@noy-db/hub 0.7.0-pre.8 → 0.7.0

package/dist/transactions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadGuardExecutor = lazy(() => import('../../with-audit/guards/executor.js'))\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = await loadGuardExecutor()\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/transactions`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TransactionsStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface WithTransactionsOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ transactionsStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: WithTransactionsOptions): TransactionsStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,IAAM,oBAAoB,KAAK,MAAM,OAAO,yBAAqC,CAAC;AAuBlF,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAI,MAAM,kBAAkB;AAClD,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;ACtEO,SAAS,iBAAiB,MAAsD;AACrF,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadGuardExecutor = lazy(() => import('../../with-audit/guards/executor.js'))\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = await loadGuardExecutor()\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/transactions`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TransactionsStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface WithTransactionsOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ transactionsStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: WithTransactionsOptions): TransactionsStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAcA,IAAM,oBAAoB,KAAK,MAAM,OAAO,yBAAqC,CAAC;AAuBlF,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAI,MAAM,kBAAkB;AAClD,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;ACtEO,SAAS,iBAAiB,MAAsD;AACrF,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}

package/dist/{ulid-VQW6ERQN.js → ulid-4MKXG325.js}

@@ -2,9 +2,8 @@ import {
   generateULID,
   isULID
 } from "./chunk-4AOERLTV.js";
-import "./chunk-PZ5AY32C.js";
 export {
   generateULID,
   isULID
 };
-//# sourceMappingURL=ulid-VQW6ERQN.js.map
+//# sourceMappingURL=ulid-4MKXG325.js.map

package/dist/util/index.js

@@ -3,8 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 
 // src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";

package/dist/util/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/kernel/util/sanitize-filename.ts"],"sourcesContent":["/**\n * Target-profile aware filename sanitizer.\n *\n * Pure string in / string out. No filesystem access, no I/O. Use this\n * at the boundary where a user-supplied filename meets a storage\n * destination — local FS, ZIP archive, S3 key, URL path, SMB share —\n * to defuse the canonical 14-class footgun before it reaches that\n * destination.\n *\n * ## Threat model\n *\n *   1. Path injection — `..`, NUL bytes, `\\` on POSIX, absolute paths.\n *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,\n *      `COM1-9`, `LPT1-9`, with or without an extension.\n *   3. Windows reserved chars — `< > : \" / \\ | ? *` plus ASCII 0-31.\n *   4. Trailing `.` and ` ` on Windows / SMB.\n *   5. Unicode normalization drift — same display, different bytes →\n *      \"two files with the same name\" sync ghosts.\n *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`\n *      into `harmless.txt.exe`.\n *   7. URL `+` ambiguity in S3 presigned URLs.\n *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in\n *      pre-2006 readers.\n *   9-14. Length caps, leading/trailing whitespace + controls,\n *      `.DS_Store`-style hidden noise, etc.\n *\n * ## Always-on transforms (every profile)\n *\n *   - NFC normalize (`String.prototype.normalize('NFC')`).\n *   - Reject NUL — hard fail, not strip. Silent strip enables a\n *     classic truncation bypass (`safe.txt\\0.exe` → `safe.txt`).\n *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).\n *   - Trim leading/trailing whitespace and ASCII control chars.\n *\n * ## Non-goals (i18n boundary policy, )\n *\n *   - No transliteration.\n *   - No locale-aware slugging.\n *   - No script-specific segmentation.\n *\n * @module\n */\n\nimport { FilenameSanitizationError } from '../errors.js'\n\n/**\n * One of seven storage destinations the sanitizer knows how to defang\n * for. Pick the most restrictive that covers your write site:\n * `'macos-smb'` is the safe default for \"I don't know where these\n * files end up but they're going to a real filesystem somewhere.\"\n */\nexport type FilenameProfile =\n  | 'posix'\n  | 'windows'\n  | 'macos-smb'\n  | 'zip'\n  | 'url-path'\n  | 's3-key'\n  | 'opaque'\n\nexport interface SanitizeFilenameOptions {\n  /** Target-destination profile. */\n  readonly profile: FilenameProfile\n  /**\n   * Override the per-profile length cap. Useful when leaving headroom\n   * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write\n   * site that wants 15 bytes of slack for `-1`, `-2`, …\n   */\n  readonly maxBytes?: number\n  /**\n   * Required when `profile === 'opaque'`. The opaque profile replaces\n   * the entire input with `${opaqueId}.${ext}` (extension preserved\n   * from the input when present).\n   */\n  readonly opaqueId?: string\n}\n\nconst REPLACEMENT = '_'\n\n// Bidi overrides: U+202A LRE, U+202B RLE, U+202C PDF, U+202D LRO,\n// U+202E RLO, U+2066 LRI, U+2067 RLI, U+2068 FSI, U+2069 PDI.\nconst BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g\n\n// Reserved by Windows / NTFS / FAT / SMB.\nconst WINDOWS_RESERVED_CHARS = /[<>:\"/\\\\|?*]/g\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'CON', 'PRN', 'AUX', 'NUL',\n  'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',\n  'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',\n])\n\n// macOS legacy hidden-noise files. Match the full name.\nconst MAC_HIDDEN_NOISE = /^(?:\\.DS_Store|\\.localized|\\.fseventsd|\\._.+)$/i\n\n// RFC 3986 unreserved set.\nconst URL_UNRESERVED = /[A-Za-z0-9\\-._~]/\n\nconst utf8 = new TextEncoder()\n\nfunction isControlCode(cp: number): boolean {\n  return (cp >= 0 && cp <= 0x1f) || cp === 0x7f\n}\n\nfunction stripControlChars(s: string): string {\n  let out = ''\n  for (let i = 0; i < s.length; i++) {\n    out += isControlCode(s.charCodeAt(i)) ? REPLACEMENT : s[i]\n  }\n  return out\n}\n\nfunction trimWhitespaceAndControls(s: string): string {\n  let start = 0\n  let end = s.length\n  while (start < end) {\n    const ch = s[start]!\n    if (!isControlCode(s.charCodeAt(start)) && ch.trim() !== '') break\n    start++\n  }\n  while (end > start) {\n    const ch = s[end - 1]!\n    if (!isControlCode(s.charCodeAt(end - 1)) && ch.trim() !== '') break\n    end--\n  }\n  return s.slice(start, end)\n}\n\n/**\n * Sanitize a filename for a target-destination profile. Pure: same\n * input + options always returns the same output, no I/O.\n *\n * Returns the sanitized name. Throws {@link FilenameSanitizationError}\n * when the input cannot be made safe at all (NUL byte, empty after\n * normalization, missing `opaqueId` for the opaque profile,\n * `..` segment that would fall out of any reasonable target).\n */\nexport function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string {\n  if (typeof name !== 'string') {\n    throw new FilenameSanitizationError('input must be a string')\n  }\n  if (name.includes('\\0')) {\n    throw new FilenameSanitizationError('NUL byte in filename')\n  }\n\n  let s = name.normalize('NFC').replace(BIDI_OVERRIDES, '')\n\n  if (opts.profile === 'opaque') {\n    return applyOpaque(s, opts)\n  }\n\n  s = trimWhitespaceAndControls(s)\n\n  switch (opts.profile) {\n    case 'posix':     return cap(applyPosix(s),     opts.maxBytes ?? 255,  'utf8')\n    case 'windows':   return cap(applyWindows(s),   opts.maxBytes ?? 255,  'utf16')\n    case 'macos-smb': return cap(applyMacosSmb(s),  opts.maxBytes ?? 240,  'utf8')\n    case 'zip':       return cap(applyZip(s),       opts.maxBytes ?? 255,  'utf8')\n    case 'url-path':  return cap(applyUrlPath(s),   opts.maxBytes ?? 1024, 'bytes-pre-encode')\n    case 's3-key':    return cap(applyS3Key(s),     opts.maxBytes ?? 1024, 'utf8')\n  }\n}\n\n// ─── Profile implementations ────────────────────────────────────────────\n\nfunction applyPosix(s: string): string {\n  // POSIX is permissive; only `/` and NUL are off-limits.\n  const cleaned = s.replace(/\\//g, REPLACEMENT)\n  return rejectDotSegments(cleaned)\n}\n\nfunction applyWindows(s: string): string {\n  let cleaned = s.replace(WINDOWS_RESERVED_CHARS, REPLACEMENT)\n  cleaned = stripControlChars(cleaned)\n  // Trailing space/dot are stripped by Win32 path resolution.\n  cleaned = cleaned.replace(/[. ]+$/g, '')\n  cleaned = rejectDotSegments(cleaned)\n  return avoidWindowsReservedName(cleaned)\n}\n\nfunction applyMacosSmb(s: string): string {\n  let cleaned = applyWindows(s)\n  if (MAC_HIDDEN_NOISE.test(cleaned)) {\n    cleaned = REPLACEMENT + cleaned\n  }\n  return cleaned\n}\n\nfunction applyZip(s: string): string {\n  let cleaned = s.replace(/^\\/+/, '')\n  cleaned = rejectDotSegments(cleaned)\n  return stripControlChars(cleaned)\n}\n\nfunction applyUrlPath(s: string): string {\n  // RFC 3986 percent-encoding for path segment. Keep `unreserved`,\n  // encode everything else. `+` is encoded as `%2B` because S3 and\n  // legacy servers treat raw `+` as space ambiguously.\n  let out = ''\n  for (const ch of s) {\n    if (URL_UNRESERVED.test(ch)) { out += ch; continue }\n    const bytes = utf8.encode(ch)\n    for (const b of bytes) {\n      out += '%' + b.toString(16).toUpperCase().padStart(2, '0')\n    }\n  }\n  return out\n}\n\nfunction applyS3Key(s: string): string {\n  // Strip leading slashes BEFORE percent-encoding — once `/` is\n  // encoded to `%2F` the leading-slash regex no longer matches.\n  return applyUrlPath(s.replace(/^\\/+/, ''))\n}\n\nfunction applyOpaque(s: string, opts: SanitizeFilenameOptions): string {\n  if (!opts.opaqueId) {\n    throw new FilenameSanitizationError('opaque profile requires opaqueId')\n  }\n  // Preserve a \"safe-looking\" extension only — alphanumeric, ≤16 bytes.\n  const dot = s.lastIndexOf('.')\n  if (dot > 0 && dot < s.length - 1) {\n    const ext = s.slice(dot + 1)\n    if (/^[A-Za-z0-9]{1,16}$/.test(ext)) {\n      return `${opts.opaqueId}.${ext.toLowerCase()}`\n    }\n  }\n  return opts.opaqueId\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction rejectDotSegments(s: string): string {\n  if (s === '.' || s === '..' || s.split(/[/\\\\]/).some((seg) => seg === '..')) {\n    throw new FilenameSanitizationError('path traversal segment in filename')\n  }\n  if (s.length === 0) {\n    throw new FilenameSanitizationError('empty filename after sanitization')\n  }\n  return s\n}\n\nfunction avoidWindowsReservedName(s: string): string {\n  const dot = s.indexOf('.')\n  const base = dot === -1 ? s : s.slice(0, dot)\n  if (WINDOWS_RESERVED_NAMES.has(base.toUpperCase())) {\n    return REPLACEMENT + s\n  }\n  return s\n}\n\ntype LengthUnit = 'utf8' | 'utf16' | 'bytes-pre-encode'\n\nfunction cap(s: string, max: number, unit: LengthUnit): string {\n  if (max <= 0) {\n    throw new FilenameSanitizationError('maxBytes must be positive')\n  }\n  if (unit === 'utf16') {\n    if (s.length <= max) return s\n    return s.slice(0, max)\n  }\n  if (unit === 'bytes-pre-encode') {\n    if (utf8.encode(s).byteLength <= max) return s\n    return truncateToByteCap(s, max)\n  }\n  if (utf8.encode(s).byteLength <= max) return s\n  return truncateToByteCap(s, max)\n}\n\nfunction truncateToByteCap(s: string, max: number): string {\n  // Walk by code points so we never split a multi-byte sequence in\n  // the middle. Whole-grapheme handling (ZWJ-joined emoji) is a\n  // documented non-goal; we only protect against UTF-8 boundary\n  // splits here.\n  let out = ''\n  let used = 0\n  for (const cp of s) {\n    const n = utf8.encode(cp).byteLength\n    if (used + n > max) break\n    out += cp\n    used += n\n  }\n  if (out.length === 0) {\n    throw new FilenameSanitizationError('maxBytes too small for a single code point')\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;AA6EA,IAAM,cAAc;AAIpB,IAAM,iBAAiB;AAGvB,IAAM,yBAAyB;AAE/B,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EACrB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAChE;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAClE,CAAC;AAGD,IAAM,mBAAmB;AAGzB,IAAM,iBAAiB;AAEvB,IAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,cAAc,IAAqB;AAC1C,SAAQ,MAAM,KAAK,MAAM,MAAS,OAAO;AAC3C;AAEA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,WAAO,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,GAAmB;AACpD,MAAI,QAAQ;AACZ,MAAI,MAAM,EAAE;AACZ,SAAO,QAAQ,KAAK;AAClB,UAAM,KAAK,EAAE,KAAK;AAClB,QAAI,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC7D;AAAA,EACF;AACA,SAAO,MAAM,OAAO;AAClB,UAAM,KAAK,EAAE,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,EAAE,WAAW,MAAM,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC/D;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAWO,SAAS,iBAAiB,MAAc,MAAuC;AACpF,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,0BAA0B,wBAAwB;AAAA,EAC9D;AACA,MAAI,KAAK,SAAS,IAAI,GAAG;AACvB,UAAM,IAAI,0BAA0B,sBAAsB;AAAA,EAC5D;AAEA,MAAI,IAAI,KAAK,UAAU,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AAExD,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,YAAY,GAAG,IAAI;AAAA,EAC5B;AAEA,MAAI,0BAA0B,CAAC;AAE/B,UAAQ,KAAK,SAAS;AAAA,IACpB,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,KAAM,OAAO;AAAA,IAC9E,KAAK;AAAa,aAAO,IAAI,cAAc,CAAC,GAAI,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,SAAS,CAAC,GAAS,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,MAAM,kBAAkB;AAAA,IACzF,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,MAAM,MAAM;AAAA,EAC/E;AACF;AAIA,SAAS,WAAW,GAAmB;AAErC,QAAM,UAAU,EAAE,QAAQ,OAAO,WAAW;AAC5C,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AACvC,MAAI,UAAU,EAAE,QAAQ,wBAAwB,WAAW;AAC3D,YAAU,kBAAkB,OAAO;AAEnC,YAAU,QAAQ,QAAQ,WAAW,EAAE;AACvC,YAAU,kBAAkB,OAAO;AACnC,SAAO,yBAAyB,OAAO;AACzC;AAEA,SAAS,cAAc,GAAmB;AACxC,MAAI,UAAU,aAAa,CAAC;AAC5B,MAAI,iBAAiB,KAAK,OAAO,GAAG;AAClC,cAAU,cAAc;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,SAAS,GAAmB;AACnC,MAAI,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAClC,YAAU,kBAAkB,OAAO;AACnC,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AAIvC,MAAI,MAAM;AACV,aAAW,MAAM,GAAG;AAClB,QAAI,eAAe,KAAK,EAAE,GAAG;AAAE,aAAO;AAAI;AAAA,IAAS;AACnD,UAAM,QAAQ,KAAK,OAAO,EAAE;AAC5B,eAAW,KAAK,OAAO;AACrB,aAAO,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AAGrC,SAAO,aAAa,EAAE,QAAQ,QAAQ,EAAE,CAAC;AAC3C;AAEA,SAAS,YAAY,GAAW,MAAuC;AACrE,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI,0BAA0B,kCAAkC;AAAA,EACxE;AAEA,QAAM,MAAM,EAAE,YAAY,GAAG;AAC7B,MAAI,MAAM,KAAK,MAAM,EAAE,SAAS,GAAG;AACjC,UAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,QAAI,sBAAsB,KAAK,GAAG,GAAG;AACnC,aAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,YAAY,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAC3E,UAAM,IAAI,0BAA0B,oCAAoC;AAAA,EAC1E;AACA,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,IAAI,0BAA0B,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,GAAmB;AACnD,QAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,QAAM,OAAO,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG;AAC5C,MAAI,uBAAuB,IAAI,KAAK,YAAY,CAAC,GAAG;AAClD,WAAO,cAAc;AAAA,EACvB;AACA,SAAO;AACT;AAIA,SAAS,IAAI,GAAW,KAAa,MAA0B;AAC7D,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,0BAA0B,2BAA2B;AAAA,EACjE;AACA,MAAI,SAAS,SAAS;AACpB,QAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,WAAO,EAAE,MAAM,GAAG,GAAG;AAAA,EACvB;AACA,MAAI,SAAS,oBAAoB;AAC/B,QAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,WAAO,kBAAkB,GAAG,GAAG;AAAA,EACjC;AACA,MAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,SAAO,kBAAkB,GAAG,GAAG;AACjC;AAEA,SAAS,kBAAkB,GAAW,KAAqB;AAKzD,MAAI,MAAM;AACV,MAAI,OAAO;AACX,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,KAAK,OAAO,EAAE,EAAE;AAC1B,QAAI,OAAO,IAAI,IAAK;AACpB,WAAO;AACP,YAAQ;AAAA,EACV;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,0BAA0B,4CAA4C;AAAA,EAClF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/kernel/util/sanitize-filename.ts"],"sourcesContent":["/**\n * Target-profile aware filename sanitizer.\n *\n * Pure string in / string out. No filesystem access, no I/O. Use this\n * at the boundary where a user-supplied filename meets a storage\n * destination — local FS, ZIP archive, S3 key, URL path, SMB share —\n * to defuse the canonical 14-class footgun before it reaches that\n * destination.\n *\n * ## Threat model\n *\n *   1. Path injection — `..`, NUL bytes, `\\` on POSIX, absolute paths.\n *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,\n *      `COM1-9`, `LPT1-9`, with or without an extension.\n *   3. Windows reserved chars — `< > : \" / \\ | ? *` plus ASCII 0-31.\n *   4. Trailing `.` and ` ` on Windows / SMB.\n *   5. Unicode normalization drift — same display, different bytes →\n *      \"two files with the same name\" sync ghosts.\n *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`\n *      into `harmless.txt.exe`.\n *   7. URL `+` ambiguity in S3 presigned URLs.\n *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in\n *      pre-2006 readers.\n *   9-14. Length caps, leading/trailing whitespace + controls,\n *      `.DS_Store`-style hidden noise, etc.\n *\n * ## Always-on transforms (every profile)\n *\n *   - NFC normalize (`String.prototype.normalize('NFC')`).\n *   - Reject NUL — hard fail, not strip. Silent strip enables a\n *     classic truncation bypass (`safe.txt\\0.exe` → `safe.txt`).\n *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).\n *   - Trim leading/trailing whitespace and ASCII control chars.\n *\n * ## Non-goals (i18n boundary policy, )\n *\n *   - No transliteration.\n *   - No locale-aware slugging.\n *   - No script-specific segmentation.\n *\n * @module\n */\n\nimport { FilenameSanitizationError } from '../errors.js'\n\n/**\n * One of seven storage destinations the sanitizer knows how to defang\n * for. Pick the most restrictive that covers your write site:\n * `'macos-smb'` is the safe default for \"I don't know where these\n * files end up but they're going to a real filesystem somewhere.\"\n */\nexport type FilenameProfile =\n  | 'posix'\n  | 'windows'\n  | 'macos-smb'\n  | 'zip'\n  | 'url-path'\n  | 's3-key'\n  | 'opaque'\n\nexport interface SanitizeFilenameOptions {\n  /** Target-destination profile. */\n  readonly profile: FilenameProfile\n  /**\n   * Override the per-profile length cap. Useful when leaving headroom\n   * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write\n   * site that wants 15 bytes of slack for `-1`, `-2`, …\n   */\n  readonly maxBytes?: number\n  /**\n   * Required when `profile === 'opaque'`. The opaque profile replaces\n   * the entire input with `${opaqueId}.${ext}` (extension preserved\n   * from the input when present).\n   */\n  readonly opaqueId?: string\n}\n\nconst REPLACEMENT = '_'\n\n// Bidi overrides: U+202A LRE, U+202B RLE, U+202C PDF, U+202D LRO,\n// U+202E RLO, U+2066 LRI, U+2067 RLI, U+2068 FSI, U+2069 PDI.\nconst BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g\n\n// Reserved by Windows / NTFS / FAT / SMB.\nconst WINDOWS_RESERVED_CHARS = /[<>:\"/\\\\|?*]/g\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n  'CON', 'PRN', 'AUX', 'NUL',\n  'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',\n  'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',\n])\n\n// macOS legacy hidden-noise files. Match the full name.\nconst MAC_HIDDEN_NOISE = /^(?:\\.DS_Store|\\.localized|\\.fseventsd|\\._.+)$/i\n\n// RFC 3986 unreserved set.\nconst URL_UNRESERVED = /[A-Za-z0-9\\-._~]/\n\nconst utf8 = new TextEncoder()\n\nfunction isControlCode(cp: number): boolean {\n  return (cp >= 0 && cp <= 0x1f) || cp === 0x7f\n}\n\nfunction stripControlChars(s: string): string {\n  let out = ''\n  for (let i = 0; i < s.length; i++) {\n    out += isControlCode(s.charCodeAt(i)) ? REPLACEMENT : s[i]\n  }\n  return out\n}\n\nfunction trimWhitespaceAndControls(s: string): string {\n  let start = 0\n  let end = s.length\n  while (start < end) {\n    const ch = s[start]!\n    if (!isControlCode(s.charCodeAt(start)) && ch.trim() !== '') break\n    start++\n  }\n  while (end > start) {\n    const ch = s[end - 1]!\n    if (!isControlCode(s.charCodeAt(end - 1)) && ch.trim() !== '') break\n    end--\n  }\n  return s.slice(start, end)\n}\n\n/**\n * Sanitize a filename for a target-destination profile. Pure: same\n * input + options always returns the same output, no I/O.\n *\n * Returns the sanitized name. Throws {@link FilenameSanitizationError}\n * when the input cannot be made safe at all (NUL byte, empty after\n * normalization, missing `opaqueId` for the opaque profile,\n * `..` segment that would fall out of any reasonable target).\n */\nexport function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string {\n  if (typeof name !== 'string') {\n    throw new FilenameSanitizationError('input must be a string')\n  }\n  if (name.includes('\\0')) {\n    throw new FilenameSanitizationError('NUL byte in filename')\n  }\n\n  let s = name.normalize('NFC').replace(BIDI_OVERRIDES, '')\n\n  if (opts.profile === 'opaque') {\n    return applyOpaque(s, opts)\n  }\n\n  s = trimWhitespaceAndControls(s)\n\n  switch (opts.profile) {\n    case 'posix':     return cap(applyPosix(s),     opts.maxBytes ?? 255,  'utf8')\n    case 'windows':   return cap(applyWindows(s),   opts.maxBytes ?? 255,  'utf16')\n    case 'macos-smb': return cap(applyMacosSmb(s),  opts.maxBytes ?? 240,  'utf8')\n    case 'zip':       return cap(applyZip(s),       opts.maxBytes ?? 255,  'utf8')\n    case 'url-path':  return cap(applyUrlPath(s),   opts.maxBytes ?? 1024, 'bytes-pre-encode')\n    case 's3-key':    return cap(applyS3Key(s),     opts.maxBytes ?? 1024, 'utf8')\n  }\n}\n\n// ─── Profile implementations ────────────────────────────────────────────\n\nfunction applyPosix(s: string): string {\n  // POSIX is permissive; only `/` and NUL are off-limits.\n  const cleaned = s.replace(/\\//g, REPLACEMENT)\n  return rejectDotSegments(cleaned)\n}\n\nfunction applyWindows(s: string): string {\n  let cleaned = s.replace(WINDOWS_RESERVED_CHARS, REPLACEMENT)\n  cleaned = stripControlChars(cleaned)\n  // Trailing space/dot are stripped by Win32 path resolution.\n  cleaned = cleaned.replace(/[. ]+$/g, '')\n  cleaned = rejectDotSegments(cleaned)\n  return avoidWindowsReservedName(cleaned)\n}\n\nfunction applyMacosSmb(s: string): string {\n  let cleaned = applyWindows(s)\n  if (MAC_HIDDEN_NOISE.test(cleaned)) {\n    cleaned = REPLACEMENT + cleaned\n  }\n  return cleaned\n}\n\nfunction applyZip(s: string): string {\n  let cleaned = s.replace(/^\\/+/, '')\n  cleaned = rejectDotSegments(cleaned)\n  return stripControlChars(cleaned)\n}\n\nfunction applyUrlPath(s: string): string {\n  // RFC 3986 percent-encoding for path segment. Keep `unreserved`,\n  // encode everything else. `+` is encoded as `%2B` because S3 and\n  // legacy servers treat raw `+` as space ambiguously.\n  let out = ''\n  for (const ch of s) {\n    if (URL_UNRESERVED.test(ch)) { out += ch; continue }\n    const bytes = utf8.encode(ch)\n    for (const b of bytes) {\n      out += '%' + b.toString(16).toUpperCase().padStart(2, '0')\n    }\n  }\n  return out\n}\n\nfunction applyS3Key(s: string): string {\n  // Strip leading slashes BEFORE percent-encoding — once `/` is\n  // encoded to `%2F` the leading-slash regex no longer matches.\n  return applyUrlPath(s.replace(/^\\/+/, ''))\n}\n\nfunction applyOpaque(s: string, opts: SanitizeFilenameOptions): string {\n  if (!opts.opaqueId) {\n    throw new FilenameSanitizationError('opaque profile requires opaqueId')\n  }\n  // Preserve a \"safe-looking\" extension only — alphanumeric, ≤16 bytes.\n  const dot = s.lastIndexOf('.')\n  if (dot > 0 && dot < s.length - 1) {\n    const ext = s.slice(dot + 1)\n    if (/^[A-Za-z0-9]{1,16}$/.test(ext)) {\n      return `${opts.opaqueId}.${ext.toLowerCase()}`\n    }\n  }\n  return opts.opaqueId\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction rejectDotSegments(s: string): string {\n  if (s === '.' || s === '..' || s.split(/[/\\\\]/).some((seg) => seg === '..')) {\n    throw new FilenameSanitizationError('path traversal segment in filename')\n  }\n  if (s.length === 0) {\n    throw new FilenameSanitizationError('empty filename after sanitization')\n  }\n  return s\n}\n\nfunction avoidWindowsReservedName(s: string): string {\n  const dot = s.indexOf('.')\n  const base = dot === -1 ? s : s.slice(0, dot)\n  if (WINDOWS_RESERVED_NAMES.has(base.toUpperCase())) {\n    return REPLACEMENT + s\n  }\n  return s\n}\n\ntype LengthUnit = 'utf8' | 'utf16' | 'bytes-pre-encode'\n\nfunction cap(s: string, max: number, unit: LengthUnit): string {\n  if (max <= 0) {\n    throw new FilenameSanitizationError('maxBytes must be positive')\n  }\n  if (unit === 'utf16') {\n    if (s.length <= max) return s\n    return s.slice(0, max)\n  }\n  if (unit === 'bytes-pre-encode') {\n    if (utf8.encode(s).byteLength <= max) return s\n    return truncateToByteCap(s, max)\n  }\n  if (utf8.encode(s).byteLength <= max) return s\n  return truncateToByteCap(s, max)\n}\n\nfunction truncateToByteCap(s: string, max: number): string {\n  // Walk by code points so we never split a multi-byte sequence in\n  // the middle. Whole-grapheme handling (ZWJ-joined emoji) is a\n  // documented non-goal; we only protect against UTF-8 boundary\n  // splits here.\n  let out = ''\n  let used = 0\n  for (const cp of s) {\n    const n = utf8.encode(cp).byteLength\n    if (used + n > max) break\n    out += cp\n    used += n\n  }\n  if (out.length === 0) {\n    throw new FilenameSanitizationError('maxBytes too small for a single code point')\n  }\n  return out\n}\n"],"mappings":";;;;;;;;AA6EA,IAAM,cAAc;AAIpB,IAAM,iBAAiB;AAGvB,IAAM,yBAAyB;AAE/B,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EACrB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAChE;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAClE,CAAC;AAGD,IAAM,mBAAmB;AAGzB,IAAM,iBAAiB;AAEvB,IAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,cAAc,IAAqB;AAC1C,SAAQ,MAAM,KAAK,MAAM,MAAS,OAAO;AAC3C;AAEA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,WAAO,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,GAAmB;AACpD,MAAI,QAAQ;AACZ,MAAI,MAAM,EAAE;AACZ,SAAO,QAAQ,KAAK;AAClB,UAAM,KAAK,EAAE,KAAK;AAClB,QAAI,CAAC,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC7D;AAAA,EACF;AACA,SAAO,MAAM,OAAO;AAClB,UAAM,KAAK,EAAE,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,EAAE,WAAW,MAAM,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,GAAI;AAC/D;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAWO,SAAS,iBAAiB,MAAc,MAAuC;AACpF,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,0BAA0B,wBAAwB;AAAA,EAC9D;AACA,MAAI,KAAK,SAAS,IAAI,GAAG;AACvB,UAAM,IAAI,0BAA0B,sBAAsB;AAAA,EAC5D;AAEA,MAAI,IAAI,KAAK,UAAU,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AAExD,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,YAAY,GAAG,IAAI;AAAA,EAC5B;AAEA,MAAI,0BAA0B,CAAC;AAE/B,UAAQ,KAAK,SAAS;AAAA,IACpB,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,KAAM,OAAO;AAAA,IAC9E,KAAK;AAAa,aAAO,IAAI,cAAc,CAAC,GAAI,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,SAAS,CAAC,GAAS,KAAK,YAAY,KAAM,MAAM;AAAA,IAC7E,KAAK;AAAa,aAAO,IAAI,aAAa,CAAC,GAAK,KAAK,YAAY,MAAM,kBAAkB;AAAA,IACzF,KAAK;AAAa,aAAO,IAAI,WAAW,CAAC,GAAO,KAAK,YAAY,MAAM,MAAM;AAAA,EAC/E;AACF;AAIA,SAAS,WAAW,GAAmB;AAErC,QAAM,UAAU,EAAE,QAAQ,OAAO,WAAW;AAC5C,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AACvC,MAAI,UAAU,EAAE,QAAQ,wBAAwB,WAAW;AAC3D,YAAU,kBAAkB,OAAO;AAEnC,YAAU,QAAQ,QAAQ,WAAW,EAAE;AACvC,YAAU,kBAAkB,OAAO;AACnC,SAAO,yBAAyB,OAAO;AACzC;AAEA,SAAS,cAAc,GAAmB;AACxC,MAAI,UAAU,aAAa,CAAC;AAC5B,MAAI,iBAAiB,KAAK,OAAO,GAAG;AAClC,cAAU,cAAc;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,SAAS,SAAS,GAAmB;AACnC,MAAI,UAAU,EAAE,QAAQ,QAAQ,EAAE;AAClC,YAAU,kBAAkB,OAAO;AACnC,SAAO,kBAAkB,OAAO;AAClC;AAEA,SAAS,aAAa,GAAmB;AAIvC,MAAI,MAAM;AACV,aAAW,MAAM,GAAG;AAClB,QAAI,eAAe,KAAK,EAAE,GAAG;AAAE,aAAO;AAAI;AAAA,IAAS;AACnD,UAAM,QAAQ,KAAK,OAAO,EAAE;AAC5B,eAAW,KAAK,OAAO;AACrB,aAAO,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AAGrC,SAAO,aAAa,EAAE,QAAQ,QAAQ,EAAE,CAAC;AAC3C;AAEA,SAAS,YAAY,GAAW,MAAuC;AACrE,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI,0BAA0B,kCAAkC;AAAA,EACxE;AAEA,QAAM,MAAM,EAAE,YAAY,GAAG;AAC7B,MAAI,MAAM,KAAK,MAAM,EAAE,SAAS,GAAG;AACjC,UAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,QAAI,sBAAsB,KAAK,GAAG,GAAG;AACnC,aAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,YAAY,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,MAAI,MAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AAC3E,UAAM,IAAI,0BAA0B,oCAAoC;AAAA,EAC1E;AACA,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,IAAI,0BAA0B,mCAAmC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,GAAmB;AACnD,QAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,QAAM,OAAO,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,GAAG;AAC5C,MAAI,uBAAuB,IAAI,KAAK,YAAY,CAAC,GAAG;AAClD,WAAO,cAAc;AAAA,EACvB;AACA,SAAO;AACT;AAIA,SAAS,IAAI,GAAW,KAAa,MAA0B;AAC7D,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,0BAA0B,2BAA2B;AAAA,EACjE;AACA,MAAI,SAAS,SAAS;AACpB,QAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,WAAO,EAAE,MAAM,GAAG,GAAG;AAAA,EACvB;AACA,MAAI,SAAS,oBAAoB;AAC/B,QAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,WAAO,kBAAkB,GAAG,GAAG;AAAA,EACjC;AACA,MAAI,KAAK,OAAO,CAAC,EAAE,cAAc,IAAK,QAAO;AAC7C,SAAO,kBAAkB,GAAG,GAAG;AACjC;AAEA,SAAS,kBAAkB,GAAW,KAAqB;AAKzD,MAAI,MAAM;AACV,MAAI,OAAO;AACX,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,KAAK,OAAO,EAAE,EAAE;AAC1B,QAAI,OAAO,IAAI,IAAK;AACpB,WAAO;AACP,YAAQ;AAAA,EACV;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,0BAA0B,4CAA4C;AAAA,EAClF;AACA,SAAO;AACT;","names":[]}

package/dist/{vault-diff-FE5J35NJ.js → vault-diff-C6WUJFNP.js}

@@ -2,8 +2,7 @@ import {
   diffVault
 } from "./chunk-LFUID7OW.js";
 import "./chunk-SVLR4POP.js";
-import "./chunk-PZ5AY32C.js";
 export {
   diffVault
 };
-//# sourceMappingURL=vault-diff-FE5J35NJ.js.map
+//# sourceMappingURL=vault-diff-C6WUJFNP.js.map

package/dist/vault-head/index.js

@@ -6,20 +6,19 @@ import {
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "../chunk-BYBB4ABD.js";
+} from "../chunk-77K4PG6P.js";
 import {
   buildRecordEnvelope
-} from "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-SZJ3DLZA.js";
+import "../chunk-BOWNCWZT.js";
+import "../chunk-YSRUYAVU.js";
+import "../chunk-RMF67KCG.js";
 import "../chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-SL3JAAKN.js";
+import "../chunk-7MG7SJT7.js";
+import "../chunk-7O3Y4PPD.js";
 
 // src/with-commit/vault-head/head.ts
 function bucketIndex(collection, id, buckets) {

package/dist/vault-head/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/{verify-WYOFLSNA.js → verify-KOV2G5D6.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-FOG7YEJP.js";
+} from "./chunk-BOWNCWZT.js";
 import {
   dualReadSealedSlot
-} from "./chunk-KDJGJR7F.js";
+} from "./chunk-YSRUYAVU.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,12 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-W5LHQXZU.js";
+} from "./chunk-SL3JAAKN.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-JBIV4FLR.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/kernel/enclave/classify/verify.ts
 async function padOnce(iter = VDIG_ITERATIONS) {
@@ -137,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-WYOFLSNA.js.map
+//# sourceMappingURL=verify-KOV2G5D6.js.map

package/dist/{verify-WYOFLSNA.js.map → verify-KOV2G5D6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Elevated records (_tier > 0, with-audit tier moves) are non-comparable\n * through every door and pad-false exactly like missing records (#691) —\n * the tier-aware read surface is getAtTier, never verify.\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS;AAC1D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}
+{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Elevated records (_tier > 0, with-audit tier moves) are non-comparable\n * through every door and pad-false exactly like missing records (#691) —\n * the tier-aware read surface is getAtTier, never verify.\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS;AAC1D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/walk-3UQBRMDV.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-KUX3OB6D.js";
+import "./chunk-RXLYKVTF.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-REDOOY2Q.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-2Y4IMKA6.js";
+import "./chunk-77K4PG6P.js";
+import "./chunk-SZJ3DLZA.js";
+import "./chunk-BOWNCWZT.js";
+import "./chunk-YSRUYAVU.js";
+import "./chunk-RMF67KCG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-SL3JAAKN.js";
+import "./chunk-7MG7SJT7.js";
+import "./chunk-7O3Y4PPD.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-3UQBRMDV.js.map

package/dist/with-formula/derivations/dispatch.d.ts

@@ -94,5 +94,20 @@ export interface DerivationDispatchCtx extends DerivationDeleteCtx {
  * by the executor — a write to the child recomputes the parent aggregate, and
  * a write to the parent recomputes its own.
  */
-export declare function dispatchDerivations(ctx: DerivationDispatchCtx, id: string, record: Record<string, unknown>, version: number, wave?: WaveContext): Promise<void>;
+export declare function dispatchDerivations(ctx: DerivationDispatchCtx, id: string, record: Record<string, unknown>, version: number, wave?: WaveContext, 
+/** The pre-write record at `id` in THIS collection (undefined = not
+ *  captured — no field-match trigger, or a sync-applied wave; null =
+ *  captured and absent, i.e. a create). Only a `Record` re-fires the OLD
+ *  matched set alongside the new one (spec §7). */
+prior?: Record<string, unknown> | null): Promise<void>;
+/**
+ * Trigger fan-out for a DELETED parent record (#1249, spec §8). Distinct from
+ * the "record-shape derivations not dispatched on delete" rule — that is
+ * about deleting a SOURCE record; this fires when a TRIGGER collection's
+ * record is deleted, re-deriving source records that still exist. Pairs
+ * evaluate against the tombstoned record's values; matched sources re-derive
+ * through the normal executor (their derive() reads the now-absent parent
+ * and decides what that means — the engine never cascades deletes).
+ */
+export declare function dispatchTriggerDerivationsOnDelete(ctx: DerivationDispatchCtx, id: string, deleted: Record<string, unknown>): Promise<void>;
 export {};

package/dist/with-formula/derivations/registry.d.ts

@@ -1,8 +1,10 @@
 import { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js';
+import { type NormalizedTrigger } from './trigger-match.js';
 import type { DerivationSpec } from './types.js';
 interface RegisteredStrategy {
     spec: DerivationSpec<any, any>;
     strategyHash: string;
+    readonly triggers: ReadonlyArray<NormalizedTrigger>;
 }
 /**
  * Vault-internal registry of derivation strategies. Owned by `Vault`;
@@ -22,6 +24,24 @@ export declare class DerivationRegistry {
     register(spec: DerivationSpec<any, any>): Promise<void>;
     strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy>;
     strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy>;
+    /**
+     * The #1253-pattern typo guard for match fields (#1249): a misspelt
+     * `to`/`from` silently matches nothing forever, so validate against the
+     * collection's enumerable field set at the earliest point it exists.
+     * `schemaFieldKeys(schema) === undefined` (TS-generic collection,
+     * unreadable validator) is DELIBERATELY silent — those fields are real
+     * and unenumerable. `configKeys` folds in the collection's other
+     * non-schema field declarations (fieldMeta/moneyFields/dictKeyFields/
+     * refs/computed); `denormExempt` is derived here from this registry's
+     * own strategies rather than taken as a parameter — a field this
+     * collection's own derivations write via `denorm` is never a typo.
+     */
+    validateFieldsFor(collectionName: string, schema: unknown, configKeys: ReadonlyArray<string>, viaSources?: {
+        readonly computed?: Readonly<Record<string, unknown>> | undefined;
+        readonly viaFields?: Readonly<Record<string, unknown>> | undefined;
+    } | undefined): void;
+    /** #1266 — one message shape for both match sides; see {@link matchTargetFieldNames}. */
+    private _virtualMatchMessage;
     /**
      * All registered strategies as a flat, deduplicated array.
      * Each strategy is indexed once per source (not once per output key),

package/dist/with-formula/derivations/trigger-match.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Pure helpers behind composite `triggerBy` (#1249).
+ *
+ * A trigger entry is a CONJUNCTION of equality pairs: a source record
+ * matches when EVERY pair satisfies String(source[to]) === String(written[from]).
+ * `from: 'id'` reads the written record's id (winning over any stored field
+ * named `id`, matching dispatch's `{ ...incoming, id }` convention). The
+ * legacy `on` form normalizes to `[{ from: 'id', to: on }]` so everything
+ * downstream has ONE shape.
+ *
+ * Scalar coercion is verbatim from `_findMatchingIds`: both sides must be
+ * string | number; anything else fails the pair (never throws).
+ * Spec: docs/superpowers/specs/2026-08-29-composite-triggerby-design.md §4-§5.
+ * @module
+ */
+/** One declared hop through an intermediate collection (#1277). */
+export interface MatchVia {
+    /** The intermediate collection to resolve through. */
+    readonly collection: string;
+    /** Field on the intermediate whose value equals `written[from]`. */
+    readonly take: string;
+    /** Field on the intermediate whose value is compared against `source[to]`. */
+    readonly on: string;
+}
+export interface MatchPair {
+    readonly from: string;
+    readonly to: string;
+    readonly via?: MatchVia;
+}
+/** True when any pair in this trigger resolves through an intermediate. */
+export declare function hasHop(match: ReadonlyArray<MatchPair>): boolean;
+/** Every intermediate collection named by a trigger's pairs, deduplicated. */
+export declare function hopCollections(match: ReadonlyArray<MatchPair>): string[];
+export interface NormalizedTrigger {
+    readonly collection: string;
+    readonly match: ReadonlyArray<MatchPair>;
+    readonly maxFanout?: number;
+}
+interface RawTrigger {
+    readonly collection: string;
+    readonly on?: string;
+    readonly match?: ReadonlyArray<MatchPair>;
+    readonly maxFanout?: number;
+}
+export declare function normalizeTriggerBy(triggerBy: ReadonlyArray<RawTrigger> | undefined): NormalizedTrigger[];
+/**
+ * Resolve one trigger's pairs into the value tuple a written record presents,
+ * following any declared hop (#1277).
+ *
+ * Non-hop pairs behave exactly as {@link tupleFromWritten}. A hop pair reads
+ * `written[from]`, finds the intermediate record whose `via.take` equals it,
+ * and substitutes that record's `via.on` value — so everything downstream
+ * still compares a flat `{ field, value }` tuple against source records and
+ * the existing index-backed matcher is unchanged.
+ *
+ * Returns `null` when ANY pair cannot produce a value — a missing field, a
+ * non-scalar, or an intermediate that does not resolve. That is a legitimate
+ * no-match, not an error: a dangling reference addresses nothing, and refusing
+ * here would turn a data condition into a thrown exception on every write.
+ *
+ * Supersedes the sync `tupleFromWritten`, which was DELETED rather than kept
+ * (#1294): having two tuple builders that had to agree is precisely how the
+ * delete path drifted — it called the unhopped one, so a mapped pair compared
+ * the wrong side of the relationship and matched nothing, silently. One path
+ * cannot disagree with itself.
+ *
+ * ONE lookup per hop per written record. `take: 'id'` is a direct `get`; any
+ * other `take` is a field match on the intermediate, which uses its index when
+ * one is declared.
+ */
+export declare function resolveTuple(match: ReadonlyArray<MatchPair>, writtenId: string, record: Record<string, unknown> | null, lookup: (collection: string, field: string, value: string) => Promise<Record<string, unknown> | null>): Promise<Array<{
+    field: string;
+    value: string;
+}> | null>;
+/**
+ * The tuple a written INTERMEDIATE record presents (#1277 option 2).
+ *
+ * When a record of `via.collection` is written, the sources it addresses are
+ * those whose `to` equals the intermediate's own `via.on` value — no lookup is
+ * needed, because the intermediate IS the written record. Pairs that do not
+ * hop through this collection cannot be constrained by such a write and are
+ * skipped, which makes the fan-out deliberately WIDER than a trigger write:
+ * refreshing too much is recoverable, refreshing too little is the silent
+ * staleness this feature exists to remove.
+ *
+ * Returns `null` when no pair hops through `collection`, or when the
+ * intermediate carries no scalar at `via.on`.
+ */
+export declare function tupleFromIntermediate(match: ReadonlyArray<MatchPair>, collection: string, record: Record<string, unknown> | null): Array<{
+    field: string;
+    value: string;
+}> | null;
+/** Any single component differing means NOT the same tuple (spec §7). */
+export declare function sameTuple(a: Array<{
+    field: string;
+    value: string;
+}> | null, b: Array<{
+    field: string;
+    value: string;
+}> | null): boolean;
+/** Moved to the kernel (#1249) so `collection.ts` can import statically without
+ *  dragging derivations code into the floor bundle; re-exported here for
+ *  compatibility with existing consumers of this module. */
+export { recordMatchesPairs, findMatchingIdsByPairs } from '../../kernel/match-pairs.js';

package/dist/with-formula/derivations/types.d.ts

@@ -183,6 +183,67 @@ export interface DerivationSpec<TSource extends Record<string, unknown>, TOutput
         collection: string;
         on: string;
         maxFanout?: number;
+    } | {
+        /**
+         * Multi-field trigger (#1249): a source record matches when EVERY
+         * pair satisfies `String(source[to]) === String(written[from])`.
+         * `from: 'id'` reads the written record's id; any other `from`
+         * reads the written record's field. Exactly one of `on` | `match`
+         * per entry. On a LOCAL UPDATE that changes any matched `from`
+         * field, fan-out runs on old-match ∪ new-match (any single
+         * component changing counts) — the prior record is threaded only
+         * from the local write path, so a sync-applied wave write or a
+         * tiers restore fans out on the new tuple only. Parent DELETES fan
+         * out using the tombstoned record's values — for the `on` form, the
+         * plain `match` form, AND a `via` hop, including a delete of the
+         * INTERMEDIATE record itself (#1294; before that fix "both forms"
+         * meant `on` | `match` and silently excluded hops, which is a
+         * sentence a consumer reasonably read the other way). A
+         * missing/non-scalar `from` value matches nothing. Match fields
+         * are validated against the collections' enumerable field sets
+         * where possible (silent for TS-generic collections — see the
+         * registration guard).
+         */
+        collection: string;
+        match: ReadonlyArray<{
+            from: string;
+            to: string;
+            /**
+             * ONE declared hop (#1277). Without it, `to` names a field on the
+             * source record compared directly against `written[from]`. With it,
+             * the comparison goes through an intermediate record:
+             *
+             * ```
+             * intermediate = the record in `via.collection` where
+             *                intermediate[via.take] === written[from]
+             * match when   String(source[to]) === String(intermediate[via.on])
+             * ```
+             *
+             * This exists for a topology where the two collections share no
+             * field: bills carry `entityId`, disbursements carry `clientId`, and
+             * the client record is what relates them. A denormalised key would
+             * work and is the wrong answer — it is a second copy of something
+             * the vault can already resolve, and a partial backfill goes quiet on
+             * exactly the oldest, least-audited rows.
+             *
+             * Resolution costs ONE lookup per written record (a `get` when
+             * `take` is `'id'`), not one per candidate row — the same bound that
+             * made #1266 refuse virtual computed fields as match targets.
+             *
+             * ⚠️ A write OR DELETE of a `via.collection` record ALSO fires this
+             * trigger (#1277 option 2, deletes added in #1294), fanning out on
+             * the intermediate's old ∪ new value. That
+             * is what keeps a re-pointed intermediate from silently stranding
+             * every source it used to address; the alternative failed silently on
+             * exactly the rare edit nobody repeats.
+             */
+            via?: {
+                collection: string;
+                take: string;
+                on: string;
+            };
+        }>;
+        maxFanout?: number;
     }>;
     /**
      * @internal — set by `withRollup()`. Marks this strategy as