,15 +462,26 @@ async function grant(store, vault, callerKeyring, options) {
   const newSalt = generateSalt();
   const newKek = await deriveKey(options.secret, newSalt);
   const granteeMayHoldSecrets = options.role === "owner" || options.role === "admin";
+  let mintedForGrant = false;
+  for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
+    if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
+    if (callerKeyring.deks.has(collName)) continue;
+    if (await collectionHasRecords(store, vault, collName)) continue;
+    callerKeyring.deks.set(collName, await generateDEK());
+    mintedForGrant = true;
+  }
+  if (mintedForGrant) await persistKeyring(store, vault, callerKeyring);
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
     if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
     const dek = callerKeyring.deks.get(collName);
     if (dek) {
       wrappedDeks[collName] = await wrapKey(dek, newKek);
     }
   }
-  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer") {
+  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer" || permissionsAreWildcard(options.permissions)) {
     for (const [collName, dek] of callerKeyring.deks) {
       if (collName in wrappedDeks) continue;
       if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
@@ -817,6 +834,23 @@ async function listUsersWithEnvelopes(store, vault, userEnvelopeDek, callerRole,
   }
   return out;
 }
+async function collectionHasRecords(store, vault, collectionName) {
+  const ids = await store.list(vault, collectionName);
+  return ids.length > 0;
+}
+async function reloadPersistedDEK(store, vault, keyring, collectionName) {
+  if (!keyring.kek) return null;
+  const found = await readKeyringFile(store, vault, keyring.userId);
+  const wrapped = found?.file.deks[collectionName];
+  if (wrapped === void 0) return null;
+  try {
+    const dek = await unwrapKey(wrapped, keyring.kek);
+    keyring.deks.set(collectionName, dek);
+    return dek;
+  } catch {
+    return null;
+  }
+}
 async function ensureCollectionDEK(store, vault, keyring) {
   const inFlight = /* @__PURE__ */ new Map();
   return async (collectionName) => {
@@ -825,6 +859,20 @@ async function ensureCollectionDEK(store, vault, keyring) {
     const pending = inFlight.get(collectionName);
     if (pending) return pending;
     const promise = (async () => {
+      if (!collectionName.startsWith("_")) {
+        if (!hasAccess(keyring, collectionName)) {
+          throw new NoAccessError(
+            `No access \u2014 user does not have a key for collection "${collectionName}". Grant them this collection in \`permissions\` to give them one.`
+          );
+        }
+        if (await collectionHasRecords(store, vault, collectionName)) {
+          const refreshed = await reloadPersistedDEK(store, vault, keyring, collectionName);
+          if (refreshed) return refreshed;
+          throw new NoAccessError(
+            `No access \u2014 user "${keyring.userId}" is entitled to collection "${collectionName}" but holds no key for it, because the collection was created AFTER their grant. A collection DEK can only be wrapped at grant time (wrapping needs the grantee's secret, which the vault never stores), so this cannot be back-filled \u2014 re-grant the user to give them the key.`
+          );
+        }
+      }
       const dek = await generateDEK();
       keyring.deks.set(collectionName, dek);
       await persistKeyring(store, vault, keyring);
@@ -838,14 +886,20 @@ async function ensureCollectionDEK(store, vault, keyring) {
     }
   };
 }
+var PERMISSION_WILDCARD = "*";
+function permissionsAreWildcard(permissions) {
+  return permissions !== void 0 && PERMISSION_WILDCARD in permissions;
+}
 function hasWritePermission(keyring, collectionName) {
   if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return true;
   if (keyring.role === "viewer" || keyring.role === "client") return false;
+  if (keyring.permissions[PERMISSION_WILDCARD] === "rw") return true;
   return keyring.permissions[collectionName] === "rw";
 }
 function hasAccess(keyring, collectionName) {
   if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian" || keyring.role === "viewer")
     return true;
+  if (PERMISSION_WILDCARD in keyring.permissions) return true;
   return collectionName in keyring.permissions;
 }
 async function persistKeyring(store, vault, keyring) {
@@ -856,6 +910,8 @@ async function persistKeyring(store, vault, keyring) {
   }
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
   const existingEcho = existingFound?.file.echo;
+  const existingGrantedBy = existingFound?.file.granted_by;
+  const existingCreatedAt = existingFound?.file.created_at;
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
@@ -869,8 +925,8 @@ async function persistKeyring(store, vault, keyring) {
     permissions: keyring.permissions,
     deks: wrappedDeks,
     salt: bufferToBase64(keyring.salt),
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: keyring.userId,
+    created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    granted_by: existingGrantedBy ?? keyring.userId,
     canary,
     ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
     ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability },
@@ -968,4 +1024,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-RW3XKAF3.js.map
+//# sourceMappingURL=chunk-JRKZTEZZ.js.map