@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-QMWY2FDS.js

@@ -0,0 +1,157 @@
+import {
+  ValidationError
+} from "./chunk-37EPTBBR.js";
+
+// src/capsule/plumbing/normalize.ts
+function normalizeForVerify(mode, value) {
+  const nfc = value.normalize("NFC");
+  if (mode === "password") return nfc;
+  return nfc.toLowerCase().normalize("NFC").trim().replace(/\s+/g, " ");
+}
+
+// src/capsule/plumbing/digest.ts
+var subtle = globalThis.crypto.subtle;
+var KEY_BITS = 256;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var RECOVERY_SECRET_BYTES = 32;
+var PRESENCE_TAG_KEY_DOMAIN = "noydb.presence.tag.v1";
+var ECHO_KDF_CONTEXT = new Uint8Array([255, ...new TextEncoder().encode("noydb-echo-secret-v1")]);
+function encodeEchoParts(parts) {
+  for (const name of ["prompt", "echo", "key"]) {
+    if (typeof parts?.[name] !== "string") {
+      throw new ValidationError("echo secret parts must be three strings: prompt, echo, key");
+    }
+  }
+  const enc = new TextEncoder();
+  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p));
+  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0);
+  const out = new Uint8Array(total);
+  out.set(ECHO_KDF_CONTEXT, 0);
+  let offset = ECHO_KDF_CONTEXT.length;
+  for (const s of segments) {
+    new DataView(out.buffer).setUint32(offset, s.length, false);
+    out.set(s, offset + 4);
+    offset += 4 + s.length;
+  }
+  return out;
+}
+async function sha256Hex(data) {
+  const hash = await subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Bytes(data) {
+  return new Uint8Array(await subtle.digest("SHA-256", data));
+}
+async function deriveBlobAddressKey(root, tier) {
+  const rawRoot = await subtle.exportKey("raw", root);
+  const hkdfKey = await subtle.importKey("raw", rawRoot, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-blob-address");
+  const info = new TextEncoder().encode(`tier:${tier}`);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
+  return subtle.importKey("raw", bits, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+}
+async function hmacSha256Hex(key, data) {
+  const rawKey = await subtle.exportKey("raw", key);
+  const hmacKey = await subtle.importKey(
+    "raw",
+    rawKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", hmacKey, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function derivePresenceKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey(
+    "raw",
+    rawDek,
+    "HKDF",
+    false,
+    ["deriveBits"]
+  );
+  const salt = new TextEncoder().encode("noydb-presence");
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function derivePresenceTagKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN);
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function hmacSignHex(key, data) {
+  const sig = await subtle.sign("HMAC", key, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hkdfAesGcmKey(ikm, salt, info) {
+  const key = await subtle.importKey("raw", ikm, "HKDF", false, ["deriveKey"]);
+  return subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    key,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function generateIV() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+}
+function generateSalt() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+}
+function generateRecoverySecret() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES));
+}
+function bufferToBase64(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64ToBuffer(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+export {
+  normalizeForVerify,
+  KEY_BITS,
+  IV_BYTES,
+  encodeEchoParts,
+  sha256Hex,
+  sha256Bytes,
+  deriveBlobAddressKey,
+  hmacSha256Hex,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  hmacSignHex,
+  hkdfAesGcmKey,
+  generateIV,
+  generateSalt,
+  generateRecoverySecret,
+  bufferToBase64,
+  base64ToBuffer
+};
+//# sourceMappingURL=chunk-QMWY2FDS.js.map

package/dist/chunk-QMWY2FDS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/plumbing/normalize.ts","../src/capsule/plumbing/digest.ts"],"sourcesContent":["/**\n * Preset normalization for verify candidates AND stored comparands (§4).\n * Both sides of every comparison route through the SAME function so\n * write-time digests and verify-time candidates agree. @module\n */\nexport type VerifyNormalizeMode = 'password' | 'secret-answer'\n\nexport function normalizeForVerify(mode: VerifyNormalizeMode, value: string): string {\n  const nfc = value.normalize('NFC')\n  if (mode === 'password') return nfc\n  // secret-answer: NFC -> casefold -> re-NFC -> trim -> collapse internal\n  // whitespace runs. `.toLowerCase()` is the chosen casefold approximation\n  // (JS has no full Unicode caseless-match in the stdlib, e.g. ß stays ß);\n  // the re-NFC after lowercasing keeps the result deterministic.\n  return nfc.toLowerCase().normalize('NFC').trim().replace(/\\s+/g, ' ')\n}\n","/**\n * The digest group — hashing, HKDF over public inputs, randomness, base64.\n *\n * Shared by every capsule, and that is the design's own answer rather than a\n * convenience: the capsule-seam spec's group table marks `digest` \"as today\"\n * for `enclave-aes`, `exclave-plain` AND `enclave-pqc` alike. Hashes are not\n * secrets, so there is nothing here to swap — a plaintext capsule computes the\n * same SHA-256 as an encrypting one, and a blob address derived differently\n * per capsule would simply be a bug.\n *\n * ⚠️ This module calls `crypto.subtle`, inside `capsule/**`, which is where the\n * `subtle-outside-capsule` ban permits it. The ban's TARGET is code outside the\n * capsule reaching for WebCrypto on its own; a shared capsule-layer primitive\n * is the thing it is pushing callers toward.\n */\nimport { ValidationError } from '../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** AES key size in bits. Shared: every capsule that derives an AES-GCM subkey\n *  from the digest group produces a 256-bit key, or the derivations diverge. */\nexport const KEY_BITS = 256\n\nconst SALT_BYTES = 32\nexport const IV_BYTES = 12\nconst RECOVERY_SECRET_BYTES = 32\nconst PRESENCE_TAG_KEY_DOMAIN = 'noydb.presence.tag.v1'\n\n/** The echo-secret typed parts. Encoding lives here with `encodeEchoParts`; the\n *  KEK derivation that consumes it stays in the capsule's `authenticate` group. */\nexport interface EchoSecretParts {\n  readonly prompt: string\n  readonly echo: string\n  readonly key: string\n}\n\nconst ECHO_KDF_CONTEXT = new Uint8Array([0xff, ...new TextEncoder().encode('noydb-echo-secret-v1')])\n\n/**\n * AG-1 encoding: domain context + 4-byte big-endian length prefix per\n * part. Two independent guarantees make a single typed string unable to\n * derive an echo vault's KEK (spec AG-1):\n *\n *   1. The `0xFF` context prefix — UTF-8 never produces that byte, so the\n *      encoding is provably not the encoding of ANY string (not merely of\n *      no separator-joined form).\n *   2. Structural length prefixes — part boundaries are key material, so\n *      re-splitting the same characters changes the derived KEK.\n *\n * @throws ValidationError when any part is not a string — the single\n * chokepoint every echo KEK derivation and block mint passes through, so a\n * malformed parts object cannot be `TextEncoder`-coerced into key material.\n */\nexport function encodeEchoParts(parts: EchoSecretParts): Uint8Array {\n  for (const name of ['prompt', 'echo', 'key'] as const) {\n    if (typeof parts?.[name] !== 'string') {\n      throw new ValidationError('echo secret parts must be three strings: prompt, echo, key')\n    }\n  }\n  const enc = new TextEncoder()\n  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p))\n  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0)\n  const out = new Uint8Array(total)\n  out.set(ECHO_KDF_CONTEXT, 0)\n  let offset = ECHO_KDF_CONTEXT.length\n  for (const s of segments) {\n    new DataView(out.buffer).setUint32(offset, s.length, false)\n    out.set(s, offset + 4)\n    offset += 4 + s.length\n  }\n  return out\n}\n\n/**\n * SHA-256 hex digest of raw bytes. Used to derive content-addressed\n * eTags for blob deduplication. Computed on plaintext bytes\n * before compression and encryption so the eTag identifies content, not\n * ciphertext, and survives re-encryption (key rotation, re-upload).\n */\nexport async function sha256Hex(data: Uint8Array): Promise<string> {\n  const hash = await subtle.digest('SHA-256', data as unknown as BufferSource)\n  return Array.from(new Uint8Array(hash))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/** SHA-256 of raw bytes, as bytes. */\nexport async function sha256Bytes(data: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.digest('SHA-256', data as unknown as BufferSource))\n}\n\n// ─── HMAC-SHA-256 ─────────────────────────────\n\n/**\n * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).\n *\n * The blob eTag is an HMAC over the plaintext. It used to be keyed by the\n * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation\n * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,\n * permanently. `decryptResponse()` checks that unconditionally, so the\n * presigned-URL read path raised `TamperedError` on legitimate data forever;\n * dedup also split, minting a second address for identical bytes.\n *\n * The fix is a `root` that rotation never touches (`_blob_addr`, refused by\n * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES\n * while every address stays stable, which is what makes the AAD\n * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /\n * `_blob_versions_*` row survive it untouched.\n *\n * **Derived PER TIER, deliberately.** A single vault-wide address would make an\n * elevated blob and a tier-0 blob with identical content share an eTag,\n * leaking equality across a boundary the tier system exists to enforce — and\n * `rehomeForTier` re-addresses on a tier move precisely because the address is\n * tier-scoped today. Domain separation keeps that property while removing the\n * rotation coupling: the two are independent axes, and only one of them was\n * ever meant to change the address.\n *\n * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can\n * never coincide with a wrapping or encryption key.\n */\nexport async function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey> {\n  const rawRoot = await subtle.exportKey('raw', root)\n  const hkdfKey = await subtle.importKey('raw', rawRoot, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-blob-address')\n  const info = new TextEncoder().encode(`tier:${tier}`)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  // Imported as AES-GCM only because `hmacSha256Hex` re-exports raw and\n  // re-imports as HMAC; the algorithm tag here is a carrier, never used to\n  // encrypt anything.\n  return subtle.importKey('raw', bits, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt'])\n}\n\n/**\n * HMAC-SHA-256(key, data) as hex.\n *\n * Keyed, unlike {@link sha256Hex}: blob eTags derived with this are opaque to\n * the store, so an attacker with store access cannot pre-compute the address of\n * a file they guess at. Dedup still works inside a vault, where the key is shared.\n */\nexport async function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  // Export AES-GCM DEK raw bytes → import as HMAC key\n  const rawKey = await subtle.exportKey('raw', key)\n  const hmacKey = await subtle.importKey(\n    'raw',\n    rawKey,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const sig = await subtle.sign('HMAC', hmacKey, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n// ─── AAD-aware Binary Encrypt / Decrypt ──\n\n/**\n * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.\n *\n * The presence key is domain-separated from the data DEK by the fixed salt\n * `'noydb-presence'` and the `info` = collection name. This means:\n *  - The adapter never sees the presence key.\n *  - Presence payloads rotate automatically when the collection DEK is rotated.\n *  - Revoked users cannot derive the new presence key after a DEK rotation.\n *\n * @param dek            The collection's AES-256-GCM DEK (extractable).\n * @param collectionName Used as the HKDF `info` parameter for domain separation.\n * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.\n */\nexport async function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  // Step 1: export DEK raw bytes\n  const rawDek = await subtle.exportKey('raw', dek)\n\n  // Step 2: import as HKDF key material\n  const hkdfKey = await subtle.importKey(\n    'raw',\n    rawDek,\n    'HKDF',\n    false,\n    ['deriveBits'],\n  )\n\n  // Step 3: derive 256 bits with salt='noydb-presence' and info=collectionName\n  const salt = new TextEncoder().encode('noydb-presence')\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n\n  // Step 4: import derived bits as AES-GCM key\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Derive the presence-TAG key from a collection DEK: a non-extractable,\n * sign-only HMAC-SHA256 key, HKDF-separated from the presence PAYLOAD key\n * ({@link derivePresenceKey}) by its own salt. The tag is the adapter-opaque\n * record id for storage-polled presence; the adapter never sees the userId.\n */\nexport async function derivePresenceTagKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN)\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * HMAC-SHA256 hex with a key that IS an HMAC key (e.g. from\n * {@link derivePresenceTagKey}). {@link hmacSha256Hex} takes an AES-GCM\n * carrier and re-imports its raw bytes, which needs an extractable key;\n * this one signs directly and works with non-extractable keys.\n */\nexport async function hmacSignHex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  const sig = await subtle.sign('HMAC', key, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * HKDF-SHA256 → non-extractable AES-256-GCM key from caller-supplied input\n * key material. The magic-link content key derives here from\n * `(serverSecret, SHA-256(token), info)`; `salt`/`info` are the caller's\n * domain separation, this function adds none.\n */\nexport async function hkdfAesGcmKey(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<CryptoKey> {\n  const key = await subtle.importKey('raw', ikm as BufferSource, 'HKDF', false, ['deriveKey'])\n  return subtle.deriveKey(\n    { name: 'HKDF', hash: 'SHA-256', salt: salt as BufferSource, info: info as BufferSource },\n    key,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n// ─── Sealed Field Key Derivation ──────────────────────────\n\n/** Generate a random 12-byte IV for AES-GCM. */\nexport function generateIV(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES))\n}\n\n/** Generate a random 32-byte salt for PBKDF2. */\nexport function generateSalt(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES))\n}\n\n/**\n * Mint a fresh recovery secret — the high-entropy value a recovery profile\n * wraps the DEK set under and then hands out (Shamir splits it into shares;\n * paper prints it). Not a salt: a salt is public, this is not, and a fork\n * may size them differently. The reference enclave returns 32 bytes.\n *\n * Callers must zero the buffer once it has been wrapped and split.\n */\nexport function generateRecoverySecret(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES))\n}\n\n// ─── Recipient sealing (RSA-OAEP-SHA256) ───────────────────────────────\n//\n// The managed-secret TLV wraps a per-blob CEK for a recipient who holds an\n// RSA private key — locally (`MemoryRecipientSealer`) or in a KMS\n// (`@noy-db/at-aws-kms`, wire-compatible with RSAES_OAEP_SHA_256). Only the\n// asymmetric steps live here; the TLV layout stays in `managed-secret.ts`.\nexport function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string {\n  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer)\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]!)\n  }\n  return btoa(binary)\n}\nexport function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer> {\n  const binary = atob(base64)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes\n}\n"],"mappings":";;;;;AAOO,SAAS,mBAAmB,MAA2B,OAAuB;AACnF,QAAM,MAAM,MAAM,UAAU,KAAK;AACjC,MAAI,SAAS,WAAY,QAAO;AAKhC,SAAO,IAAI,YAAY,EAAE,UAAU,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG;AACtE;;;ACEA,IAAM,SAAS,WAAW,OAAO;AAI1B,IAAM,WAAW;AAExB,IAAM,aAAa;AACZ,IAAM,WAAW;AACxB,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAUhC,IAAM,mBAAmB,IAAI,WAAW,CAAC,KAAM,GAAG,IAAI,YAAY,EAAE,OAAO,sBAAsB,CAAC,CAAC;AAiB5F,SAAS,gBAAgB,OAAoC;AAClE,aAAW,QAAQ,CAAC,UAAU,QAAQ,KAAK,GAAY;AACrD,QAAI,OAAO,QAAQ,IAAI,MAAM,UAAU;AACrC,YAAM,IAAI,gBAAgB,4DAA4D;AAAA,IACxF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,WAAW,CAAC,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC;AAC/E,QAAM,QAAQ,iBAAiB,SAAS,SAAS,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC;AACrF,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,IAAI,kBAAkB,CAAC;AAC3B,MAAI,SAAS,iBAAiB;AAC9B,aAAW,KAAK,UAAU;AACxB,QAAI,SAAS,IAAI,MAAM,EAAE,UAAU,QAAQ,EAAE,QAAQ,KAAK;AAC1D,QAAI,IAAI,GAAG,SAAS,CAAC;AACrB,cAAU,IAAI,EAAE;AAAA,EAClB;AACA,SAAO;AACT;AAQA,eAAsB,UAAU,MAAmC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO,WAAW,IAA+B;AAC3E,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAGA,eAAsB,YAAY,MAAuC;AACvE,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,WAAW,IAA+B,CAAC;AACvF;AA+BA,eAAsB,qBAAqB,MAAiB,MAAkC;AAC5F,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,IAAI;AAClD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,SAAS,QAAQ,OAAO,CAAC,YAAY,CAAC;AACpF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,oBAAoB;AAC1D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,QAAQ,IAAI,EAAE;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AAIrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,SAAS,CAAC;AACxF;AASA,eAAsB,cAAc,KAAgB,MAAmC;AAErF,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,SAAS,IAA+B;AAC9E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAiBA,eAAsB,kBAAkB,KAAgB,gBAA4C;AAElG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAGhD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AAGA,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB;AACtD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AAGA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAQA,eAAsB,qBAAqB,KAAgB,gBAA4C;AACrG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,uBAAuB;AAC7D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AACrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAQA,eAAsB,YAAY,KAAgB,MAAmC;AACnF,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAA+B;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAQA,eAAsB,cAAc,KAAiB,MAAkB,MAAsC;AAC3G,QAAM,MAAM,MAAM,OAAO,UAAU,OAAO,KAAqB,QAAQ,OAAO,CAAC,WAAW,CAAC;AAC3F,SAAO,OAAO;AAAA,IACZ,EAAE,MAAM,QAAQ,MAAM,WAAW,MAA4B,KAA2B;AAAA,IACxF;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAKO,SAAS,aAAyB;AACvC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,QAAQ,CAAC;AACnE;AAGO,SAAS,eAA2B;AACzC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AACrE;AAUO,SAAS,yBAAqC;AACnD,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,qBAAqB,CAAC;AAChF;AAQO,SAAS,eAAe,QAA0C;AACvE,QAAM,QAAQ,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;AAC3E,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAAA,EACzC;AACA,SAAO,KAAK,MAAM;AACpB;AACO,SAAS,eAAe,QAAyC;AACtE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-LH5A3ZPG.js → chunk-RB4DOPGZ.js}

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-TRGTKX5E.js";
+} from "./chunk-OKSTSITU.js";
 import {
   SearchNotEnabledError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-lookup/search/tokenize.ts
 var WORD = /[\p{L}\p{N}]+/gu;
@@ -85,25 +85,122 @@ var segmentTokens = (text) => {
 };
 var segmentTokenizer = (text) => segmentTokens(text).map((t) => t.term);
 
+// src/with-lookup/search/phrase.ts
+var QUOTED = /"([^"]*)"(?:~(\d+))?/g;
+function parseSearchQuery(query) {
+  const phrases = [];
+  const rest = query.replace(QUOTED, (_m, body, slop) => {
+    const terms = segmentTokenizer(body);
+    if (terms.length > 0) phrases.push({ terms, slop: slop === void 0 ? void 0 : Number(slop) });
+    return " ";
+  });
+  return { terms: segmentTokenizer(rest), phrases };
+}
+function matchClause(positions, clause) {
+  const lists = [];
+  for (const t of clause.terms) {
+    const l = positions.get(t);
+    if (l === void 0 || l.length === 0) return NO_MATCH;
+    lists.push(l);
+  }
+  return clause.slop === void 0 ? matchOrderedAdjacent(lists) : matchWindow(dedupeByTerm(clause.terms, lists), clause.terms.length + clause.slop);
+}
+var NO_MATCH = { count: 0, start: -1 };
+function matchOrderedAdjacent(lists) {
+  const sets = lists.slice(1).map((l) => new Set(l));
+  let count = 0;
+  let start = -1;
+  for (const p of lists[0]) {
+    let ok = true;
+    for (let i = 0; i < sets.length; i++) {
+      if (!sets[i].has(p + i + 1)) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok) {
+      count++;
+      if (start < 0) start = p;
+    }
+  }
+  return { count, start };
+}
+function dedupeByTerm(terms, lists) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (let i = 0; i < terms.length; i++) {
+    if (seen.has(terms[i])) continue;
+    seen.add(terms[i]);
+    out.push(lists[i]);
+  }
+  return out;
+}
+function matchWindow(lists, size) {
+  const merged = [];
+  for (let t = 0; t < lists.length; t++) for (const p of lists[t]) merged.push({ pos: p, term: t });
+  merged.sort((a, b) => a.pos - b.pos || a.term - b.term);
+  const need = lists.length;
+  const have = new Array(need).fill(0);
+  let distinct = 0;
+  let left = 0;
+  let count = 0;
+  let start = -1;
+  for (let right = 0; right < merged.length; right++) {
+    const rt = merged[right].term;
+    if (have[rt] === 0) distinct++;
+    have[rt] = have[rt] + 1;
+    while (distinct === need && have[merged[left].term] > 1) {
+      const lt = merged[left].term;
+      have[lt] = have[lt] - 1;
+      left++;
+    }
+    if (distinct === need && merged[right].pos - merged[left].pos + 1 <= size) {
+      count++;
+      if (start < 0) start = merged[left].pos;
+    }
+  }
+  return { count, start };
+}
+
 // src/with-lookup/search/inverted-index.ts
 var K12 = 1.2;
 var B2 = 0.75;
+var INDEX_SNAPSHOT_VERSION = 2;
 var InvertedIndex = class _InvertedIndex {
   // per field: df (term -> #docs), N (#docs), totalLen
   fieldStats = /* @__PURE__ */ new Map();
   docs = [];
-  static build(docs) {
+  posFields = EMPTY_FIELDS;
+  static build(docs, opts = {}) {
     const idx = new _InvertedIndex();
+    const positional = new Set(opts.positions ?? []);
+    idx.posFields = positional;
     for (const d of docs) {
       for (const f of d.fields) {
         const tokens = segmentTokens(f.text);
         const tf = /* @__PURE__ */ new Map();
         const firstOffset = /* @__PURE__ */ new Map();
-        for (const t of tokens) {
+        const pos = positional.has(f.field) ? /* @__PURE__ */ new Map() : void 0;
+        for (let i = 0; i < tokens.length; i++) {
+          const t = tokens[i];
           tf.set(t.term, (tf.get(t.term) ?? 0) + 1);
           if (!firstOffset.has(t.term)) firstOffset.set(t.term, t.offset);
+          if (pos) {
+            const list = pos.get(t.term);
+            if (list) list.push(i);
+            else pos.set(t.term, [i]);
+          }
         }
-        const doc = { id: d.id, field: f.field, ...f.locale !== void 0 ? { locale: f.locale } : {}, text: f.text, len: tokens.length, tf, firstOffset };
+        const doc = {
+          id: d.id,
+          field: f.field,
+          ...f.locale !== void 0 ? { locale: f.locale } : {},
+          text: f.text,
+          len: tokens.length,
+          tf,
+          firstOffset,
+          ...pos ? { pos } : {}
+        };
         idx.docs.push(doc);
         let s = idx.fieldStats.get(f.field);
         if (!s) {
@@ -117,14 +214,24 @@ var InvertedIndex = class _InvertedIndex {
     }
     return idx;
   }
+  /** Fields this index carries positions for (#1354) — the store compares it against the live config. */
+  get positionFields() {
+    return this.posFields;
+  }
   query(query, opts = {}) {
-    const terms = segmentTokenizer(query);
-    if (terms.length === 0) return [];
-    const usePrefix = opts.prefix ?? false;
+    const parsed = parseSearchQuery(query);
+    if (parsed.phrases.length > 0 && this.posFields.size === 0) {
+      throw new Error(
+        'A phrase or proximity clause ("\u2026" / "\u2026"~n) needs positional postings, and no indexed field declares them. Add the field to the collection\'s `textIndexPositions` option (opt-in: it grows the index).'
+      );
+    }
+    const terms = parsed.terms;
+    const usePrefix = (opts.prefix ?? false) && terms.length > 0;
     const exact = usePrefix ? terms.slice(0, -1) : terms;
     const prefix = usePrefix ? terms[terms.length - 1] : void 0;
+    if (exact.length === 0 && prefix === void 0 && parsed.phrases.length === 0) return [];
     const match = opts.match ?? "any";
-    const required = exact.length + (prefix !== void 0 ? 1 : 0);
+    const required = exact.length + (prefix !== void 0 ? 1 : 0) + parsed.phrases.length;
     const best = /* @__PURE__ */ new Map();
     for (const doc of this.docs) {
       if (opts.fields !== void 0 && !opts.fields.includes(doc.field)) continue;
@@ -141,6 +248,14 @@ var InvertedIndex = class _InvertedIndex {
         const denom = tf + K12 * (1 - B2 + B2 * (doc.len / avgdl));
         score += idf * (tf * (K12 + 1) / (denom || 1));
       };
+      for (const clause of parsed.phrases) {
+        if (!doc.pos) continue;
+        const m = matchClause(doc.pos, clause);
+        if (m.count === 0) continue;
+        let df = Infinity;
+        for (const t of clause.terms) df = Math.min(df, stats.df.get(t) ?? 0);
+        scoreTerm(m.count, df === Infinity ? 1 : df || 1, this.charOffsetAt(doc, m.start));
+      }
       for (const qt of exact) scoreTerm(doc.tf.get(qt) ?? 0, stats.df.get(qt) ?? 0, doc.firstOffset.get(qt) ?? -1);
       if (prefix !== void 0) {
         const exactSet = new Set(exact);
@@ -162,6 +277,8 @@ var InvertedIndex = class _InvertedIndex {
       }
       if (matchedCount === 0) continue;
       if (match === "all" && matchedCount < required) continue;
+      const boost = opts.boost?.[doc.field];
+      if (boost !== void 0 && boost !== 1) score *= boost;
       const hit = {
         id: doc.id,
         score,
@@ -176,9 +293,15 @@ var InvertedIndex = class _InvertedIndex {
     const results = [...best.values()].sort((a, b) => b.score - a.score);
     return opts.limit !== void 0 ? results.slice(0, opts.limit) : results;
   }
+  /** Token ordinal → char offset in the ORIGINAL text, by re-segmenting this one doc. */
+  charOffsetAt(doc, tokenPos) {
+    if (tokenPos < 0) return -1;
+    return segmentTokens(doc.text)[tokenPos]?.offset ?? -1;
+  }
   toSnapshot() {
     return {
-      v: 1,
+      v: INDEX_SNAPSHOT_VERSION,
+      posFields: [...this.posFields],
       fieldStats: [...this.fieldStats].map(([f, s]) => [f, { df: [...s.df], n: s.n, totalLen: s.totalLen }]),
       docs: this.docs.map((d) => ({
         id: d.id,
@@ -187,12 +310,14 @@ var InvertedIndex = class _InvertedIndex {
         len: d.len,
         tf: [...d.tf],
         firstOffset: [...d.firstOffset],
-        ...d.locale !== void 0 ? { locale: d.locale } : {}
+        ...d.locale !== void 0 ? { locale: d.locale } : {},
+        ...d.pos ? { pos: [...d.pos] } : {}
       }))
     };
   }
   static fromSnapshot(s) {
     const idx = new _InvertedIndex();
+    idx.posFields = new Set(s.posFields);
     for (const [f, st] of s.fieldStats) idx.fieldStats.set(f, { df: new Map(st.df), n: st.n, totalLen: st.totalLen });
     for (const d of s.docs) {
       idx.docs.push({
@@ -202,12 +327,14 @@ var InvertedIndex = class _InvertedIndex {
         len: d.len,
         tf: new Map(d.tf),
         firstOffset: new Map(d.firstOffset),
-        ...d.locale !== void 0 ? { locale: d.locale } : {}
+        ...d.locale !== void 0 ? { locale: d.locale } : {},
+        ...d.pos ? { pos: new Map(d.pos.map(([t, l]) => [t, [...l]])) } : {}
       });
     }
     return idx;
   }
 };
+var EMPTY_FIELDS = /* @__PURE__ */ new Set();
 
 // src/with-lookup/search/snippet.ts
 function extractSnippet(text, offset, window = 80) {
@@ -228,8 +355,8 @@ var MemoryIndexStore = class {
   get built() {
     return this.index !== void 0;
   }
-  async ensureBuilt(build) {
-    if (this.index === void 0) this.index = InvertedIndex.build(build());
+  async ensureBuilt(build, opts) {
+    if (this.index === void 0) this.index = InvertedIndex.build(build(), opts);
     return this.index;
   }
   markDirty() {
@@ -294,31 +421,31 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search } = await import("./collection-facade-JSJYIKS4.js");
+      const { search } = await import("./collection-facade-CS7CA2XO.js");
       return search(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve } = await import("./collection-facade-JSJYIKS4.js");
+      const { retrieve } = await import("./collection-facade-CS7CA2XO.js");
       return retrieve(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo } = await import("./collection-facade-JSJYIKS4.js");
+      const { similarTo } = await import("./collection-facade-CS7CA2XO.js");
       return similarTo(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex } = await import("./collection-facade-JSJYIKS4.js");
+      const { warmIndex } = await import("./collection-facade-CS7CA2XO.js");
       return warmIndex(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex } = await import("./collection-facade-JSJYIKS4.js");
+      const { flushIndex } = await import("./collection-facade-CS7CA2XO.js");
       return flushIndex(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite } = await import("./collection-facade-JSJYIKS4.js");
+      const { embedOnWrite } = await import("./collection-facade-CS7CA2XO.js");
       return embedOnWrite(ctx, id, record, version);
     },
     async rebuildEmbeddings(ctx) {
-      const { rebuildEmbeddings } = await import("./collection-facade-JSJYIKS4.js");
+      const { rebuildEmbeddings } = await import("./collection-facade-CS7CA2XO.js");
       return rebuildEmbeddings(ctx);
     }
   };
@@ -355,6 +482,7 @@ export {
   searchScan,
   segmentTokens,
   segmentTokenizer,
+  INDEX_SNAPSHOT_VERSION,
   InvertedIndex,
   extractSnippet,
   MemoryIndexStore,
@@ -364,4 +492,4 @@ export {
   buildBlobFieldEntries,
   withSearch
 };
-//# sourceMappingURL=chunk-LH5A3ZPG.js.map
+//# sourceMappingURL=chunk-RB4DOPGZ.js.map

package/dist/chunk-RB4DOPGZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/search/tokenize.ts","../src/with-lookup/search/scan.ts","../src/with-lookup/search/segment.ts","../src/with-lookup/search/phrase.ts","../src/with-lookup/search/inverted-index.ts","../src/with-lookup/search/snippet.ts","../src/with-lookup/search/index-store.ts","../src/with-lookup/search/build-docs.ts","../src/with-lookup/search/active.ts","../src/with-lookup/search/strategy.ts"],"sourcesContent":["/**\n * Default text tokenizer for scan-mode search.\n *\n * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a\n * word-boundary tokenizer: it does **not** segment scripts written without\n * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per\n * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`\n * (the engine takes one as a parameter); substring/`contains` matching is the\n * pragmatic fallback until then.\n */\nexport type Tokenizer = (text: string) => string[]\n\nconst WORD = /[\\p{L}\\p{N}]+/gu\n\nexport const tokenize: Tokenizer = (text: string): string[] => {\n  if (!text) return []\n  return text.normalize('NFKC').toLowerCase().match(WORD) ?? []\n}\n","/**\n * Scan-mode full-text search — ranks **already-decrypted** records by\n * BM25 against a tokenized query. Pure client-side: nothing is written to the\n * store, so this adds **zero** leakage (unlike a store-usable blind index,\n * which is a separate, gated opt-in).\n *\n * O(n) over the collection; intended for small/medium collections (the pilot's\n * scale) where moving the existing userland scan into the DB is the win.\n */\nimport { tokenize, type Tokenizer } from './tokenize.js'\n\nexport interface SearchOptions {\n  /** Top-N by score (default: all matches). */\n  readonly limit?: number\n  /** `'any'` (default) = OR of query terms; `'all'` = every term must match. */\n  readonly match?: 'any' | 'all'\n  /** Treat the LAST query term as a prefix (typeahead). */\n  readonly prefix?: boolean\n}\n\nexport interface SearchResult<T> {\n  readonly id: string\n  readonly score: number\n  readonly record: T\n}\n\nexport interface SearchEntry<T> {\n  readonly id: string\n  readonly record: T\n}\n\nconst K1 = 1.2\nconst B = 0.75\n\n/** Coerce a field value to searchable text (numbers/booleans stringified). */\nfunction fieldText(record: unknown, field: string): string {\n  const v = (record as Record<string, unknown>)[field]\n  if (typeof v === 'string') return v\n  if (v === null || v === undefined) return ''\n  if (typeof v === 'number' || typeof v === 'boolean') return String(v)\n  return ''\n}\n\nexport function searchScan<T>(\n  entries: ReadonlyArray<SearchEntry<T>>,\n  field: string,\n  query: string,\n  opts: SearchOptions = {},\n  tokenizer: Tokenizer = tokenize,\n): SearchResult<T>[] {\n  const queryTerms = tokenizer(query)\n  if (queryTerms.length === 0) return []\n\n  const match = opts.match ?? 'any'\n  const usePrefix = opts.prefix ?? false\n  const exactTerms = usePrefix ? queryTerms.slice(0, -1) : queryTerms\n  const prefixTerm = usePrefix ? queryTerms[queryTerms.length - 1] : undefined\n\n  // One tokenize pass per doc; collect corpus stats (df, avg length).\n  const docs = entries.map((e) => ({ id: e.id, record: e.record, terms: tokenizer(fieldText(e.record, field)) }))\n  const N = docs.length || 1\n  const df = new Map<string, number>()\n  let totalLen = 0\n  for (const d of docs) {\n    totalLen += d.terms.length\n    for (const t of new Set(d.terms)) df.set(t, (df.get(t) ?? 0) + 1)\n  }\n  const avgdl = totalLen / N || 1\n\n  // Document frequency for the prefix term: docs containing ANY term with it.\n  let prefixDf = 0\n  if (prefixTerm !== undefined) {\n    for (const d of docs) {\n      if (d.terms.some((t) => t.startsWith(prefixTerm))) prefixDf++\n    }\n  }\n\n  const requiredCount = exactTerms.length + (prefixTerm !== undefined ? 1 : 0)\n  const results: SearchResult<T>[] = []\n\n  for (const d of docs) {\n    const tf = new Map<string, number>()\n    for (const t of d.terms) tf.set(t, (tf.get(t) ?? 0) + 1)\n\n    const matched: { tf: number; df: number }[] = []\n    for (const qt of exactTerms) {\n      const c = tf.get(qt) ?? 0\n      if (c > 0) matched.push({ tf: c, df: df.get(qt) ?? 0 })\n    }\n    if (prefixTerm !== undefined) {\n      let ptf = 0\n      for (const [t, c] of tf) if (t.startsWith(prefixTerm)) ptf += c\n      if (ptf > 0) matched.push({ tf: ptf, df: prefixDf })\n    }\n\n    if (matched.length === 0) continue\n    if (match === 'all' && matched.length < requiredCount) continue\n\n    let score = 0\n    for (const m of matched) {\n      const idf = Math.log(1 + (N - m.df + 0.5) / (m.df + 0.5))\n      const denom = m.tf + K1 * (1 - B + B * (d.terms.length / avgdl))\n      score += idf * ((m.tf * (K1 + 1)) / (denom || 1))\n    }\n    results.push({ id: d.id, score, record: d.record })\n  }\n\n  results.sort((a, b) => b.score - a.score)\n  return opts.limit !== undefined ? results.slice(0, opts.limit) : results\n}\n","/**\n * i18n word tokenizer for the L1 lexical index. Uses Intl.Segmenter\n * (standard ECMAScript — hub-portable) to dictionary-segment Thai/Lao/Khmer/CJK,\n * which the word-run `tokenize` cannot. Terms are matched in NFKC-lowercased form;\n * offsets index the ORIGINAL text so snippets slice the user's text.\n */\nimport type { Tokenizer } from './tokenize.js'\n\nconst SEGMENTER = new Intl.Segmenter(undefined, { granularity: 'word' })\n\nexport interface Token {\n  readonly term: string\n  readonly offset: number\n}\n\n/** Word-like tokens with NFKC-lowercased terms + original-text char offsets. */\nexport const segmentTokens = (text: string): Token[] => {\n  const out: Token[] = []\n  if (!text) return out\n  for (const s of SEGMENTER.segment(text)) {\n    if (s.isWordLike) out.push({ term: s.segment.normalize('NFKC').toLowerCase(), offset: s.index })\n  }\n  return out\n}\n\n/** Term-only tokenizer (the public `Tokenizer` shape) — for queries. */\nexport const segmentTokenizer: Tokenizer = (text: string): string[] =>\n  segmentTokens(text).map((t) => t.term)\n","/**\n * Phrase / proximity clause parsing and matching over positional postings\n * (#1354).\n *\n * ## The query syntax\n *\n * A double-quoted run inside a `retrieve()` query string is a **clause**;\n * everything outside quotes stays a bare term and behaves exactly as it did\n * before this file existed.\n *\n *  - `\"tax invoice\"`   — PHRASE: the terms must be adjacent, **in the written\n *                        order**, with nothing between them.\n *  - `\"tax invoice\"~3` — PROXIMITY: the terms must all occur inside a window\n *                        of `k + 3` tokens (`k` = the clause's term count),\n *                        i.e. at most 3 tokens of slack, **in any order**.\n *\n * ⭐ **Proximity is UNORDERED, and that is a deliberate divergence from\n * Lucene.** Lucene's `~n` is an edit distance over positions, so a mere\n * transposition of two adjacent terms costs 2 and `\"invoice tax\"~0` does NOT\n * match the text `tax invoice`. Here `~n` reads as *\"n words of slack, order\n * irrelevant\"* (the Meilisearch / Typesense reading), so `\"invoice tax\"~0`\n * DOES match `tax invoice`. Pinned by\n * `search-phrase-proximity.test.ts` → *\"proximity is unordered — the case\n * Lucene disagrees on\"*. Callers who want ordering use the unslopped phrase\n * form, which is strictly ordered.\n *\n * A clause matches **within one field posting only** — positions are recorded\n * per `(record, field)`, so a term ending `name` and a term starting `notes`\n * can never form a phrase. That is a property of the data layout, not a check.\n *\n * Repeated terms in a PROXIMITY clause collapse to a set (`\"tax tax\"~2`\n * requires only that `tax` occur); a PHRASE clause matches repeats exactly,\n * because it tests literal position arithmetic.\n */\nimport { segmentTokenizer } from './segment.js'\n\n/** One quoted clause. `slop === undefined` ⇒ strict ordered phrase. */\nexport interface PhraseClause {\n  readonly terms: readonly string[]\n  readonly slop: number | undefined\n}\n\nexport interface ParsedQuery {\n  /** Unquoted terms — scored exactly as before #1354. */\n  readonly terms: readonly string[]\n  readonly phrases: readonly PhraseClause[]\n}\n\nconst QUOTED = /\"([^\"]*)\"(?:~(\\d+))?/g\n\n/**\n * Split a raw query into bare terms + quoted clauses. An unterminated quote\n * has no closing delimiter to match, so it never forms a clause and its text\n * falls through to the bare-term tokenizer — a typo degrades to today's\n * behaviour rather than to an error.\n */\nexport function parseSearchQuery(query: string): ParsedQuery {\n  const phrases: PhraseClause[] = []\n  const rest = query.replace(QUOTED, (_m, body: string, slop: string | undefined) => {\n    const terms = segmentTokenizer(body)\n    // A one-term clause is just that term; keep it a clause anyway so `match:'all'`\n    // counts it once, and so `\"foo\"` never silently means something different\n    // from `foo`.\n    if (terms.length > 0) phrases.push({ terms, slop: slop === undefined ? undefined : Number(slop) })\n    return ' '\n  })\n  return { terms: segmentTokenizer(rest), phrases }\n}\n\n/**\n * Occurrences of a clause inside one field's positional postings, plus the\n * token position the first occurrence starts at (`-1` when there is none).\n *\n * `positions` maps term → ascending token ordinals. A term the posting does\n * not carry is an immediate miss.\n */\nexport function matchClause(\n  positions: ReadonlyMap<string, readonly number[]>,\n  clause: PhraseClause,\n): { count: number; start: number } {\n  const lists: (readonly number[])[] = []\n  for (const t of clause.terms) {\n    const l = positions.get(t)\n    if (l === undefined || l.length === 0) return NO_MATCH\n    lists.push(l)\n  }\n  return clause.slop === undefined\n    ? matchOrderedAdjacent(lists)\n    : matchWindow(dedupeByTerm(clause.terms, lists), clause.terms.length + clause.slop)\n}\n\nconst NO_MATCH = { count: 0, start: -1 }\n\n/** Strict phrase: positions p, p+1, … p+k-1, one per term, in written order. */\nfunction matchOrderedAdjacent(lists: readonly (readonly number[])[]): { count: number; start: number } {\n  const sets = lists.slice(1).map((l) => new Set(l))\n  let count = 0\n  let start = -1\n  for (const p of lists[0]!) {\n    let ok = true\n    for (let i = 0; i < sets.length; i++) {\n      if (!sets[i]!.has(p + i + 1)) { ok = false; break }\n    }\n    if (ok) { count++; if (start < 0) start = p }\n  }\n  return { count, start }\n}\n\n/** Distinct terms only — a proximity window asks \"are they all here\", so a\n *  repeated term must not demand two separate occurrences. */\nfunction dedupeByTerm(\n  terms: readonly string[],\n  lists: readonly (readonly number[])[],\n): readonly (readonly number[])[] {\n  const seen = new Set<string>()\n  const out: (readonly number[])[] = []\n  for (let i = 0; i < terms.length; i++) {\n    if (seen.has(terms[i]!)) continue\n    seen.add(terms[i]!)\n    out.push(lists[i]!)\n  }\n  return out\n}\n\n/**\n * Unordered window: count the windows containing every list at least once\n * whose token span is `< size` (span = max − min + 1 ≤ size). One window is\n * counted per right endpoint after shrinking from the left, so overlapping\n * windows do not inflate the count without bound — it is a frequency signal\n * for BM25, not an exact non-overlapping occurrence count.\n */\nfunction matchWindow(\n  lists: readonly (readonly number[])[],\n  size: number,\n): { count: number; start: number } {\n  const merged: { pos: number; term: number }[] = []\n  for (let t = 0; t < lists.length; t++) for (const p of lists[t]!) merged.push({ pos: p, term: t })\n  merged.sort((a, b) => a.pos - b.pos || a.term - b.term)\n\n  const need = lists.length\n  const have = new Array<number>(need).fill(0)\n  let distinct = 0\n  let left = 0\n  let count = 0\n  let start = -1\n  for (let right = 0; right < merged.length; right++) {\n    const rt = merged[right]!.term\n    if (have[rt]! === 0) distinct++\n    have[rt] = have[rt]! + 1\n    while (distinct === need && have[merged[left]!.term]! > 1) {\n      const lt = merged[left]!.term\n      have[lt] = have[lt]! - 1\n      left++\n    }\n    if (distinct === need && merged[right]!.pos - merged[left]!.pos + 1 <= size) {\n      count++\n      if (start < 0) start = merged[left]!.pos\n    }\n  }\n  return { count, start }\n}\n","/**\n * In-memory inverted index for the L1 lexical retrieval layer. Built\n * client-side from already-decrypted records; nothing touches the store. BM25\n * mirrors src/search/scan.ts; multi-field with max-field combination so a record\n * ranks by its strongest field, which also supplies the snippet location.\n *\n * ## Positional postings (#1354)\n *\n * A field named in {@link IndexBuildOptions.positions} additionally records, per\n * term, the ascending token ordinals it occurs at — which is what phrase\n * (`\"tax invoice\"`) and proximity (`\"tax invoice\"~3`) clauses match on. That\n * roughly doubles the per-doc payload (one ordinal per token, on top of the\n * existing tf/firstOffset maps), so it is **opt-in per field**: a field absent\n * from `positions` stores nothing extra and a collection that opts none in\n * serializes a snapshot with no `pos` entries at all.\n *\n * ⭐ Char offsets are NOT stored alongside the ordinals. A matched clause needs\n * one offset, for one hit, to place a snippet — re-segmenting that single doc's\n * text (which the snapshot already carries) is cheaper than paying a second\n * number per token in every persisted index.\n */\nimport { segmentTokens } from './segment.js'\nimport { parseSearchQuery, matchClause } from './phrase.js'\n\nconst K1 = 1.2\nconst B = 0.75\n\nexport interface IndexDoc {\n  readonly id: string\n  readonly fields: ReadonlyArray<{ readonly field: string; readonly locale?: string; readonly text: string }>\n}\n\nexport interface IndexHit {\n  readonly id: string\n  readonly score: number\n  readonly field: string\n  readonly locale?: string\n  readonly text: string\n  readonly offset: number\n}\n\n/** Build-time index shape. The only knob is which fields carry positions. */\nexport interface IndexBuildOptions {\n  /** Fields whose postings record token positions (phrase / proximity). Opt-in: index size grows. */\n  readonly positions?: readonly string[]\n}\n\nexport interface QueryOptions {\n  readonly limit?: number\n  readonly match?: 'any' | 'all'\n  readonly prefix?: boolean\n  readonly fields?: readonly string[]\n  /**\n   * Per-field score weights (BM25F-style, #1354). Purely query-side — nothing\n   * in the index changes. A field with no entry weighs 1, and the no-boost path\n   * performs no multiplication at all, so an unboosted query's scores are\n   * bit-for-bit what they were before boosts existed.\n   *\n   * ⚠️ Textbook BM25F pools term frequencies ACROSS fields before one\n   * saturation step. This index scores each field independently and keeps the\n   * best (see the class doc), so a boost weights the per-field score instead.\n   * Same intent — \"a hit in `name` is worth more than a hit in `notes`\" —\n   * different arithmetic; do not expect Lucene's BM25F numbers.\n   */\n  readonly boost?: Readonly<Record<string, number>>\n}\n\n/**\n * Persisted shape. `v` is the format stamp: an older stamp is REJECTED and the\n * index rebuilt, never migrated or read leniently — see\n * {@link parseIndexSnapshot}. v1 (pre-#1354) had no `posFields` and no `pos`,\n * and a v1 blob read as v2 would silently answer \"this doc has no positions\",\n * i.e. \"your phrase does not match\", which is a wrong answer rather than a slow\n * one.\n */\nexport const INDEX_SNAPSHOT_VERSION = 2\n\nexport interface IndexSnapshot {\n  readonly v: number\n  /** Fields whose docs carry `pos`. Empty ⇒ nobody opted in. */\n  readonly posFields: readonly string[]\n  readonly fieldStats: ReadonlyArray<[string, { df: [string, number][]; n: number; totalLen: number }]>\n  readonly docs: ReadonlyArray<{\n    id: string; field: string; locale?: string; text: string; len: number\n    tf: [string, number][]; firstOffset: [string, number][]\n    /** term -> ascending token ordinals. Present iff `field` ∈ `posFields`. */\n    pos?: [string, number[]][]\n  }>\n}\n\ninterface Doc {\n  id: string\n  field: string\n  locale?: string\n  text: string\n  len: number\n  tf: Map<string, number>\n  firstOffset: Map<string, number>\n  pos?: Map<string, number[]>\n}\n\nexport class InvertedIndex {\n  // per field: df (term -> #docs), N (#docs), totalLen\n  private readonly fieldStats = new Map<string, { df: Map<string, number>; n: number; totalLen: number }>()\n  private readonly docs: Doc[] = []\n  private posFields: ReadonlySet<string> = EMPTY_FIELDS\n\n  static build(docs: ReadonlyArray<IndexDoc>, opts: IndexBuildOptions = {}): InvertedIndex {\n    const idx = new InvertedIndex()\n    const positional = new Set(opts.positions ?? [])\n    idx.posFields = positional\n    for (const d of docs) {\n      for (const f of d.fields) {\n        const tokens = segmentTokens(f.text)\n        const tf = new Map<string, number>()\n        const firstOffset = new Map<string, number>()\n        const pos = positional.has(f.field) ? new Map<string, number[]>() : undefined\n        for (let i = 0; i < tokens.length; i++) {\n          const t = tokens[i]!\n          tf.set(t.term, (tf.get(t.term) ?? 0) + 1)\n          if (!firstOffset.has(t.term)) firstOffset.set(t.term, t.offset)\n          if (pos) {\n            const list = pos.get(t.term)\n            if (list) list.push(i)\n            else pos.set(t.term, [i])\n          }\n        }\n        const doc: Doc = {\n          id: d.id, field: f.field, ...(f.locale !== undefined ? { locale: f.locale } : {}),\n          text: f.text, len: tokens.length, tf, firstOffset, ...(pos ? { pos } : {}),\n        }\n        idx.docs.push(doc)\n        let s = idx.fieldStats.get(f.field)\n        if (!s) { s = { df: new Map(), n: 0, totalLen: 0 }; idx.fieldStats.set(f.field, s) }\n        s.n += 1\n        s.totalLen += doc.len\n        for (const term of tf.keys()) s.df.set(term, (s.df.get(term) ?? 0) + 1)\n      }\n    }\n    return idx\n  }\n\n  /** Fields this index carries positions for (#1354) — the store compares it against the live config. */\n  get positionFields(): ReadonlySet<string> { return this.posFields }\n\n  query(query: string, opts: QueryOptions = {}): IndexHit[] {\n    const parsed = parseSearchQuery(query)\n    if (parsed.phrases.length > 0 && this.posFields.size === 0) {\n      throw new Error(\n        'A phrase or proximity clause (\"…\" / \"…\"~n) needs positional postings, and no indexed field ' +\n          'declares them. Add the field to the collection\\'s `textIndexPositions` option (opt-in: it grows the index).',\n      )\n    }\n    const terms = parsed.terms\n    const usePrefix = (opts.prefix ?? false) && terms.length > 0\n    const exact = usePrefix ? terms.slice(0, -1) : terms\n    const prefix = usePrefix ? terms[terms.length - 1] : undefined\n    if (exact.length === 0 && prefix === undefined && parsed.phrases.length === 0) return []\n    const match = opts.match ?? 'any'\n    const required = exact.length + (prefix !== undefined ? 1 : 0) + parsed.phrases.length\n\n    // best (max-score) doc per record\n    const best = new Map<string, IndexHit>()\n    for (const doc of this.docs) {\n      if (opts.fields !== undefined && !opts.fields.includes(doc.field)) continue\n      const stats = this.fieldStats.get(doc.field)!\n      const avgdl = stats.totalLen / stats.n || 1\n      let score = 0\n      let matchedCount = 0\n      let snippetOffset = -1\n\n      const scoreTerm = (tf: number, df: number, offset: number): void => {\n        if (tf <= 0) return\n        matchedCount += 1\n        if (snippetOffset < 0 && offset >= 0) snippetOffset = offset\n        const idf = Math.log(1 + (stats.n - df + 0.5) / (df + 0.5))\n        const denom = tf + K1 * (1 - B + B * (doc.len / avgdl))\n        score += idf * ((tf * (K1 + 1)) / (denom || 1))\n      }\n\n      // Clauses are scored FIRST so a matched phrase — not a stray loose term —\n      // decides where the snippet window opens.\n      for (const clause of parsed.phrases) {\n        if (!doc.pos) continue // this field did not opt in: it cannot satisfy a clause\n        const m = matchClause(doc.pos, clause)\n        if (m.count === 0) continue\n        // df for a clause is bounded above by the rarest of its terms' df; the\n        // exact clause df would need a second pass over every doc for every\n        // query, which buys precision nobody is asking for at L1.\n        let df = Infinity\n        for (const t of clause.terms) df = Math.min(df, stats.df.get(t) ?? 0)\n        scoreTerm(m.count, df === Infinity ? 1 : df || 1, this.charOffsetAt(doc, m.start))\n      }\n\n      for (const qt of exact) scoreTerm(doc.tf.get(qt) ?? 0, stats.df.get(qt) ?? 0, doc.firstOffset.get(qt) ?? -1)\n\n      if (prefix !== undefined) {\n        // Build a set of exact query terms so we don't double-count a term that\n        // is both an exact match and starts with the prefix (defect 2 fix).\n        const exactSet = new Set(exact)\n        let ptf = 0\n        let poff = -1\n        for (const [term, c] of doc.tf) {\n          if (term.startsWith(prefix) && !exactSet.has(term)) {\n            ptf += c\n            if (poff < 0) poff = doc.firstOffset.get(term) ?? -1\n          }\n        }\n        if (ptf > 0) {\n          // df for the prefix: count DISTINCT docs in this field that have any\n          // prefix-matching term — mirrors scan.ts semantics (defect 1 fix).\n          let pdf = 0\n          for (const d of this.docs) {\n            if (d.field === doc.field && [...d.tf.keys()].some((t) => t.startsWith(prefix))) pdf++\n          }\n          scoreTerm(ptf, pdf || 1, poff)\n        }\n      }\n\n      if (matchedCount === 0) continue\n      if (match === 'all' && matchedCount < required) continue\n\n      // No boost option, or a weight of exactly 1, performs no arithmetic —\n      // that is what makes an unboosted ranking provably unchanged (#1354).\n      const boost = opts.boost?.[doc.field]\n      if (boost !== undefined && boost !== 1) score *= boost\n\n      const hit: IndexHit = {\n        id: doc.id, score, field: doc.field, text: doc.text,\n        offset: snippetOffset < 0 ? 0 : snippetOffset,\n        ...(doc.locale !== undefined ? { locale: doc.locale } : {}),\n      }\n      const prev = best.get(doc.id)\n      if (!prev || hit.score > prev.score) best.set(doc.id, hit)\n    }\n\n    const results = [...best.values()].sort((a, b) => b.score - a.score)\n    return opts.limit !== undefined ? results.slice(0, opts.limit) : results\n  }\n\n  /** Token ordinal → char offset in the ORIGINAL text, by re-segmenting this one doc. */\n  private charOffsetAt(doc: Doc, tokenPos: number): number {\n    if (tokenPos < 0) return -1\n    return segmentTokens(doc.text)[tokenPos]?.offset ?? -1\n  }\n\n  toSnapshot(): IndexSnapshot {\n    return {\n      v: INDEX_SNAPSHOT_VERSION,\n      posFields: [...this.posFields],\n      fieldStats: [...this.fieldStats].map(([f, s]) => [f, { df: [...s.df], n: s.n, totalLen: s.totalLen }]),\n      docs: this.docs.map((d) => ({\n        id: d.id, field: d.field, text: d.text, len: d.len,\n        tf: [...d.tf], firstOffset: [...d.firstOffset],\n        ...(d.locale !== undefined ? { locale: d.locale } : {}),\n        ...(d.pos ? { pos: [...d.pos] as [string, number[]][] } : {}),\n      })),\n    }\n  }\n\n  static fromSnapshot(s: IndexSnapshot): InvertedIndex {\n    const idx = new InvertedIndex()\n    idx.posFields = new Set(s.posFields)\n    for (const [f, st] of s.fieldStats) idx.fieldStats.set(f, { df: new Map(st.df), n: st.n, totalLen: st.totalLen })\n    for (const d of s.docs) {\n      idx.docs.push({\n        id: d.id, field: d.field, text: d.text, len: d.len,\n        tf: new Map(d.tf), firstOffset: new Map(d.firstOffset),\n        ...(d.locale !== undefined ? { locale: d.locale } : {}),\n        ...(d.pos ? { pos: new Map(d.pos.map(([t, l]) => [t, [...l]])) } : {}),\n      })\n    }\n    return idx\n  }\n}\n\nconst EMPTY_FIELDS: ReadonlySet<string> = new Set()\n","/**\n * Minimal-disclosure snippet: a char-window around a match offset (L1).\n * Unicode-safe (operates on code points). `…` marks each truncated end.\n */\nexport function extractSnippet(text: string, offset: number, window = 80): string {\n  const chars = Array.from(text)\n  if (chars.length <= window) return text\n  // offset is a UTF-16 index into `text`; map to a code-point index.\n  const cpOffset = Array.from(text.slice(0, Math.max(0, offset))).length\n  const half = Math.floor(window / 2)\n  let start = Math.max(0, cpOffset - half)\n  const end = Math.min(chars.length, start + window)\n  start = Math.max(0, end - window)\n  const body = chars.slice(start, end).join('')\n  return `${start > 0 ? '…' : ''}${body}${end < chars.length ? '…' : ''}`\n}\n","/**\n * The index persistence seam (L1.5). MemoryIndexStore is session-scoped and\n * lazy; an opaque-blob backend implements the same interface so the\n * collection call-site is unchanged.\n */\nimport { InvertedIndex, type IndexDoc, type IndexBuildOptions } from './inverted-index.js'\n\nexport interface IndexStore {\n  /** `opts` carries the positional-postings opt-in (#1354); a persisted store also\n   *  uses it to decide whether a loaded sidecar still matches the live config. */\n  ensureBuilt(build: () => ReadonlyArray<IndexDoc>, opts?: IndexBuildOptions): Promise<InvertedIndex>\n  markDirty(): void\n  flush(): Promise<void>\n  readonly built: boolean\n}\n\nexport class MemoryIndexStore implements IndexStore {\n  private index: InvertedIndex | undefined\n\n  get built(): boolean { return this.index !== undefined }\n\n  async ensureBuilt(build: () => ReadonlyArray<IndexDoc>, opts?: IndexBuildOptions): Promise<InvertedIndex> {\n    if (this.index === undefined) this.index = InvertedIndex.build(build(), opts)\n    return this.index\n  }\n\n  markDirty(): void { this.index = undefined }\n\n  async flush(): Promise<void> { /* in-memory: nothing to persist */ }\n}\n","/**\n * Map a decrypted record's configured text fields → IndexDoc field entries\n * (L1). String, i18nText, dictKey, and blob-filename expansion. Uses\n * getAtPath for nested/[]-wildcard paths. Blob filenames are NOT inline on the\n * record — the collection pre-resolves them (one listSlots() per record, the\n * heaviest source) and feeds them to {@link buildBlobFieldEntries}.\n */\nimport { getAtPath } from '../../via/i18n/core.js'\nimport type { I18nTextDescriptor } from '../../via/i18n/core.js'\nimport type { DictKeyDescriptor, StaticDictDescriptor } from '../../via/i18n/dictionary.js'\nimport type { IndexDoc } from './inverted-index.js'\n\n/**\n * One entry in an {@link IndexDoc}'s `fields` array — the return shape of the\n * `build*FieldEntries` helpers. Exported so `@noy-db/hub/search` can name the\n * return type of its own public functions (#843 C1: the subpath's first\n * type-reachability gap).\n */\nexport type FieldEntry = IndexDoc['fields'][number]\n\nexport function buildStringFieldEntries(\n  record: Record<string, unknown>,\n  textIndexes: readonly string[],\n  only?: readonly string[],\n): FieldEntry[] {\n  const fields = only ? textIndexes.filter((f) => only.includes(f)) : textIndexes\n  const out: FieldEntry[] = []\n  for (const field of fields) {\n    for (const leaf of getAtPath(record, field)) {\n      if (typeof leaf === 'string' && leaf !== '') out.push({ field, text: leaf })\n    }\n  }\n  return out\n}\n\nexport function buildI18nFieldEntries(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  textIndexes: readonly string[],\n  only?: readonly string[],\n): FieldEntry[] {\n  const fields = (only ? textIndexes.filter((f) => only.includes(f)) : textIndexes).filter((f) => f in i18nFields)\n  const out: FieldEntry[] = []\n  for (const field of fields) {\n    for (const leaf of getAtPath(record, field)) {\n      if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) continue\n      for (const [locale, val] of Object.entries(leaf as Record<string, unknown>)) {\n        if (typeof val === 'string' && val !== '') out.push({ field, locale, text: val })\n      }\n    }\n  }\n  return out\n}\n\n/** label map: field -> (key -> { locale -> label }). Precomputed in the collection (async for dynamic dicts). */\nexport function buildDictKeyFieldEntries(\n  record: Record<string, unknown>,\n  dictKeyFields: Record<string, DictKeyDescriptor | StaticDictDescriptor>,\n  labelMaps: Map<string, Map<string, Record<string, string>>>,\n  textIndexes: readonly string[],\n  only?: readonly string[],\n): FieldEntry[] {\n  const fields = (only ? textIndexes.filter((f) => only.includes(f)) : textIndexes).filter((f) => f in dictKeyFields)\n  const out: FieldEntry[] = []\n  for (const field of fields) {\n    const map = labelMaps.get(field)\n    if (!map) continue\n    for (const leaf of getAtPath(record, field)) {\n      const keys = typeof leaf === 'string' ? [leaf] : Array.isArray(leaf) ? leaf.filter((k): k is string => typeof k === 'string') : []\n      for (const key of keys) {\n        const labels = map.get(key)\n        if (!labels) continue\n        for (const [locale, label] of Object.entries(labels)) {\n          if (label !== '') out.push({ field, locale, text: label })\n        }\n      }\n    }\n  }\n  return out\n}\n\n/**\n * Blob filenames precomputed in the collection (`field -> filenames[]`, from one\n * async `listSlots()` per record — the heaviest source, see {@link buildBlobFieldEntries}'s\n * caller). Bytes are never tokenized; only the slot `filename` is indexed.\n */\nexport function buildBlobFieldEntries(filenamesByField: Map<string, string[]>): FieldEntry[] {\n  const out: FieldEntry[] = []\n  for (const [field, names] of filenamesByField) {\n    for (const name of names) if (name !== '') out.push({ field, text: name })\n  }\n  return out\n}\n","/**\n * Enable the search / retrieval capability.\n * Pass to `createNoydb({ searchStrategy: withSearch() })` to make a collection's\n * `search` / `retrieve` / `similarTo` / `warmIndex` / `flushIndex` methods live,\n * and to enable the put()-time embedding-vector compute for collections that\n * declare an `embeddings` config. The search/retrieval engine is dynamically\n * imported here, so it stays out of the floor bundle until opted in.\n */\nimport type { SearchStrategy } from './strategy.js'\n\nexport function withSearch(): SearchStrategy {\n  return {\n    async search(ctx, field, query, opts) {\n      const { search } = await import('./collection-facade.js')\n      return search(ctx, field, query, opts)\n    },\n    async retrieve(ctx, query, opts) {\n      const { retrieve } = await import('./collection-facade.js')\n      return retrieve(ctx, query, opts)\n    },\n    async similarTo(ctx, vector, opts) {\n      const { similarTo } = await import('./collection-facade.js')\n      return similarTo(ctx, vector, opts)\n    },\n    async warmIndex(ctx) {\n      const { warmIndex } = await import('./collection-facade.js')\n      return warmIndex(ctx)\n    },\n    async flushIndex(ctx) {\n      const { flushIndex } = await import('./collection-facade.js')\n      return flushIndex(ctx)\n    },\n    async embedOnWrite(ctx, id, record, version) {\n      const { embedOnWrite } = await import('./collection-facade.js')\n      return embedOnWrite(ctx, id, record, version)\n    },\n    async rebuildEmbeddings(ctx) {\n      const { rebuildEmbeddings } = await import('./collection-facade.js')\n      return rebuildEmbeddings(ctx)\n    },\n  }\n}\n","/**\n * Search capability strategy — the on-demand collection-level retrieval\n * operations the `Collection` routes through: scan-mode full-text `search`,\n * unified `retrieve` (lexical | semantic | hybrid), raw-vector `similarTo`, and\n * the lexical-index lifecycle (`warmIndex` / `flushIndex`). The active engine\n * ({@link withSearch}) dynamically imports the search/retrieval facade (keeping\n * it out of the floor bundle); {@link NO_SEARCH} throws.\n *\n * The embedding write-hook (`embedOnWrite`) is paired here too: opting into\n * `withSearch()` enables both the query surface AND the put()-time vector\n * compute — a vector that no gated `similarTo` / semantic `retrieve` could read\n * is dead weight, so embedding compute is not separately gatable. `Collection`\n * always assembles the per-call {@link SearchContext} and delegates here, so an\n * un-opted-in caller hits `NO_SEARCH`'s throw.\n * @internal\n */\nimport type { SearchContext } from './collection-facade.js'\nimport type { SearchOptions, SearchResult } from './index.js'\nimport type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js'\nimport { SearchNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SearchStrategy {\n  search<T>(ctx: SearchContext<T>, field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>\n  retrieve<T>(ctx: SearchContext<T>, query: string, opts?: RetrieveOptions<T>): Promise<RetrieveHit<T>[]>\n  similarTo<T>(ctx: SearchContext<T>, vector: Float32Array, opts?: SimilarToOptions): Promise<RetrieveHit<T>[]>\n  warmIndex<T>(ctx: SearchContext<T>): Promise<void>\n  flushIndex<T>(ctx: SearchContext<T>): Promise<void>\n  embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>\n  rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{ rebuilt: number; skipped: number }>\n}\n\n/**\n * No-op stub — the floor default. Every capability method (and the embedding\n * write-hook) throws {@link SearchNotEnabledError}; opt in with\n * `searchStrategy: withSearch()` in createNoydb. @internal\n */\nexport const NO_SEARCH: SearchStrategy = {\n  async search() { throw new SearchNotEnabledError() },\n  async retrieve() { throw new SearchNotEnabledError() },\n  async similarTo() { throw new SearchNotEnabledError() },\n  async warmIndex() { throw new SearchNotEnabledError() },\n  async flushIndex() { throw new SearchNotEnabledError() },\n  async embedOnWrite() { throw new SearchNotEnabledError() },\n  async rebuildEmbeddings() { throw new SearchNotEnabledError() },\n}\n"],"mappings":";;;;;;;;AAYA,IAAM,OAAO;AAEN,IAAM,WAAsB,CAAC,SAA2B;AAC7D,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO,KAAK,UAAU,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,KAAK,CAAC;AAC9D;;;ACcA,IAAM,KAAK;AACX,IAAM,IAAI;AAGV,SAAS,UAAU,QAAiB,OAAuB;AACzD,QAAM,IAAK,OAAmC,KAAK;AACnD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAW,QAAO,OAAO,CAAC;AACpE,SAAO;AACT;AAEO,SAAS,WACd,SACA,OACA,OACA,OAAsB,CAAC,GACvB,YAAuB,UACJ;AACnB,QAAM,aAAa,UAAU,KAAK;AAClC,MAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AAErC,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,YAAY,KAAK,UAAU;AACjC,QAAM,aAAa,YAAY,WAAW,MAAM,GAAG,EAAE,IAAI;AACzD,QAAM,aAAa,YAAY,WAAW,WAAW,SAAS,CAAC,IAAI;AAGnE,QAAM,OAAO,QAAQ,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,QAAQ,OAAO,UAAU,UAAU,EAAE,QAAQ,KAAK,CAAC,EAAE,EAAE;AAC9G,QAAM,IAAI,KAAK,UAAU;AACzB,QAAM,KAAK,oBAAI,IAAoB;AACnC,MAAI,WAAW;AACf,aAAW,KAAK,MAAM;AACpB,gBAAY,EAAE,MAAM;AACpB,eAAW,KAAK,IAAI,IAAI,EAAE,KAAK,EAAG,IAAG,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,KAAK;AAG9B,MAAI,WAAW;AACf,MAAI,eAAe,QAAW;AAC5B,eAAW,KAAK,MAAM;AACpB,UAAI,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,UAAU,CAAC,EAAG;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,gBAAgB,WAAW,UAAU,eAAe,SAAY,IAAI;AAC1E,QAAM,UAA6B,CAAC;AAEpC,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,oBAAI,IAAoB;AACnC,eAAW,KAAK,EAAE,MAAO,IAAG,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AAEvD,UAAM,UAAwC,CAAC;AAC/C,eAAW,MAAM,YAAY;AAC3B,YAAM,IAAI,GAAG,IAAI,EAAE,KAAK;AACxB,UAAI,IAAI,EAAG,SAAQ,KAAK,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;AAAA,IACxD;AACA,QAAI,eAAe,QAAW;AAC5B,UAAI,MAAM;AACV,iBAAW,CAAC,GAAG,CAAC,KAAK,GAAI,KAAI,EAAE,WAAW,UAAU,EAAG,QAAO;AAC9D,UAAI,MAAM,EAAG,SAAQ,KAAK,EAAE,IAAI,KAAK,IAAI,SAAS,CAAC;AAAA,IACrD;AAEA,QAAI,QAAQ,WAAW,EAAG;AAC1B,QAAI,UAAU,SAAS,QAAQ,SAAS,cAAe;AAEvD,QAAI,QAAQ;AACZ,eAAW,KAAK,SAAS;AACvB,YAAM,MAAM,KAAK,IAAI,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI;AACxD,YAAM,QAAQ,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,MAAM,SAAS;AACzD,eAAS,OAAQ,EAAE,MAAM,KAAK,MAAO,SAAS;AAAA,IAChD;AACA,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,QAAQ,EAAE,OAAO,CAAC;AAAA,EACpD;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AACxC,SAAO,KAAK,UAAU,SAAY,QAAQ,MAAM,GAAG,KAAK,KAAK,IAAI;AACnE;;;ACrGA,IAAM,YAAY,IAAI,KAAK,UAAU,QAAW,EAAE,aAAa,OAAO,CAAC;AAQhE,IAAM,gBAAgB,CAAC,SAA0B;AACtD,QAAM,MAAe,CAAC;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,aAAW,KAAK,UAAU,QAAQ,IAAI,GAAG;AACvC,QAAI,EAAE,WAAY,KAAI,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAU,MAAM,EAAE,YAAY,GAAG,QAAQ,EAAE,MAAM,CAAC;AAAA,EACjG;AACA,SAAO;AACT;AAGO,IAAM,mBAA8B,CAAC,SAC1C,cAAc,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;;;ACqBvC,IAAM,SAAS;AAQR,SAAS,iBAAiB,OAA4B;AAC3D,QAAM,UAA0B,CAAC;AACjC,QAAM,OAAO,MAAM,QAAQ,QAAQ,CAAC,IAAI,MAAc,SAA6B;AACjF,UAAM,QAAQ,iBAAiB,IAAI;AAInC,QAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,EAAE,OAAO,MAAM,SAAS,SAAY,SAAY,OAAO,IAAI,EAAE,CAAC;AACjG,WAAO;AAAA,EACT,CAAC;AACD,SAAO,EAAE,OAAO,iBAAiB,IAAI,GAAG,QAAQ;AAClD;AASO,SAAS,YACd,WACA,QACkC;AAClC,QAAM,QAA+B,CAAC;AACtC,aAAW,KAAK,OAAO,OAAO;AAC5B,UAAM,IAAI,UAAU,IAAI,CAAC;AACzB,QAAI,MAAM,UAAa,EAAE,WAAW,EAAG,QAAO;AAC9C,UAAM,KAAK,CAAC;AAAA,EACd;AACA,SAAO,OAAO,SAAS,SACnB,qBAAqB,KAAK,IAC1B,YAAY,aAAa,OAAO,OAAO,KAAK,GAAG,OAAO,MAAM,SAAS,OAAO,IAAI;AACtF;AAEA,IAAM,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG;AAGvC,SAAS,qBAAqB,OAAyE;AACrG,QAAM,OAAO,MAAM,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;AACjD,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,aAAW,KAAK,MAAM,CAAC,GAAI;AACzB,QAAI,KAAK;AACT,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAI,CAAC,KAAK,CAAC,EAAG,IAAI,IAAI,IAAI,CAAC,GAAG;AAAE,aAAK;AAAO;AAAA,MAAM;AAAA,IACpD;AACA,QAAI,IAAI;AAAE;AAAS,UAAI,QAAQ,EAAG,SAAQ;AAAA,IAAE;AAAA,EAC9C;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;AAIA,SAAS,aACP,OACA,OACgC;AAChC,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAA6B,CAAC;AACpC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,QAAI,KAAK,IAAI,MAAM,CAAC,CAAE,EAAG;AACzB,SAAK,IAAI,MAAM,CAAC,CAAE;AAClB,QAAI,KAAK,MAAM,CAAC,CAAE;AAAA,EACpB;AACA,SAAO;AACT;AASA,SAAS,YACP,OACA,MACkC;AAClC,QAAM,SAA0C,CAAC;AACjD,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,YAAW,KAAK,MAAM,CAAC,EAAI,QAAO,KAAK,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;AACjG,SAAO,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;AAEtD,QAAM,OAAO,MAAM;AACnB,QAAM,OAAO,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAC3C,MAAI,WAAW;AACf,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,KAAK,OAAO,KAAK,EAAG;AAC1B,QAAI,KAAK,EAAE,MAAO,EAAG;AACrB,SAAK,EAAE,IAAI,KAAK,EAAE,IAAK;AACvB,WAAO,aAAa,QAAQ,KAAK,OAAO,IAAI,EAAG,IAAI,IAAK,GAAG;AACzD,YAAM,KAAK,OAAO,IAAI,EAAG;AACzB,WAAK,EAAE,IAAI,KAAK,EAAE,IAAK;AACvB;AAAA,IACF;AACA,QAAI,aAAa,QAAQ,OAAO,KAAK,EAAG,MAAM,OAAO,IAAI,EAAG,MAAM,KAAK,MAAM;AAC3E;AACA,UAAI,QAAQ,EAAG,SAAQ,OAAO,IAAI,EAAG;AAAA,IACvC;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;;;ACxIA,IAAMA,MAAK;AACX,IAAMC,KAAI;AAkDH,IAAM,yBAAyB;AA0B/B,IAAM,gBAAN,MAAM,eAAc;AAAA;AAAA,EAER,aAAa,oBAAI,IAAsE;AAAA,EACvF,OAAc,CAAC;AAAA,EACxB,YAAiC;AAAA,EAEzC,OAAO,MAAM,MAA+B,OAA0B,CAAC,GAAkB;AACvF,UAAM,MAAM,IAAI,eAAc;AAC9B,UAAM,aAAa,IAAI,IAAI,KAAK,aAAa,CAAC,CAAC;AAC/C,QAAI,YAAY;AAChB,eAAW,KAAK,MAAM;AACpB,iBAAW,KAAK,EAAE,QAAQ;AACxB,cAAM,SAAS,cAAc,EAAE,IAAI;AACnC,cAAM,KAAK,oBAAI,IAAoB;AACnC,cAAM,cAAc,oBAAI,IAAoB;AAC5C,cAAM,MAAM,WAAW,IAAI,EAAE,KAAK,IAAI,oBAAI,IAAsB,IAAI;AACpE,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAM,IAAI,OAAO,CAAC;AAClB,aAAG,IAAI,EAAE,OAAO,GAAG,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC;AACxC,cAAI,CAAC,YAAY,IAAI,EAAE,IAAI,EAAG,aAAY,IAAI,EAAE,MAAM,EAAE,MAAM;AAC9D,cAAI,KAAK;AACP,kBAAM,OAAO,IAAI,IAAI,EAAE,IAAI;AAC3B,gBAAI,KAAM,MAAK,KAAK,CAAC;AAAA,gBAChB,KAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAAA,UAC1B;AAAA,QACF;AACA,cAAM,MAAW;AAAA,UACf,IAAI,EAAE;AAAA,UAAI,OAAO,EAAE;AAAA,UAAO,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,UAC/E,MAAM,EAAE;AAAA,UAAM,KAAK,OAAO;AAAA,UAAQ;AAAA,UAAI;AAAA,UAAa,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,QAC1E;AACA,YAAI,KAAK,KAAK,GAAG;AACjB,YAAI,IAAI,IAAI,WAAW,IAAI,EAAE,KAAK;AAClC,YAAI,CAAC,GAAG;AAAE,cAAI,EAAE,IAAI,oBAAI,IAAI,GAAG,GAAG,GAAG,UAAU,EAAE;AAAG,cAAI,WAAW,IAAI,EAAE,OAAO,CAAC;AAAA,QAAE;AACnF,UAAE,KAAK;AACP,UAAE,YAAY,IAAI;AAClB,mBAAW,QAAQ,GAAG,KAAK,EAAG,GAAE,GAAG,IAAI,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,MACxE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,iBAAsC;AAAE,WAAO,KAAK;AAAA,EAAU;AAAA,EAElE,MAAM,OAAe,OAAqB,CAAC,GAAe;AACxD,UAAM,SAAS,iBAAiB,KAAK;AACrC,QAAI,OAAO,QAAQ,SAAS,KAAK,KAAK,UAAU,SAAS,GAAG;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,KAAK,UAAU,UAAU,MAAM,SAAS;AAC3D,UAAM,QAAQ,YAAY,MAAM,MAAM,GAAG,EAAE,IAAI;AAC/C,UAAM,SAAS,YAAY,MAAM,MAAM,SAAS,CAAC,IAAI;AACrD,QAAI,MAAM,WAAW,KAAK,WAAW,UAAa,OAAO,QAAQ,WAAW,EAAG,QAAO,CAAC;AACvF,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,WAAW,MAAM,UAAU,WAAW,SAAY,IAAI,KAAK,OAAO,QAAQ;AAGhF,UAAM,OAAO,oBAAI,IAAsB;AACvC,eAAW,OAAO,KAAK,MAAM;AAC3B,UAAI,KAAK,WAAW,UAAa,CAAC,KAAK,OAAO,SAAS,IAAI,KAAK,EAAG;AACnE,YAAM,QAAQ,KAAK,WAAW,IAAI,IAAI,KAAK;AAC3C,YAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAC1C,UAAI,QAAQ;AACZ,UAAI,eAAe;AACnB,UAAI,gBAAgB;AAEpB,YAAM,YAAY,CAAC,IAAY,IAAY,WAAyB;AAClE,YAAI,MAAM,EAAG;AACb,wBAAgB;AAChB,YAAI,gBAAgB,KAAK,UAAU,EAAG,iBAAgB;AACtD,cAAM,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,KAAK,QAAQ,KAAK,IAAI;AAC1D,cAAM,QAAQ,KAAKD,OAAM,IAAIC,KAAIA,MAAK,IAAI,MAAM;AAChD,iBAAS,OAAQ,MAAMD,MAAK,MAAO,SAAS;AAAA,MAC9C;AAIA,iBAAW,UAAU,OAAO,SAAS;AACnC,YAAI,CAAC,IAAI,IAAK;AACd,cAAM,IAAI,YAAY,IAAI,KAAK,MAAM;AACrC,YAAI,EAAE,UAAU,EAAG;AAInB,YAAI,KAAK;AACT,mBAAW,KAAK,OAAO,MAAO,MAAK,KAAK,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;AACpE,kBAAU,EAAE,OAAO,OAAO,WAAW,IAAI,MAAM,GAAG,KAAK,aAAa,KAAK,EAAE,KAAK,CAAC;AAAA,MACnF;AAEA,iBAAW,MAAM,MAAO,WAAU,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,YAAY,IAAI,EAAE,KAAK,EAAE;AAE3G,UAAI,WAAW,QAAW;AAGxB,cAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,YAAI,MAAM;AACV,YAAI,OAAO;AACX,mBAAW,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;AAC9B,cAAI,KAAK,WAAW,MAAM,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG;AAClD,mBAAO;AACP,gBAAI,OAAO,EAAG,QAAO,IAAI,YAAY,IAAI,IAAI,KAAK;AAAA,UACpD;AAAA,QACF;AACA,YAAI,MAAM,GAAG;AAGX,cAAI,MAAM;AACV,qBAAW,KAAK,KAAK,MAAM;AACzB,gBAAI,EAAE,UAAU,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EAAG;AAAA,UACnF;AACA,oBAAU,KAAK,OAAO,GAAG,IAAI;AAAA,QAC/B;AAAA,MACF;AAEA,UAAI,iBAAiB,EAAG;AACxB,UAAI,UAAU,SAAS,eAAe,SAAU;AAIhD,YAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,UAAI,UAAU,UAAa,UAAU,EAAG,UAAS;AAEjD,YAAM,MAAgB;AAAA,QACpB,IAAI,IAAI;AAAA,QAAI;AAAA,QAAO,OAAO,IAAI;AAAA,QAAO,MAAM,IAAI;AAAA,QAC/C,QAAQ,gBAAgB,IAAI,IAAI;AAAA,QAChC,GAAI,IAAI,WAAW,SAAY,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,MAC3D;AACA,YAAM,OAAO,KAAK,IAAI,IAAI,EAAE;AAC5B,UAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAO,MAAK,IAAI,IAAI,IAAI,GAAG;AAAA,IAC3D;AAEA,UAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AACnE,WAAO,KAAK,UAAU,SAAY,QAAQ,MAAM,GAAG,KAAK,KAAK,IAAI;AAAA,EACnE;AAAA;AAAA,EAGQ,aAAa,KAAU,UAA0B;AACvD,QAAI,WAAW,EAAG,QAAO;AACzB,WAAO,cAAc,IAAI,IAAI,EAAE,QAAQ,GAAG,UAAU;AAAA,EACtD;AAAA,EAEA,aAA4B;AAC1B,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW,CAAC,GAAG,KAAK,SAAS;AAAA,MAC7B,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC;AAAA,MACrG,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO;AAAA,QAC1B,IAAI,EAAE;AAAA,QAAI,OAAO,EAAE;AAAA,QAAO,MAAM,EAAE;AAAA,QAAM,KAAK,EAAE;AAAA,QAC/C,IAAI,CAAC,GAAG,EAAE,EAAE;AAAA,QAAG,aAAa,CAAC,GAAG,EAAE,WAAW;AAAA,QAC7C,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,QACrD,GAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAA0B,IAAI,CAAC;AAAA,MAC7D,EAAE;AAAA,IACJ;AAAA,EACF;AAAA,EAEA,OAAO,aAAa,GAAiC;AACnD,UAAM,MAAM,IAAI,eAAc;AAC9B,QAAI,YAAY,IAAI,IAAI,EAAE,SAAS;AACnC,eAAW,CAAC,GAAG,EAAE,KAAK,EAAE,WAAY,KAAI,WAAW,IAAI,GAAG,EAAE,IAAI,IAAI,IAAI,GAAG,EAAE,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,SAAS,CAAC;AAChH,eAAW,KAAK,EAAE,MAAM;AACtB,UAAI,KAAK,KAAK;AAAA,QACZ,IAAI,EAAE;AAAA,QAAI,OAAO,EAAE;AAAA,QAAO,MAAM,EAAE;AAAA,QAAM,KAAK,EAAE;AAAA,QAC/C,IAAI,IAAI,IAAI,EAAE,EAAE;AAAA,QAAG,aAAa,IAAI,IAAI,EAAE,WAAW;AAAA,QACrD,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,QACrD,GAAI,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACtE,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,eAAoC,oBAAI,IAAI;;;AChR3C,SAAS,eAAe,MAAc,QAAgB,SAAS,IAAY;AAChF,QAAM,QAAQ,MAAM,KAAK,IAAI;AAC7B,MAAI,MAAM,UAAU,OAAQ,QAAO;AAEnC,QAAM,WAAW,MAAM,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE;AAChE,QAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,MAAI,QAAQ,KAAK,IAAI,GAAG,WAAW,IAAI;AACvC,QAAM,MAAM,KAAK,IAAI,MAAM,QAAQ,QAAQ,MAAM;AACjD,UAAQ,KAAK,IAAI,GAAG,MAAM,MAAM;AAChC,QAAM,OAAO,MAAM,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE;AAC5C,SAAO,GAAG,QAAQ,IAAI,WAAM,EAAE,GAAG,IAAI,GAAG,MAAM,MAAM,SAAS,WAAM,EAAE;AACvE;;;ACCO,IAAM,mBAAN,MAA6C;AAAA,EAC1C;AAAA,EAER,IAAI,QAAiB;AAAE,WAAO,KAAK,UAAU;AAAA,EAAU;AAAA,EAEvD,MAAM,YAAY,OAAsC,MAAkD;AACxG,QAAI,KAAK,UAAU,OAAW,MAAK,QAAQ,cAAc,MAAM,MAAM,GAAG,IAAI;AAC5E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,YAAkB;AAAE,SAAK,QAAQ;AAAA,EAAU;AAAA,EAE3C,MAAM,QAAuB;AAAA,EAAsC;AACrE;;;ACTO,SAAS,wBACd,QACA,aACA,MACc;AACd,QAAM,SAAS,OAAO,YAAY,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI;AACpE,QAAM,MAAoB,CAAC;AAC3B,aAAW,SAAS,QAAQ;AAC1B,eAAW,QAAQ,UAAU,QAAQ,KAAK,GAAG;AAC3C,UAAI,OAAO,SAAS,YAAY,SAAS,GAAI,KAAI,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,IAC7E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,sBACd,QACA,YACA,aACA,MACc;AACd,QAAM,UAAU,OAAO,YAAY,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,aAAa,OAAO,CAAC,MAAM,KAAK,UAAU;AAC/G,QAAM,MAAoB,CAAC;AAC3B,aAAW,SAAS,QAAQ;AAC1B,eAAW,QAAQ,UAAU,QAAQ,KAAK,GAAG;AAC3C,UAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG;AAC9D,iBAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,YAAI,OAAO,QAAQ,YAAY,QAAQ,GAAI,KAAI,KAAK,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,yBACd,QACA,eACA,WACA,aACA,MACc;AACd,QAAM,UAAU,OAAO,YAAY,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,aAAa,OAAO,CAAC,MAAM,KAAK,aAAa;AAClH,QAAM,MAAoB,CAAC;AAC3B,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,UAAU,IAAI,KAAK;AAC/B,QAAI,CAAC,IAAK;AACV,eAAW,QAAQ,UAAU,QAAQ,KAAK,GAAG;AAC3C,YAAM,OAAO,OAAO,SAAS,WAAW,CAAC,IAAI,IAAI,MAAM,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;AACjI,iBAAW,OAAO,MAAM;AACtB,cAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,YAAI,CAAC,OAAQ;AACb,mBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,cAAI,UAAU,GAAI,KAAI,KAAK,EAAE,OAAO,QAAQ,MAAM,MAAM,CAAC;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,sBAAsB,kBAAuD;AAC3F,QAAM,MAAoB,CAAC;AAC3B,aAAW,CAAC,OAAO,KAAK,KAAK,kBAAkB;AAC7C,eAAW,QAAQ,MAAO,KAAI,SAAS,GAAI,KAAI,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;;;AClFO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,OAAO,OAAO,MAAM;AACpC,YAAM,EAAE,OAAO,IAAI,MAAM,OAAO,iCAAwB;AACxD,aAAO,OAAO,KAAK,OAAO,OAAO,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,SAAS,KAAK,OAAO,MAAM;AAC/B,YAAM,EAAE,SAAS,IAAI,MAAM,OAAO,iCAAwB;AAC1D,aAAO,SAAS,KAAK,OAAO,IAAI;AAAA,IAClC;AAAA,IACA,MAAM,UAAU,KAAK,QAAQ,MAAM;AACjC,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,iCAAwB;AAC3D,aAAO,UAAU,KAAK,QAAQ,IAAI;AAAA,IACpC;AAAA,IACA,MAAM,UAAU,KAAK;AACnB,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,iCAAwB;AAC3D,aAAO,UAAU,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,iCAAwB;AAC5D,aAAO,WAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,aAAa,KAAK,IAAI,QAAQ,SAAS;AAC3C,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,iCAAwB;AAC9D,aAAO,aAAa,KAAK,IAAI,QAAQ,OAAO;AAAA,IAC9C;AAAA,IACA,MAAM,kBAAkB,KAAK;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,iCAAwB;AACnE,aAAO,kBAAkB,GAAG;AAAA,IAC9B;AAAA,EACF;AACF;;;ACLO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,WAAW;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACtD,MAAM,YAAY;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACtD,MAAM,aAAa;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACvD,MAAM,eAAe;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACzD,MAAM,oBAAoB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAChE;","names":["K1","B"]}

package/dist/chunk-RHVMZSUU.js

@@ -0,0 +1,7 @@
+// src/port/with/coverage-strategy.ts
+var NO_COVERAGE = { observer: () => void 0 };
+
+export {
+  NO_COVERAGE
+};
+//# sourceMappingURL=chunk-RHVMZSUU.js.map

package/dist/chunk-RHVMZSUU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/coverage-strategy.ts"],"sourcesContent":["/**\n * Read-coverage sensor contract (#1363, from the #1251 design).\n *\n * ⛔⛔ **THIS IS TELEMETRY. IT IS NOT A CONTROL.** Against an insider holding\n * the device and local keys, it prevents nothing — they hold the DEK, so the\n * plaintext is derivable whatever hub decides. What it does is make bulk\n * extraction **visible early, attributable and loud**. The real remediation is\n * key custody — tiers and per-collection DEKs — and any deployment that reads\n * this as a control has been made *less* safe by it, because it stops building\n * the key boundary that would actually bind.\n *\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`RecordCodec` can hold the {@link NO_COVERAGE}\n * floor default without a spine→service static import.\n *\n * ⛔ There is deliberately NO refusal path here, and none may be added. The\n * design ruled (#1251 §3) that set-completion ALERTING beats threshold\n * blocking: a refusal at a boundary is a threshold the reader can\n * binary-search, and a signal is not. Adding \"just an option\" to refuse\n * reintroduces exactly the objection the shape was chosen to dissolve.\n *\n * @internal\n */\n\n/**\n * The one event every sensor in the #1251 design emits, whatever its\n * enforcement point — so a controller subscribes once. Emitted on the Noydb\n * event bus as `'coverage:threshold'`.\n */\nexport interface CoverageEvent {\n  /** Authenticated identity the reads are attributed to (`keyring.userId`). */\n  readonly principal: string\n  readonly vault: string\n  readonly collection: string\n  /** Records novel to this window (Bloom-estimated; under-reports, never over). */\n  readonly novel: number\n  /** Decrypts served to this principal for this collection, all time. */\n  readonly served: number\n  /** Distinct-ever-decrypted as a fraction of the declared corpus, 0..1 (HLL-estimated). */\n  readonly coverage: number\n  /** ISO-8601 start of the window the crossing was observed in. */\n  readonly window: string\n  /** Which sensor produced it. `'hub/coverage'` for this one. */\n  readonly source: string\n}\n\n/**\n * The decrypt observer: called once per record decrypt, with the record id.\n *\n * ⛔ The id is passed so the sketch can be UPDATED with it, and must never be\n * retained. See `with-audit/coverage/sketch.ts`.\n */\nexport type CoverageObserver = (id: string) => void\n\n/** The minimal emitter slice the sensor needs. Structural, to avoid an import. */\nexport interface CoverageEmitter {\n  emit(event: 'coverage:threshold', data: CoverageEvent): void\n}\n\n/** Field descriptors, read only for the `bulk` axis. Structural by design. */\nexport type CoverageFieldMeta = Readonly<Record<string, { readonly bulk?: 'sensitive' }>>\n\nexport interface CoverageStrategy {\n  /**\n   * Resolve the decrypt observer for one collection, or `undefined` when\n   * nothing should be accounted — which is the un-opted-in case, and also the\n   * opted-in case for a collection declaring no `bulk: 'sensitive'` field.\n   *\n   * `fieldMeta` is a THUNK because `fieldMeta` can be attached to a Collection\n   * after construction (`_applyFieldMeta`, first-wins), and this is called\n   * from the constructor.\n   *\n   * ⛔ `eager` is load-bearing, not informational — see the eager-hydration\n   * note in `with-audit/coverage/accounting.ts`. An eager collection decrypts\n   * its WHOLE corpus at hydration, so a decrypt-point sensor reads 100%\n   * coverage for anyone who opens the vault.\n   */\n  observer(\n    vault: string,\n    collection: string,\n    principal: string,\n    fieldMeta: () => CoverageFieldMeta | undefined,\n    emitter: CoverageEmitter,\n    eager: boolean,\n  ): CoverageObserver | undefined\n}\n\n/**\n * The un-opted-in floor: no observer, therefore no accounting, no allocation\n * per read, and no coverage code in the bundle. `Collection` calls\n * `observer()` once at construction and stores `undefined`; `RecordCodec`'s\n * hot path is a single `!== undefined` test.\n */\nexport const NO_COVERAGE: CoverageStrategy = { observer: () => undefined }\n"],"mappings":";AA6FO,IAAM,cAAgC,EAAE,UAAU,MAAM,OAAU;","names":[]}

package/dist/{chunk-BUE2D7PX.js → chunk-SMV2HRDU.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -149,4 +149,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-BUE2D7PX.js.map
+//# sourceMappingURL=chunk-SMV2HRDU.js.map