@noy-db/hub 0.7.0-pre.11 → 0.7.0-pre.13

package/dist/{walk-G3CZIL4L.js → walk-P3E6QSNC.js}

@@ -1,7 +1,8 @@
 import {
   dumpVaultSchema
-} from "./chunk-A5WZEPXJ.js";
-import "./chunk-KHKKD62N.js";
+} from "./chunk-VGICZPVE.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
 import "./chunk-URHRIAV6.js";
 import "./chunk-Y2NBBT6K.js";
 import "./chunk-WWNYSV7S.js";
@@ -18,4 +19,4 @@ import "./chunk-PZ5AY32C.js";
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-G3CZIL4L.js.map
+//# sourceMappingURL=walk-P3E6QSNC.js.map

package/dist/with-formula/derivations/dispatch.d.ts

@@ -94,5 +94,20 @@ export interface DerivationDispatchCtx extends DerivationDeleteCtx {
  * by the executor — a write to the child recomputes the parent aggregate, and
  * a write to the parent recomputes its own.
  */
-export declare function dispatchDerivations(ctx: DerivationDispatchCtx, id: string, record: Record<string, unknown>, version: number, wave?: WaveContext): Promise<void>;
+export declare function dispatchDerivations(ctx: DerivationDispatchCtx, id: string, record: Record<string, unknown>, version: number, wave?: WaveContext, 
+/** The pre-write record at `id` in THIS collection (undefined = not
+ *  captured — no field-match trigger, or a sync-applied wave; null =
+ *  captured and absent, i.e. a create). Only a `Record` re-fires the OLD
+ *  matched set alongside the new one (spec §7). */
+prior?: Record<string, unknown> | null): Promise<void>;
+/**
+ * Trigger fan-out for a DELETED parent record (#1249, spec §8). Distinct from
+ * the "record-shape derivations not dispatched on delete" rule — that is
+ * about deleting a SOURCE record; this fires when a TRIGGER collection's
+ * record is deleted, re-deriving source records that still exist. Pairs
+ * evaluate against the tombstoned record's values; matched sources re-derive
+ * through the normal executor (their derive() reads the now-absent parent
+ * and decides what that means — the engine never cascades deletes).
+ */
+export declare function dispatchTriggerDerivationsOnDelete(ctx: DerivationDispatchCtx, id: string, deleted: Record<string, unknown>): Promise<void>;
 export {};

package/dist/with-formula/derivations/registry.d.ts

@@ -1,15 +1,11 @@
 import { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js';
+import { type NormalizedTrigger } from './trigger-match.js';
 import type { DerivationSpec } from './types.js';
 interface RegisteredStrategy {
     spec: DerivationSpec<any, any>;
     strategyHash: string;
+    readonly triggers: ReadonlyArray<NormalizedTrigger>;
 }
-/**
- * Vault-internal registry of derivation strategies. Owned by `Vault`;
- * not exported.
- *
- * @internal
- */
 export declare class DerivationRegistry {
     private readonly _bySource;
     private readonly _byOutput;
@@ -22,6 +18,24 @@ export declare class DerivationRegistry {
     register(spec: DerivationSpec<any, any>): Promise<void>;
     strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy>;
     strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy>;
+    /**
+     * The #1253-pattern typo guard for match fields (#1249): a misspelt
+     * `to`/`from` silently matches nothing forever, so validate against the
+     * collection's enumerable field set at the earliest point it exists.
+     * `schemaFieldKeys(schema) === undefined` (TS-generic collection,
+     * unreadable validator) is DELIBERATELY silent — those fields are real
+     * and unenumerable. `configKeys` folds in the collection's other
+     * non-schema field declarations (fieldMeta/moneyFields/dictKeyFields/
+     * refs/computed); `denormExempt` is derived here from this registry's
+     * own strategies rather than taken as a parameter — a field this
+     * collection's own derivations write via `denorm` is never a typo.
+     */
+    validateFieldsFor(collectionName: string, schema: unknown, configKeys: ReadonlyArray<string>, viaSources?: {
+        readonly computed?: Readonly<Record<string, unknown>> | undefined;
+        readonly viaFields?: Readonly<Record<string, unknown>> | undefined;
+    } | undefined): void;
+    /** #1266 — one message shape for both match sides; see {@link matchTargetFieldNames}. */
+    private _virtualMatchMessage;
     /**
      * All registered strategies as a flat, deduplicated array.
      * Each strategy is indexed once per source (not once per output key),

package/dist/with-formula/derivations/trigger-match.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Pure helpers behind composite `triggerBy` (#1249).
+ *
+ * A trigger entry is a CONJUNCTION of equality pairs: a source record
+ * matches when EVERY pair satisfies String(source[to]) === String(written[from]).
+ * `from: 'id'` reads the written record's id (winning over any stored field
+ * named `id`, matching dispatch's `{ ...incoming, id }` convention). The
+ * legacy `on` form normalizes to `[{ from: 'id', to: on }]` so everything
+ * downstream has ONE shape.
+ *
+ * Scalar coercion is verbatim from `_findMatchingIds`: both sides must be
+ * string | number; anything else fails the pair (never throws).
+ * Spec: docs/superpowers/specs/2026-08-29-composite-triggerby-design.md §4-§5.
+ * @module
+ */
+export interface MatchPair {
+    readonly from: string;
+    readonly to: string;
+}
+export interface NormalizedTrigger {
+    readonly collection: string;
+    readonly match: ReadonlyArray<MatchPair>;
+    readonly maxFanout?: number;
+}
+interface RawTrigger {
+    readonly collection: string;
+    readonly on?: string;
+    readonly match?: ReadonlyArray<MatchPair>;
+    readonly maxFanout?: number;
+}
+export declare function normalizeTriggerBy(triggerBy: ReadonlyArray<RawTrigger> | undefined): NormalizedTrigger[];
+/**
+ * The value tuple a written record presents to one trigger entry.
+ * `null` means "this record cannot address any source" (a from-field is
+ * absent or non-scalar) — a legitimate no-match, not an error.
+ */
+export declare function tupleFromWritten(match: ReadonlyArray<MatchPair>, writtenId: string, record: Record<string, unknown> | null): Array<{
+    field: string;
+    value: string;
+}> | null;
+/** Any single component differing means NOT the same tuple (spec §7). */
+export declare function sameTuple(a: Array<{
+    field: string;
+    value: string;
+}> | null, b: Array<{
+    field: string;
+    value: string;
+}> | null): boolean;
+/** Moved to the kernel (#1249) so `collection.ts` can import statically without
+ *  dragging derivations code into the floor bundle; re-exported here for
+ *  compatibility with existing consumers of this module. */
+export { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js';

package/dist/with-formula/derivations/types.d.ts

@@ -183,6 +183,29 @@ export interface DerivationSpec<TSource extends Record<string, unknown>, TOutput
         collection: string;
         on: string;
         maxFanout?: number;
+    } | {
+        /**
+         * Multi-field trigger (#1249): a source record matches when EVERY
+         * pair satisfies `String(source[to]) === String(written[from])`.
+         * `from: 'id'` reads the written record's id; any other `from`
+         * reads the written record's field. Exactly one of `on` | `match`
+         * per entry. On a LOCAL UPDATE that changes any matched `from`
+         * field, fan-out runs on old-match ∪ new-match (any single
+         * component changing counts) — the prior record is threaded only
+         * from the local write path, so a sync-applied wave write or a
+         * tiers restore fans out on the new tuple only. Parent DELETES fan
+         * out using the tombstoned record's values — for BOTH forms. A
+         * missing/non-scalar `from` value matches nothing. Match fields
+         * are validated against the collections' enumerable field sets
+         * where possible (silent for TS-generic collections — see the
+         * registration guard).
+         */
+        collection: string;
+        match: ReadonlyArray<{
+            from: string;
+            to: string;
+        }>;
+        maxFanout?: number;
     }>;
     /**
      * @internal — set by `withRollup()`. Marks this strategy as

package/dist/with-shape/introspection/behaviors.d.ts

@@ -46,6 +46,13 @@ export interface DerivationBehaviorEntry {
         readonly collection: string;
         readonly on: string;
         readonly maxFanout?: number;
+    } | {
+        readonly collection: string;
+        readonly match: ReadonlyArray<{
+            readonly from: string;
+            readonly to: string;
+        }>;
+        readonly maxFanout?: number;
     }>;
     readonly rollup?: {
         readonly from: string;

package/dist/with-shape/introspection/describe.d.ts

@@ -206,6 +206,36 @@ export interface ZodFieldSlot {
  * A duck-typed probe, not a Zod dependency: an unrecognised validator returns
  * `undefined` and the caller stays silent rather than guessing, so a validator
  * hub cannot read never produces a false "unknown field" error.
+ *
+ * Wrappers (reported by the pilot on #1249's guard, and it equally affected
+ * #1253's): a wrapped object's `.shape` is undefined, so "has a schema" and
+ * "hub can enumerate its fields" silently diverged for exactly the schemas
+ * most worth guarding — validated ones.
+ *
+ * ONE RULE UNWRAPS ALL OF THEM: FOLLOW THE OUTPUT SIDE. These keys describe
+ * the PARSED record, so the only question a wrapper raises is whether it
+ * changes the parsed shape.
+ *
+ *   Zod 3 `ZodEffects`  — `.refine()`/`.superRefine()` (`effect.type` is
+ *     `'refinement'`) and `z.preprocess()` (`'preprocess'`) both parse WITH
+ *     the inner schema, so the output is the inner object: follow
+ *     `_def.schema`. `.transform()` REPLACES the output, so the inner keys
+ *     would be a lie: stay `undefined`, deliberately.
+ *   Zod 4 `ZodPipe`     — `z.preprocess()` is `pipe(transform -> object)` and
+ *     `.transform()` is `pipe(object -> transform)`. Following `_def.out`
+ *     resolves both correctly with no effect-kind test: preprocess reaches the
+ *     object, transform reaches a `ZodTransform` that has no shape and no
+ *     inner schema, so the loop returns `undefined` on its own.
+ *
+ * `preprocess` was the pilot's second finding (#1262): the first fix followed
+ * refinements only, which left four of their registered collections unguarded
+ * — including the one carrying their only `fieldMeta` PII declaration, i.e.
+ * precisely the collection #1253 was written for. It is one string away from
+ * `transform` and means the opposite thing, so a test pins the two apart.
+ *
+ * A duck-typed probe throughout: an unrecognised validator returns `undefined`
+ * and the caller stays silent rather than guessing. Bounded depth, so a cyclic
+ * duck cannot hang us.
  */
 export declare function schemaFieldKeys(schema: unknown): readonly string[] | undefined;
 export declare function deriveZodFields(schema: unknown): Promise<Record<string, ZodFieldSlot>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.7.0-pre.11",
+  "version": "0.7.0-pre.13",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -233,14 +233,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.7.0-pre.11"
+    "@noy-db/attestation": "0.7.0-pre.13"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.7.0-pre.11"
+    "@noy-db/on-shamir": "0.7.0-pre.13"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"