@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/coverage/index.js

@@ -0,0 +1,306 @@
+import {
+  NO_COVERAGE
+} from "../chunk-RHVMZSUU.js";
+
+// src/with-audit/coverage/sketch.ts
+function fnv1a(s, seed = 2166136261) {
+  let h = seed >>> 0;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  h ^= h >>> 16;
+  h = Math.imul(h, 2246822507) >>> 0;
+  h ^= h >>> 13;
+  h = Math.imul(h, 3266489909) >>> 0;
+  h ^= h >>> 16;
+  return h >>> 0;
+}
+var HyperLogLog = class _HyperLogLog {
+  precision;
+  registers;
+  constructor(precision = 14) {
+    if (!Number.isInteger(precision) || precision < 4 || precision > 16) {
+      throw new RangeError(`HyperLogLog precision must be an integer in [4,16], got ${precision}`);
+    }
+    this.precision = precision;
+    this.registers = new Uint8Array(1 << precision);
+  }
+  add(id) {
+    const h = fnv1a(id);
+    const idx = h >>> 32 - this.precision;
+    const rest = h << this.precision >>> 0;
+    const rank = rest === 0 ? 32 - this.precision + 1 : Math.clz32(rest) + 1;
+    if (rank > this.registers[idx]) this.registers[idx] = rank;
+  }
+  /** Estimated distinct count. */
+  count() {
+    const m = this.registers.length;
+    let zeros = 0;
+    let sum = 0;
+    for (let i = 0; i < m; i++) {
+      const r = this.registers[i];
+      if (r === 0) zeros++;
+      sum += 2 ** -r;
+    }
+    const alpha = m === 16 ? 0.673 : m === 32 ? 0.697 : m === 64 ? 0.709 : 0.7213 / (1 + 1.079 / m);
+    const raw = alpha * m * m / sum;
+    if (raw <= 2.5 * m && zeros > 0) return Math.round(m * Math.log(m / zeros));
+    return Math.round(raw);
+  }
+  /** Serializable state — registers only. No id, no id-derived key. */
+  toJSON() {
+    let bin = "";
+    for (const b of this.registers) bin += String.fromCharCode(b);
+    return { p: this.precision, r: btoa(bin) };
+  }
+  static fromJSON(state) {
+    const hll = new _HyperLogLog(state.p);
+    const bin = atob(state.r);
+    for (let i = 0; i < hll.registers.length && i < bin.length; i++) {
+      hll.registers[i] = bin.charCodeAt(i);
+    }
+    return hll;
+  }
+};
+var BloomFilter = class {
+  bits;
+  hashes;
+  words;
+  constructor(bits = 1 << 14, hashes = 7) {
+    if (!Number.isInteger(bits) || bits < 64) throw new RangeError(`Bloom bits must be >= 64, got ${bits}`);
+    if (!Number.isInteger(hashes) || hashes < 1 || hashes > 16) {
+      throw new RangeError(`Bloom hashes must be in [1,16], got ${hashes}`);
+    }
+    this.bits = bits;
+    this.hashes = hashes;
+    this.words = new Uint32Array(Math.ceil(bits / 32));
+  }
+  /** Set the id's bits; returns true when the id was NOT already present. */
+  addIfAbsent(id) {
+    const h1 = fnv1a(id);
+    const h2 = fnv1a(id, 2654435761) | 1;
+    let novel = false;
+    for (let i = 0; i < this.hashes; i++) {
+      const bit = h1 + Math.imul(i, h2) >>> 0;
+      const pos = bit % this.bits;
+      const w = pos >>> 5;
+      const mask = 1 << (pos & 31);
+      if ((this.words[w] & mask) === 0) {
+        this.words[w] = this.words[w] | mask;
+        novel = true;
+      }
+    }
+    return novel;
+  }
+  clear() {
+    this.words.fill(0);
+  }
+};
+
+// src/with-audit/coverage/accounting.ts
+var DEFAULT_ALERT_AT = [0.6, 0.9];
+var HOUR_MS = 36e5;
+var Account = class {
+  constructor(principal, vault, collection, opts) {
+    this.principal = principal;
+    this.vault = vault;
+    this.collection = collection;
+    this.hll = new HyperLogLog(opts.precision);
+    this.bloom = new BloomFilter(opts.bloomBits, opts.bloomHashes);
+    this.windowStart = opts.now;
+  }
+  principal;
+  vault;
+  collection;
+  hll;
+  bloom;
+  served = 0;
+  servedInWindow = 0;
+  novelInWindow = 0;
+  windowStart;
+  /** Running mean of previous windows' served counts, for burstiness. */
+  servedMean = 0;
+  windowsClosed = 0;
+  fired = /* @__PURE__ */ new Set();
+};
+var CoverageRegistry = class {
+  #accounts = /* @__PURE__ */ new Map();
+  #precision;
+  #bloomBits;
+  #bloomHashes;
+  #windowMs;
+  #collections;
+  #now;
+  #warnedEager = /* @__PURE__ */ new Set();
+  constructor(opts = {}) {
+    this.#precision = opts.precision ?? 14;
+    this.#bloomBits = opts.bloomBits ?? 1 << 14;
+    this.#bloomHashes = opts.bloomHashes ?? 7;
+    this.#windowMs = opts.windowMs ?? HOUR_MS;
+    this.#collections = opts.collections ?? {};
+    this.#now = opts.now ?? (() => Date.now());
+    if (this.#windowMs <= 0) throw new RangeError(`windowMs must be > 0, got ${this.#windowMs}`);
+  }
+  observer(vault, collection, principal, fieldMeta, emitter, eager) {
+    let accounted;
+    return (id) => {
+      accounted ??= this.#resolveAccounted(collection, fieldMeta(), eager);
+      if (!accounted) return;
+      this.#record(principal, vault, collection, id, emitter);
+    };
+  }
+  /**
+   * ⛔⛔ THE MEASUREMENT THAT DECIDES WHETHER THIS SENSOR SAYS ANYTHING TRUE.
+   *
+   * The design's unit is "the record decrypt". In hub that is only the same
+   * thing as "the record was read" for a LAZY collection (`prefetch: false`),
+   * where reads go per-id against the store. An EAGER collection — the default
+   * — decrypts its entire corpus once, at hydration, into the working set:
+   * measured on a 30-record collection, one `get()` after reopening the vault
+   * took the sensor from 0 to `coverage: 1`. Every principal who so much as
+   * opens the vault would trip every threshold.
+   *
+   * A sensor that reports total coverage for everyone is worse than no sensor:
+   * it is exactly the "invites reliance" failure this feature is supposed to
+   * be honest about. So an eager bulk-declared collection is NOT accounted,
+   * and the refusal is LOUD — silence here would look identical to "nobody has
+   * read anything", which is the most dangerous possible false negative.
+   *
+   * The codec cannot tell hydration from a read (it sees neither caller nor
+   * intent), so this cannot be fixed inside the sensor. Declaring the
+   * collection lazy is the fix, and the warning says so.
+   */
+  #resolveAccounted(collection, fieldMeta, eager) {
+    const declared = this.#collections[collection] !== void 0 || declaresBulk(fieldMeta);
+    if (!declared) return false;
+    if (!eager) return true;
+    if (!this.#warnedEager.has(collection)) {
+      this.#warnedEager.add(collection);
+      console.warn(
+        `[noy-db] withCoverage(): collection "${collection}" is bulk-declared but EAGER, so it is NOT accounted. An eager collection decrypts its whole corpus at hydration, which would read as 100% coverage for every principal that opens the vault. Declare it \`prefetch: false\` (with a \`cache\` budget) to make its reads countable. Coverage is telemetry either way \u2014 the remediation for bulk exposure is key custody (tiers, per-collection DEKs).`
+      );
+    }
+    return false;
+  }
+  #account(principal, vault, collection, now) {
+    const k = JSON.stringify([principal, vault, collection]);
+    let acc = this.#accounts.get(k);
+    if (acc === void 0) {
+      acc = new Account(principal, vault, collection, {
+        precision: this.#precision,
+        bloomBits: this.#bloomBits,
+        bloomHashes: this.#bloomHashes,
+        now
+      });
+      this.#accounts.set(k, acc);
+    }
+    return acc;
+  }
+  #record(principal, vault, collection, id, emitter) {
+    const now = this.#now();
+    const acc = this.#account(principal, vault, collection, now);
+    if (now - acc.windowStart >= this.#windowMs) {
+      acc.servedMean = acc.windowsClosed === 0 ? acc.servedInWindow : (acc.servedMean * acc.windowsClosed + acc.servedInWindow) / (acc.windowsClosed + 1);
+      acc.windowsClosed++;
+      acc.bloom.clear();
+      acc.servedInWindow = 0;
+      acc.novelInWindow = 0;
+      acc.windowStart = now;
+    }
+    acc.hll.add(id);
+    if (acc.bloom.addIfAbsent(id)) acc.novelInWindow++;
+    acc.served++;
+    acc.servedInWindow++;
+    const policy = this.#collections[collection];
+    const corpusSize = policy?.corpusSize;
+    if (corpusSize === void 0 || corpusSize <= 0) return;
+    const coverage = Math.min(1, acc.hll.count() / corpusSize);
+    for (const t of policy?.alertAt ?? DEFAULT_ALERT_AT) {
+      if (coverage < t || acc.fired.has(t)) continue;
+      acc.fired.add(t);
+      const event = {
+        principal,
+        vault,
+        collection,
+        novel: acc.novelInWindow,
+        served: acc.served,
+        coverage,
+        window: new Date(acc.windowStart).toISOString(),
+        source: "hub/coverage"
+      };
+      emitter.emit("coverage:threshold", event);
+    }
+  }
+  /** Current accounting, for an operator surface. Estimates, never exact. */
+  stats() {
+    const out = [];
+    for (const acc of this.#accounts.values()) {
+      const corpusSize = this.#collections[acc.collection]?.corpusSize;
+      const distinct = acc.hll.count();
+      out.push({
+        principal: acc.principal,
+        vault: acc.vault,
+        collection: acc.collection,
+        distinct,
+        served: acc.served,
+        novelInWindow: acc.novelInWindow,
+        servedInWindow: acc.servedInWindow,
+        burstiness: acc.servedMean > 0 ? acc.servedInWindow / acc.servedMean : 1,
+        ...corpusSize !== void 0 && corpusSize > 0 ? { coverage: Math.min(1, distinct / corpusSize) } : {},
+        window: new Date(acc.windowStart).toISOString()
+      });
+    }
+    return out;
+  }
+  /**
+   * Serializable state, for a deployment that wants coverage to survive a
+   * restart — the horizon must exceed tenure, and a process does not.
+   * ⛔ Sketches only. Never a record id: see {@link CoverageSnapshot}.
+   */
+  snapshot() {
+    const entries = [];
+    for (const acc of this.#accounts.values()) {
+      entries.push({
+        principal: acc.principal,
+        vault: acc.vault,
+        collection: acc.collection,
+        hll: acc.hll.toJSON(),
+        served: acc.served,
+        windowStart: acc.windowStart
+      });
+    }
+    return { _noydb_coverage: 1, entries };
+  }
+  /**
+   * Restore a snapshot. The novelty filter is deliberately NOT restored:
+   * novelty is a within-window notion and the window did not survive.
+   * Distinct-ever did, which is the quantity that must not reset.
+   */
+  restore(snapshot) {
+    for (const e of snapshot.entries) {
+      const acc = this.#account(e.principal, e.vault, e.collection, e.windowStart);
+      acc.hll = HyperLogLog.fromJSON(e.hll);
+      acc.served = e.served;
+      acc.windowStart = e.windowStart;
+    }
+  }
+};
+function declaresBulk(fieldMeta) {
+  if (fieldMeta === void 0) return false;
+  for (const meta of Object.values(fieldMeta)) if (meta?.bulk === "sensitive") return true;
+  return false;
+}
+
+// src/with-audit/coverage/active.ts
+function withCoverage(opts = {}) {
+  return new CoverageRegistry(opts);
+}
+export {
+  BloomFilter,
+  CoverageRegistry,
+  HyperLogLog,
+  NO_COVERAGE,
+  withCoverage
+};
+//# sourceMappingURL=index.js.map

package/dist/coverage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-audit/coverage/sketch.ts","../../src/with-audit/coverage/accounting.ts","../../src/with-audit/coverage/active.ts"],"sourcesContent":["/**\n * Bounded-size sketches for the coverage sensor (#1363).\n *\n * ⚠️ THE WHOLE POINT OF A SKETCH HERE IS WHAT IT CANNOT DO. Coverage state\n * answers *\"how much of this corpus has this principal seen\"*, and the exact\n * answer — the id set — is a SECOND COPY OF THE SENSITIVE SET. A sensor built\n * to notice bulk extraction would then be the best single artefact to extract.\n * So no structure in this module retains a record id, and none can be\n * enumerated back into one: HyperLogLog keeps per-register leading-zero ranks,\n * Bloom keeps bits. Both are lossy on purpose, and the accuracy that costs is\n * the price of the property (`no-record-ids.test.ts` pins it).\n *\n * @module\n */\n\n/** 32-bit FNV-1a. Not cryptographic — a sketch only needs good dispersion. */\nfunction fnv1a(s: string, seed = 0x811c9dc5): number {\n  let h = seed >>> 0\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  // Final avalanche (murmur3 fmix32) — FNV alone disperses low bits poorly,\n  // and HLL reads the TOP bits for the register index.\n  h ^= h >>> 16\n  h = Math.imul(h, 0x85ebca6b) >>> 0\n  h ^= h >>> 13\n  h = Math.imul(h, 0xc2b2ae35) >>> 0\n  h ^= h >>> 16\n  return h >>> 0\n}\n\n// ─── HyperLogLog — distinct ids ever decrypted ────────────────────────────\n\n/**\n * HyperLogLog over `2^precision` one-byte registers.\n *\n * ⭐ SIZING IS THE OPEN QUESTION THIS FEATURE SHIPS WITH, not a settled\n * default. At the scale the design anticipates (~1k records, ~30 principals)\n * the estimator runs entirely in its LINEAR-COUNTING range, where accuracy is\n * a function of load factor rather than of HLL's asymptotic 1.04/√m. So the\n * default is chosen by MEASUREMENT, not theory — `__tests__/coverage/sketch.test.ts`\n * pins the error band this implementation actually produces:\n *\n * | distinct ids | p=10 (1 KiB) | p=12 (4 KiB) | **p=14 (16 KiB, default)** |\n * |---:|---:|---:|---:|\n * | 100    | 3.00% | 1.00% | **0.00%** |\n * | 1 000  | 2.90% | 0.50% | **0.40%** |\n * | 10 000 | 2.34% | 5.62% | **0.96%** |\n * | 50 000 | 2.31% | 1.70% | **1.52%** |\n *\n * (p=12's 5.62% at 10 000 is the linear-counting/raw-estimator crossover, and\n * is exactly why the default is not chosen from the memory column.)\n * 16 KiB is per `(principal, vault, collection)` — a ~30-principal deployment\n * with a handful of bulk-declared collections stays in the low megabytes.\n * `precision` is configurable for a deployment whose corpus is a different\n * order of magnitude.\n *\n * ⛔ An exact per-collection bitmap would be smaller AND exact at that scale.\n * It is not shipped because it leaks ids: bit *i* set means \"record *i* was\n * read\", which is the second copy this module exists to avoid. Revisit only\n * against a real dataset, and only with that trade stated.\n */\nexport class HyperLogLog {\n  readonly precision: number\n  private readonly registers: Uint8Array\n\n  constructor(precision = 14) {\n    if (!Number.isInteger(precision) || precision < 4 || precision > 16) {\n      throw new RangeError(`HyperLogLog precision must be an integer in [4,16], got ${precision}`)\n    }\n    this.precision = precision\n    this.registers = new Uint8Array(1 << precision)\n  }\n\n  add(id: string): void {\n    const h = fnv1a(id)\n    const idx = h >>> (32 - this.precision)\n    // Rank = 1 + leading zeros of the remaining bits (bounded by the width).\n    const rest = (h << this.precision) >>> 0\n    const rank = rest === 0 ? 32 - this.precision + 1 : Math.clz32(rest) + 1\n    if (rank > this.registers[idx]!) this.registers[idx] = rank\n  }\n\n  /** Estimated distinct count. */\n  count(): number {\n    const m = this.registers.length\n    let zeros = 0\n    let sum = 0\n    for (let i = 0; i < m; i++) {\n      const r = this.registers[i]!\n      if (r === 0) zeros++\n      sum += 2 ** -r\n    }\n    const alpha = m === 16 ? 0.673 : m === 32 ? 0.697 : m === 64 ? 0.709 : 0.7213 / (1 + 1.079 / m)\n    const raw = (alpha * m * m) / sum\n    // Small-range correction: linear counting, which is where a ~1k corpus\n    // lives. This is the branch the pilot's scale actually exercises.\n    if (raw <= 2.5 * m && zeros > 0) return Math.round(m * Math.log(m / zeros))\n    return Math.round(raw)\n  }\n\n  /** Serializable state — registers only. No id, no id-derived key. */\n  toJSON(): { readonly p: number; readonly r: string } {\n    let bin = ''\n    for (const b of this.registers) bin += String.fromCharCode(b)\n    return { p: this.precision, r: btoa(bin) }\n  }\n\n  static fromJSON(state: { readonly p: number; readonly r: string }): HyperLogLog {\n    const hll = new HyperLogLog(state.p)\n    const bin = atob(state.r)\n    for (let i = 0; i < hll.registers.length && i < bin.length; i++) {\n      hll.registers[i] = bin.charCodeAt(i)\n    }\n    return hll\n  }\n}\n\n// ─── Bloom — novelty within one window ────────────────────────────────────\n\n/**\n * Bloom filter for *novelty per window* — \"have I seen this id in this\n * window?\". False positives under-report novelty (a novel read is scored as a\n * repeat), which is the safe direction for a sensor that must not cry wolf;\n * false negatives are impossible.\n */\nexport class BloomFilter {\n  readonly bits: number\n  readonly hashes: number\n  private readonly words: Uint32Array\n\n  constructor(bits = 1 << 14, hashes = 7) {\n    if (!Number.isInteger(bits) || bits < 64) throw new RangeError(`Bloom bits must be >= 64, got ${bits}`)\n    if (!Number.isInteger(hashes) || hashes < 1 || hashes > 16) {\n      throw new RangeError(`Bloom hashes must be in [1,16], got ${hashes}`)\n    }\n    this.bits = bits\n    this.hashes = hashes\n    this.words = new Uint32Array(Math.ceil(bits / 32))\n  }\n\n  /** Set the id's bits; returns true when the id was NOT already present. */\n  addIfAbsent(id: string): boolean {\n    const h1 = fnv1a(id)\n    const h2 = fnv1a(id, 0x9e3779b1) | 1\n    let novel = false\n    for (let i = 0; i < this.hashes; i++) {\n      const bit = (h1 + Math.imul(i, h2)) >>> 0\n      const pos = bit % this.bits\n      const w = pos >>> 5\n      const mask = 1 << (pos & 31)\n      if ((this.words[w]! & mask) === 0) {\n        this.words[w] = this.words[w]! | mask\n        novel = true\n      }\n    }\n    return novel\n  }\n\n  clear(): void {\n    this.words.fill(0)\n  }\n}\n","/**\n * Coverage accounting (#1363) — per `(principal, vault, collection)`.\n *\n * ⛔⛔ **TELEMETRY, NOT A CONTROL.** Against an insider holding the device and\n * local keys this prevents nothing; it makes bulk extraction visible early,\n * attributable and loud. Key custody (tiers, per-collection DEKs) is the\n * remediation. Nothing in this module refuses a read, and nothing in it may\n * ever grow the ability to (#1251 §3: a refusal is a threshold the reader can\n * binary-search; a signal is not).\n *\n * What is accounted, and why each one:\n *\n *  - **distinct ids ever decrypted** (HyperLogLog) — coverage is the protected\n *    quantity, not rate: patience lowers an extractor's rate and never their\n *    coverage. Monotonic, and the horizon is the life of the state, never a\n *    30-day window that resets faster than the attack completes.\n *  - **novelty per window** (Bloom, cleared per window) — the discriminator\n *    that is orthogonal to speed. A legitimate operator re-reads a working\n *    subset (high volume, low novelty); an extractor reads new records.\n *  - **served** — decrypts, all time and per window.\n *  - **burstiness** — this window's served count over the running mean of the\n *    previous windows'. 1 while there is no history to compare against.\n *\n * @module\n */\n\nimport { BloomFilter, HyperLogLog } from './sketch.js'\nimport type {\n  CoverageEmitter,\n  CoverageEvent,\n  CoverageFieldMeta,\n  CoverageObserver,\n  CoverageStrategy,\n} from '../../port/with/coverage-strategy.js'\n\n/** Per-collection policy. Absent `corpusSize` ⇒ no coverage estimate, so no alert. */\nexport interface CoverageCollectionPolicy {\n  /**\n   * How many records the corpus holds. Coverage is `distinct / corpusSize`.\n   * Deliberately DECLARED rather than counted: counting means a store read on\n   * a sensor that must not touch the store, and a corpus size that moves with\n   * every write makes an alert threshold un-reproducible.\n   */\n  readonly corpusSize?: number\n  /** Coverage fractions to alert at. Default `[0.6, 0.9]`. Each fires at most once. */\n  readonly alertAt?: readonly number[]\n}\n\nexport interface WithCoverageOptions {\n  /**\n   * HyperLogLog precision — the register file is `2^precision` bytes per\n   * `(principal, vault, collection)`. Default 14 (16 KiB), chosen by\n   * measurement; the table is in `sketch.ts`.\n   */\n  readonly precision?: number\n  /** Bloom width in bits, per key, per window. Default 16 384 (2 KiB). */\n  readonly bloomBits?: number\n  /** Bloom hash count. Default 7. */\n  readonly bloomHashes?: number\n  /** Novelty window length. Default one hour. NOT the coverage horizon — that never resets. */\n  readonly windowMs?: number\n  /** Per-collection corpus size and alert thresholds. */\n  readonly collections?: Readonly<Record<string, CoverageCollectionPolicy>>\n  /** Clock seam, for tests. */\n  readonly now?: () => number\n}\n\nexport interface CoverageStats {\n  readonly principal: string\n  readonly vault: string\n  readonly collection: string\n  /** HLL estimate of distinct ids ever decrypted. */\n  readonly distinct: number\n  readonly served: number\n  readonly novelInWindow: number\n  readonly servedInWindow: number\n  readonly burstiness: number\n  /** Absent when the collection declares no `corpusSize`. */\n  readonly coverage?: number\n  readonly window: string\n}\n\n/**\n * Serializable coverage state.\n *\n * ⛔ SKETCHES ONLY — the invariant this module exists to hold. A structure\n * that could name the records a principal has read would be a second copy of\n * the sensitive set: the sensor built to notice bulk extraction would become\n * the single best artefact to extract. Pinned by\n * `__tests__/coverage/no-record-ids.test.ts`.\n */\nexport interface CoverageSnapshot {\n  readonly _noydb_coverage: 1\n  readonly entries: ReadonlyArray<{\n    readonly principal: string\n    readonly vault: string\n    readonly collection: string\n    readonly hll: { readonly p: number; readonly r: string }\n    readonly served: number\n    readonly windowStart: number\n  }>\n}\n\nconst DEFAULT_ALERT_AT = [0.6, 0.9] as const\nconst HOUR_MS = 3_600_000\n\nclass Account {\n  hll: HyperLogLog\n  readonly bloom: BloomFilter\n  served = 0\n  servedInWindow = 0\n  novelInWindow = 0\n  windowStart: number\n  /** Running mean of previous windows' served counts, for burstiness. */\n  servedMean = 0\n  windowsClosed = 0\n  readonly fired = new Set<number>()\n\n  constructor(\n    readonly principal: string,\n    readonly vault: string,\n    readonly collection: string,\n    opts: { precision: number; bloomBits: number; bloomHashes: number; now: number },\n  ) {\n    this.hll = new HyperLogLog(opts.precision)\n    this.bloom = new BloomFilter(opts.bloomBits, opts.bloomHashes)\n    this.windowStart = opts.now\n  }\n}\n\nexport class CoverageRegistry implements CoverageStrategy {\n  readonly #accounts = new Map<string, Account>()\n  readonly #precision: number\n  readonly #bloomBits: number\n  readonly #bloomHashes: number\n  readonly #windowMs: number\n  readonly #collections: Readonly<Record<string, CoverageCollectionPolicy>>\n  readonly #now: () => number\n  readonly #warnedEager = new Set<string>()\n\n  constructor(opts: WithCoverageOptions = {}) {\n    this.#precision = opts.precision ?? 14\n    this.#bloomBits = opts.bloomBits ?? 1 << 14\n    this.#bloomHashes = opts.bloomHashes ?? 7\n    this.#windowMs = opts.windowMs ?? HOUR_MS\n    this.#collections = opts.collections ?? {}\n    this.#now = opts.now ?? (() => Date.now())\n    if (this.#windowMs <= 0) throw new RangeError(`windowMs must be > 0, got ${this.#windowMs}`)\n  }\n\n  observer(\n    vault: string,\n    collection: string,\n    principal: string,\n    fieldMeta: () => CoverageFieldMeta | undefined,\n    emitter: CoverageEmitter,\n    eager: boolean,\n  ): CoverageObserver | undefined {\n    // Whether this collection is accounted resolves on the FIRST decrypt, not\n    // here: `fieldMeta` can be attached to a Collection after construction\n    // (`_applyFieldMeta`, first-wins) and this runs from the constructor. So\n    // an opted-in deployment pays one boolean test per decrypt on the\n    // collections it does not account for; an un-opted-in one pays nothing at\n    // all, because NO_COVERAGE returns no observer.\n    let accounted: boolean | undefined\n    return (id: string): void => {\n      accounted ??= this.#resolveAccounted(collection, fieldMeta(), eager)\n      if (!accounted) return\n      this.#record(principal, vault, collection, id, emitter)\n    }\n  }\n\n  /**\n   * ⛔⛔ THE MEASUREMENT THAT DECIDES WHETHER THIS SENSOR SAYS ANYTHING TRUE.\n   *\n   * The design's unit is \"the record decrypt\". In hub that is only the same\n   * thing as \"the record was read\" for a LAZY collection (`prefetch: false`),\n   * where reads go per-id against the store. An EAGER collection — the default\n   * — decrypts its entire corpus once, at hydration, into the working set:\n   * measured on a 30-record collection, one `get()` after reopening the vault\n   * took the sensor from 0 to `coverage: 1`. Every principal who so much as\n   * opens the vault would trip every threshold.\n   *\n   * A sensor that reports total coverage for everyone is worse than no sensor:\n   * it is exactly the \"invites reliance\" failure this feature is supposed to\n   * be honest about. So an eager bulk-declared collection is NOT accounted,\n   * and the refusal is LOUD — silence here would look identical to \"nobody has\n   * read anything\", which is the most dangerous possible false negative.\n   *\n   * The codec cannot tell hydration from a read (it sees neither caller nor\n   * intent), so this cannot be fixed inside the sensor. Declaring the\n   * collection lazy is the fix, and the warning says so.\n   */\n  #resolveAccounted(collection: string, fieldMeta: CoverageFieldMeta | undefined, eager: boolean): boolean {\n    const declared = this.#collections[collection] !== undefined || declaresBulk(fieldMeta)\n    if (!declared) return false\n    if (!eager) return true\n    if (!this.#warnedEager.has(collection)) {\n      this.#warnedEager.add(collection)\n      console.warn(\n        `[noy-db] withCoverage(): collection \"${collection}\" is bulk-declared but EAGER, so it is NOT ` +\n        `accounted. An eager collection decrypts its whole corpus at hydration, which would read as ` +\n        `100% coverage for every principal that opens the vault. Declare it \\`prefetch: false\\` ` +\n        `(with a \\`cache\\` budget) to make its reads countable. Coverage is telemetry either way — ` +\n        `the remediation for bulk exposure is key custody (tiers, per-collection DEKs).`,\n      )\n    }\n    return false\n  }\n\n  #account(principal: string, vault: string, collection: string, now: number): Account {\n    const k = JSON.stringify([principal, vault, collection])\n    let acc = this.#accounts.get(k)\n    if (acc === undefined) {\n      acc = new Account(principal, vault, collection, {\n        precision: this.#precision,\n        bloomBits: this.#bloomBits,\n        bloomHashes: this.#bloomHashes,\n        now,\n      })\n      this.#accounts.set(k, acc)\n    }\n    return acc\n  }\n\n  #record(principal: string, vault: string, collection: string, id: string, emitter: CoverageEmitter): void {\n    const now = this.#now()\n    const acc = this.#account(principal, vault, collection, now)\n\n    if (now - acc.windowStart >= this.#windowMs) {\n      // Close the window: fold its served count into the running mean, clear\n      // the novelty filter. ⛔ The HLL is NOT cleared — the coverage horizon\n      // must exceed tenure, and a horizon that resets is the low-and-slow hole\n      // the whole reframe (#1251 §3) exists to close.\n      acc.servedMean = acc.windowsClosed === 0\n        ? acc.servedInWindow\n        : (acc.servedMean * acc.windowsClosed + acc.servedInWindow) / (acc.windowsClosed + 1)\n      acc.windowsClosed++\n      acc.bloom.clear()\n      acc.servedInWindow = 0\n      acc.novelInWindow = 0\n      acc.windowStart = now\n    }\n\n    // Unconditionally, before the novelty test: a Bloom false positive must not\n    // leak into the distinct count, which is what an alert is computed from.\n    acc.hll.add(id)\n    if (acc.bloom.addIfAbsent(id)) acc.novelInWindow++\n    acc.served++\n    acc.servedInWindow++\n\n    const policy = this.#collections[collection]\n    const corpusSize = policy?.corpusSize\n    if (corpusSize === undefined || corpusSize <= 0) return\n    const coverage = Math.min(1, acc.hll.count() / corpusSize)\n    for (const t of policy?.alertAt ?? DEFAULT_ALERT_AT) {\n      if (coverage < t || acc.fired.has(t)) continue\n      acc.fired.add(t)\n      const event: CoverageEvent = {\n        principal,\n        vault,\n        collection,\n        novel: acc.novelInWindow,\n        served: acc.served,\n        coverage,\n        window: new Date(acc.windowStart).toISOString(),\n        source: 'hub/coverage',\n      }\n      emitter.emit('coverage:threshold', event)\n    }\n  }\n\n  /** Current accounting, for an operator surface. Estimates, never exact. */\n  stats(): readonly CoverageStats[] {\n    const out: CoverageStats[] = []\n    for (const acc of this.#accounts.values()) {\n      const corpusSize = this.#collections[acc.collection]?.corpusSize\n      const distinct = acc.hll.count()\n      out.push({\n        principal: acc.principal,\n        vault: acc.vault,\n        collection: acc.collection,\n        distinct,\n        served: acc.served,\n        novelInWindow: acc.novelInWindow,\n        servedInWindow: acc.servedInWindow,\n        burstiness: acc.servedMean > 0 ? acc.servedInWindow / acc.servedMean : 1,\n        ...(corpusSize !== undefined && corpusSize > 0\n          ? { coverage: Math.min(1, distinct / corpusSize) }\n          : {}),\n        window: new Date(acc.windowStart).toISOString(),\n      })\n    }\n    return out\n  }\n\n  /**\n   * Serializable state, for a deployment that wants coverage to survive a\n   * restart — the horizon must exceed tenure, and a process does not.\n   * ⛔ Sketches only. Never a record id: see {@link CoverageSnapshot}.\n   */\n  snapshot(): CoverageSnapshot {\n    const entries: Array<CoverageSnapshot['entries'][number]> = []\n    for (const acc of this.#accounts.values()) {\n      entries.push({\n        principal: acc.principal,\n        vault: acc.vault,\n        collection: acc.collection,\n        hll: acc.hll.toJSON(),\n        served: acc.served,\n        windowStart: acc.windowStart,\n      })\n    }\n    return { _noydb_coverage: 1, entries }\n  }\n\n  /**\n   * Restore a snapshot. The novelty filter is deliberately NOT restored:\n   * novelty is a within-window notion and the window did not survive.\n   * Distinct-ever did, which is the quantity that must not reset.\n   */\n  restore(snapshot: CoverageSnapshot): void {\n    for (const e of snapshot.entries) {\n      const acc = this.#account(e.principal, e.vault, e.collection, e.windowStart)\n      acc.hll = HyperLogLog.fromJSON(e.hll)\n      acc.served = e.served\n      acc.windowStart = e.windowStart\n    }\n  }\n}\n\nfunction declaresBulk(fieldMeta: CoverageFieldMeta | undefined): boolean {\n  if (fieldMeta === undefined) return false\n  for (const meta of Object.values(fieldMeta)) if (meta?.bulk === 'sensitive') return true\n  return false\n}\n","/**\n * `withCoverage()` — the opt-in read-coverage sensor (#1363).\n *\n * ⛔⛔ **Against an insider holding the device and local keys, this prevents\n * nothing. It makes bulk extraction visible early, attributable and loud. It\n * is telemetry.** The real remediation is key custody — tiers and\n * per-collection DEKs — and this factory is not a substitute for one. Read the\n * sentence again before wiring it into anything that describes itself as a\n * control.\n *\n * @module\n */\n\nimport { CoverageRegistry } from './accounting.js'\nimport type { WithCoverageOptions } from './accounting.js'\n\n/**\n * Enable coverage accounting for every collection that declares a\n * `bulk: 'sensitive'` field (or that is named in `opts.collections`).\n *\n * ```ts\n * const coverage = withCoverage({ collections: { clients: { corpusSize: 1200, alertAt: [0.6, 0.9] } } })\n * const db = await createNoydb({ user: 'alice', secret, coverageStrategy: coverage })\n * db.on('coverage:threshold', (e) => notifyOwner(e))   // a SIGNAL, never a refusal\n * ```\n *\n * The returned registry is the strategy AND the read surface: `stats()` for a\n * live view, `snapshot()`/`restore()` to carry the coverage horizon across a\n * restart. Nothing it returns can name a record that was read.\n */\nexport function withCoverage(opts: WithCoverageOptions = {}): CoverageRegistry {\n  return new CoverageRegistry(opts)\n}\n"],"mappings":";;;;;AAgBA,SAAS,MAAM,GAAW,OAAO,YAAoB;AACnD,MAAI,IAAI,SAAS;AACjB,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AAGA,OAAK,MAAM;AACX,MAAI,KAAK,KAAK,GAAG,UAAU,MAAM;AACjC,OAAK,MAAM;AACX,MAAI,KAAK,KAAK,GAAG,UAAU,MAAM;AACjC,OAAK,MAAM;AACX,SAAO,MAAM;AACf;AAiCO,IAAM,cAAN,MAAM,aAAY;AAAA,EACd;AAAA,EACQ;AAAA,EAEjB,YAAY,YAAY,IAAI;AAC1B,QAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,KAAK,YAAY,IAAI;AACnE,YAAM,IAAI,WAAW,2DAA2D,SAAS,EAAE;AAAA,IAC7F;AACA,SAAK,YAAY;AACjB,SAAK,YAAY,IAAI,WAAW,KAAK,SAAS;AAAA,EAChD;AAAA,EAEA,IAAI,IAAkB;AACpB,UAAM,IAAI,MAAM,EAAE;AAClB,UAAM,MAAM,MAAO,KAAK,KAAK;AAE7B,UAAM,OAAQ,KAAK,KAAK,cAAe;AACvC,UAAM,OAAO,SAAS,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,MAAM,IAAI,IAAI;AACvE,QAAI,OAAO,KAAK,UAAU,GAAG,EAAI,MAAK,UAAU,GAAG,IAAI;AAAA,EACzD;AAAA;AAAA,EAGA,QAAgB;AACd,UAAM,IAAI,KAAK,UAAU;AACzB,QAAI,QAAQ;AACZ,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,YAAM,IAAI,KAAK,UAAU,CAAC;AAC1B,UAAI,MAAM,EAAG;AACb,aAAO,KAAK,CAAC;AAAA,IACf;AACA,UAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK,QAAQ,UAAU,IAAI,QAAQ;AAC7F,UAAM,MAAO,QAAQ,IAAI,IAAK;AAG9B,QAAI,OAAO,MAAM,KAAK,QAAQ,EAAG,QAAO,KAAK,MAAM,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC;AAC1E,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB;AAAA;AAAA,EAGA,SAAqD;AACnD,QAAI,MAAM;AACV,eAAW,KAAK,KAAK,UAAW,QAAO,OAAO,aAAa,CAAC;AAC5D,WAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,GAAG,EAAE;AAAA,EAC3C;AAAA,EAEA,OAAO,SAAS,OAAgE;AAC9E,UAAM,MAAM,IAAI,aAAY,MAAM,CAAC;AACnC,UAAM,MAAM,KAAK,MAAM,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,IAAI,UAAU,UAAU,IAAI,IAAI,QAAQ,KAAK;AAC/D,UAAI,UAAU,CAAC,IAAI,IAAI,WAAW,CAAC;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AACF;AAUO,IAAM,cAAN,MAAkB;AAAA,EACd;AAAA,EACA;AAAA,EACQ;AAAA,EAEjB,YAAY,OAAO,KAAK,IAAI,SAAS,GAAG;AACtC,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAI,OAAM,IAAI,WAAW,iCAAiC,IAAI,EAAE;AACtG,QAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,YAAM,IAAI,WAAW,uCAAuC,MAAM,EAAE;AAAA,IACtE;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ,IAAI,YAAY,KAAK,KAAK,OAAO,EAAE,CAAC;AAAA,EACnD;AAAA;AAAA,EAGA,YAAY,IAAqB;AAC/B,UAAM,KAAK,MAAM,EAAE;AACnB,UAAM,KAAK,MAAM,IAAI,UAAU,IAAI;AACnC,QAAI,QAAQ;AACZ,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,MAAO,KAAK,KAAK,KAAK,GAAG,EAAE,MAAO;AACxC,YAAM,MAAM,MAAM,KAAK;AACvB,YAAM,IAAI,QAAQ;AAClB,YAAM,OAAO,MAAM,MAAM;AACzB,WAAK,KAAK,MAAM,CAAC,IAAK,UAAU,GAAG;AACjC,aAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAK;AACjC,gBAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,KAAK,CAAC;AAAA,EACnB;AACF;;;AC5DA,IAAM,mBAAmB,CAAC,KAAK,GAAG;AAClC,IAAM,UAAU;AAEhB,IAAM,UAAN,MAAc;AAAA,EAYZ,YACW,WACA,OACA,YACT,MACA;AAJS;AACA;AACA;AAGT,SAAK,MAAM,IAAI,YAAY,KAAK,SAAS;AACzC,SAAK,QAAQ,IAAI,YAAY,KAAK,WAAW,KAAK,WAAW;AAC7D,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA,EARW;AAAA,EACA;AAAA,EACA;AAAA,EAdX;AAAA,EACS;AAAA,EACT,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB;AAAA;AAAA,EAEA,aAAa;AAAA,EACb,gBAAgB;AAAA,EACP,QAAQ,oBAAI,IAAY;AAYnC;AAEO,IAAM,mBAAN,MAAmD;AAAA,EAC/C,YAAY,oBAAI,IAAqB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe,oBAAI,IAAY;AAAA,EAExC,YAAY,OAA4B,CAAC,GAAG;AAC1C,SAAK,aAAa,KAAK,aAAa;AACpC,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,eAAe,KAAK,eAAe;AACxC,SAAK,YAAY,KAAK,YAAY;AAClC,SAAK,eAAe,KAAK,eAAe,CAAC;AACzC,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAI,KAAK,aAAa,EAAG,OAAM,IAAI,WAAW,6BAA6B,KAAK,SAAS,EAAE;AAAA,EAC7F;AAAA,EAEA,SACE,OACA,YACA,WACA,WACA,SACA,OAC8B;AAO9B,QAAI;AACJ,WAAO,CAAC,OAAqB;AAC3B,oBAAc,KAAK,kBAAkB,YAAY,UAAU,GAAG,KAAK;AACnE,UAAI,CAAC,UAAW;AAChB,WAAK,QAAQ,WAAW,OAAO,YAAY,IAAI,OAAO;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,kBAAkB,YAAoB,WAA0C,OAAyB;AACvG,UAAM,WAAW,KAAK,aAAa,UAAU,MAAM,UAAa,aAAa,SAAS;AACtF,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,KAAK,aAAa,IAAI,UAAU,GAAG;AACtC,WAAK,aAAa,IAAI,UAAU;AAChC,cAAQ;AAAA,QACN,wCAAwC,UAAU;AAAA,MAKpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,WAAmB,OAAe,YAAoB,KAAsB;AACnF,UAAM,IAAI,KAAK,UAAU,CAAC,WAAW,OAAO,UAAU,CAAC;AACvD,QAAI,MAAM,KAAK,UAAU,IAAI,CAAC;AAC9B,QAAI,QAAQ,QAAW;AACrB,YAAM,IAAI,QAAQ,WAAW,OAAO,YAAY;AAAA,QAC9C,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB;AAAA,MACF,CAAC;AACD,WAAK,UAAU,IAAI,GAAG,GAAG;AAAA,IAC3B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,WAAmB,OAAe,YAAoB,IAAY,SAAgC;AACxG,UAAM,MAAM,KAAK,KAAK;AACtB,UAAM,MAAM,KAAK,SAAS,WAAW,OAAO,YAAY,GAAG;AAE3D,QAAI,MAAM,IAAI,eAAe,KAAK,WAAW;AAK3C,UAAI,aAAa,IAAI,kBAAkB,IACnC,IAAI,kBACH,IAAI,aAAa,IAAI,gBAAgB,IAAI,mBAAmB,IAAI,gBAAgB;AACrF,UAAI;AACJ,UAAI,MAAM,MAAM;AAChB,UAAI,iBAAiB;AACrB,UAAI,gBAAgB;AACpB,UAAI,cAAc;AAAA,IACpB;AAIA,QAAI,IAAI,IAAI,EAAE;AACd,QAAI,IAAI,MAAM,YAAY,EAAE,EAAG,KAAI;AACnC,QAAI;AACJ,QAAI;AAEJ,UAAM,SAAS,KAAK,aAAa,UAAU;AAC3C,UAAM,aAAa,QAAQ;AAC3B,QAAI,eAAe,UAAa,cAAc,EAAG;AACjD,UAAM,WAAW,KAAK,IAAI,GAAG,IAAI,IAAI,MAAM,IAAI,UAAU;AACzD,eAAW,KAAK,QAAQ,WAAW,kBAAkB;AACnD,UAAI,WAAW,KAAK,IAAI,MAAM,IAAI,CAAC,EAAG;AACtC,UAAI,MAAM,IAAI,CAAC;AACf,YAAM,QAAuB;AAAA,QAC3B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,IAAI;AAAA,QACX,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,QAAQ,IAAI,KAAK,IAAI,WAAW,EAAE,YAAY;AAAA,QAC9C,QAAQ;AAAA,MACV;AACA,cAAQ,KAAK,sBAAsB,KAAK;AAAA,IAC1C;AAAA,EACF;AAAA;AAAA,EAGA,QAAkC;AAChC,UAAM,MAAuB,CAAC;AAC9B,eAAW,OAAO,KAAK,UAAU,OAAO,GAAG;AACzC,YAAM,aAAa,KAAK,aAAa,IAAI,UAAU,GAAG;AACtD,YAAM,WAAW,IAAI,IAAI,MAAM;AAC/B,UAAI,KAAK;AAAA,QACP,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB;AAAA,QACA,QAAQ,IAAI;AAAA,QACZ,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,YAAY,IAAI,aAAa,IAAI,IAAI,iBAAiB,IAAI,aAAa;AAAA,QACvE,GAAI,eAAe,UAAa,aAAa,IACzC,EAAE,UAAU,KAAK,IAAI,GAAG,WAAW,UAAU,EAAE,IAC/C,CAAC;AAAA,QACL,QAAQ,IAAI,KAAK,IAAI,WAAW,EAAE,YAAY;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAA6B;AAC3B,UAAM,UAAsD,CAAC;AAC7D,eAAW,OAAO,KAAK,UAAU,OAAO,GAAG;AACzC,cAAQ,KAAK;AAAA,QACX,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB,KAAK,IAAI,IAAI,OAAO;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,aAAa,IAAI;AAAA,MACnB,CAAC;AAAA,IACH;AACA,WAAO,EAAE,iBAAiB,GAAG,QAAQ;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,UAAkC;AACxC,eAAW,KAAK,SAAS,SAAS;AAChC,YAAM,MAAM,KAAK,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW;AAC3E,UAAI,MAAM,YAAY,SAAS,EAAE,GAAG;AACpC,UAAI,SAAS,EAAE;AACf,UAAI,cAAc,EAAE;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,aAAa,WAAmD;AACvE,MAAI,cAAc,OAAW,QAAO;AACpC,aAAW,QAAQ,OAAO,OAAO,SAAS,EAAG,KAAI,MAAM,SAAS,YAAa,QAAO;AACpF,SAAO;AACT;;;ACjTO,SAAS,aAAa,OAA4B,CAAC,GAAqB;AAC7E,SAAO,IAAI,iBAAiB,IAAI;AAClC;","names":[]}

package/dist/custody/index.js

@@ -2,21 +2,21 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-GPEQUXHL.js";
-import "../chunk-G56KBWFY.js";
-import "../chunk-KG7TZKZG.js";
-import "../chunk-JMGDHKQF.js";
-import "../chunk-77K4PG6P.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BOWNCWZT.js";
-import "../chunk-YSRUYAVU.js";
-import "../chunk-RMF67KCG.js";
+} from "../chunk-B6SJIBQK.js";
+import "../chunk-M7NI3IWE.js";
+import "../chunk-7VCXZDA4.js";
+import "../chunk-JCN44NCY.js";
+import "../chunk-KJFW62P4.js";
+import "../chunk-SEE332EV.js";
+import "../chunk-6QSQQLSE.js";
+import "../chunk-DE4DH2RZ.js";
+import "../chunk-LQ4ZHOKP.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-SL3JAAKN.js";
-import "../chunk-7MG7SJT7.js";
+import "../chunk-UYB234ZR.js";
+import "../chunk-ODVPTDPK.js";
 import {
   CustodyNotEnabledError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-244VXYPG.js";
 export {
   CustodyApi,
   CustodyNotEnabledError,

package/dist/{dead-filter-TSWZQRR5.js → dead-filter-U2UYKSZL.js}

@@ -4,7 +4,7 @@ import {
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-FLR73HHF.js");
+  const { loadPersistedSchema } = await import("./storage-SVMKRGCW.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -24,4 +24,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-TSWZQRR5.js.map
+//# sourceMappingURL=dead-filter-U2UYKSZL.js.map

package/dist/debug/index.js

@@ -1,7 +1,7 @@
 import {
   DebugPlaintextError,
   DebugReservedFieldError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-244VXYPG.js";
 
 // src/kernel/debug.ts
 function readPlaintextRecord(envelope) {

package/dist/{delegation-OVIFFPG4.js → delegation-S3AEPW2T.js}

@@ -1,30 +1,30 @@
-import "./chunk-UGTBXF5U.js";
+import "./chunk-SOIQ4MM4.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
   dekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-JCN44NCY.js";
 import {
   buildRecordAad,
   openEnvelopeJson
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import "./chunk-BOWNCWZT.js";
-import "./chunk-YSRUYAVU.js";
-import "./chunk-RMF67KCG.js";
+} from "./chunk-SEE332EV.js";
+import "./chunk-6QSQQLSE.js";
+import "./chunk-DE4DH2RZ.js";
+import "./chunk-LQ4ZHOKP.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-SL3JAAKN.js";
-import "./chunk-7MG7SJT7.js";
+} from "./chunk-UYB234ZR.js";
+import "./chunk-ODVPTDPK.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -102,4 +102,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-OVIFFPG4.js.map
+//# sourceMappingURL=delegation-S3AEPW2T.js.map

package/dist/derivations/index.js

@@ -1,44 +1,47 @@
 import {
   DerivationRegistry
-} from "../chunk-HDOU6I2Y.js";
+} from "../chunk-VNPEWFPD.js";
 import "../chunk-FFWI7UH7.js";
 import {
   DerivationExecutor
-} from "../chunk-TFR7DSOV.js";
+} from "../chunk-MVZ2TPVP.js";
 import {
   withDerivation,
   withRollup
-} from "../chunk-BUE2D7PX.js";
-import "../chunk-2C3AQB46.js";
+} from "../chunk-32YV3TJT.js";
+import "../chunk-UD5EVGZ7.js";
 import "../chunk-TFMM5DBB.js";
-import "../chunk-RTBJ5IOO.js";
-import "../chunk-5VCRVKOZ.js";
+import "../chunk-MDWKM2XC.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-REDOOY2Q.js";
+import "../chunk-PSIV7CJV.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-2Y4IMKA6.js";
-import "../chunk-U4FOQDY4.js";
+import "../chunk-3H5KLDZN.js";
+import "../chunk-FH2L2E34.js";
+import "../chunk-QOOUUR4A.js";
+import "../chunk-NYMLINRP.js";
 import "../chunk-V4PXLYWM.js";
-import "../chunk-MVMXZYXT.js";
-import "../chunk-6I2RQCET.js";
-import "../chunk-TRGTKX5E.js";
-import "../chunk-UXVWEX5L.js";
-import "../chunk-BOET4NA4.js";
-import "../chunk-77K4PG6P.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BOWNCWZT.js";
-import "../chunk-YSRUYAVU.js";
-import "../chunk-RMF67KCG.js";
+import "../chunk-ORDURZBU.js";
+import "../chunk-XBKH4FOC.js";
+import "../chunk-TKUOEU2F.js";
+import "../chunk-DF73H4UN.js";
+import "../chunk-GHLTDZRS.js";
+import "../chunk-Z5HTYMMQ.js";
+import "../chunk-CKNGS5MH.js";
+import "../chunk-KJFW62P4.js";
+import "../chunk-SEE332EV.js";
+import "../chunk-6QSQQLSE.js";
+import "../chunk-DE4DH2RZ.js";
+import "../chunk-LQ4ZHOKP.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-SL3JAAKN.js";
-import "../chunk-7MG7SJT7.js";
+import "../chunk-UYB234ZR.js";
+import "../chunk-ODVPTDPK.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-244VXYPG.js";
 export {
   DerivationCapExceededError,
   DerivationCycleError,

package/dist/derive-OX7F6TGG.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-PSIV7CJV.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-KJFW62P4.js";
+import "./chunk-SEE332EV.js";
+import "./chunk-6QSQQLSE.js";
+import "./chunk-DE4DH2RZ.js";
+import "./chunk-LQ4ZHOKP.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-UYB234ZR.js";
+import "./chunk-ODVPTDPK.js";
+import "./chunk-244VXYPG.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-OX7F6TGG.js.map

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-MUM7IANK.js";
+} from "../chunk-4MXI3ODD.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,16 +16,16 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-KG7TZKZG.js";
-import "../chunk-77K4PG6P.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BOWNCWZT.js";
-import "../chunk-YSRUYAVU.js";
-import "../chunk-RMF67KCG.js";
+} from "../chunk-7VCXZDA4.js";
+import "../chunk-KJFW62P4.js";
+import "../chunk-SEE332EV.js";
+import "../chunk-6QSQQLSE.js";
+import "../chunk-DE4DH2RZ.js";
+import "../chunk-LQ4ZHOKP.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-SL3JAAKN.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+import "../chunk-UYB234ZR.js";
+import "../chunk-ODVPTDPK.js";
+import "../chunk-244VXYPG.js";
 export {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,

package/dist/{dispatch-WC6X2M6C.js → dispatch-3CQDJV5Q.js}

@@ -14,7 +14,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-PUAO6AKJ.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-B6SRO2QS.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -23,7 +23,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-DDL7WQEZ.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-TJ3DYZMQ.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -45,7 +45,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-PUAO6AKJ.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-B6SRO2QS.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -58,7 +58,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-DDL7WQEZ.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-TJ3DYZMQ.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -70,4 +70,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-WC6X2M6C.js.map
+//# sourceMappingURL=dispatch-3CQDJV5Q.js.map