@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/coverage/index.js

@@ -0,0 +1,306 @@
+import {
+  NO_COVERAGE
+} from "../chunk-RHVMZSUU.js";
+
+// src/with-audit/coverage/sketch.ts
+function fnv1a(s, seed = 2166136261) {
+  let h = seed >>> 0;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  h ^= h >>> 16;
+  h = Math.imul(h, 2246822507) >>> 0;
+  h ^= h >>> 13;
+  h = Math.imul(h, 3266489909) >>> 0;
+  h ^= h >>> 16;
+  return h >>> 0;
+}
+var HyperLogLog = class _HyperLogLog {
+  precision;
+  registers;
+  constructor(precision = 14) {
+    if (!Number.isInteger(precision) || precision < 4 || precision > 16) {
+      throw new RangeError(`HyperLogLog precision must be an integer in [4,16], got ${precision}`);
+    }
+    this.precision = precision;
+    this.registers = new Uint8Array(1 << precision);
+  }
+  add(id) {
+    const h = fnv1a(id);
+    const idx = h >>> 32 - this.precision;
+    const rest = h << this.precision >>> 0;
+    const rank = rest === 0 ? 32 - this.precision + 1 : Math.clz32(rest) + 1;
+    if (rank > this.registers[idx]) this.registers[idx] = rank;
+  }
+  /** Estimated distinct count. */
+  count() {
+    const m = this.registers.length;
+    let zeros = 0;
+    let sum = 0;
+    for (let i = 0; i < m; i++) {
+      const r = this.registers[i];
+      if (r === 0) zeros++;
+      sum += 2 ** -r;
+    }
+    const alpha = m === 16 ? 0.673 : m === 32 ? 0.697 : m === 64 ? 0.709 : 0.7213 / (1 + 1.079 / m);
+    const raw = alpha * m * m / sum;
+    if (raw <= 2.5 * m && zeros > 0) return Math.round(m * Math.log(m / zeros));
+    return Math.round(raw);
+  }
+  /** Serializable state — registers only. No id, no id-derived key. */
+  toJSON() {
+    let bin = "";
+    for (const b of this.registers) bin += String.fromCharCode(b);
+    return { p: this.precision, r: btoa(bin) };
+  }
+  static fromJSON(state) {
+    const hll = new _HyperLogLog(state.p);
+    const bin = atob(state.r);
+    for (let i = 0; i < hll.registers.length && i < bin.length; i++) {
+      hll.registers[i] = bin.charCodeAt(i);
+    }
+    return hll;
+  }
+};
+var BloomFilter = class {
+  bits;
+  hashes;
+  words;
+  constructor(bits = 1 << 14, hashes = 7) {
+    if (!Number.isInteger(bits) || bits < 64) throw new RangeError(`Bloom bits must be >= 64, got ${bits}`);
+    if (!Number.isInteger(hashes) || hashes < 1 || hashes > 16) {
+      throw new RangeError(`Bloom hashes must be in [1,16], got ${hashes}`);
+    }
+    this.bits = bits;
+    this.hashes = hashes;
+    this.words = new Uint32Array(Math.ceil(bits / 32));
+  }
+  /** Set the id's bits; returns true when the id was NOT already present. */
+  addIfAbsent(id) {
+    const h1 = fnv1a(id);
+    const h2 = fnv1a(id, 2654435761) | 1;
+    let novel = false;
+    for (let i = 0; i < this.hashes; i++) {
+      const bit = h1 + Math.imul(i, h2) >>> 0;
+      const pos = bit % this.bits;
+      const w = pos >>> 5;
+      const mask = 1 << (pos & 31);
+      if ((this.words[w] & mask) === 0) {
+        this.words[w] = this.words[w] | mask;
+        novel = true;
+      }
+    }
+    return novel;
+  }
+  clear() {
+    this.words.fill(0);
+  }
+};
+
+// src/with-audit/coverage/accounting.ts
+var DEFAULT_ALERT_AT = [0.6, 0.9];
+var HOUR_MS = 36e5;
+var Account = class {
+  constructor(principal, vault, collection, opts) {
+    this.principal = principal;
+    this.vault = vault;
+    this.collection = collection;
+    this.hll = new HyperLogLog(opts.precision);
+    this.bloom = new BloomFilter(opts.bloomBits, opts.bloomHashes);
+    this.windowStart = opts.now;
+  }
+  principal;
+  vault;
+  collection;
+  hll;
+  bloom;
+  served = 0;
+  servedInWindow = 0;
+  novelInWindow = 0;
+  windowStart;
+  /** Running mean of previous windows' served counts, for burstiness. */
+  servedMean = 0;
+  windowsClosed = 0;
+  fired = /* @__PURE__ */ new Set();
+};
+var CoverageRegistry = class {
+  #accounts = /* @__PURE__ */ new Map();
+  #precision;
+  #bloomBits;
+  #bloomHashes;
+  #windowMs;
+  #collections;
+  #now;
+  #warnedEager = /* @__PURE__ */ new Set();
+  constructor(opts = {}) {
+    this.#precision = opts.precision ?? 14;
+    this.#bloomBits = opts.bloomBits ?? 1 << 14;
+    this.#bloomHashes = opts.bloomHashes ?? 7;
+    this.#windowMs = opts.windowMs ?? HOUR_MS;
+    this.#collections = opts.collections ?? {};
+    this.#now = opts.now ?? (() => Date.now());
+    if (this.#windowMs <= 0) throw new RangeError(`windowMs must be > 0, got ${this.#windowMs}`);
+  }
+  observer(vault, collection, principal, fieldMeta, emitter, eager) {
+    let accounted;
+    return (id) => {
+      accounted ??= this.#resolveAccounted(collection, fieldMeta(), eager);
+      if (!accounted) return;
+      this.#record(principal, vault, collection, id, emitter);
+    };
+  }
+  /**
+   * ⛔⛔ THE MEASUREMENT THAT DECIDES WHETHER THIS SENSOR SAYS ANYTHING TRUE.
+   *
+   * The design's unit is "the record decrypt". In hub that is only the same
+   * thing as "the record was read" for a LAZY collection (`prefetch: false`),
+   * where reads go per-id against the store. An EAGER collection — the default
+   * — decrypts its entire corpus once, at hydration, into the working set:
+   * measured on a 30-record collection, one `get()` after reopening the vault
+   * took the sensor from 0 to `coverage: 1`. Every principal who so much as
+   * opens the vault would trip every threshold.
+   *
+   * A sensor that reports total coverage for everyone is worse than no sensor:
+   * it is exactly the "invites reliance" failure this feature is supposed to
+   * be honest about. So an eager bulk-declared collection is NOT accounted,
+   * and the refusal is LOUD — silence here would look identical to "nobody has
+   * read anything", which is the most dangerous possible false negative.
+   *
+   * The codec cannot tell hydration from a read (it sees neither caller nor
+   * intent), so this cannot be fixed inside the sensor. Declaring the
+   * collection lazy is the fix, and the warning says so.
+   */
+  #resolveAccounted(collection, fieldMeta, eager) {
+    const declared = this.#collections[collection] !== void 0 || declaresBulk(fieldMeta);
+    if (!declared) return false;
+    if (!eager) return true;
+    if (!this.#warnedEager.has(collection)) {
+      this.#warnedEager.add(collection);
+      console.warn(
+        `[noy-db] withCoverage(): collection "${collection}" is bulk-declared but EAGER, so it is NOT accounted. An eager collection decrypts its whole corpus at hydration, which would read as 100% coverage for every principal that opens the vault. Declare it \`prefetch: false\` (with a \`cache\` budget) to make its reads countable. Coverage is telemetry either way \u2014 the remediation for bulk exposure is key custody (tiers, per-collection DEKs).`
+      );
+    }
+    return false;
+  }
+  #account(principal, vault, collection, now) {
+    const k = JSON.stringify([principal, vault, collection]);
+    let acc = this.#accounts.get(k);
+    if (acc === void 0) {
+      acc = new Account(principal, vault, collection, {
+        precision: this.#precision,
+        bloomBits: this.#bloomBits,
+        bloomHashes: this.#bloomHashes,
+        now
+      });
+      this.#accounts.set(k, acc);
+    }
+    return acc;
+  }
+  #record(principal, vault, collection, id, emitter) {
+    const now = this.#now();
+    const acc = this.#account(principal, vault, collection, now);
+    if (now - acc.windowStart >= this.#windowMs) {
+      acc.servedMean = acc.windowsClosed === 0 ? acc.servedInWindow : (acc.servedMean * acc.windowsClosed + acc.servedInWindow) / (acc.windowsClosed + 1);
+      acc.windowsClosed++;
+      acc.bloom.clear();
+      acc.servedInWindow = 0;
+      acc.novelInWindow = 0;
+      acc.windowStart = now;
+    }
+    acc.hll.add(id);
+    if (acc.bloom.addIfAbsent(id)) acc.novelInWindow++;
+    acc.served++;
+    acc.servedInWindow++;
+    const policy = this.#collections[collection];
+    const corpusSize = policy?.corpusSize;
+    if (corpusSize === void 0 || corpusSize <= 0) return;
+    const coverage = Math.min(1, acc.hll.count() / corpusSize);
+    for (const t of policy?.alertAt ?? DEFAULT_ALERT_AT) {
+      if (coverage < t || acc.fired.has(t)) continue;
+      acc.fired.add(t);
+      const event = {
+        principal,
+        vault,
+        collection,
+        novel: acc.novelInWindow,
+        served: acc.served,
+        coverage,
+        window: new Date(acc.windowStart).toISOString(),
+        source: "hub/coverage"
+      };
+      emitter.emit("coverage:threshold", event);
+    }
+  }
+  /** Current accounting, for an operator surface. Estimates, never exact. */
+  stats() {
+    const out = [];
+    for (const acc of this.#accounts.values()) {
+      const corpusSize = this.#collections[acc.collection]?.corpusSize;
+      const distinct = acc.hll.count();
+      out.push({
+        principal: acc.principal,
+        vault: acc.vault,
+        collection: acc.collection,
+        distinct,
+        served: acc.served,
+        novelInWindow: acc.novelInWindow,
+        servedInWindow: acc.servedInWindow,
+        burstiness: acc.servedMean > 0 ? acc.servedInWindow / acc.servedMean : 1,
+        ...corpusSize !== void 0 && corpusSize > 0 ? { coverage: Math.min(1, distinct / corpusSize) } : {},
+        window: new Date(acc.windowStart).toISOString()
+      });
+    }
+    return out;
+  }
+  /**
+   * Serializable state, for a deployment that wants coverage to survive a
+   * restart — the horizon must exceed tenure, and a process does not.
+   * ⛔ Sketches only. Never a record id: see {@link CoverageSnapshot}.
+   */
+  snapshot() {
+    const entries = [];
+    for (const acc of this.#accounts.values()) {
+      entries.push({
+        principal: acc.principal,
+        vault: acc.vault,
+        collection: acc.collection,
+        hll: acc.hll.toJSON(),
+        served: acc.served,
+        windowStart: acc.windowStart
+      });
+    }
+    return { _noydb_coverage: 1, entries };
+  }
+  /**
+   * Restore a snapshot. The novelty filter is deliberately NOT restored:
+   * novelty is a within-window notion and the window did not survive.
+   * Distinct-ever did, which is the quantity that must not reset.
+   */
+  restore(snapshot) {
+    for (const e of snapshot.entries) {
+      const acc = this.#account(e.principal, e.vault, e.collection, e.windowStart);
+      acc.hll = HyperLogLog.fromJSON(e.hll);
+      acc.served = e.served;
+      acc.windowStart = e.windowStart;
+    }
+  }
+};
+function declaresBulk(fieldMeta) {
+  if (fieldMeta === void 0) return false;
+  for (const meta of Object.values(fieldMeta)) if (meta?.bulk === "sensitive") return true;
+  return false;
+}
+
+// src/with-audit/coverage/active.ts
+function withCoverage(opts = {}) {
+  return new CoverageRegistry(opts);
+}
+export {
+  BloomFilter,
+  CoverageRegistry,
+  HyperLogLog,
+  NO_COVERAGE,
+  withCoverage
+};
+//# sourceMappingURL=index.js.map

package/dist/coverage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-audit/coverage/sketch.ts","../../src/with-audit/coverage/accounting.ts","../../src/with-audit/coverage/active.ts"],"sourcesContent":["/**\n * Bounded-size sketches for the coverage sensor (#1363).\n *\n * ⚠️ THE WHOLE POINT OF A SKETCH HERE IS WHAT IT CANNOT DO. Coverage state\n * answers *\"how much of this corpus has this principal seen\"*, and the exact\n * answer — the id set — is a SECOND COPY OF THE SENSITIVE SET. A sensor built\n * to notice bulk extraction would then be the best single artefact to extract.\n * So no structure in this module retains a record id, and none can be\n * enumerated back into one: HyperLogLog keeps per-register leading-zero ranks,\n * Bloom keeps bits. Both are lossy on purpose, and the accuracy that costs is\n * the price of the property (`no-record-ids.test.ts` pins it).\n *\n * @module\n */\n\n/** 32-bit FNV-1a. Not cryptographic — a sketch only needs good dispersion. */\nfunction fnv1a(s: string, seed = 0x811c9dc5): number {\n  let h = seed >>> 0\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  // Final avalanche (murmur3 fmix32) — FNV alone disperses low bits poorly,\n  // and HLL reads the TOP bits for the register index.\n  h ^= h >>> 16\n  h = Math.imul(h, 0x85ebca6b) >>> 0\n  h ^= h >>> 13\n  h = Math.imul(h, 0xc2b2ae35) >>> 0\n  h ^= h >>> 16\n  return h >>> 0\n}\n\n// ─── HyperLogLog — distinct ids ever decrypted ────────────────────────────\n\n/**\n * HyperLogLog over `2^precision` one-byte registers.\n *\n * ⭐ SIZING IS THE OPEN QUESTION THIS FEATURE SHIPS WITH, not a settled\n * default. At the scale the design anticipates (~1k records, ~30 principals)\n * the estimator runs entirely in its LINEAR-COUNTING range, where accuracy is\n * a function of load factor rather than of HLL's asymptotic 1.04/√m. So the\n * default is chosen by MEASUREMENT, not theory — `__tests__/coverage/sketch.test.ts`\n * pins the error band this implementation actually produces:\n *\n * | distinct ids | p=10 (1 KiB) | p=12 (4 KiB) | **p=14 (16 KiB, default)** |\n * |---:|---:|---:|---:|\n * | 100    | 3.00% | 1.00% | **0.00%** |\n * | 1 000  | 2.90% | 0.50% | **0.40%** |\n * | 10 000 | 2.34% | 5.62% | **0.96%** |\n * | 50 000 | 2.31% | 1.70% | **1.52%** |\n *\n * (p=12's 5.62% at 10 000 is the linear-counting/raw-estimator crossover, and\n * is exactly why the default is not chosen from the memory column.)\n * 16 KiB is per `(principal, vault, collection)` — a ~30-principal deployment\n * with a handful of bulk-declared collections stays in the low megabytes.\n * `precision` is configurable for a deployment whose corpus is a different\n * order of magnitude.\n *\n * ⛔ An exact per-collection bitmap would be smaller AND exact at that scale.\n * It is not shipped because it leaks ids: bit *i* set means \"record *i* was\n * read\", which is the second copy this module exists to avoid. Revisit only\n * against a real dataset, and only with that trade stated.\n */\nexport class HyperLogLog {\n  readonly precision: number\n  private readonly registers: Uint8Array\n\n  constructor(precision = 14) {\n    if (!Number.isInteger(precision) || precision < 4 || precision > 16) {\n      throw new RangeError(`HyperLogLog precision must be an integer in [4,16], got ${precision}`)\n    }\n    this.precision = precision\n    this.registers = new Uint8Array(1 << precision)\n  }\n\n  add(id: string): void {\n    const h = fnv1a(id)\n    const idx = h >>> (32 - this.precision)\n    // Rank = 1 + leading zeros of the remaining bits (bounded by the width).\n    const rest = (h << this.precision) >>> 0\n    const rank = rest === 0 ? 32 - this.precision + 1 : Math.clz32(rest) + 1\n    if (rank > this.registers[idx]!) this.registers[idx] = rank\n  }\n\n  /** Estimated distinct count. */\n  count(): number {\n    const m = this.registers.length\n    let zeros = 0\n    let sum = 0\n    for (let i = 0; i < m; i++) {\n      const r = this.registers[i]!\n      if (r === 0) zeros++\n      sum += 2 ** -r\n    }\n    const alpha = m === 16 ? 0.673 : m === 32 ? 0.697 : m === 64 ? 0.709 : 0.7213 / (1 + 1.079 / m)\n    const raw = (alpha * m * m) / sum\n    // Small-range correction: linear counting, which is where a ~1k corpus\n    // lives. This is the branch the pilot's scale actually exercises.\n    if (raw <= 2.5 * m && zeros > 0) return Math.round(m * Math.log(m / zeros))\n    return Math.round(raw)\n  }\n\n  /** Serializable state — registers only. No id, no id-derived key. */\n  toJSON(): { readonly p: number; readonly r: string } {\n    let bin = ''\n    for (const b of this.registers) bin += String.fromCharCode(b)\n    return { p: this.precision, r: btoa(bin) }\n  }\n\n  static fromJSON(state: { readonly p: number; readonly r: string }): HyperLogLog {\n    const hll = new HyperLogLog(state.p)\n    const bin = atob(state.r)\n    for (let i = 0; i < hll.registers.length && i < bin.length; i++) {\n      hll.registers[i] = bin.charCodeAt(i)\n    }\n    return hll\n  }\n}\n\n// ─── Bloom — novelty within one window ────────────────────────────────────\n\n/**\n * Bloom filter for *novelty per window* — \"have I seen this id in this\n * window?\". False positives under-report novelty (a novel read is scored as a\n * repeat), which is the safe direction for a sensor that must not cry wolf;\n * false negatives are impossible.\n */\nexport class BloomFilter {\n  readonly bits: number\n  readonly hashes: number\n  private readonly words: Uint32Array\n\n  constructor(bits = 1 << 14, hashes = 7) {\n    if (!Number.isInteger(bits) || bits < 64) throw new RangeError(`Bloom bits must be >= 64, got ${bits}`)\n    if (!Number.isInteger(hashes) || hashes < 1 || hashes > 16) {\n      throw new RangeError(`Bloom hashes must be in [1,16], got ${hashes}`)\n    }\n    this.bits = bits\n    this.hashes = hashes\n    this.words = new Uint32Array(Math.ceil(bits / 32))\n  }\n\n  /** Set the id's bits; returns true when the id was NOT already present. */\n  addIfAbsent(id: string): boolean {\n    const h1 = fnv1a(id)\n    const h2 = fnv1a(id, 0x9e3779b1) | 1\n    let novel = false\n    for (let i = 0; i < this.hashes; i++) {\n      const bit = (h1 + Math.imul(i, h2)) >>> 0\n      const pos = bit % this.bits\n      const w = pos >>> 5\n      const mask = 1 << (pos & 31)\n      if ((this.words[w]! & mask) === 0) {\n        this.words[w] = this.words[w]! | mask\n        novel = true\n      }\n    }\n    return novel\n  }\n\n  clear(): void {\n    this.words.fill(0)\n  }\n}\n","/**\n * Coverage accounting (#1363) — per `(principal, vault, collection)`.\n *\n * ⛔⛔ **TELEMETRY, NOT A CONTROL.** Against an insider holding the device and\n * local keys this prevents nothing; it makes bulk extraction visible early,\n * attributable and loud. Key custody (tiers, per-collection DEKs) is the\n * remediation. Nothing in this module refuses a read, and nothing in it may\n * ever grow the ability to (#1251 §3: a refusal is a threshold the reader can\n * binary-search; a signal is not).\n *\n * What is accounted, and why each one:\n *\n *  - **distinct ids ever decrypted** (HyperLogLog) — coverage is the protected\n *    quantity, not rate: patience lowers an extractor's rate and never their\n *    coverage. Monotonic, and the horizon is the life of the state, never a\n *    30-day window that resets faster than the attack completes.\n *  - **novelty per window** (Bloom, cleared per window) — the discriminator\n *    that is orthogonal to speed. A legitimate operator re-reads a working\n *    subset (high volume, low novelty); an extractor reads new records.\n *  - **served** — decrypts, all time and per window.\n *  - **burstiness** — this window's served count over the running mean of the\n *    previous windows'. 1 while there is no history to compare against.\n *\n * @module\n */\n\nimport { BloomFilter, HyperLogLog } from './sketch.js'\nimport type {\n  CoverageEmitter,\n  CoverageEvent,\n  CoverageFieldMeta,\n  CoverageObserver,\n  CoverageStrategy,\n} from '../../port/with/coverage-strategy.js'\n\n/** Per-collection policy. Absent `corpusSize` ⇒ no coverage estimate, so no alert. */\nexport interface CoverageCollectionPolicy {\n  /**\n   * How many records the corpus holds. Coverage is `distinct / corpusSize`.\n   * Deliberately DECLARED rather than counted: counting means a store read on\n   * a sensor that must not touch the store, and a corpus size that moves with\n   * every write makes an alert threshold un-reproducible.\n   */\n  readonly corpusSize?: number\n  /** Coverage fractions to alert at. Default `[0.6, 0.9]`. Each fires at most once. */\n  readonly alertAt?: readonly number[]\n}\n\nexport interface WithCoverageOptions {\n  /**\n   * HyperLogLog precision — the register file is `2^precision` bytes per\n   * `(principal, vault, collection)`. Default 14 (16 KiB), chosen by\n   * measurement; the table is in `sketch.ts`.\n   */\n  readonly precision?: number\n  /** Bloom width in bits, per key, per window. Default 16 384 (2 KiB). */\n  readonly bloomBits?: number\n  /** Bloom hash count. Default 7. */\n  readonly bloomHashes?: number\n  /** Novelty window length. Default one hour. NOT the coverage horizon — that never resets. */\n  readonly windowMs?: number\n  /** Per-collection corpus size and alert thresholds. */\n  readonly collections?: Readonly<Record<string, CoverageCollectionPolicy>>\n  /** Clock seam, for tests. */\n  readonly now?: () => number\n}\n\nexport interface CoverageStats {\n  readonly principal: string\n  readonly vault: string\n  readonly collection: string\n  /** HLL estimate of distinct ids ever decrypted. */\n  readonly distinct: number\n  readonly served: number\n  readonly novelInWindow: number\n  readonly servedInWindow: number\n  readonly burstiness: number\n  /** Absent when the collection declares no `corpusSize`. */\n  readonly coverage?: number\n  readonly window: string\n}\n\n/**\n * Serializable coverage state.\n *\n * ⛔ SKETCHES ONLY — the invariant this module exists to hold. A structure\n * that could name the records a principal has read would be a second copy of\n * the sensitive set: the sensor built to notice bulk extraction would become\n * the single best artefact to extract. Pinned by\n * `__tests__/coverage/no-record-ids.test.ts`.\n */\nexport interface CoverageSnapshot {\n  readonly _noydb_coverage: 1\n  readonly entries: ReadonlyArray<{\n    readonly principal: string\n    readonly vault: string\n    readonly collection: string\n    readonly hll: { readonly p: number; readonly r: string }\n    readonly served: number\n    readonly windowStart: number\n  }>\n}\n\nconst DEFAULT_ALERT_AT = [0.6, 0.9] as const\nconst HOUR_MS = 3_600_000\n\nclass Account {\n  hll: HyperLogLog\n  readonly bloom: BloomFilter\n  served = 0\n  servedInWindow = 0\n  novelInWindow = 0\n  windowStart: number\n  /** Running mean of previous windows' served counts, for burstiness. */\n  servedMean = 0\n  windowsClosed = 0\n  readonly fired = new Set<number>()\n\n  constructor(\n    readonly principal: string,\n    readonly vault: string,\n    readonly collection: string,\n    opts: { precision: number; bloomBits: number; bloomHashes: number; now: number },\n  ) {\n    this.hll = new HyperLogLog(opts.precision)\n    this.bloom = new BloomFilter(opts.bloomBits, opts.bloomHashes)\n    this.windowStart = opts.now\n  }\n}\n\nexport class CoverageRegistry implements CoverageStrategy {\n  readonly #accounts = new Map<string, Account>()\n  readonly #precision: number\n  readonly #bloomBits: number\n  readonly #bloomHashes: number\n  readonly #windowMs: number\n  readonly #collections: Readonly<Record<string, CoverageCollectionPolicy>>\n  readonly #now: () => number\n  readonly #warnedEager = new Set<string>()\n\n  constructor(opts: WithCoverageOptions = {}) {\n    this.#precision = opts.precision ?? 14\n    this.#bloomBits = opts.bloomBits ?? 1 << 14\n    this.#bloomHashes = opts.bloomHashes ?? 7\n    this.#windowMs = opts.windowMs ?? HOUR_MS\n    this.#collections = opts.collections ?? {}\n    this.#now = opts.now ?? (() => Date.now())\n    if (this.#windowMs <= 0) throw new RangeError(`windowMs must be > 0, got ${this.#windowMs}`)\n  }\n\n  observer(\n    vault: string,\n    collection: string,\n    principal: string,\n    fieldMeta: () => CoverageFieldMeta | undefined,\n    emitter: CoverageEmitter,\n    eager: boolean,\n  ): CoverageObserver | undefined {\n    // Whether this collection is accounted resolves on the FIRST decrypt, not\n    // here: `fieldMeta` can be attached to a Collection after construction\n    // (`_applyFieldMeta`, first-wins) and this runs from the constructor. So\n    // an opted-in deployment pays one boolean test per decrypt on the\n    // collections it does not account for; an un-opted-in one pays nothing at\n    // all, because NO_COVERAGE returns no observer.\n    let accounted: boolean | undefined\n    return (id: string): void => {\n      accounted ??= this.#resolveAccounted(collection, fieldMeta(), eager)\n      if (!accounted) return\n      this.#record(principal, vault, collection, id, emitter)\n    }\n  }\n\n  /**\n   * ⛔⛔ THE MEASUREMENT THAT DECIDES WHETHER THIS SENSOR SAYS ANYTHING TRUE.\n   *\n   * The design's unit is \"the record decrypt\". In hub that is only the same\n   * thing as \"the record was read\" for a LAZY collection (`prefetch: false`),\n   * where reads go per-id against the store. An EAGER collection — the default\n   * — decrypts its entire corpus once, at hydration, into the working set:\n   * measured on a 30-record collection, one `get()` after reopening the vault\n   * took the sensor from 0 to `coverage: 1`. Every principal who so much as\n   * opens the vault would trip every threshold.\n   *\n   * A sensor that reports total coverage for everyone is worse than no sensor:\n   * it is exactly the \"invites reliance\" failure this feature is supposed to\n   * be honest about. So an eager bulk-declared collection is NOT accounted,\n   * and the refusal is LOUD — silence here would look identical to \"nobody has\n   * read anything\", which is the most dangerous possible false negative.\n   *\n   * The codec cannot tell hydration from a read (it sees neither caller nor\n   * intent), so this cannot be fixed inside the sensor. Declaring the\n   * collection lazy is the fix, and the warning says so.\n   */\n  #resolveAccounted(collection: string, fieldMeta: CoverageFieldMeta | undefined, eager: boolean): boolean {\n    const declared = this.#collections[collection] !== undefined || declaresBulk(fieldMeta)\n    if (!declared) return false\n    if (!eager) return true\n    if (!this.#warnedEager.has(collection)) {\n      this.#warnedEager.add(collection)\n      console.warn(\n        `[noy-db] withCoverage(): collection \"${collection}\" is bulk-declared but EAGER, so it is NOT ` +\n        `accounted. An eager collection decrypts its whole corpus at hydration, which would read as ` +\n        `100% coverage for every principal that opens the vault. Declare it \\`prefetch: false\\` ` +\n        `(with a \\`cache\\` budget) to make its reads countable. Coverage is telemetry either way — ` +\n        `the remediation for bulk exposure is key custody (tiers, per-collection DEKs).`,\n      )\n    }\n    return false\n  }\n\n  #account(principal: string, vault: string, collection: string, now: number): Account {\n    const k = JSON.stringify([principal, vault, collection])\n    let acc = this.#accounts.get(k)\n    if (acc === undefined) {\n      acc = new Account(principal, vault, collection, {\n        precision: this.#precision,\n        bloomBits: this.#bloomBits,\n        bloomHashes: this.#bloomHashes,\n        now,\n      })\n      this.#accounts.set(k, acc)\n    }\n    return acc\n  }\n\n  #record(principal: string, vault: string, collection: string, id: string, emitter: CoverageEmitter): void {\n    const now = this.#now()\n    const acc = this.#account(principal, vault, collection, now)\n\n    if (now - acc.windowStart >= this.#windowMs) {\n      // Close the window: fold its served count into the running mean, clear\n      // the novelty filter. ⛔ The HLL is NOT cleared — the coverage horizon\n      // must exceed tenure, and a horizon that resets is the low-and-slow hole\n      // the whole reframe (#1251 §3) exists to close.\n      acc.servedMean = acc.windowsClosed === 0\n        ? acc.servedInWindow\n        : (acc.servedMean * acc.windowsClosed + acc.servedInWindow) / (acc.windowsClosed + 1)\n      acc.windowsClosed++\n      acc.bloom.clear()\n      acc.servedInWindow = 0\n      acc.novelInWindow = 0\n      acc.windowStart = now\n    }\n\n    // Unconditionally, before the novelty test: a Bloom false positive must not\n    // leak into the distinct count, which is what an alert is computed from.\n    acc.hll.add(id)\n    if (acc.bloom.addIfAbsent(id)) acc.novelInWindow++\n    acc.served++\n    acc.servedInWindow++\n\n    const policy = this.#collections[collection]\n    const corpusSize = policy?.corpusSize\n    if (corpusSize === undefined || corpusSize <= 0) return\n    const coverage = Math.min(1, acc.hll.count() / corpusSize)\n    for (const t of policy?.alertAt ?? DEFAULT_ALERT_AT) {\n      if (coverage < t || acc.fired.has(t)) continue\n      acc.fired.add(t)\n      const event: CoverageEvent = {\n        principal,\n        vault,\n        collection,\n        novel: acc.novelInWindow,\n        served: acc.served,\n        coverage,\n        window: new Date(acc.windowStart).toISOString(),\n        source: 'hub/coverage',\n      }\n      emitter.emit('coverage:threshold', event)\n    }\n  }\n\n  /** Current accounting, for an operator surface. Estimates, never exact. */\n  stats(): readonly CoverageStats[] {\n    const out: CoverageStats[] = []\n    for (const acc of this.#accounts.values()) {\n      const corpusSize = this.#collections[acc.collection]?.corpusSize\n      const distinct = acc.hll.count()\n      out.push({\n        principal: acc.principal,\n        vault: acc.vault,\n        collection: acc.collection,\n        distinct,\n        served: acc.served,\n        novelInWindow: acc.novelInWindow,\n        servedInWindow: acc.servedInWindow,\n        burstiness: acc.servedMean > 0 ? acc.servedInWindow / acc.servedMean : 1,\n        ...(corpusSize !== undefined && corpusSize > 0\n          ? { coverage: Math.min(1, distinct / corpusSize) }\n          : {}),\n        window: new Date(acc.windowStart).toISOString(),\n      })\n    }\n    return out\n  }\n\n  /**\n   * Serializable state, for a deployment that wants coverage to survive a\n   * restart — the horizon must exceed tenure, and a process does not.\n   * ⛔ Sketches only. Never a record id: see {@link CoverageSnapshot}.\n   */\n  snapshot(): CoverageSnapshot {\n    const entries: Array<CoverageSnapshot['entries'][number]> = []\n    for (const acc of this.#accounts.values()) {\n      entries.push({\n        principal: acc.principal,\n        vault: acc.vault,\n        collection: acc.collection,\n        hll: acc.hll.toJSON(),\n        served: acc.served,\n        windowStart: acc.windowStart,\n      })\n    }\n    return { _noydb_coverage: 1, entries }\n  }\n\n  /**\n   * Restore a snapshot. The novelty filter is deliberately NOT restored:\n   * novelty is a within-window notion and the window did not survive.\n   * Distinct-ever did, which is the quantity that must not reset.\n   */\n  restore(snapshot: CoverageSnapshot): void {\n    for (const e of snapshot.entries) {\n      const acc = this.#account(e.principal, e.vault, e.collection, e.windowStart)\n      acc.hll = HyperLogLog.fromJSON(e.hll)\n      acc.served = e.served\n      acc.windowStart = e.windowStart\n    }\n  }\n}\n\nfunction declaresBulk(fieldMeta: CoverageFieldMeta | undefined): boolean {\n  if (fieldMeta === undefined) return false\n  for (const meta of Object.values(fieldMeta)) if (meta?.bulk === 'sensitive') return true\n  return false\n}\n","/**\n * `withCoverage()` — the opt-in read-coverage sensor (#1363).\n *\n * ⛔⛔ **Against an insider holding the device and local keys, this prevents\n * nothing. It makes bulk extraction visible early, attributable and loud. It\n * is telemetry.** The real remediation is key custody — tiers and\n * per-collection DEKs — and this factory is not a substitute for one. Read the\n * sentence again before wiring it into anything that describes itself as a\n * control.\n *\n * @module\n */\n\nimport { CoverageRegistry } from './accounting.js'\nimport type { WithCoverageOptions } from './accounting.js'\n\n/**\n * Enable coverage accounting for every collection that declares a\n * `bulk: 'sensitive'` field (or that is named in `opts.collections`).\n *\n * ```ts\n * const coverage = withCoverage({ collections: { clients: { corpusSize: 1200, alertAt: [0.6, 0.9] } } })\n * const db = await createNoydb({ user: 'alice', secret, coverageStrategy: coverage })\n * db.on('coverage:threshold', (e) => notifyOwner(e))   // a SIGNAL, never a refusal\n * ```\n *\n * The returned registry is the strategy AND the read surface: `stats()` for a\n * live view, `snapshot()`/`restore()` to carry the coverage horizon across a\n * restart. Nothing it returns can name a record that was read.\n */\nexport function withCoverage(opts: WithCoverageOptions = {}): CoverageRegistry {\n  return new CoverageRegistry(opts)\n}\n"],"mappings":";;;;;AAgBA,SAAS,MAAM,GAAW,OAAO,YAAoB;AACnD,MAAI,IAAI,SAAS;AACjB,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AAGA,OAAK,MAAM;AACX,MAAI,KAAK,KAAK,GAAG,UAAU,MAAM;AACjC,OAAK,MAAM;AACX,MAAI,KAAK,KAAK,GAAG,UAAU,MAAM;AACjC,OAAK,MAAM;AACX,SAAO,MAAM;AACf;AAiCO,IAAM,cAAN,MAAM,aAAY;AAAA,EACd;AAAA,EACQ;AAAA,EAEjB,YAAY,YAAY,IAAI;AAC1B,QAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,KAAK,YAAY,IAAI;AACnE,YAAM,IAAI,WAAW,2DAA2D,SAAS,EAAE;AAAA,IAC7F;AACA,SAAK,YAAY;AACjB,SAAK,YAAY,IAAI,WAAW,KAAK,SAAS;AAAA,EAChD;AAAA,EAEA,IAAI,IAAkB;AACpB,UAAM,IAAI,MAAM,EAAE;AAClB,UAAM,MAAM,MAAO,KAAK,KAAK;AAE7B,UAAM,OAAQ,KAAK,KAAK,cAAe;AACvC,UAAM,OAAO,SAAS,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,MAAM,IAAI,IAAI;AACvE,QAAI,OAAO,KAAK,UAAU,GAAG,EAAI,MAAK,UAAU,GAAG,IAAI;AAAA,EACzD;AAAA;AAAA,EAGA,QAAgB;AACd,UAAM,IAAI,KAAK,UAAU;AACzB,QAAI,QAAQ;AACZ,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,YAAM,IAAI,KAAK,UAAU,CAAC;AAC1B,UAAI,MAAM,EAAG;AACb,aAAO,KAAK,CAAC;AAAA,IACf;AACA,UAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK,QAAQ,MAAM,KAAK,QAAQ,UAAU,IAAI,QAAQ;AAC7F,UAAM,MAAO,QAAQ,IAAI,IAAK;AAG9B,QAAI,OAAO,MAAM,KAAK,QAAQ,EAAG,QAAO,KAAK,MAAM,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC;AAC1E,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB;AAAA;AAAA,EAGA,SAAqD;AACnD,QAAI,MAAM;AACV,eAAW,KAAK,KAAK,UAAW,QAAO,OAAO,aAAa,CAAC;AAC5D,WAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,GAAG,EAAE;AAAA,EAC3C;AAAA,EAEA,OAAO,SAAS,OAAgE;AAC9E,UAAM,MAAM,IAAI,aAAY,MAAM,CAAC;AACnC,UAAM,MAAM,KAAK,MAAM,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,IAAI,UAAU,UAAU,IAAI,IAAI,QAAQ,KAAK;AAC/D,UAAI,UAAU,CAAC,IAAI,IAAI,WAAW,CAAC;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AACF;AAUO,IAAM,cAAN,MAAkB;AAAA,EACd;AAAA,EACA;AAAA,EACQ;AAAA,EAEjB,YAAY,OAAO,KAAK,IAAI,SAAS,GAAG;AACtC,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAI,OAAM,IAAI,WAAW,iCAAiC,IAAI,EAAE;AACtG,QAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,YAAM,IAAI,WAAW,uCAAuC,MAAM,EAAE;AAAA,IACtE;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ,IAAI,YAAY,KAAK,KAAK,OAAO,EAAE,CAAC;AAAA,EACnD;AAAA;AAAA,EAGA,YAAY,IAAqB;AAC/B,UAAM,KAAK,MAAM,EAAE;AACnB,UAAM,KAAK,MAAM,IAAI,UAAU,IAAI;AACnC,QAAI,QAAQ;AACZ,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,MAAO,KAAK,KAAK,KAAK,GAAG,EAAE,MAAO;AACxC,YAAM,MAAM,MAAM,KAAK;AACvB,YAAM,IAAI,QAAQ;AAClB,YAAM,OAAO,MAAM,MAAM;AACzB,WAAK,KAAK,MAAM,CAAC,IAAK,UAAU,GAAG;AACjC,aAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAK;AACjC,gBAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,KAAK,CAAC;AAAA,EACnB;AACF;;;AC5DA,IAAM,mBAAmB,CAAC,KAAK,GAAG;AAClC,IAAM,UAAU;AAEhB,IAAM,UAAN,MAAc;AAAA,EAYZ,YACW,WACA,OACA,YACT,MACA;AAJS;AACA;AACA;AAGT,SAAK,MAAM,IAAI,YAAY,KAAK,SAAS;AACzC,SAAK,QAAQ,IAAI,YAAY,KAAK,WAAW,KAAK,WAAW;AAC7D,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA,EARW;AAAA,EACA;AAAA,EACA;AAAA,EAdX;AAAA,EACS;AAAA,EACT,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB;AAAA;AAAA,EAEA,aAAa;AAAA,EACb,gBAAgB;AAAA,EACP,QAAQ,oBAAI,IAAY;AAYnC;AAEO,IAAM,mBAAN,MAAmD;AAAA,EAC/C,YAAY,oBAAI,IAAqB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe,oBAAI,IAAY;AAAA,EAExC,YAAY,OAA4B,CAAC,GAAG;AAC1C,SAAK,aAAa,KAAK,aAAa;AACpC,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,eAAe,KAAK,eAAe;AACxC,SAAK,YAAY,KAAK,YAAY;AAClC,SAAK,eAAe,KAAK,eAAe,CAAC;AACzC,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAI,KAAK,aAAa,EAAG,OAAM,IAAI,WAAW,6BAA6B,KAAK,SAAS,EAAE;AAAA,EAC7F;AAAA,EAEA,SACE,OACA,YACA,WACA,WACA,SACA,OAC8B;AAO9B,QAAI;AACJ,WAAO,CAAC,OAAqB;AAC3B,oBAAc,KAAK,kBAAkB,YAAY,UAAU,GAAG,KAAK;AACnE,UAAI,CAAC,UAAW;AAChB,WAAK,QAAQ,WAAW,OAAO,YAAY,IAAI,OAAO;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,kBAAkB,YAAoB,WAA0C,OAAyB;AACvG,UAAM,WAAW,KAAK,aAAa,UAAU,MAAM,UAAa,aAAa,SAAS;AACtF,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,KAAK,aAAa,IAAI,UAAU,GAAG;AACtC,WAAK,aAAa,IAAI,UAAU;AAChC,cAAQ;AAAA,QACN,wCAAwC,UAAU;AAAA,MAKpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,WAAmB,OAAe,YAAoB,KAAsB;AACnF,UAAM,IAAI,KAAK,UAAU,CAAC,WAAW,OAAO,UAAU,CAAC;AACvD,QAAI,MAAM,KAAK,UAAU,IAAI,CAAC;AAC9B,QAAI,QAAQ,QAAW;AACrB,YAAM,IAAI,QAAQ,WAAW,OAAO,YAAY;AAAA,QAC9C,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB;AAAA,MACF,CAAC;AACD,WAAK,UAAU,IAAI,GAAG,GAAG;AAAA,IAC3B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,WAAmB,OAAe,YAAoB,IAAY,SAAgC;AACxG,UAAM,MAAM,KAAK,KAAK;AACtB,UAAM,MAAM,KAAK,SAAS,WAAW,OAAO,YAAY,GAAG;AAE3D,QAAI,MAAM,IAAI,eAAe,KAAK,WAAW;AAK3C,UAAI,aAAa,IAAI,kBAAkB,IACnC,IAAI,kBACH,IAAI,aAAa,IAAI,gBAAgB,IAAI,mBAAmB,IAAI,gBAAgB;AACrF,UAAI;AACJ,UAAI,MAAM,MAAM;AAChB,UAAI,iBAAiB;AACrB,UAAI,gBAAgB;AACpB,UAAI,cAAc;AAAA,IACpB;AAIA,QAAI,IAAI,IAAI,EAAE;AACd,QAAI,IAAI,MAAM,YAAY,EAAE,EAAG,KAAI;AACnC,QAAI;AACJ,QAAI;AAEJ,UAAM,SAAS,KAAK,aAAa,UAAU;AAC3C,UAAM,aAAa,QAAQ;AAC3B,QAAI,eAAe,UAAa,cAAc,EAAG;AACjD,UAAM,WAAW,KAAK,IAAI,GAAG,IAAI,IAAI,MAAM,IAAI,UAAU;AACzD,eAAW,KAAK,QAAQ,WAAW,kBAAkB;AACnD,UAAI,WAAW,KAAK,IAAI,MAAM,IAAI,CAAC,EAAG;AACtC,UAAI,MAAM,IAAI,CAAC;AACf,YAAM,QAAuB;AAAA,QAC3B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,IAAI;AAAA,QACX,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,QAAQ,IAAI,KAAK,IAAI,WAAW,EAAE,YAAY;AAAA,QAC9C,QAAQ;AAAA,MACV;AACA,cAAQ,KAAK,sBAAsB,KAAK;AAAA,IAC1C;AAAA,EACF;AAAA;AAAA,EAGA,QAAkC;AAChC,UAAM,MAAuB,CAAC;AAC9B,eAAW,OAAO,KAAK,UAAU,OAAO,GAAG;AACzC,YAAM,aAAa,KAAK,aAAa,IAAI,UAAU,GAAG;AACtD,YAAM,WAAW,IAAI,IAAI,MAAM;AAC/B,UAAI,KAAK;AAAA,QACP,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB;AAAA,QACA,QAAQ,IAAI;AAAA,QACZ,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,YAAY,IAAI,aAAa,IAAI,IAAI,iBAAiB,IAAI,aAAa;AAAA,QACvE,GAAI,eAAe,UAAa,aAAa,IACzC,EAAE,UAAU,KAAK,IAAI,GAAG,WAAW,UAAU,EAAE,IAC/C,CAAC;AAAA,QACL,QAAQ,IAAI,KAAK,IAAI,WAAW,EAAE,YAAY;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAA6B;AAC3B,UAAM,UAAsD,CAAC;AAC7D,eAAW,OAAO,KAAK,UAAU,OAAO,GAAG;AACzC,cAAQ,KAAK;AAAA,QACX,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB,KAAK,IAAI,IAAI,OAAO;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,aAAa,IAAI;AAAA,MACnB,CAAC;AAAA,IACH;AACA,WAAO,EAAE,iBAAiB,GAAG,QAAQ;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,UAAkC;AACxC,eAAW,KAAK,SAAS,SAAS;AAChC,YAAM,MAAM,KAAK,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW;AAC3E,UAAI,MAAM,YAAY,SAAS,EAAE,GAAG;AACpC,UAAI,SAAS,EAAE;AACf,UAAI,cAAc,EAAE;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,aAAa,WAAmD;AACvE,MAAI,cAAc,OAAW,QAAO;AACpC,aAAW,QAAQ,OAAO,OAAO,SAAS,EAAG,KAAI,MAAM,SAAS,YAAa,QAAO;AACpF,SAAO;AACT;;;ACjTO,SAAS,aAAa,OAA4B,CAAC,GAAqB;AAC7E,SAAO,IAAI,iBAAiB,IAAI;AAClC;","names":[]}

package/dist/custody/index.js

@@ -2,21 +2,20 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-UHHPLO3I.js";
-import "../chunk-3V4KWFX7.js";
-import "../chunk-XKWGNJ26.js";
-import "../chunk-JMGDHKQF.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-V3RWOOSO.js";
+import "../chunk-XSPFDUDG.js";
+import "../chunk-LIOVX5TJ.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   CustodyNotEnabledError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   CustodyApi,
   CustodyNotEnabledError,

package/dist/{dead-filter-PKQDLOT4.js → dead-filter-4F3LWYKH.js}

@@ -1,10 +1,18 @@
 import {
   liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+} from "./chunk-2MG3SW7Q.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-RW4QBS23.js");
+  const { loadPersistedSchema } = await import("./storage-BYN5LO6Z.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -24,4 +32,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-PKQDLOT4.js.map
+//# sourceMappingURL=dead-filter-4F3LWYKH.js.map

package/dist/dead-filter-4F3LWYKH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/debug/index.js

@@ -1,11 +1,20 @@
+import {
+  hasSealedBody
+} from "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   DebugPlaintextError,
   DebugReservedFieldError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/kernel/debug.ts
 function readPlaintextRecord(envelope) {
-  if (envelope._iv !== "") {
+  if (hasSealedBody(envelope)) {
     throw new Error(
       "readPlaintextRecord: envelope is encrypted (non-empty _iv) \u2014 decrypt via the vault, not this helper"
     );

package/dist/debug/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/kernel/debug.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/**\n * The option's two failure modes, re-exported here so a consumer can `catch`\n * them by identity (#914). Both are thrown from the kernel — `createNoydb`\n * raises `DebugPlaintextError` when `debugPlaintext` is combined with\n * encryption, and the record codec raises `DebugReservedFieldError` for a\n * field colliding with the `_`-prefixed metadata. This entry is the only one\n * that publishes them.\n */\nexport { DebugPlaintextError, DebugReservedFieldError } from './errors.js'\n\n/** Re-exported so `readPlaintextRecord`'s parameter is nameable from this entry. */\nexport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  if (envelope._iv !== '') {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n"],"mappings":";;;;;;AAsCO,SAAS,oBACd,UACU;AACV,MAAI,SAAS,QAAQ,IAAI;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;","names":[]}
+{"version":3,"sources":["../../src/kernel/debug.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\nimport { hasSealedBody } from '../capsule/index.js'\n\n/**\n * The option's two failure modes, re-exported here so a consumer can `catch`\n * them by identity (#914). Both are thrown from the kernel — `createNoydb`\n * raises `DebugPlaintextError` when `debugPlaintext` is combined with\n * encryption, and the record codec raises `DebugReservedFieldError` for a\n * field colliding with the `_`-prefixed metadata. This entry is the only one\n * that publishes them.\n */\nexport { DebugPlaintextError, DebugReservedFieldError } from './errors.js'\n\n/** Re-exported so `readPlaintextRecord`'s parameter is nameable from this entry. */\nexport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  // #15: `hasSealedBody` rather than `_iv !== ''` — see that helper's note.\n  if (hasSealedBody(envelope)) {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCO,SAAS,oBACd,UACU;AAEV,MAAI,cAAc,QAAQ,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;","names":[]}

package/dist/{delegation-DS5NRILW.js → delegation-NANZDG4N.js}

@@ -1,30 +1,27 @@
-import "./chunk-UGTBXF5U.js";
+import "./chunk-7XMHMVTS.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
   dekKey
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-FLPCETP6.js";
 import {
   buildRecordAad,
-  openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import {
+  buildRecordEnvelope,
   encrypt,
+  openEnvelopeJson,
   unwrapKey,
   wrapKey
-} from "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -102,4 +99,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-DS5NRILW.js.map
+//# sourceMappingURL=delegation-NANZDG4N.js.map

package/dist/delegation-NANZDG4N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../capsule/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derivations/index.js

@@ -1,44 +1,46 @@
 import {
   DerivationRegistry
-} from "../chunk-F3W6YMDC.js";
+} from "../chunk-U2FZNEWJ.js";
 import "../chunk-FFWI7UH7.js";
 import {
   DerivationExecutor
-} from "../chunk-TFR7DSOV.js";
+} from "../chunk-H427H63K.js";
 import {
   withDerivation,
   withRollup
-} from "../chunk-BUE2D7PX.js";
-import "../chunk-CUQPWYRX.js";
+} from "../chunk-SMV2HRDU.js";
+import "../chunk-IUT3GWP3.js";
 import "../chunk-TFMM5DBB.js";
-import "../chunk-RTBJ5IOO.js";
-import "../chunk-5VCRVKOZ.js";
+import "../chunk-M5B2W6YY.js";
+import "../chunk-GUZET4SG.js";
 import "../chunk-VYYM3MEN.js";
-import "../chunk-ACAQ2DSG.js";
+import "../chunk-747G6CT3.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-SGZAIJCV.js";
-import "../chunk-R7BX2NB3.js";
+import "../chunk-3L2NBKDR.js";
+import "../chunk-244QBK7Z.js";
+import "../chunk-NYMLINRP.js";
 import "../chunk-V4PXLYWM.js";
-import "../chunk-MVMXZYXT.js";
-import "../chunk-Q2MPFCQ7.js";
-import "../chunk-TRGTKX5E.js";
-import "../chunk-UXVWEX5L.js";
-import "../chunk-QPQUVOZ2.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+import "../chunk-3EWS67C7.js";
+import "../chunk-XBKH4FOC.js";
+import "../chunk-2GHDLTPE.js";
+import "../chunk-23D6M6VM.js";
+import "../chunk-OKSTSITU.js";
+import "../chunk-SYNY3VB5.js";
+import "../chunk-6QVKPHBF.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   DerivationCapExceededError,
   DerivationCycleError,

package/dist/derive-XLOJVXPU.js

@@ -0,0 +1,20 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-747G6CT3.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-XLOJVXPU.js.map