@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-747G6CT3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/derive.ts"],"sourcesContent":["/**\n * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1\n * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)\n * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so\n * hub never statically imports zod. Other validator families write a stub\n * envelope flagging the kind.\n *\n * @see design-history/2026-05-22-schema-dump-design.md\n *\n * @module\n */\n\nimport { canonicalize } from './canonicalize.js'\nimport { sha256Hex } from '../../capsule/index.js'\nimport type { PersistedSchemaEnvelope, PersistedSchemaKind } from './types.js'\n\n/**\n * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`\n * property (present in Zod v3.23+ and Zod v4+). Falls back to the\n * `_def.typeName` heuristic for older Zod v3 builds that predate Standard\n * Schema support.\n */\nexport function isZodSchema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  // Standard Schema v1 vendor tag — most reliable across Zod majors\n  const std = (value as { '~standard'?: { vendor?: unknown } })['~standard']\n  if (std && typeof std === 'object' && (std as { vendor?: unknown }).vendor === 'zod') return true\n  // Zod v3 fallback: _def.typeName starts with 'Zod' (e.g. 'ZodObject')\n  const def = (value as { _def?: { typeName?: unknown } })._def\n  if (!def || typeof def !== 'object') return false\n  return typeof (def as { typeName?: unknown }).typeName === 'string'\n    && ((def as { typeName: string }).typeName).startsWith('Zod')\n}\n\nfunction detectKind(validator: unknown): PersistedSchemaKind {\n  if (isZodSchema(validator)) return 'Zod'\n  return 'Unknown'\n}\n\n/**\n * Returns `true` when the validator was created with the Zod v4 native API\n * (i.e. `import { z } from 'zod'` where zod resolves to v4). Zod v4 native\n * schemas carry a `_zod` property whereas Zod v3 schemas (and the v3-compat\n * shim shipped inside zod@4 at `zod/v3`) use `_def.typeName`.\n *\n * Kept duck-typed so hub never statically imports zod.\n */\nexport function isZod4Schema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  return '_zod' in value\n}\n\n/**\n * Lazy-require `zod-to-json-schema`. Returns the converter, or throws a\n * clear error if the peer-dep isn't installed.\n */\nasync function loadZodToJsonSchemaConverter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod-to-json-schema')) as { zodToJsonSchema?: (s: unknown) => object }\n    if (!mod.zodToJsonSchema) {\n      throw new Error('zod-to-json-schema export missing')\n    }\n    return mod.zodToJsonSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema requires the optional peer-dep `zod-to-json-schema`. '\n      + 'Install it: `pnpm add zod-to-json-schema` (or npm/yarn equivalent). '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\n/**\n * Lazy-require Zod v4's built-in `toJSONSchema`. Used when the validator is a\n * Zod v4 native schema and `zod-to-json-schema` is absent or cannot handle it.\n *\n * Dynamic so hub never loads zod unless a caller actually persists a Zod v4\n * schema. ⚠️ Dynamic is NOT what keeps zod out of the tarball — that is\n * `peerDependencies` (#1227). tsup externalises DECLARED dependencies and\n * BUNDLES everything else, static or dynamic alike, so while zod was a\n * devDependency only, this line silently vendored 548 KB of zod@4.4.3 into\n * `dist/` at a build-frozen version. The comment here previously claimed the\n * dynamic import was what prevented that; it never did.\n *\n * Declaring it an OPTIONAL peer is also the correctness fix, not just a size\n * one: `toJSONSchema` reads a schema's internals, and the schema is built by\n * the CONSUMER's zod. A vendored copy meant hub inspected one zod's objects\n * with another zod's version of that reader. Now there is one zod — theirs.\n */\nasync function loadZodV4Converter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod')) as { toJSONSchema?: (s: unknown) => object }\n    if (typeof mod.toJSONSchema !== 'function') {\n      throw new Error('zod.toJSONSchema not available (zod v4 required)')\n    }\n    return mod.toJSONSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\nexport async function derivePersistedSchema(\n  validator: unknown,\n): Promise<PersistedSchemaEnvelope> {\n  const kind = detectKind(validator)\n  const derivedAt = new Date().toISOString()\n\n  if (kind === 'Zod') {\n    let jsonSchema: object\n\n    if (isZod4Schema(validator)) {\n      // Zod v4 native schemas: use zod's built-in toJSONSchema (available in\n      // zod@4) because zod-to-json-schema@3.x parses _def.typeName which is\n      // absent in native v4 schemas.\n      const convert = await loadZodV4Converter()\n      jsonSchema = convert(validator)\n    } else {\n      // Zod v3 schemas (or v3-compat shim): use the optional peer-dep\n      // zod-to-json-schema for backward compatibility.\n      const convert = await loadZodToJsonSchemaConverter()\n      jsonSchema = convert(validator)\n    }\n\n    const canonical = canonicalize(jsonSchema)\n    const hash = await sha256Hex(new TextEncoder().encode(canonical))\n    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt }\n  }\n\n  return {\n    _noydb_schema: 1,\n    kind,\n    jsonSchema: null,\n    hash: null,\n    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,\n    derivedAt,\n  }\n}\n"],"mappings":";;;;;;;;AAsBO,SAAS,YAAY,OAAyB;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,MAAO,MAAiD,WAAW;AACzE,MAAI,OAAO,OAAO,QAAQ,YAAa,IAA6B,WAAW,MAAO,QAAO;AAE7F,QAAM,MAAO,MAA4C;AACzD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,SAAO,OAAQ,IAA+B,aAAa,YACpD,IAA6B,SAAU,WAAW,KAAK;AAChE;AAEA,SAAS,WAAW,WAAyC;AAC3D,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,SAAO;AACT;AAUO,SAAS,aAAa,OAAyB;AACpD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,SAAO,UAAU;AACnB;AAMA,eAAe,+BAAgE;AAC7E,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,oBAAoB;AAC9C,QAAI,CAAC,IAAI,iBAAiB;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kKAEqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAmBA,eAAe,qBAAsD;AACnE,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,KAAK;AAC/B,QAAI,OAAO,IAAI,iBAAiB,YAAY;AAC1C,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,4FACqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,WACkC;AAClC,QAAM,OAAO,WAAW,SAAS;AACjC,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,MAAI,SAAS,OAAO;AAClB,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAI3B,YAAM,UAAU,MAAM,mBAAmB;AACzC,mBAAa,QAAQ,SAAS;AAAA,IAChC,OAAO;AAGL,YAAM,UAAU,MAAM,6BAA6B;AACnD,mBAAa,QAAQ,SAAS;AAAA,IAChC;AAEA,UAAM,YAAY,aAAa,UAAU;AACzC,UAAM,OAAO,MAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,EAAE,eAAe,GAAG,MAAM,YAAY,MAAM,UAAU;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ,yCAAyC,IAAI;AAAA,IACrD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-QTQUH4DS.js → chunk-7R2Q7CPL.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-ZYIYHJ5R.js";
+} from "./chunk-MXOQ5JCG.js";
 import {
   deriveSchemaManifest
-} from "./chunk-4GFX6MPA.js";
+} from "./chunk-TEHHROZL.js";
 import {
   loadFence
-} from "./chunk-453F654R.js";
+} from "./chunk-VAORSCSU.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-BVN6KXL2.js";
+} from "./chunk-KZXDLBY6.js";
 import {
   loadKeyring
-} from "./chunk-3V4KWFX7.js";
+} from "./chunk-XSPFDUDG.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -64,16 +64,16 @@ function wrapPodStore(bundle, options) {
     }
   }
   async function flush(vault) {
-    const snapshot = snapshots.get(vault) ?? {};
-    const format = {
-      _noydb_bundle_store: BUNDLE_STORE_VERSION,
-      vault,
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      data: snapshot
-    };
-    const bytes = new TextEncoder().encode(JSON.stringify(format));
-    const expectedVersion = versions.get(vault) ?? null;
     for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {
+      const snapshot = snapshots.get(vault) ?? {};
+      const format = {
+        _noydb_bundle_store: BUNDLE_STORE_VERSION,
+        vault,
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        data: snapshot
+      };
+      const bytes = new TextEncoder().encode(JSON.stringify(format));
+      const expectedVersion = versions.get(vault) ?? null;
       try {
         const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion);
         versions.set(vault, newVersion);
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-QTQUH4DS.js.map
+//# sourceMappingURL=chunk-7R2Q7CPL.js.map

package/dist/chunk-7R2Q7CPL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-pod/pod-store.ts","../src/with-pod/redirect.ts","../src/with-pod/open.ts"],"sourcesContent":["import type { NoydbStore, NoydbPodStore, VaultSnapshot, EncryptedEnvelope } from '../kernel/types.js'\nimport { ConflictError, PodVersionConflictError } from '../kernel/errors.js'\n\n// ─── Bundle format ─────────────────────────────────────────────────────\n\nconst BUNDLE_STORE_VERSION = 1 as const\n\n/**\n * Wire format written by `wrapPodStore`. A JSON-serialised object that\n * contains the entire `VaultSnapshot` (all encrypted envelopes) plus a small\n * header for integrity checking. The envelopes inside are already AES-GCM\n * encrypted by core — the bundle bytes themselves are not additionally\n * encrypted, but they are safe to store on untrusted blob hosts because\n * every record inside is already ciphertext.\n *\n * @internal\n */\ninterface BundleStoreData {\n  readonly _noydb_bundle_store: typeof BUNDLE_STORE_VERSION\n  readonly vault: string\n  readonly ts: string\n  readonly data: VaultSnapshot\n}\n\n// ─── Options ───────────────────────────────────────────────────────────\n\nexport interface WrapPodStoreOptions {\n  /**\n   * When `true` (default), every `put()` and `delete()` flushes the full\n   * vault snapshot to the bundle backend. Set to `false` for bulk operations\n   * and call `store.flush(vaultId)` manually.\n   */\n  autoFlush?: boolean\n}\n\n// ─── Extended NoydbStore with flush/batch ───────────────────────────────\n\nexport interface WrappedPodNoydbStore extends NoydbStore {\n  /** Manually flush the in-memory snapshot to the bundle backend. */\n  flush(vaultId: string): Promise<void>\n  /**\n   * Run a batch of mutations without flushing until the callback completes.\n   * A single flush is performed at the end.\n   */\n  batch(vaultId: string, fn: () => Promise<void>): Promise<void>\n}\n\n// ─── wrapPodStore ───────────────────────────────────────────────────\n\nconst MAX_CONFLICT_RETRIES = 3\n\n/**\n * Convert a `NoydbPodStore` (blob-oriented read/write with OCC) into the\n * standard six-method `NoydbStore` interface expected by `createNoydb({ store })`.\n *\n * Bundle stores operate on the entire vault as a single serialised unit —\n * ideal for backends like Google Drive, WebDAV, or iCloud Drive that work\n * best with whole-file I/O rather than per-record KV operations.\n *\n * ## Optimistic concurrency\n *\n * The wrapper tracks the `version` token from the last `readBundle` and\n * passes it as `expectedVersion` on every flush. On\n * `PodVersionConflictError`, it re-reads, merges the remote snapshot\n * (last-write-wins per record key), and retries (max 3 attempts).\n *\n * ## Flush modes\n *\n * By default, flushes on every mutation (O(vault size) per write). Options:\n * - `autoFlush: false` + explicit `store.flush(vaultId)` calls\n * - `store.batch(vaultId, async () => { ... })` — defers flush until end\n * - Pair with `syncPolicy: { push: { mode: 'debounce' } }` from \n */\nexport function wrapPodStore(\n  bundle: NoydbPodStore,\n  options?: WrapPodStoreOptions,\n): WrappedPodNoydbStore {\n  const autoFlush = options?.autoFlush !== false\n\n  // Per-vault state\n  const snapshots = new Map<string, VaultSnapshot>()\n  const versions = new Map<string, string | null>()\n  const loaded = new Set<string>()\n\n  // Batch mode: when > 0, suppress auto-flush\n  let batchDepth = 0\n\n  // #908 — in-flight loads, keyed by vault. Without this, every concurrent\n  // caller issued its own `readBundle` and then REPLACED `snapshots` with a\n  // freshly parsed object — orphaning the mutations earlier callers had\n  // already made to the object they were handed. 100 racing puts kept 1.\n  const loading = new Map<string, Promise<VaultSnapshot>>()\n\n  async function load(vault: string): Promise<VaultSnapshot> {\n    if (loaded.has(vault)) return snapshots.get(vault)!\n\n    const inFlight = loading.get(vault)\n    if (inFlight) return inFlight\n\n    const pending = (async () => {\n      const result = await bundle.readBundle(vault)\n      if (result) {\n        const text = new TextDecoder().decode(result.bytes)\n        const format = JSON.parse(text) as BundleStoreData\n        snapshots.set(vault, format.data)\n        versions.set(vault, result.version)\n      } else {\n        snapshots.set(vault, {})\n        versions.set(vault, null)\n      }\n\n      loaded.add(vault)\n      return snapshots.get(vault)!\n    })()\n\n    loading.set(vault, pending)\n    try {\n      return await pending\n    } finally {\n      // Clear on failure too, so a transient read error does not poison\n      // every later load of this vault with a rejected promise.\n      loading.delete(vault)\n    }\n  }\n\n  async function flush(vault: string): Promise<void> {\n    // ⛔ BOTH of these MUST be read inside the loop, from the maps. #10: they\n    // used to be captured once above it, so a retry re-sent the stale\n    // `expectedVersion` and the PRE-merge bytes — against any OCC backend that\n    // is a guaranteed repeat conflict, so the loop burned its retries and threw\n    // while the merge it had just computed was discarded. The conflict branch\n    // below writes the merged snapshot and the observed remote version into the\n    // maps; reading them here is what makes that work mean anything.\n    // Pinned by `__tests__/pod-flush-conflict-retry.test.ts`.\n    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {\n      const snapshot = snapshots.get(vault) ?? {}\n      const format: BundleStoreData = {\n        _noydb_bundle_store: BUNDLE_STORE_VERSION,\n        vault,\n        ts: new Date().toISOString(),\n        data: snapshot,\n      }\n      const bytes = new TextEncoder().encode(JSON.stringify(format))\n      const expectedVersion = versions.get(vault) ?? null\n\n      try {\n        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion)\n        versions.set(vault, newVersion)\n        return\n      } catch (err) {\n        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {\n          // Pull remote, merge (last-write-wins by record key), retry\n          const remote = await bundle.readBundle(vault)\n          if (remote) {\n            const remoteText = new TextDecoder().decode(remote.bytes)\n            const remoteFormat = JSON.parse(remoteText) as BundleStoreData\n            const localSnap = snapshots.get(vault) ?? {}\n            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap)\n            snapshots.set(vault, mergedSnap)\n            versions.set(vault, remote.version)\n          }\n          // The next iteration re-reads both maps above, so it re-encodes the\n          // merged snapshot and sends the version we just observed.\n          continue\n        }\n        throw err\n      }\n    }\n  }\n\n  // #908 — one flush at a time per vault. `flush` reads and writes the vault's\n  // version token, so concurrent flushes race: each sends the same\n  // `expectedVersion`, the losers take the conflict/merge path, and with enough\n  // of them the retry budget is exhausted and the error surfaces to a caller\n  // whose write was perfectly valid. Serialising makes every flush see the\n  // token its predecessor produced.\n  const flushChain = new Map<string, Promise<void>>()\n\n  function serialFlush(vault: string): Promise<void> {\n    const prev = flushChain.get(vault) ?? Promise.resolve()\n    // Chain past a rejection as well — one failed flush must not wedge every\n    // subsequent write to this vault.\n    const next = prev.then(() => flush(vault), () => flush(vault))\n    flushChain.set(vault, next)\n    return next\n  }\n\n  async function maybeFlush(vault: string): Promise<void> {\n    if (autoFlush && batchDepth === 0) {\n      await serialFlush(vault)\n    }\n  }\n\n  const store: WrappedPodNoydbStore = {\n    name: bundle.name ?? 'bundle',\n\n    async flush(vaultId: string): Promise<void> {\n      await serialFlush(vaultId)\n    },\n\n    async batch(vaultId: string, fn: () => Promise<void>): Promise<void> {\n      await load(vaultId) // ensure loaded before batch\n      batchDepth++\n      try {\n        await fn()\n      } finally {\n        batchDepth--\n      }\n      await serialFlush(vaultId)\n    },\n\n    async get(vault: string, collection: string, id: string): Promise<EncryptedEnvelope | null> {\n      const snap = await load(vault)\n      return snap[collection]?.[id] ?? null\n    },\n\n    async put(\n      vault: string,\n      collection: string,\n      id: string,\n      envelope: EncryptedEnvelope,\n      expectedVersion?: number,\n    ): Promise<void> {\n      const snap = await load(vault)\n\n      if (expectedVersion !== undefined) {\n        const current = snap[collection]?.[id]\n        const currentVersion = current?._v ?? 0\n        if (currentVersion !== expectedVersion) {\n          throw new ConflictError(\n            currentVersion,\n            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`,\n          )\n        }\n      }\n\n      snap[collection] ??= {}\n      snap[collection][id] = envelope\n      await maybeFlush(vault)\n    },\n\n    async delete(vault: string, collection: string, id: string): Promise<void> {\n      const snap = await load(vault)\n      if (snap[collection]) {\n        delete snap[collection][id]\n        await maybeFlush(vault)\n      }\n    },\n\n    async list(vault: string, collection: string): Promise<string[]> {\n      const snap = await load(vault)\n      return Object.keys(snap[collection] ?? {})\n    },\n\n    async loadAll(vault: string): Promise<VaultSnapshot> {\n      const snap = await load(vault)\n      // #908 — two contract fixes in one place:\n      //  1. internal collections (`_keyring`, `_sync`) are the vault's own\n      //     bookkeeping and must not appear in a snapshot — `@noy-db/to-file`\n      //     sets the reference behaviour with this same `_`-prefix rule;\n      //  2. copy rather than hand out the live cache, which let a caller\n      //     mutating the result silently rewrite the wrapper's own state.\n      // `get()`/`list()` still serve internal collections; this is about what\n      // a *snapshot* claims, not about hiding data.\n      const out: VaultSnapshot = {}\n      for (const [collection, records] of Object.entries(snap)) {\n        if (collection.startsWith('_')) continue\n        out[collection] = { ...records }\n      }\n      return out\n    },\n\n    async saveAll(vault: string, data: VaultSnapshot): Promise<void> {\n      snapshots.set(vault, data)\n      loaded.add(vault)\n      await serialFlush(vault)\n    },\n  }\n\n  return store\n}\n\n// ─── Snapshot merge (last-write-wins per record) ────────────────────────\n\nfunction mergeSnapshots(remote: VaultSnapshot, local: VaultSnapshot): VaultSnapshot {\n  const merged: VaultSnapshot = {}\n\n  // Start with all remote collections\n  for (const [coll, records] of Object.entries(remote)) {\n    merged[coll] = { ...records }\n  }\n\n  // Overlay local collections — LWW by _ts per record\n  for (const [coll, records] of Object.entries(local)) {\n    if (!merged[coll]) {\n      merged[coll] = { ...records }\n      continue\n    }\n    for (const [id, envelope] of Object.entries(records)) {\n      const existing = merged[coll][id]\n      if (!existing || envelope._ts >= existing._ts) {\n        merged[coll][id] = envelope\n      }\n    }\n  }\n\n  return merged\n}\n\n// ─── Factory helper ─────────────────────────────────────────────────────\n\n/**\n * Type-safe factory helper for `NoydbPodStore` implementations,\n * analogous to `createStore` for KV stores.\n */\nexport function createPodStore<TOptions>(\n  factory: (options: TOptions) => NoydbPodStore,\n): (options: TOptions) => NoydbPodStore {\n  return factory\n}\n\n// ─── Deprecated aliases (pre-rename compatibility) ──────────────────────\n\n","/**\n * Redirect record (#944) — a signed \"this moved, go there\" pointer carried\n * in the pod's PLAINTEXT header (`NoydbPodHeader.redirect`, see\n * `format.ts`) so a dispatcher can follow it pre-auth: no secret, no\n * decompression.\n *\n * The record carries its OWN inner `sig` (via `signRecord`/`verifyRecord`\n * from `signature.ts`) — independent from, and in addition to, the #943\n * pod-header signature. A Redirect is REQUIRED to be signed: there is no\n * legacy unsigned install base for this new record type, so an absent or\n * invalid signature is invalid for following, not merely \"unverified\".\n *\n * Minimum-disclosure: the record is kept to exactly\n * `{ v, target, reason, issuedBy, sig }` — no timestamps, no identities\n * beyond the signer's `keyId` fingerprint.\n */\n\nimport type { DocSigner } from '../with-audit/attestation/signer.js'\nimport { signRecord, verifyRecord } from './signature.js'\nimport { readPodRedirect } from './pod.js'\nimport {\n  RedirectBadSignatureError,\n  RedirectDepthExceededError,\n  RedirectLoopError,\n  RedirectUnreachableError,\n} from '../kernel/errors.js'\n\n/**\n * A signed pointer to another pod. `target` is a locator string or URL —\n * the forthcoming #945 `Locator` type isn't built yet, so `target` stays a\n * plain string for now (forward-seam noted, not blurred: a Redirect says\n * \"go elsewhere once\"; a Locator will say \"where cargo lives\").\n */\nexport interface Redirect {\n  readonly v: 1\n  readonly target: string\n  readonly reason: 'moved' | 'release' | 'tombstone' | 'repoint'\n  readonly issuedBy: string\n  readonly sig: string\n}\n\n/**\n * Sign a new Redirect record with `signer`. Builds the record minus `sig`,\n * signs it via the #943 `signRecord` convention, and returns the complete\n * signed record.\n */\nexport async function signRedirect(\n  signer: DocSigner,\n  fields: { readonly target: string; readonly reason: Redirect['reason'] },\n): Promise<Redirect> {\n  const record = {\n    v: 1 as const,\n    target: fields.target,\n    reason: fields.reason,\n    issuedBy: signer.keyId,\n  }\n  const sig = await signRecord(signer.privateKeyPkcs8B64, record)\n  return { ...record, sig }\n}\n\n/**\n * Verify a Redirect record's signature against `trustedKeys`\n * (`keyId → publicKeyB64`). Fails closed: an `issuedBy` not present in\n * `trustedKeys` is untrusted/unverifiable and returns `false`, same as a\n * tampered or forged signature.\n */\nexport async function verifyRedirect(\n  record: Redirect,\n  trustedKeys: Readonly<Record<string, string>>,\n): Promise<boolean> {\n  const publicKeyB64 = trustedKeys[record.issuedBy]\n  if (publicKeyB64 === undefined) return false\n  const payload = { v: record.v, target: record.target, reason: record.reason, issuedBy: record.issuedBy }\n  return verifyRecord(publicKeyB64, record.sig, payload)\n}\n\n/** One followed hop's provenance — surfaced so a UI can show \"moved from X via Y\". */\nexport interface RedirectHop {\n  readonly target: string\n  readonly reason: Redirect['reason']\n  readonly issuedBy: string\n}\n\n/** Result of {@link followRedirects}: the terminal (non-redirect) pod's bytes, plus the ordered hop list that led there. */\nexport interface FollowRedirectsResult {\n  readonly terminal: Uint8Array\n  readonly hops: readonly RedirectHop[]\n}\n\n/**\n * Follow a chain of Redirect records starting from `start`'s pod bytes,\n * fetching each hop's target via `fetcher`, until a pod with no `redirect`\n * header field (the terminal) is reached.\n *\n * HTTP-redirect discipline: each hop's Redirect is verified against\n * `opts.trustedKeys` BEFORE it is followed (fail closed — an untrusted or\n * forged hop never advances the walk), loops are detected on the target\n * about to be followed, and the hop count is capped at `opts.maxDepth`\n * (default 8). `fetcher` throwing or returning `null` for a target means\n * that hop is unreachable.\n *\n * @throws {RedirectBadSignatureError} a hop's Redirect fails verification.\n * @throws {RedirectLoopError} a hop's target was already followed in this chain.\n * @throws {RedirectDepthExceededError} more than `maxDepth` hops were followed.\n * @throws {RedirectUnreachableError} `fetcher` threw or returned `null` for a target.\n */\nexport async function followRedirects(\n  start: Uint8Array,\n  fetcher: (target: string) => Promise<Uint8Array | null>,\n  opts: { readonly trustedKeys: Readonly<Record<string, string>>; readonly maxDepth?: number },\n): Promise<FollowRedirectsResult> {\n  const maxDepth = opts.maxDepth ?? 8\n  let current = start\n  const hops: RedirectHop[] = []\n  const visited = new Set<string>()\n\n  for (;;) {\n    const rec = readPodRedirect(current)\n    if (rec === undefined) return { terminal: current, hops }\n\n    if (!(await verifyRedirect(rec, opts.trustedKeys))) {\n      throw new RedirectBadSignatureError(rec.target)\n    }\n    if (visited.has(rec.target)) {\n      throw new RedirectLoopError(rec.target)\n    }\n    visited.add(rec.target)\n\n    hops.push({ target: rec.target, reason: rec.reason, issuedBy: rec.issuedBy })\n    if (hops.length > maxDepth) {\n      throw new RedirectDepthExceededError(maxDepth)\n    }\n\n    let next: Uint8Array | null\n    try {\n      next = await fetcher(rec.target)\n    } catch (cause) {\n      throw new RedirectUnreachableError(rec.target, cause)\n    }\n    if (next === null) {\n      throw new RedirectUnreachableError(rec.target)\n    }\n    current = next\n  }\n}\n","/**\n * `open(podBytesOrFile)` — the pod READ-path orchestrator (#941 Task 4).\n *\n * A free function (never a `Vault` method — `kernel/vault.ts` is at its\n * line ceiling and open() needs no vault-internal state that isn't already\n * reachable through published seams). Composes, in order:\n *\n *   1. `readPod` — parse + integrity-check the container (throws\n *      `PodIntegrityError` on a corrupted/truncated pod).\n *   2. `verifyPodHeader` — only when `opts.trustedKeys` is supplied.\n *      `'unsigned'` is benign (legacy pod, or `writePod({ sign: false })`)\n *      and open() proceeds; `'untrusted'` / `'tampered'` are fail-closed —\n *      `PodHeaderVerificationError` — mirroring `followRedirects`'s\n *      `RedirectBadSignatureError` posture: once a caller opts into\n *      verification, an unverifiable header is a hard stop.\n *   3. `createNoydb` + `openVault` + `vault.load(dumpJson)` — the exact\n *      unlock+restore sequence `bundle-roundtrip.test.ts` drives by hand.\n *      The pod header carries no vault name (minimum-disclosure —\n *      `format.ts`'s forbidden-fields list), so the caller names the\n *      target vault via `opts.vault`.\n *   4. Re-derive the `SchemaManifest` from the just-restored `_schemas/*`\n *      (the source of truth — Task 3's `deriveSchemaManifest`), via a\n *      NON-MINTING `LookupDEK` built from `loadKeyring`'s already-unwrapped\n *      `UnlockedKeyring.deks` map directly (`with-party/team/keyring.js`).\n *      **Not** `ensureCollectionDEK` (#941 review fix — Important 2): that\n *      helper mints+persists a fresh DEK into `_keyring/<user>` for any\n *      collection absent from the keyring, which is correct for a WRITE\n *      path but wrong here — `deriveSchemaManifest` only ever reads\n *      collections that already have a `_schemas` envelope, so an absent\n *      DEK means \"this principal can't decrypt this sibling\" (e.g. a\n *      collection-scoped grantee), never \"new collection.\" The old\n *      minting call polluted a scoped principal's freshly-restored keyring\n *      with garbage sibling DEKs on every `open()`. The returned\n *      `manifest` is that principal's own visible slice — see\n *      `derive.ts`'s `LookupDEK` doc and `sync.ts`'s module doc for the\n *      full rationale (the same distinction governs why the sync path\n *      must SKIP rather than write a partial manifest).\n *   5. Generation check (AC #4 coexistence): compare the HIGHEST\n *      per-collection generation stamp carried by the restored manifest\n *      against THIS store's schema-fence generation as it stood\n *      immediately before the restore (0 for a brand-new vault; whatever a\n *      coexisting local vault already had). If the pod is ahead and\n *      `!opts.allowGenerationAhead`, throw `MigrationRequiredError` (the\n *      same class `SchemaFenceController`'s write-path gate throws) — the\n *      reader hasn't reconciled schema changes that happened elsewhere.\n *      `allowGenerationAhead: true` is the documented dev override: open\n *      proceeds, with a console warning. Divergence in the OTHER direction\n *      (reader ahead of the pod) is non-fatal but also warned (#941\n *      review, Important 3 — AC #4 coexistence divergence must be\n *      observable in either direction, not just the bypass case).\n *\n *      NOTE: this deliberately reads per-collection entries, not\n *      `manifest.generation` itself. `_meta/schema-fence` is local\n *      session-coordination state and does NOT travel in a pod dump\n *      (`with-pod/backup.ts`'s reserved-collection list carries `_schemas`\n *      and `_manifest` but not `_meta`) — a fresh re-derive's top-level\n *      `generation` is always driven by the (untouched-by-restore) target\n *      store's own fence, not the pod's. Each `_schemas/<collection>`\n *      envelope's own `generation` field DOES travel (it's stamped at\n *      declare-time from the writer's real fence), so per-collection\n *      entries are the only signal that survives a restore intact.\n *\n * @module\n */\n\nimport { readPod, verifyPodHeader } from './pod.js'\nimport type { NoydbPodHeader } from './format.js'\nimport type { PodVerifyResult } from './pod.js'\nimport { createNoydb } from '../kernel/noydb.js'\nimport type { Noydb } from '../kernel/noydb.js'\nimport type { Vault } from '../kernel/vault.js'\nimport type { NoydbOptions, NoydbStore, EchoSecretParts } from '../kernel/types.js'\nimport { MigrationRequiredError, PodHeaderVerificationError } from '../kernel/errors.js'\nimport { loadKeyring } from '../with-party/team/keyring.js'\nimport { loadFence } from '../with-shape/schema-update/fence.js'\nimport { deriveSchemaManifest, type LookupDEK } from '../with-shape/manifest/derive.js'\nimport type { SchemaManifest } from '../with-shape/manifest/types.js'\n\nexport interface OpenPodOptions {\n  /** The ciphertext store to restore into (and where the opened `Vault` lives). */\n  readonly store: NoydbStore\n  /**\n   * The target vault name. The pod header deliberately carries no vault\n   * name (minimum-disclosure — `NoydbPodHeader`'s forbidden-fields list),\n   * so the caller names the vault to restore into/open.\n   */\n  readonly vault: string\n  /** User identifier — passed through to `createNoydb`. */\n  readonly user: string\n  /** That user's secret — passed through to `createNoydb` / `loadKeyring`. */\n  readonly secret: string | EchoSecretParts\n  /**\n   * Trusted signing keys (`keyId → publicKeyB64`). When supplied,\n   * `verifyPodHeader` runs and its result is returned as `verification`.\n   * Omitted → no verification attempted, `verification` is absent.\n   */\n  readonly trustedKeys?: Readonly<Record<string, string>>\n  /**\n   * Passthrough to `createNoydb` for every option beyond `store`/`user`/\n   * `secret` (history/indexing/blobs/… strategies, `secretMode`, etc.).\n   */\n  readonly noydbOptions?: Omit<NoydbOptions, 'store' | 'user' | 'secret'>\n  /**\n   * Dev override for the generation-ahead fence (AC #4). Default `false`:\n   * a pod whose schema manifest generation is ahead of this store's\n   * pre-restore fence generation throws `MigrationRequiredError`. `true`\n   * opens anyway, logging a console warning.\n   */\n  readonly allowGenerationAhead?: boolean\n}\n\nexport interface OpenPodResult {\n  readonly db: Noydb\n  readonly vault: Vault\n  readonly header: NoydbPodHeader\n  /** Present iff `opts.trustedKeys` was supplied. */\n  readonly verification?: PodVerifyResult\n  /** The pod's schema manifest, re-derived from the just-restored `_schemas/*`. */\n  readonly manifest?: SchemaManifest\n}\n\n/**\n * Open a `.noydb` pod: verify its integrity (and, opt-in, its signature),\n * unlock + restore it into `opts.vault`, and re-derive its schema manifest.\n * See the module doc for the full flow and the errors each step can throw.\n */\nexport async function open(podFileOrBytes: Uint8Array, opts: OpenPodOptions): Promise<OpenPodResult> {\n  const { header, dumpJson } = await readPod(podFileOrBytes)\n\n  let verification: PodVerifyResult | undefined\n  if (opts.trustedKeys !== undefined) {\n    verification = await verifyPodHeader(podFileOrBytes, opts.trustedKeys)\n    if (verification.status === 'untrusted' || verification.status === 'tampered') {\n      throw new PodHeaderVerificationError(verification.status, verification.keyId)\n    }\n  }\n\n  // Reader's pre-restore generation snapshot (see module doc, step 5) —\n  // must be read from the raw store BEFORE vault.load() overwrites it.\n  const readerGeneration = (await loadFence(opts.store, opts.vault)).currentSchemaVersion\n\n  const db = await createNoydb({ ...opts.noydbOptions, store: opts.store, user: opts.user, secret: opts.secret })\n  const vault = await db.openVault(opts.vault)\n  await vault.load(dumpJson)\n\n  // #941 review fix: a NON-MINTING lookup, not `ensureCollectionDEK` (which\n  // mints+persists a fresh DEK for any collection absent from the keyring).\n  // open() is a READ path — deriveSchemaManifest only ever iterates\n  // collections that already have a `_schemas` envelope, so an absent DEK\n  // here means \"this principal cannot decrypt this sibling,\" never \"new\n  // collection.\" The old minting call polluted a scoped principal's just-\n  // restored `_keyring/<user>` file with garbage sibling DEKs on every\n  // open(). See `derive.ts`'s `LookupDEK` doc for the full rationale.\n  const keyring = await loadKeyring(opts.store, opts.vault, { userId: opts.user, secret: opts.secret })\n  const lookupDEK: LookupDEK = async (name) => keyring.deks.get(name)\n  const { manifest, undecodableCollections } = await deriveSchemaManifest(opts.store, opts.vault, lookupDEK)\n\n  // A scoped principal's `manifest` is legitimately their own visible\n  // slice (see `sync.ts`'s module doc) — `open()` is a per-principal read,\n  // not an assertion of pod-wide completeness. `undecodableCollections` is\n  // intentionally not surfaced on `OpenPodResult` (out of this fix's\n  // scope); callers that need it can call `deriveSchemaManifest` directly.\n  void undecodableCollections\n\n  // See module doc, step 5 — the pod's generation signal is the highest\n  // per-collection stamp, not the (locally re-derived, fence-driven)\n  // top-level `manifest.generation`.\n  const podGeneration = Object.values(manifest.collections)\n    .reduce((max, entry) => Math.max(max, entry.generation), 0)\n\n  if (podGeneration > readerGeneration) {\n    if (!opts.allowGenerationAhead) {\n      throw new MigrationRequiredError(\n        `open(): pod's schema generation (${podGeneration}) is ahead of vault ` +\n          `\"${opts.vault}\"'s local generation (${readerGeneration}). Pass ` +\n          `\\`allowGenerationAhead: true\\` to open anyway, or reconcile the schema first.`,\n      )\n    }\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\" opened with allowGenerationAhead — pod schema ` +\n        `generation ${podGeneration} is ahead of the local generation ${readerGeneration}.`,\n    )\n  } else if (podGeneration < readerGeneration) {\n    // #941 review (Important 3, AC #4): divergence in EITHER direction\n    // should be observable, not just the ahead-bypass case above. The\n    // reader being ahead of the pod is non-fatal (the pod is simply older\n    // content) but silent coexistence divergence is exactly what AC #4\n    // asks to surface — same `[noy-db]`-prefixed console.warn facility as\n    // `sync.ts`'s cap-exhaustion warning.\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\"'s local schema generation (${readerGeneration}) is ` +\n        `ahead of the pod's (${podGeneration}) — the pod reflects an earlier schema than this reader.`,\n    )\n  }\n\n  return { db, vault, header, manifest, ...(verification !== undefined ? { verification } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAM,uBAAuB;AA4C7B,IAAM,uBAAuB;AAwBtB,SAAS,aACd,QACA,SACsB;AACtB,QAAM,YAAY,SAAS,cAAc;AAGzC,QAAM,YAAY,oBAAI,IAA2B;AACjD,QAAM,WAAW,oBAAI,IAA2B;AAChD,QAAM,SAAS,oBAAI,IAAY;AAG/B,MAAI,aAAa;AAMjB,QAAM,UAAU,oBAAI,IAAoC;AAExD,iBAAe,KAAK,OAAuC;AACzD,QAAI,OAAO,IAAI,KAAK,EAAG,QAAO,UAAU,IAAI,KAAK;AAEjD,UAAM,WAAW,QAAQ,IAAI,KAAK;AAClC,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AAC3B,YAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,UAAI,QAAQ;AACV,cAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,kBAAU,IAAI,OAAO,OAAO,IAAI;AAChC,iBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,MACpC,OAAO;AACL,kBAAU,IAAI,OAAO,CAAC,CAAC;AACvB,iBAAS,IAAI,OAAO,IAAI;AAAA,MAC1B;AAEA,aAAO,IAAI,KAAK;AAChB,aAAO,UAAU,IAAI,KAAK;AAAA,IAC5B,GAAG;AAEH,YAAQ,IAAI,OAAO,OAAO;AAC1B,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AAGA,cAAQ,OAAO,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,MAAM,OAA8B;AASjD,aAAS,UAAU,GAAG,UAAU,sBAAsB,WAAW;AAC/D,YAAM,WAAW,UAAU,IAAI,KAAK,KAAK,CAAC;AAC1C,YAAM,SAA0B;AAAA,QAC9B,qBAAqB;AAAA,QACrB;AAAA,QACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AAC7D,YAAM,kBAAkB,SAAS,IAAI,KAAK,KAAK;AAE/C,UAAI;AACF,cAAM,EAAE,SAAS,WAAW,IAAI,MAAM,OAAO,YAAY,OAAO,OAAO,eAAe;AACtF,iBAAS,IAAI,OAAO,UAAU;AAC9B;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,2BAA2B,UAAU,uBAAuB,GAAG;AAEhF,gBAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,cAAI,QAAQ;AACV,kBAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AACxD,kBAAM,eAAe,KAAK,MAAM,UAAU;AAC1C,kBAAM,YAAY,UAAU,IAAI,KAAK,KAAK,CAAC;AAC3C,kBAAM,aAAa,eAAe,aAAa,MAAM,SAAS;AAC9D,sBAAU,IAAI,OAAO,UAAU;AAC/B,qBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,UACpC;AAGA;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAQA,QAAM,aAAa,oBAAI,IAA2B;AAElD,WAAS,YAAY,OAA8B;AACjD,UAAM,OAAO,WAAW,IAAI,KAAK,KAAK,QAAQ,QAAQ;AAGtD,UAAM,OAAO,KAAK,KAAK,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,KAAK,CAAC;AAC7D,eAAW,IAAI,OAAO,IAAI;AAC1B,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,OAA8B;AACtD,QAAI,aAAa,eAAe,GAAG;AACjC,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,QAA8B;AAAA,IAClC,MAAM,OAAO,QAAQ;AAAA,IAErB,MAAM,MAAM,SAAgC;AAC1C,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,MAAM,SAAiB,IAAwC;AACnE,YAAM,KAAK,OAAO;AAClB;AACA,UAAI;AACF,cAAM,GAAG;AAAA,MACX,UAAE;AACA;AAAA,MACF;AACA,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,IAAI,OAAe,YAAoB,IAA+C;AAC1F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,KAAK,UAAU,IAAI,EAAE,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,IACJ,OACA,YACA,IACA,UACA,iBACe;AACf,YAAM,OAAO,MAAM,KAAK,KAAK;AAE7B,UAAI,oBAAoB,QAAW;AACjC,cAAM,UAAU,KAAK,UAAU,IAAI,EAAE;AACrC,cAAM,iBAAiB,SAAS,MAAM;AACtC,YAAI,mBAAmB,iBAAiB;AACtC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,oBAAoB,eAAe,cAAc,cAAc,OAAO,UAAU,IAAI,EAAE;AAAA,UACxF;AAAA,QACF;AAAA,MACF;AAEA,WAAK,UAAU,MAAM,CAAC;AACtB,WAAK,UAAU,EAAE,EAAE,IAAI;AACvB,YAAM,WAAW,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,OAAO,OAAe,YAAoB,IAA2B;AACzE,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,KAAK,UAAU,GAAG;AACpB,eAAO,KAAK,UAAU,EAAE,EAAE;AAC1B,cAAM,WAAW,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,OAAe,YAAuC;AAC/D,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,QAAQ,OAAuC;AACnD,YAAM,OAAO,MAAM,KAAK,KAAK;AAS7B,YAAM,MAAqB,CAAC;AAC5B,iBAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AACxD,YAAI,WAAW,WAAW,GAAG,EAAG;AAChC,YAAI,UAAU,IAAI,EAAE,GAAG,QAAQ;AAAA,MACjC;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAe,MAAoC;AAC/D,gBAAU,IAAI,OAAO,IAAI;AACzB,aAAO,IAAI,KAAK;AAChB,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,eAAe,QAAuB,OAAqC;AAClF,QAAM,SAAwB,CAAC;AAG/B,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,WAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAAA,EAC9B;AAGA,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,QAAI,CAAC,OAAO,IAAI,GAAG;AACjB,aAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAC5B;AAAA,IACF;AACA,eAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,YAAM,WAAW,OAAO,IAAI,EAAE,EAAE;AAChC,UAAI,CAAC,YAAY,SAAS,OAAO,SAAS,KAAK;AAC7C,eAAO,IAAI,EAAE,EAAE,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,eACd,SACsC;AACtC,SAAO;AACT;;;ACjRA,eAAsB,aACpB,QACA,QACmB;AACnB,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,EACnB;AACA,QAAM,MAAM,MAAM,WAAW,OAAO,oBAAoB,MAAM;AAC9D,SAAO,EAAE,GAAG,QAAQ,IAAI;AAC1B;AAQA,eAAsB,eACpB,QACA,aACkB;AAClB,QAAM,eAAe,YAAY,OAAO,QAAQ;AAChD,MAAI,iBAAiB,OAAW,QAAO;AACvC,QAAM,UAAU,EAAE,GAAG,OAAO,GAAG,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AACvG,SAAO,aAAa,cAAc,OAAO,KAAK,OAAO;AACvD;AAgCA,eAAsB,gBACpB,OACA,SACA,MACgC;AAChC,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,UAAU;AACd,QAAM,OAAsB,CAAC;AAC7B,QAAM,UAAU,oBAAI,IAAY;AAEhC,aAAS;AACP,UAAM,MAAM,gBAAgB,OAAO;AACnC,QAAI,QAAQ,OAAW,QAAO,EAAE,UAAU,SAAS,KAAK;AAExD,QAAI,CAAE,MAAM,eAAe,KAAK,KAAK,WAAW,GAAI;AAClD,YAAM,IAAI,0BAA0B,IAAI,MAAM;AAAA,IAChD;AACA,QAAI,QAAQ,IAAI,IAAI,MAAM,GAAG;AAC3B,YAAM,IAAI,kBAAkB,IAAI,MAAM;AAAA,IACxC;AACA,YAAQ,IAAI,IAAI,MAAM;AAEtB,SAAK,KAAK,EAAE,QAAQ,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS,CAAC;AAC5E,QAAI,KAAK,SAAS,UAAU;AAC1B,YAAM,IAAI,2BAA2B,QAAQ;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,IAAI,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,YAAM,IAAI,yBAAyB,IAAI,QAAQ,KAAK;AAAA,IACtD;AACA,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,yBAAyB,IAAI,MAAM;AAAA,IAC/C;AACA,cAAU;AAAA,EACZ;AACF;;;AClBA,eAAsB,KAAK,gBAA4B,MAA8C;AACnG,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,QAAQ,cAAc;AAEzD,MAAI;AACJ,MAAI,KAAK,gBAAgB,QAAW;AAClC,mBAAe,MAAM,gBAAgB,gBAAgB,KAAK,WAAW;AACrE,QAAI,aAAa,WAAW,eAAe,aAAa,WAAW,YAAY;AAC7E,YAAM,IAAI,2BAA2B,aAAa,QAAQ,aAAa,KAAK;AAAA,IAC9E;AAAA,EACF;AAIA,QAAM,oBAAoB,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK,GAAG;AAEnE,QAAM,KAAK,MAAM,YAAY,EAAE,GAAG,KAAK,cAAc,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AAC9G,QAAM,QAAQ,MAAM,GAAG,UAAU,KAAK,KAAK;AAC3C,QAAM,MAAM,KAAK,QAAQ;AAUzB,QAAM,UAAU,MAAM,YAAY,KAAK,OAAO,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AACpG,QAAM,YAAuB,OAAO,SAAS,QAAQ,KAAK,IAAI,IAAI;AAClE,QAAM,EAAE,UAAU,uBAAuB,IAAI,MAAM,qBAAqB,KAAK,OAAO,KAAK,OAAO,SAAS;AAOzG,OAAK;AAKL,QAAM,gBAAgB,OAAO,OAAO,SAAS,WAAW,EACrD,OAAO,CAAC,KAAK,UAAU,KAAK,IAAI,KAAK,MAAM,UAAU,GAAG,CAAC;AAE5D,MAAI,gBAAgB,kBAAkB;AACpC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR,oCAAoC,aAAa,wBAC3C,KAAK,KAAK,yBAAyB,gBAAgB;AAAA,MAE3D;AAAA,IACF;AACA,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,mEACrB,aAAa,qCAAqC,gBAAgB;AAAA,IACpF;AAAA,EACF,WAAW,gBAAgB,kBAAkB;AAO3C,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,gCAAgC,gBAAgB,4BAC5D,aAAa;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,OAAO,QAAQ,UAAU,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC,EAAG;AAChG;","names":[]}

package/dist/{chunk-UGTBXF5U.js → chunk-7XMHMVTS.js}

@@ -1,9 +1,9 @@
 import {
   dekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-FLPCETP6.js";
 import {
   TierNotGrantedError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/team/tiers.ts
 function assertTierAccess(keyring, collection, tier) {
@@ -17,4 +17,4 @@ function assertTierAccess(keyring, collection, tier) {
 export {
   assertTierAccess
 };
-//# sourceMappingURL=chunk-UGTBXF5U.js.map
+//# sourceMappingURL=chunk-7XMHMVTS.js.map

package/dist/{chunk-YJX7EOJD.js → chunk-A4XMIZT3.js}

@@ -201,7 +201,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-QZDHSGD4.js");
+      const { revealSealedField } = await import("./reveal-B2TLP4JQ.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -213,26 +213,26 @@ function withClassified() {
       return value;
     },
     async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-6MDTIUEV.js");
+      const { verifyDigestField } = await import("./verify-UKALW7C2.js");
       const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-6MDTIUEV.js");
+      const { verifyTextField } = await import("./verify-UKALW7C2.js");
       const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-6MDTIUEV.js");
+      const { matchGroupFields } = await import("./verify-UKALW7C2.js");
       const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
       const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
       await ctx.onAccess?.("verify", id);
       return result;
     },
     async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-NOGJ25VX.js");
+      const { computeBidxTarget } = await import("./find-JRN4RNQ5.js");
       const dek = await ctx.getDEK();
       return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
     }
@@ -244,4 +244,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-YJX7EOJD.js.map
+//# sourceMappingURL=chunk-A4XMIZT3.js.map

package/dist/{chunk-YJX7EOJD.js.map → chunk-A4XMIZT3.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/via/classified/validators.ts","../src/via/classified/presets.ts","../src/via/classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../kernel/enclave/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../kernel/enclave/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../kernel/enclave/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../kernel/enclave/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;AClJA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAyC;AACpF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAyC;AAClF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAAyC;AACnF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAAuC;AAClF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/via/classified/validators.ts","../src/via/classified/presets.ts","../src/via/classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../capsule/enclave-aes/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../capsule/enclave-aes/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;AClJA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAA8C;AACzF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAA8C;AACzF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAA8C;AACvF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAA8C;AACxF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAA4C;AACvF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-A66I4JOA.js → chunk-AEQGFRU4.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-XKWGNJ26.js";
+} from "./chunk-LIOVX5TJ.js";
 import {
   PolicyDeniedError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -213,7 +213,7 @@ var UserApi = class {
    * Honest caveat: this is a UX flag, not a privacy guarantee. The
    * envelope ciphertext at `_users/<keyringId>` and the keyring file at
    * `_keyring/<userId>` are both still observable to anyone with direct
-   * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
+   * store read access. See `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` →
    * "Directory visibility".
    */
   async setMyVisibility(visibility) {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-A66I4JOA.js.map
+//# sourceMappingURL=chunk-AEQGFRU4.js.map

package/dist/chunk-AEQGFRU4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/directory/user-envelope/api.ts"],"sourcesContent":["/**\n * Public `vault.user.*` API surface.\n *\n * Three families:\n *  - Write-self: `me` / `updateMe` / `setMe` — always target the writer's\n *    own keyringId. **Own-only write rule** is structural — no method\n *    exists to write someone else's envelope.\n *  - Read-anyone: `get` / `list` — read other principals' envelopes\n *    (subject to `view-team-profiles` policy gate).\n *  - Reactive: `subscribe` / `live` — in-process event emission on local\n *    writes. Cross-instance updates land via the team/sync engine and\n *    surface to subscribers when the sync diff replays through this API.\n *\n * @see design-history/2026-05-05-user-envelope-design.md\n *\n * @module\n */\nimport { PolicyDeniedError } from '../../../kernel/errors.js'\nimport {\n  loadUserEnvelope,\n  saveUserEnvelope,\n  listUserEnvelopeIds,\n} from './storage.js'\nimport type {\n  UserEnvelope,\n  DeepPartialOrNull,\n  Unsubscribe,\n  UserEnvelopePresented,\n  LiveUserEnvelope,\n  VaultUserApi,\n  UserApiDeps,\n  UserApiFactory,\n} from '../../../kernel/types.js'\nimport {\n  persistUserVisibility,\n  readUserVisibility,\n} from '../visibility.js'\nimport type { UserVisibility } from '../types.js'\nimport type { ExportAccessibleOptions } from '../../../with-audit/portability/export-accessible.js'\nimport type { WithdrawAccessibleOptions, WithdrawResult } from '../../../with-audit/portability/withdraw-accessible.js'\nimport type {\n  RequestWithdrawalOptions,\n  RequestWithdrawalResult,\n  WithdrawalRequest,\n  WithdrawalRequestStatus,\n  ApproveWithdrawalOptions,\n  RejectWithdrawalOptions,\n} from '../../../with-audit/portability/request-withdrawal.js'\n\ninterface ChangeListener<T = unknown> {\n  (env: UserEnvelope<T> | null): void\n}\n\n/**\n * Implementation behind `vault.user`. Constructed once per Vault via\n * {@link createUserApi}, holds the writer's keyringId in closure so\n * `updateMe`/`setMe` cannot target any other principal — the own-only\n * rule is enforced at the type level (no `set(otherKeyringId, …)`\n * method) AND at runtime (the keyringId argument simply doesn't exist\n * on the write path).\n */\nexport class UserApi implements VaultUserApi {\n  /** keyringId → set of listeners. Wildcard '*' fires on every change. */\n  private readonly listeners = new Map<string, Set<ChangeListener>>()\n\n  private readonly adapter: UserApiDeps['adapter']\n  private readonly vaultName: UserApiDeps['vaultName']\n  /** The writer's own keyringId. Frozen at construction time. */\n  private readonly writerKeyringId: UserApiDeps['writerKeyringId']\n  private readonly getDek: UserApiDeps['getDek']\n  /**\n   * Policy-gate validator. When omitted, gates are skipped — useful\n   * for low-level tests that exercise the storage layer directly.\n   * Production paths always wire the Noydb-backed implementation.\n   */\n  private readonly checkGate?: UserApiDeps['checkGate']\n  /**\n   * Noydb-backed `exportMyAccessibleData`, injected by the Vault\n   * (which holds the keyring + bundle machinery). Omitted in low-level tests.\n   */\n  private readonly exportAccessible?: UserApiDeps['exportAccessible']\n  /**\n   * Noydb-backed `unilateralWithdrawal`, injected by the Vault.\n   * Destructive — extract + dispose (delete | freeze). Omitted in low-level tests.\n   */\n  private readonly unilateralWithdraw?: UserApiDeps['unilateralWithdraw']\n  /**\n   * Noydb-backed two-party withdrawal ceremony, injected by the\n   * Vault. requestWithdraw = requester side; the rest = owner side.\n   */\n  private readonly requestWithdraw?: UserApiDeps['requestWithdraw']\n  private readonly listWithdrawals?: UserApiDeps['listWithdrawals']\n  private readonly approveWithdraw?: UserApiDeps['approveWithdraw']\n  private readonly rejectWithdraw?: UserApiDeps['rejectWithdraw']\n\n  constructor(deps: UserApiDeps) {\n    this.adapter = deps.adapter\n    this.vaultName = deps.vaultName\n    this.writerKeyringId = deps.writerKeyringId\n    this.getDek = deps.getDek\n    this.checkGate = deps.checkGate\n    this.exportAccessible = deps.exportAccessible\n    this.unilateralWithdraw = deps.unilateralWithdraw\n    this.requestWithdraw = deps.requestWithdraw\n    this.listWithdrawals = deps.listWithdrawals\n    this.approveWithdraw = deps.approveWithdraw\n    this.rejectWithdraw = deps.rejectWithdraw\n  }\n\n  /**\n   * File a two-party withdrawal request for the caller's accessible\n   * scope. Non-destructive (writes a pending request); an owner later approves\n   * or rejects. This is the path for read-only roles (`client`/`viewer`) that\n   * cannot self-serve a destructive `unilateralWithdrawal`. Gated by\n   * `user-request-withdrawal` (enabled by default).\n   */\n  async requestWithdrawal(opts: RequestWithdrawalOptions = {}): Promise<RequestWithdrawalResult> {\n    if (this.checkGate) await this.checkGate('user-request-withdrawal')\n    if (!this.requestWithdraw) {\n      throw new Error('requestWithdrawal requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.requestWithdraw(opts)\n  }\n\n  /** Owner side: list filed withdrawal requests (optionally by status). */\n  async listWithdrawalRequests(opts: { status?: WithdrawalRequestStatus } = {}): Promise<WithdrawalRequest[]> {\n    if (!this.listWithdrawals) {\n      throw new Error('listWithdrawalRequests requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.listWithdrawals(opts)\n  }\n\n  /**\n   * Owner side: approve a pending request. Extracts the requester's\n   * recorded scope under firm authority, disposes of the source per the\n   * request's disposition, and returns the re-keyed bundle to hand back. Gated\n   * by `approve-user-withdrawal` (tier-2 default) + owner/admin role.\n   */\n  async approveWithdrawal(requestId: string, opts: ApproveWithdrawalOptions = {}): Promise<WithdrawResult> {\n    if (this.checkGate) await this.checkGate('approve-user-withdrawal')\n    if (!this.approveWithdraw) {\n      throw new Error('approveWithdrawal requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.approveWithdraw(requestId, opts)\n  }\n\n  /** Owner side: reject a pending request (no data is touched). */\n  async rejectWithdrawal(requestId: string, opts: RejectWithdrawalOptions = {}): Promise<WithdrawalRequest> {\n    if (this.checkGate) await this.checkGate('approve-user-withdrawal')\n    if (!this.rejectWithdraw) {\n      throw new Error('rejectWithdrawal requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.rejectWithdraw(requestId, opts)\n  }\n\n  /**\n   * Single-party withdrawal: export the caller's accessible scope\n   * (re-keyed) and dispose of the source (`delete` or `freeze`). Gated by the\n   * fail-closed built-in `client-unilateral-withdraw` policy — undefined or\n   * disabled → throws (use `requestWithdrawal`). The firm enables it at vault\n   * creation.\n   */\n  async unilateralWithdrawal(opts: WithdrawAccessibleOptions): Promise<WithdrawResult> {\n    if (this.checkGate) await this.checkGate('client-unilateral-withdraw')\n    if (!this.unilateralWithdraw) {\n      throw new Error('unilateralWithdrawal requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.unilateralWithdraw(opts)\n  }\n\n  /**\n   * Export the calling user's accessible scope as a portable, re-keyed\n   * `.noydb` bundle. Non-destructive and **always allowed** (data sovereignty\n   * by construction) but audited. Scope = the caller's DEK access set.\n   */\n  async exportMyAccessibleData(opts: ExportAccessibleOptions = {}): Promise<Uint8Array> {\n    if (!this.exportAccessible) {\n      throw new Error('exportMyAccessibleData requires a Noydb-backed vault (not a bare UserApi)')\n    }\n    return this.exportAccessible(opts)\n  }\n\n  // ─── Write-self ──────────────────────────────────────────────────────\n\n  /** Read the writer's own envelope. Returns null if never written. */\n  async me<T = unknown>(): Promise<UserEnvelope<T> | null> {\n    const dek = await this.getDek()\n    return loadUserEnvelope<T>(this.adapter, this.vaultName, this.writerKeyringId, dek)\n  }\n\n  /**\n   * Deep-merge a partial patch into the writer's own envelope. Creates\n   * the envelope on first call. Optimistic-concurrency safe — a stale\n   * `_v` (parallel writer on another device) throws `ConflictError`.\n   *\n   * Patch semantics:\n   *   - `undefined` (or omitted key) — skip; existing value preserved\n   *   - `null` — delete the field from the merged result\n   *   - any other value — overwrite (deep-merge for plain objects,\n   *     replace for primitives / arrays)\n   *\n   * To clear a field, pass `null` rather than `undefined`. Callers\n   * with shape `T = string | null` where `null` is a meaningful value\n   * should use `setMe` for that specific field instead — `null` here\n   * always means delete.\n   *\n   * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).\n   * Pass `presented` to satisfy tightened policies that require a\n   * factor proof (e.g. STRICT_POLICY's TOTP requirement).\n   */\n  async updateMe<T extends object = Record<string, unknown>>(\n    patch: DeepPartialOrNull<T>,\n    presented?: UserEnvelopePresented,\n  ): Promise<UserEnvelope<T>> {\n    if (this.checkGate) await this.checkGate('edit-own-profile', presented)\n    const dek = await this.getDek()\n    const current = await loadUserEnvelope<T>(\n      this.adapter,\n      this.vaultName,\n      this.writerKeyringId,\n      dek,\n    )\n    const merged: T = current ? deepMerge(current.data, patch) : (patch as unknown as T)\n    const written = await saveUserEnvelope<T>(\n      this.adapter,\n      this.vaultName,\n      this.writerKeyringId,\n      merged,\n      dek,\n      current?._v ?? 0,\n    )\n    this.fireChange(this.writerKeyringId, written)\n    return written\n  }\n\n  /**\n   * Replace the writer's own envelope with `payload`. Use sparingly —\n   * `updateMe` is the canonical mutation. No `expectedVersion` check;\n   * callers explicitly take last-write-wins semantics.\n   *\n   * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.\n   */\n  async setMe<T = unknown>(\n    payload: T,\n    presented?: UserEnvelopePresented,\n  ): Promise<UserEnvelope<T>> {\n    if (this.checkGate) await this.checkGate('edit-own-profile', presented)\n    const dek = await this.getDek()\n    const written = await saveUserEnvelope<T>(\n      this.adapter,\n      this.vaultName,\n      this.writerKeyringId,\n      payload,\n      dek,\n    )\n    this.fireChange(this.writerKeyringId, written)\n    return written\n  }\n\n  // ─── Visibility ──────────────────────────────────────────────────────\n\n  /**\n   * Read the current user's visibility flag from\n   * `_meta/visibility/<keyringId>`. Returns `{ hidden: false }` when no\n   * document has been persisted (the default-visible case).\n   */\n  async getMyVisibility(): Promise<UserVisibility> {\n    const persisted = await readUserVisibility(this.adapter, this.vaultName, this.writerKeyringId)\n    return persisted ?? { hidden: false }\n  }\n\n  /**\n   * Update the current user's visibility in the team directory.\n   *\n   * - `hidden: true` — opt out of the default `listUsersWithEnvelopes`\n   *   listing. `owner`/`admin` callers can still see the user by passing\n   *   `{ includeHidden: true }`.\n   * - `hidden: false` — opt back in.\n   *\n   * Own-only by construction: the keyringId argument doesn't exist on\n   * this method, so no caller can hide or unhide another principal.\n   *\n   * Honest caveat: this is a UX flag, not a privacy guarantee. The\n   * envelope ciphertext at `_users/<keyringId>` and the keyring file at\n   * `_keyring/<userId>` are both still observable to anyone with direct\n   * store read access. See `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` →\n   * \"Directory visibility\".\n   */\n  async setMyVisibility(visibility: UserVisibility): Promise<void> {\n    await persistUserVisibility(\n      this.adapter,\n      this.vaultName,\n      this.writerKeyringId,\n      { hidden: visibility.hidden },\n    )\n  }\n\n  // ─── Read-anyone ─────────────────────────────────────────────────────\n\n  /**\n   * Read another principal's envelope by their keyringId. Returns null\n   * if the principal exists but has no envelope yet, or if the\n   * keyringId does not exist at all.\n   *\n   * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for\n   * cross-principal reads. Reading your own envelope (`keyringId ===\n   * self`) is never gated; that's just `me()` written long-form.\n   */\n  async get<T = unknown>(\n    keyringId: string,\n    presented?: UserEnvelopePresented,\n  ): Promise<UserEnvelope<T> | null> {\n    if (this.checkGate && keyringId !== this.writerKeyringId) {\n      await this.checkGate('view-team-profiles', presented)\n    }\n    const dek = await this.getDek()\n    return loadUserEnvelope<T>(this.adapter, this.vaultName, keyringId, dek)\n  }\n\n  /**\n   * Read every persisted envelope in the vault. Order is store-defined.\n   *\n   * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets\n   * any authenticated session read all envelopes. Two privacy-strict\n   * opt-outs:\n   *\n   *  - `view-team-profiles.enabled: false` → list() returns only the\n   *    caller's own envelope (silent self-fallback, no thrown error).\n   *  - `view-team-profiles.minTier: 1` + insufficient tier → throws\n   *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The\n   *    caller is expected to elevate, not silently degrade.\n   *\n   * The asymmetry is deliberate: `enabled: false` is a deliberate\n   * design choice (\"nobody sees teammate profiles in this app\");\n   * `insufficient-tier` is \"you need to authenticate further\". Different\n   * UX prompts for different intents.\n   */\n  async list<T = unknown>(presented?: UserEnvelopePresented): Promise<UserEnvelope<T>[]> {\n    if (this.checkGate) {\n      try {\n        await this.checkGate('view-team-profiles', presented)\n      } catch (err) {\n        if (err instanceof PolicyDeniedError && err.reason === 'disabled') {\n          // Privacy-strict opt-out: quietly return only self.\n          const me = await this.me<T>()\n          return me ? [me] : []\n        }\n        throw err\n      }\n    }\n    const dek = await this.getDek()\n    const ids = await listUserEnvelopeIds(this.adapter, this.vaultName)\n    const envelopes = await Promise.all(\n      ids.map((id) => loadUserEnvelope<T>(this.adapter, this.vaultName, id, dek)),\n    )\n    return envelopes.filter((e): e is UserEnvelope<T> => e !== null)\n  }\n\n  // ─── Reactive ────────────────────────────────────────────────────────\n\n  /**\n   * Listen for changes to a specific keyringId's envelope. The callback\n   * fires synchronously after every successful local `updateMe` /\n   * `setMe` for that principal.\n   *\n   * Cross-instance changes (a teammate edits their profile on their\n   * device, the sync engine pulls the diff onto this device) will fire\n   * subscribers when the sync layer replays the write through this API.\n   * In v1, subscribers do NOT fire on raw store changes — wire your sync\n   * layer to call back through `vault.user.setMe` / `updateMe` if you\n   * need that.\n   *\n   * Pass keyringId `'*'` to fire on every change in the vault.\n   */\n  subscribe<T = unknown>(\n    keyringId: string,\n    cb: (env: UserEnvelope<T> | null) => void,\n  ): Unsubscribe {\n    let listeners = this.listeners.get(keyringId)\n    if (!listeners) {\n      listeners = new Set()\n      this.listeners.set(keyringId, listeners)\n    }\n    const wrapped: ChangeListener = cb as ChangeListener\n    listeners.add(wrapped)\n    return () => {\n      listeners?.delete(wrapped)\n      if (listeners && listeners.size === 0) {\n        this.listeners.delete(keyringId)\n      }\n    }\n  }\n\n  /**\n   * Reactive handle that caches the current value and re-reads on every\n   * change for the given keyringId. Convenient for framework bindings:\n   *\n   *   const live = vault.user.live<UserShape>(vault.userId)\n   *   live.subscribe(env => render(env?.data))\n   *\n   * Initial value is `null` until the first `current()` call materializes\n   * it via `vault.user.get()`. Call `stop()` when done to release the\n   * subscription.\n   */\n  live<T = unknown>(keyringId: string): LiveUserEnvelope<T> {\n    let value: UserEnvelope<T> | null = null\n    let primed = false\n    const unsubscribe = this.subscribe<T>(keyringId, (env) => {\n      value = env\n    })\n\n    return {\n      current(): UserEnvelope<T> | null {\n        if (!primed) {\n          primed = true\n          // First call: kick off a read but return synchronously. The\n          // subscriber will be re-fired by the next write or the caller\n          // can await `vault.user.get()` directly for an immediate read.\n        }\n        return value\n      },\n      subscribe: (cb) => this.subscribe<T>(keyringId, cb),\n      stop: unsubscribe,\n    }\n  }\n\n  // ─── Internal: change emission ───────────────────────────────────────\n\n  private fireChange<T>(keyringId: string, env: UserEnvelope<T> | null): void {\n    const targeted = this.listeners.get(keyringId)\n    if (targeted) for (const l of targeted) l(env)\n    const wildcard = this.listeners.get('*')\n    if (wildcard) for (const l of wildcard) l(env)\n  }\n}\n\n/**\n * Build the `vault.user` API implementation from its dependencies. This is\n * the real {@link UserApiFactory} — `createNoydb()` dynamically imports it\n * and stashes it on the `Noydb` instance so `Vault`'s constructor can call\n * it synchronously.\n */\nexport const createUserApi: UserApiFactory = (deps: UserApiDeps): VaultUserApi => new UserApi(deps)\n\n/**\n * Recursive plain-object deep merge with delete intent.\n *\n * Patch semantics:\n *   - `undefined` — skip the key; source value preserved\n *   - `null` — delete the key from output (lodash `_.merge` /\n *     Firestore `FieldValue.delete()` semantics)\n *   - plain object — recurse (deep merge)\n *   - any other value — replace (arrays are replaced, not concatenated)\n *\n * Safe against the JS quirk where an own property explicitly set to\n * `undefined` is iterated by `Object.entries`. We dispatch on the value\n * BEFORE writing, so `{ k: undefined }` triggers the skip branch rather\n * than overwriting `out[k]` with undefined.\n */\nfunction deepMerge<T>(source: T, patch: DeepPartialOrNull<T>): T {\n  if (!isPlainObject(source) || !isPlainObject(patch)) {\n    // Top-level non-object replace. `null` patch at the leaf level\n    // would have been caught by the parent recursion's branch table;\n    // at the top level it means \"set the whole envelope to null,\"\n    // which the type system already prevents (T extends object).\n    return patch as unknown as T\n  }\n  const out: Record<string, unknown> = { ...(source as Record<string, unknown>) }\n  for (const [key, patchVal] of Object.entries(patch as Record<string, unknown>)) {\n    if (patchVal === undefined) {\n      // Skip — preserve the source value at this key. Matches the\n      // pre-existing behavior so callers who never used `null` see no diff.\n      continue\n    }\n    if (patchVal === null) {\n      // Delete intent. `delete` rather than `out[key] = undefined`\n      // because JSON.stringify drops undefined fields silently and\n      // we want the deletion to be visible to consumers iterating\n      // the merged object (e.g. `Object.keys(merged.profile)`).\n      delete out[key]\n      continue\n    }\n    const sourceVal = (source as Record<string, unknown>)[key]\n    if (isPlainObject(patchVal)) {\n      // Recurse for any plain-object patch — including the \"source is\n      // missing this key\" case. Without recursing through a synthetic\n      // empty source, nested `null` deletions in the patch would land\n      // as literal `null` values instead of triggering the delete\n      // branch (e.g. `{ app: { signature: null } }` against a missing\n      // `app` would emit `{ app: { signature: null } }` instead of\n      // `{ app: {} }`).\n      const recurseSource = isPlainObject(sourceVal) ? sourceVal : {}\n      out[key] = deepMerge(recurseSource, patchVal as DeepPartialOrNull<typeof recurseSource>)\n    } else {\n      out[key] = patchVal\n    }\n  }\n  return out as T\n}\n\nfunction isPlainObject(x: unknown): x is Record<string, unknown> {\n  if (x === null || typeof x !== 'object') return false\n  if (Array.isArray(x)) return false\n  const proto = Object.getPrototypeOf(x) as object | null\n  return proto === Object.prototype || proto === null\n}\n"],"mappings":";;;;;;;;;;;;AA6DO,IAAM,UAAN,MAAsC;AAAA;AAAA,EAE1B,YAAY,oBAAI,IAAiC;AAAA,EAEjD;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAmB;AAC7B,SAAK,UAAU,KAAK;AACpB,SAAK,YAAY,KAAK;AACtB,SAAK,kBAAkB,KAAK;AAC5B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,mBAAmB,KAAK;AAC7B,SAAK,qBAAqB,KAAK;AAC/B,SAAK,kBAAkB,KAAK;AAC5B,SAAK,kBAAkB,KAAK;AAC5B,SAAK,kBAAkB,KAAK;AAC5B,SAAK,iBAAiB,KAAK;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAAkB,OAAiC,CAAC,GAAqC;AAC7F,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,yBAAyB;AAClE,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,WAAO,KAAK,gBAAgB,IAAI;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,uBAAuB,OAA6C,CAAC,GAAiC;AAC1G,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI,MAAM,2EAA2E;AAAA,IAC7F;AACA,WAAO,KAAK,gBAAgB,IAAI;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,WAAmB,OAAiC,CAAC,GAA4B;AACvG,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,yBAAyB;AAClE,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,WAAO,KAAK,gBAAgB,WAAW,IAAI;AAAA,EAC7C;AAAA;AAAA,EAGA,MAAM,iBAAiB,WAAmB,OAAgC,CAAC,GAA+B;AACxG,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,yBAAyB;AAClE,QAAI,CAAC,KAAK,gBAAgB;AACxB,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,WAAO,KAAK,eAAe,WAAW,IAAI;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,qBAAqB,MAA0D;AACnF,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,4BAA4B;AACrE,QAAI,CAAC,KAAK,oBAAoB;AAC5B,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,WAAO,KAAK,mBAAmB,IAAI;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,uBAAuB,OAAgC,CAAC,GAAwB;AACpF,QAAI,CAAC,KAAK,kBAAkB;AAC1B,YAAM,IAAI,MAAM,2EAA2E;AAAA,IAC7F;AACA,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA,EAKA,MAAM,KAAmD;AACvD,UAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,WAAO,iBAAoB,KAAK,SAAS,KAAK,WAAW,KAAK,iBAAiB,GAAG;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAM,SACJ,OACA,WAC0B;AAC1B,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,oBAAoB,SAAS;AACtE,UAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,UAAM,SAAY,UAAU,UAAU,QAAQ,MAAM,KAAK,IAAK;AAC9D,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,SAAS,MAAM;AAAA,IACjB;AACA,SAAK,WAAW,KAAK,iBAAiB,OAAO;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MACJ,SACA,WAC0B;AAC1B,QAAI,KAAK,UAAW,OAAM,KAAK,UAAU,oBAAoB,SAAS;AACtE,UAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AACA,SAAK,WAAW,KAAK,iBAAiB,OAAO;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAA2C;AAC/C,UAAM,YAAY,MAAM,mBAAmB,KAAK,SAAS,KAAK,WAAW,KAAK,eAAe;AAC7F,WAAO,aAAa,EAAE,QAAQ,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,gBAAgB,YAA2C;AAC/D,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,EAAE,QAAQ,WAAW,OAAO;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,IACJ,WACA,WACiC;AACjC,QAAI,KAAK,aAAa,cAAc,KAAK,iBAAiB;AACxD,YAAM,KAAK,UAAU,sBAAsB,SAAS;AAAA,IACtD;AACA,UAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,WAAO,iBAAoB,KAAK,SAAS,KAAK,WAAW,WAAW,GAAG;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,KAAkB,WAA+D;AACrF,QAAI,KAAK,WAAW;AAClB,UAAI;AACF,cAAM,KAAK,UAAU,sBAAsB,SAAS;AAAA,MACtD,SAAS,KAAK;AACZ,YAAI,eAAe,qBAAqB,IAAI,WAAW,YAAY;AAEjE,gBAAM,KAAK,MAAM,KAAK,GAAM;AAC5B,iBAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,QACtB;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,UAAM,MAAM,MAAM,oBAAoB,KAAK,SAAS,KAAK,SAAS;AAClE,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,IAAI,IAAI,CAAC,OAAO,iBAAoB,KAAK,SAAS,KAAK,WAAW,IAAI,GAAG,CAAC;AAAA,IAC5E;AACA,WAAO,UAAU,OAAO,CAAC,MAA4B,MAAM,IAAI;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,UACE,WACA,IACa;AACb,QAAI,YAAY,KAAK,UAAU,IAAI,SAAS;AAC5C,QAAI,CAAC,WAAW;AACd,kBAAY,oBAAI,IAAI;AACpB,WAAK,UAAU,IAAI,WAAW,SAAS;AAAA,IACzC;AACA,UAAM,UAA0B;AAChC,cAAU,IAAI,OAAO;AACrB,WAAO,MAAM;AACX,iBAAW,OAAO,OAAO;AACzB,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,aAAK,UAAU,OAAO,SAAS;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,KAAkB,WAAwC;AACxD,QAAI,QAAgC;AACpC,QAAI,SAAS;AACb,UAAM,cAAc,KAAK,UAAa,WAAW,CAAC,QAAQ;AACxD,cAAQ;AAAA,IACV,CAAC;AAED,WAAO;AAAA,MACL,UAAkC;AAChC,YAAI,CAAC,QAAQ;AACX,mBAAS;AAAA,QAIX;AACA,eAAO;AAAA,MACT;AAAA,MACA,WAAW,CAAC,OAAO,KAAK,UAAa,WAAW,EAAE;AAAA,MAClD,MAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAIQ,WAAc,WAAmB,KAAmC;AAC1E,UAAM,WAAW,KAAK,UAAU,IAAI,SAAS;AAC7C,QAAI,SAAU,YAAW,KAAK,SAAU,GAAE,GAAG;AAC7C,UAAM,WAAW,KAAK,UAAU,IAAI,GAAG;AACvC,QAAI,SAAU,YAAW,KAAK,SAAU,GAAE,GAAG;AAAA,EAC/C;AACF;AAQO,IAAM,gBAAgC,CAAC,SAAoC,IAAI,QAAQ,IAAI;AAiBlG,SAAS,UAAa,QAAW,OAAgC;AAC/D,MAAI,CAAC,cAAc,MAAM,KAAK,CAAC,cAAc,KAAK,GAAG;AAKnD,WAAO;AAAA,EACT;AACA,QAAM,MAA+B,EAAE,GAAI,OAAmC;AAC9E,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC9E,QAAI,aAAa,QAAW;AAG1B;AAAA,IACF;AACA,QAAI,aAAa,MAAM;AAKrB,aAAO,IAAI,GAAG;AACd;AAAA,IACF;AACA,UAAM,YAAa,OAAmC,GAAG;AACzD,QAAI,cAAc,QAAQ,GAAG;AAQ3B,YAAM,gBAAgB,cAAc,SAAS,IAAI,YAAY,CAAC;AAC9D,UAAI,GAAG,IAAI,UAAU,eAAe,QAAmD;AAAA,IACzF,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAA0C;AAC/D,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC7B,QAAM,QAAQ,OAAO,eAAe,CAAC;AACrC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;","names":[]}