@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/chunk-PUBI455O.js

@@ -0,0 +1,157 @@
+import {
+  ValidationError
+} from "./chunk-VSUQI5Q6.js";
+
+// src/capsule/plumbing/normalize.ts
+function normalizeForVerify(mode, value) {
+  const nfc = value.normalize("NFC");
+  if (mode === "password") return nfc;
+  return nfc.toLowerCase().normalize("NFC").trim().replace(/\s+/g, " ");
+}
+
+// src/capsule/plumbing/digest.ts
+var subtle = globalThis.crypto.subtle;
+var KEY_BITS = 256;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var RECOVERY_SECRET_BYTES = 32;
+var PRESENCE_TAG_KEY_DOMAIN = "noydb.presence.tag.v1";
+var ECHO_KDF_CONTEXT = new Uint8Array([255, ...new TextEncoder().encode("noydb-echo-secret-v1")]);
+function encodeEchoParts(parts) {
+  for (const name of ["prompt", "echo", "key"]) {
+    if (typeof parts?.[name] !== "string") {
+      throw new ValidationError("echo secret parts must be three strings: prompt, echo, key");
+    }
+  }
+  const enc = new TextEncoder();
+  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p));
+  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0);
+  const out = new Uint8Array(total);
+  out.set(ECHO_KDF_CONTEXT, 0);
+  let offset = ECHO_KDF_CONTEXT.length;
+  for (const s of segments) {
+    new DataView(out.buffer).setUint32(offset, s.length, false);
+    out.set(s, offset + 4);
+    offset += 4 + s.length;
+  }
+  return out;
+}
+async function sha256Hex(data) {
+  const hash = await subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Bytes(data) {
+  return new Uint8Array(await subtle.digest("SHA-256", data));
+}
+async function deriveBlobAddressKey(root, tier) {
+  const rawRoot = await subtle.exportKey("raw", root);
+  const hkdfKey = await subtle.importKey("raw", rawRoot, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-blob-address");
+  const info = new TextEncoder().encode(`tier:${tier}`);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
+  return subtle.importKey("raw", bits, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+}
+async function hmacSha256Hex(key, data) {
+  const rawKey = await subtle.exportKey("raw", key);
+  const hmacKey = await subtle.importKey(
+    "raw",
+    rawKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", hmacKey, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function derivePresenceKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey(
+    "raw",
+    rawDek,
+    "HKDF",
+    false,
+    ["deriveBits"]
+  );
+  const salt = new TextEncoder().encode("noydb-presence");
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function derivePresenceTagKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN);
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, KEY_BITS);
+  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function hmacSignHex(key, data) {
+  const sig = await subtle.sign("HMAC", key, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hkdfAesGcmKey(ikm, salt, info) {
+  const key = await subtle.importKey("raw", ikm, "HKDF", false, ["deriveKey"]);
+  return subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    key,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function generateIV() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+}
+function generateSalt() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+}
+function generateRecoverySecret() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES));
+}
+function bufferToBase64(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64ToBuffer(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+export {
+  normalizeForVerify,
+  KEY_BITS,
+  IV_BYTES,
+  encodeEchoParts,
+  sha256Hex,
+  sha256Bytes,
+  deriveBlobAddressKey,
+  hmacSha256Hex,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  hmacSignHex,
+  hkdfAesGcmKey,
+  generateIV,
+  generateSalt,
+  generateRecoverySecret,
+  bufferToBase64,
+  base64ToBuffer
+};
+//# sourceMappingURL=chunk-PUBI455O.js.map

package/dist/chunk-PUBI455O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/plumbing/normalize.ts","../src/capsule/plumbing/digest.ts"],"sourcesContent":["/**\n * Preset normalization for verify candidates AND stored comparands (§4).\n * Both sides of every comparison route through the SAME function so\n * write-time digests and verify-time candidates agree. @module\n */\nexport type VerifyNormalizeMode = 'password' | 'secret-answer'\n\nexport function normalizeForVerify(mode: VerifyNormalizeMode, value: string): string {\n  const nfc = value.normalize('NFC')\n  if (mode === 'password') return nfc\n  // secret-answer: NFC -> casefold -> re-NFC -> trim -> collapse internal\n  // whitespace runs. `.toLowerCase()` is the chosen casefold approximation\n  // (JS has no full Unicode caseless-match in the stdlib, e.g. ß stays ß);\n  // the re-NFC after lowercasing keeps the result deterministic.\n  return nfc.toLowerCase().normalize('NFC').trim().replace(/\\s+/g, ' ')\n}\n","/**\n * The digest group — hashing, HKDF over public inputs, randomness, base64.\n *\n * Shared by every capsule, and that is the design's own answer rather than a\n * convenience: the capsule-seam spec's group table marks `digest` \"as today\"\n * for `enclave-aes`, `exclave-plain` AND `enclave-pqc` alike. Hashes are not\n * secrets, so there is nothing here to swap — a plaintext capsule computes the\n * same SHA-256 as an encrypting one, and a blob address derived differently\n * per capsule would simply be a bug.\n *\n * ⚠️ This module calls `crypto.subtle`, inside `capsule/**`, which is where the\n * `subtle-outside-capsule` ban permits it. The ban's TARGET is code outside the\n * capsule reaching for WebCrypto on its own; a shared capsule-layer primitive\n * is the thing it is pushing callers toward.\n */\nimport { ValidationError } from '../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** AES key size in bits. Shared: every capsule that derives an AES-GCM subkey\n *  from the digest group produces a 256-bit key, or the derivations diverge. */\nexport const KEY_BITS = 256\n\nconst SALT_BYTES = 32\nexport const IV_BYTES = 12\nconst RECOVERY_SECRET_BYTES = 32\nconst PRESENCE_TAG_KEY_DOMAIN = 'noydb.presence.tag.v1'\n\n/** The echo-secret typed parts. Encoding lives here with `encodeEchoParts`; the\n *  KEK derivation that consumes it stays in the capsule's `authenticate` group. */\nexport interface EchoSecretParts {\n  readonly prompt: string\n  readonly echo: string\n  readonly key: string\n}\n\nconst ECHO_KDF_CONTEXT = new Uint8Array([0xff, ...new TextEncoder().encode('noydb-echo-secret-v1')])\n\n/**\n * AG-1 encoding: domain context + 4-byte big-endian length prefix per\n * part. Two independent guarantees make a single typed string unable to\n * derive an echo vault's KEK (spec AG-1):\n *\n *   1. The `0xFF` context prefix — UTF-8 never produces that byte, so the\n *      encoding is provably not the encoding of ANY string (not merely of\n *      no separator-joined form).\n *   2. Structural length prefixes — part boundaries are key material, so\n *      re-splitting the same characters changes the derived KEK.\n *\n * @throws ValidationError when any part is not a string — the single\n * chokepoint every echo KEK derivation and block mint passes through, so a\n * malformed parts object cannot be `TextEncoder`-coerced into key material.\n */\nexport function encodeEchoParts(parts: EchoSecretParts): Uint8Array {\n  for (const name of ['prompt', 'echo', 'key'] as const) {\n    if (typeof parts?.[name] !== 'string') {\n      throw new ValidationError('echo secret parts must be three strings: prompt, echo, key')\n    }\n  }\n  const enc = new TextEncoder()\n  const segments = [parts.prompt, parts.echo, parts.key].map((p) => enc.encode(p))\n  const total = ECHO_KDF_CONTEXT.length + segments.reduce((n, s) => n + 4 + s.length, 0)\n  const out = new Uint8Array(total)\n  out.set(ECHO_KDF_CONTEXT, 0)\n  let offset = ECHO_KDF_CONTEXT.length\n  for (const s of segments) {\n    new DataView(out.buffer).setUint32(offset, s.length, false)\n    out.set(s, offset + 4)\n    offset += 4 + s.length\n  }\n  return out\n}\n\n/**\n * SHA-256 hex digest of raw bytes. Used to derive content-addressed\n * eTags for blob deduplication. Computed on plaintext bytes\n * before compression and encryption so the eTag identifies content, not\n * ciphertext, and survives re-encryption (key rotation, re-upload).\n */\nexport async function sha256Hex(data: Uint8Array): Promise<string> {\n  const hash = await subtle.digest('SHA-256', data as unknown as BufferSource)\n  return Array.from(new Uint8Array(hash))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/** SHA-256 of raw bytes, as bytes. */\nexport async function sha256Bytes(data: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await subtle.digest('SHA-256', data as unknown as BufferSource))\n}\n\n// ─── HMAC-SHA-256 ─────────────────────────────\n\n/**\n * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).\n *\n * The blob eTag is an HMAC over the plaintext. It used to be keyed by the\n * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation\n * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,\n * permanently. `decryptResponse()` checks that unconditionally, so the\n * presigned-URL read path raised `TamperedError` on legitimate data forever;\n * dedup also split, minting a second address for identical bytes.\n *\n * The fix is a `root` that rotation never touches (`_blob_addr`, refused by\n * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES\n * while every address stays stable, which is what makes the AAD\n * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /\n * `_blob_versions_*` row survive it untouched.\n *\n * **Derived PER TIER, deliberately.** A single vault-wide address would make an\n * elevated blob and a tier-0 blob with identical content share an eTag,\n * leaking equality across a boundary the tier system exists to enforce — and\n * `rehomeForTier` re-addresses on a tier move precisely because the address is\n * tier-scoped today. Domain separation keeps that property while removing the\n * rotation coupling: the two are independent axes, and only one of them was\n * ever meant to change the address.\n *\n * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can\n * never coincide with a wrapping or encryption key.\n */\nexport async function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey> {\n  const rawRoot = await subtle.exportKey('raw', root)\n  const hkdfKey = await subtle.importKey('raw', rawRoot, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode('noydb-blob-address')\n  const info = new TextEncoder().encode(`tier:${tier}`)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  // Imported as AES-GCM only because `hmacSha256Hex` re-exports raw and\n  // re-imports as HMAC; the algorithm tag here is a carrier, never used to\n  // encrypt anything.\n  return subtle.importKey('raw', bits, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt'])\n}\n\n/**\n * HMAC-SHA-256(key, data) as hex.\n *\n * Keyed, unlike {@link sha256Hex}: blob eTags derived with this are opaque to\n * the store, so an attacker with store access cannot pre-compute the address of\n * a file they guess at. Dedup still works inside a vault, where the key is shared.\n */\nexport async function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  // Export AES-GCM DEK raw bytes → import as HMAC key\n  const rawKey = await subtle.exportKey('raw', key)\n  const hmacKey = await subtle.importKey(\n    'raw',\n    rawKey,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const sig = await subtle.sign('HMAC', hmacKey, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n// ─── AAD-aware Binary Encrypt / Decrypt ──\n\n/**\n * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.\n *\n * The presence key is domain-separated from the data DEK by the fixed salt\n * `'noydb-presence'` and the `info` = collection name. This means:\n *  - The adapter never sees the presence key.\n *  - Presence payloads rotate automatically when the collection DEK is rotated.\n *  - Revoked users cannot derive the new presence key after a DEK rotation.\n *\n * @param dek            The collection's AES-256-GCM DEK (extractable).\n * @param collectionName Used as the HKDF `info` parameter for domain separation.\n * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.\n */\nexport async function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  // Step 1: export DEK raw bytes\n  const rawDek = await subtle.exportKey('raw', dek)\n\n  // Step 2: import as HKDF key material\n  const hkdfKey = await subtle.importKey(\n    'raw',\n    rawDek,\n    'HKDF',\n    false,\n    ['deriveBits'],\n  )\n\n  // Step 3: derive 256 bits with salt='noydb-presence' and info=collectionName\n  const salt = new TextEncoder().encode('noydb-presence')\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt, info },\n    hkdfKey,\n    KEY_BITS,\n  )\n\n  // Step 4: import derived bits as AES-GCM key\n  return subtle.importKey(\n    'raw',\n    bits,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n/**\n * Derive the presence-TAG key from a collection DEK: a non-extractable,\n * sign-only HMAC-SHA256 key, HKDF-separated from the presence PAYLOAD key\n * ({@link derivePresenceKey}) by its own salt. The tag is the adapter-opaque\n * record id for storage-polled presence; the adapter never sees the userId.\n */\nexport async function derivePresenceTagKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN)\n  const info = new TextEncoder().encode(collectionName)\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, KEY_BITS)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * HMAC-SHA256 hex with a key that IS an HMAC key (e.g. from\n * {@link derivePresenceTagKey}). {@link hmacSha256Hex} takes an AES-GCM\n * carrier and re-imports its raw bytes, which needs an extractable key;\n * this one signs directly and works with non-extractable keys.\n */\nexport async function hmacSignHex(key: CryptoKey, data: Uint8Array): Promise<string> {\n  const sig = await subtle.sign('HMAC', key, data as unknown as BufferSource)\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * HKDF-SHA256 → non-extractable AES-256-GCM key from caller-supplied input\n * key material. The magic-link content key derives here from\n * `(serverSecret, SHA-256(token), info)`; `salt`/`info` are the caller's\n * domain separation, this function adds none.\n */\nexport async function hkdfAesGcmKey(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<CryptoKey> {\n  const key = await subtle.importKey('raw', ikm as BufferSource, 'HKDF', false, ['deriveKey'])\n  return subtle.deriveKey(\n    { name: 'HKDF', hash: 'SHA-256', salt: salt as BufferSource, info: info as BufferSource },\n    key,\n    { name: 'AES-GCM', length: KEY_BITS },\n    false,\n    ['encrypt', 'decrypt'],\n  )\n}\n\n// ─── Sealed Field Key Derivation ──────────────────────────\n\n/** Generate a random 12-byte IV for AES-GCM. */\nexport function generateIV(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES))\n}\n\n/** Generate a random 32-byte salt for PBKDF2. */\nexport function generateSalt(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES))\n}\n\n/**\n * Mint a fresh recovery secret — the high-entropy value a recovery profile\n * wraps the DEK set under and then hands out (Shamir splits it into shares;\n * paper prints it). Not a salt: a salt is public, this is not, and a fork\n * may size them differently. The reference enclave returns 32 bytes.\n *\n * Callers must zero the buffer once it has been wrapped and split.\n */\nexport function generateRecoverySecret(): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(RECOVERY_SECRET_BYTES))\n}\n\n// ─── Recipient sealing (RSA-OAEP-SHA256) ───────────────────────────────\n//\n// The managed-secret TLV wraps a per-blob CEK for a recipient who holds an\n// RSA private key — locally (`MemoryRecipientSealer`) or in a KMS\n// (`@noy-db/at-aws-kms`, wire-compatible with RSAES_OAEP_SHA_256). Only the\n// asymmetric steps live here; the TLV layout stays in `managed-secret.ts`.\nexport function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string {\n  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer)\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]!)\n  }\n  return btoa(binary)\n}\nexport function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer> {\n  const binary = atob(base64)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes\n}\n"],"mappings":";;;;;AAOO,SAAS,mBAAmB,MAA2B,OAAuB;AACnF,QAAM,MAAM,MAAM,UAAU,KAAK;AACjC,MAAI,SAAS,WAAY,QAAO;AAKhC,SAAO,IAAI,YAAY,EAAE,UAAU,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG;AACtE;;;ACEA,IAAM,SAAS,WAAW,OAAO;AAI1B,IAAM,WAAW;AAExB,IAAM,aAAa;AACZ,IAAM,WAAW;AACxB,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAUhC,IAAM,mBAAmB,IAAI,WAAW,CAAC,KAAM,GAAG,IAAI,YAAY,EAAE,OAAO,sBAAsB,CAAC,CAAC;AAiB5F,SAAS,gBAAgB,OAAoC;AAClE,aAAW,QAAQ,CAAC,UAAU,QAAQ,KAAK,GAAY;AACrD,QAAI,OAAO,QAAQ,IAAI,MAAM,UAAU;AACrC,YAAM,IAAI,gBAAgB,4DAA4D;AAAA,IACxF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,WAAW,CAAC,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC;AAC/E,QAAM,QAAQ,iBAAiB,SAAS,SAAS,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC;AACrF,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,IAAI,kBAAkB,CAAC;AAC3B,MAAI,SAAS,iBAAiB;AAC9B,aAAW,KAAK,UAAU;AACxB,QAAI,SAAS,IAAI,MAAM,EAAE,UAAU,QAAQ,EAAE,QAAQ,KAAK;AAC1D,QAAI,IAAI,GAAG,SAAS,CAAC;AACrB,cAAU,IAAI,EAAE;AAAA,EAClB;AACA,SAAO;AACT;AAQA,eAAsB,UAAU,MAAmC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO,WAAW,IAA+B;AAC3E,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAGA,eAAsB,YAAY,MAAuC;AACvE,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,WAAW,IAA+B,CAAC;AACvF;AA+BA,eAAsB,qBAAqB,MAAiB,MAAkC;AAC5F,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,IAAI;AAClD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,SAAS,QAAQ,OAAO,CAAC,YAAY,CAAC;AACpF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,oBAAoB;AAC1D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,QAAQ,IAAI,EAAE;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AAIrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,SAAS,CAAC;AACxF;AASA,eAAsB,cAAc,KAAgB,MAAmC;AAErF,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,SAAS,IAA+B;AAC9E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAiBA,eAAsB,kBAAkB,KAAgB,gBAA4C;AAElG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAGhD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AAGA,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB;AACtD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO;AAAA,IACxB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AAGA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAQA,eAAsB,qBAAqB,KAAgB,gBAA4C;AACrG,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,uBAAuB;AAC7D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc;AACpD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ;AACrG,SAAO,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAQA,eAAsB,YAAY,KAAgB,MAAmC;AACnF,QAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAA+B;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAQA,eAAsB,cAAc,KAAiB,MAAkB,MAAsC;AAC3G,QAAM,MAAM,MAAM,OAAO,UAAU,OAAO,KAAqB,QAAQ,OAAO,CAAC,WAAW,CAAC;AAC3F,SAAO,OAAO;AAAA,IACZ,EAAE,MAAM,QAAQ,MAAM,WAAW,MAA4B,KAA2B;AAAA,IACxF;AAAA,IACA,EAAE,MAAM,WAAW,QAAQ,SAAS;AAAA,IACpC;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,EACvB;AACF;AAKO,SAAS,aAAyB;AACvC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,QAAQ,CAAC;AACnE;AAGO,SAAS,eAA2B;AACzC,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AACrE;AAUO,SAAS,yBAAqC;AACnD,SAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,qBAAqB,CAAC;AAChF;AAQO,SAAS,eAAe,QAA0C;AACvE,QAAM,QAAQ,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;AAC3E,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAAA,EACzC;AACA,SAAO,KAAK,MAAM;AACpB;AACO,SAAS,eAAe,QAAyC;AACtE,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-MTL7MXGR.js → chunk-QDHHHI5Q.js}

@@ -1,30 +1,29 @@
+import {
+  ENCLAVE_SCHEME
+} from "./chunk-5XONHAFD.js";
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-QWFHIOD2.js";
+} from "./chunk-D5A3GCZ4.js";
+import {
+  bytesToB64url,
+  computeFieldHashes,
+  encodeQr,
+  signPayloadCore
+} from "./chunk-GMKGGY7V.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
-  buildRecordAad
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import {
+  buildRecordAad,
+  buildRecordEnvelope,
   encrypt
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   AttestationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/attestation/issue.ts
-import {
-  computeFieldHashes,
-  signPayloadCore,
-  encodeQr,
-  bytesToB64url
-} from "@noy-db/attestation";
 async function issueAttestationCore(ctx, args) {
   if (ctx.role !== "owner") {
     throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`);
@@ -41,7 +40,7 @@ async function issueAttestationCore(ctx, args) {
     throw new AttestationError(`issueAttestation: ${e.message}`);
   }
   const docId = generateULID();
-  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64);
+  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME);
   const payload = { v: 1, docId, salt: saltB64, alg: "ed25519", keyId: signer.keyId, fieldHashes, sig };
   const index = {
     docId,
@@ -63,4 +62,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-MTL7MXGR.js.map
+//# sourceMappingURL=chunk-QDHHHI5Q.js.map

package/dist/chunk-QDHHHI5Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/issue.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, type EnclaveKey } from '../../capsule/index.js'\nimport { AttestationError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION } from './signer.js'\nimport { ENCLAVE_SCHEME } from './scheme.js'\nimport { computeFieldHashes, signPayloadCore, encodeQr, bytesToB64url } from '@noy-db/attestation'\nimport type { AttestationFieldSchema, QrPayload } from './types.js'\n\n/** Everything issueAttestationCore needs from the Vault, injected for testability. */\nexport interface IssueContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */\n  getDEK(): Promise<EnclaveKey>\n  /** Decrypted source record + its envelope version, or null if absent. */\n  readRecord(collection: string, id: string): Promise<{ record: Record<string, unknown>; version: number } | null>\n}\n\nexport interface IssueArgs {\n  readonly collection: string\n  readonly id: string\n  readonly fieldSchema: AttestationFieldSchema\n}\nexport interface IssueResult {\n  readonly docId: string\n  readonly qr: string\n  readonly payload: QrPayload\n  readonly keyId: string\n  readonly publicKeyB64: string\n}\n\nexport async function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult> {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`)\n  }\n  const src = await ctx.readRecord(args.collection, args.id)\n  if (!src) throw new AttestationError(`issueAttestation: source record '${args.collection}/${args.id}' not found.`)\n\n  const dek = await ctx.getDEK()\n  // ONE signer implementation, from signer.ts. Lazily minted + persisted.\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => Promise.resolve(dek))\n\n  const saltB64 = bytesToB64url(crypto.getRandomValues(new Uint8Array(16)))\n  let fieldHashes: string[]\n  try {\n    fieldHashes = await computeFieldHashes(saltB64, args.fieldSchema, src.record)\n  } catch (e) {\n    throw new AttestationError(`issueAttestation: ${(e as Error).message}`)\n  }\n  const docId = generateULID()\n\n  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME)\n  const payload: QrPayload = { v: 1, docId, salt: saltB64, alg: 'ed25519', keyId: signer.keyId, fieldHashes, sig }\n\n  const index = {\n    docId, issuedAt: new Date().toISOString(), keyId: signer.keyId,\n    fieldPaths: args.fieldSchema.fields.map((f) => f.path),\n    sourceRefs: [{ collection: args.collection, id: args.id, version: src.version }],\n  }\n  const identity = { collection: ATTESTATIONS_COLLECTION, id: docId, version: 1 }\n  const { iv, data } = await encrypt(JSON.stringify(index), dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(\n    identity,\n    { ts: index.issuedAt, iv, data },\n  )\n  await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, docId, env)\n\n  return { docId, qr: encodeQr(payload), payload, keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAsB,qBAAqB,KAAmB,MAAuC;AACnG,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,0DAA0D,IAAI,IAAI,mEAAmE;AAAA,EAClK;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,KAAK,YAAY,KAAK,EAAE;AACzD,MAAI,CAAC,IAAK,OAAM,IAAI,iBAAiB,oCAAoC,KAAK,UAAU,IAAI,KAAK,EAAE,cAAc;AAEjH,QAAM,MAAM,MAAM,IAAI,OAAO;AAE7B,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,QAAQ,QAAQ,GAAG,CAAC;AAExF,QAAM,UAAU,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AACxE,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,mBAAmB,SAAS,KAAK,aAAa,IAAI,MAAM;AAAA,EAC9E,SAAS,GAAG;AACV,UAAM,IAAI,iBAAiB,qBAAsB,EAAY,OAAO,EAAE;AAAA,EACxE;AACA,QAAM,QAAQ,aAAa;AAE3B,QAAM,MAAM,MAAM,gBAAgB,EAAE,GAAG,GAAG,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,YAAY,GAAG,OAAO,oBAAoB,cAAc;AAC7I,QAAM,UAAqB,EAAE,GAAG,GAAG,OAAO,MAAM,SAAS,KAAK,WAAW,OAAO,OAAO,OAAO,aAAa,IAAI;AAE/G,QAAM,QAAQ;AAAA,IACZ;AAAA,IAAO,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAG,OAAO,OAAO;AAAA,IACzD,YAAY,KAAK,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IACrD,YAAY,CAAC,EAAE,YAAY,KAAK,YAAY,IAAI,KAAK,IAAI,SAAS,IAAI,QAAQ,CAAC;AAAA,EACjF;AACA,QAAM,WAAW,EAAE,YAAY,yBAAyB,IAAI,OAAO,SAAS,EAAE;AAC9E,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,KAAK,GAAG,KAAK,eAAe,QAAQ,CAAC;AACvF,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,IAAI,MAAM,UAAU,IAAI,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,OAAO,GAAG;AAElE,SAAO,EAAE,OAAO,IAAI,SAAS,OAAO,GAAG,SAAS,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AACzG;","names":[]}

package/dist/{chunk-F24ZZTHQ.js → chunk-QGFEBNHO.js}

@@ -1,16 +1,16 @@
 import {
   splitAroundJoins
-} from "./chunk-7JE7BDYJ.js";
+} from "./chunk-ZVSKSUGI.js";
 import {
   evaluateClause,
   hasFnClause,
   normalizeMatches,
   normalizeSubqueryOperand
-} from "./chunk-HLEK5VAN.js";
+} from "./chunk-BUE7R3B5.js";
 import {
   FieldNotQueryableError,
   QueryExtensionMissingError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/query/scan-builder.ts
 var DEFAULT_SCAN_PAGE_SIZE = 100;
@@ -190,4 +190,4 @@ for (const [method, subpath] of SCAN_EXTENSION_METHODS) {
 export {
   ScanBuilder
 };
-//# sourceMappingURL=chunk-F24ZZTHQ.js.map
+//# sourceMappingURL=chunk-QGFEBNHO.js.map

package/dist/{chunk-A6IJU4TK.js → chunk-QGSNJD3B.js}

@@ -1,6 +1,6 @@
 import {
   CargoNotEnabledError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -12,4 +12,4 @@ var NO_CARGO = {
 export {
   NO_CARGO
 };
-//# sourceMappingURL=chunk-A6IJU4TK.js.map
+//# sourceMappingURL=chunk-QGSNJD3B.js.map

package/dist/chunk-QJNAHPVT.js

@@ -0,0 +1,91 @@
+// src/with-shape/introspection/field-meta.ts
+var FieldMetaUnknownFieldError = class extends Error {
+  constructor(collection, key) {
+    super(`fieldMeta for collection "${collection}" references unknown field "${key}". Declare it in the schema/config or remove the fieldMeta entry.`);
+    this.collection = collection;
+    this.key = key;
+    this.name = "FieldMetaUnknownFieldError";
+  }
+  collection;
+  key;
+};
+function validateFieldMetaKeys(collection, fieldMeta, knownFields) {
+  for (const key of Object.keys(fieldMeta)) {
+    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key);
+  }
+}
+function humanizeFieldKey(key) {
+  return key.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function resolveFieldMeta(key, inputs) {
+  const { channel, zodMeta, inferred } = inputs;
+  const pick = (k) => channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k];
+  const description = pick("description");
+  const semanticType = pick("semanticType");
+  const unit = pick("unit");
+  const sensitivity = pick("sensitivity");
+  const bulk = pick("bulk");
+  const aggregate = pick("aggregate");
+  const aliases = pick("aliases");
+  const displayFor = pick("displayFor");
+  const widget = pick("widget");
+  const group = pick("group");
+  const order = pick("order");
+  return {
+    label: pick("label") ?? humanizeFieldKey(key),
+    ...description !== void 0 ? { description } : {},
+    ...semanticType !== void 0 ? { semanticType } : {},
+    ...unit !== void 0 ? { unit } : {},
+    ...sensitivity !== void 0 ? { sensitivity } : {},
+    ...bulk !== void 0 ? { bulk } : {},
+    ...aggregate !== void 0 ? { aggregate } : {},
+    ...aliases !== void 0 ? { aliases } : {},
+    ...displayFor !== void 0 ? { displayFor } : {},
+    ...widget !== void 0 ? { widget } : {},
+    ...group !== void 0 ? { group } : {},
+    ...order !== void 0 ? { order } : {}
+  };
+}
+function schemaFieldKeys(schema) {
+  let s = schema;
+  for (let depth = 0; depth < 10; depth++) {
+    if (s === null || typeof s !== "object") return void 0;
+    const shape = s.shape;
+    if (shape !== null && typeof shape === "object") {
+      const keys = Object.keys(shape);
+      return keys.length > 0 ? keys : void 0;
+    }
+    const def = s._def;
+    const effect = def?.effect?.type;
+    if (def?.schema !== void 0 && (effect === "refinement" || effect === "preprocess")) {
+      s = def.schema;
+      continue;
+    }
+    if (def?.out !== void 0) {
+      s = def.out;
+      continue;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function validateFieldMetaAtRegistration(input) {
+  if (input.fieldMeta === void 0) return;
+  const validatorKeys = schemaFieldKeys(input.schema);
+  if (validatorKeys === void 0) return;
+  validateFieldMetaKeys(
+    input.collection,
+    input.fieldMeta,
+    /* @__PURE__ */ new Set([...validatorKeys, ...input.configKeys])
+  );
+}
+
+export {
+  FieldMetaUnknownFieldError,
+  validateFieldMetaKeys,
+  humanizeFieldKey,
+  resolveFieldMeta,
+  schemaFieldKeys,
+  validateFieldMetaAtRegistration
+};
+//# sourceMappingURL=chunk-QJNAHPVT.js.map

package/dist/chunk-QJNAHPVT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/field-meta.ts"],"sourcesContent":["/**\n * Consumer-neutral, data-relatable field descriptors — the canonical,\n * validator-agnostic authoring channel. Merged by `collection.describe()`.\n *\n * Descriptive, never prescriptive: label/semanticType/unit/sensitivity/\n * aggregate/aliases/displayFor only. Layout, styling, and active-locale\n * selection stay app-side.\n *\n * @module\n */\n\n/** Known semantic types; the union is open — unknown strings pass through. */\nexport type SemanticType =\n  | 'date' | 'datetime' | 'email' | 'url' | 'currency' | 'percent'\n  | 'country' | 'vat' | 'iban' | 'entity'\n  | (string & {})\n\nexport interface FieldMeta {\n  /** Human label for any displayable field. Required. */\n  label: string\n  description?: string\n  semanticType?: SemanticType\n  /** Display unit, e.g. '€', '%', 'kg'. */\n  unit?: string\n  /** Data classification driving redaction/inspector masking. */\n  sensitivity?: 'public' | 'pii' | 'secret'\n  /**\n   * Sensitivity that is a property of the READ SHAPE, not the value (#1251).\n   *\n   * ⚠️ Declaring this prevents nothing. Against an insider holding the device\n   * and local keys it is TELEMETRY: it lets an opt-in sensor make bulk\n   * extraction visible early, attributable and loud. The real remediation is\n   * key custody — tiers and per-collection DEKs — not this label.\n   *\n   * Reads as: *this field's collection is a corpus whose COVERAGE is a\n   * protected quantity.* Deliberately ORTHOGONAL to {@link FieldMeta.sensitivity}:\n   * a company tax id stays `'public'` (it is public by law) and is still\n   * `bulk: 'sensitive'`, because the book of business is the set, not the value.\n   *\n   * The kernel does NOTHING with it beyond carrying it through introspection\n   * (`describe()` / `dumpSchema()`), so a sensor can discover which\n   * collections to account for. Zero runtime cost when unused.\n   */\n  bulk?: 'sensitive'\n  /** Default aggregation for this field. */\n  aggregate?: 'sum' | 'count' | 'distinct' | 'none'\n  /** Canonical search synonyms (data vocabulary, not UI). */\n  aliases?: readonly string[]\n  /** Entity pairing: the field holding the human label for this id (buyerId → buyerName). */\n  displayFor?: string\n  /**\n   * Override the widget hint derived from semanticType/type.\n   * e.g. 'textarea', 'date', 'money', 'select', 'checkbox', 'number', 'text'.\n   * When absent, the widget is derived automatically by buildDescription.\n   */\n  widget?: string\n  /**\n   * Card/section grouping hint for detail & form layouts (e.g. 'Identity',\n   * 'Amounts'). Purely descriptive metadata — consumers group; describe()\n   * keeps emitting fields alphabetically.\n   */\n  group?: string\n  /** Relative ordering hint within (and across) groups. Lower renders first. */\n  order?: number\n}\n\nexport class FieldMetaUnknownFieldError extends Error {\n  constructor(public readonly collection: string, public readonly key: string) {\n    super(`fieldMeta for collection \"${collection}\" references unknown field \"${key}\". `\n      + `Declare it in the schema/config or remove the fieldMeta entry.`)\n    this.name = 'FieldMetaUnknownFieldError'\n  }\n}\n\n/** Reject fieldMeta keys that are not known fields (typo guard), fail-loud. */\nexport function validateFieldMetaKeys(\n  collection: string,\n  fieldMeta: Record<string, FieldMeta>,\n  knownFields: ReadonlySet<string>,\n): void {\n  for (const key of Object.keys(fieldMeta)) {\n    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key)\n  }\n}\n\nexport interface MergeInputs {\n  channel?: FieldMeta\n  zodMeta?: Partial<FieldMeta>\n  inferred?: Partial<FieldMeta>\n}\nexport interface ResolvedMeta extends Partial<FieldMeta> { label: string }\n\n/** camelCase / snake_case → Title Case words. */\nexport function humanizeFieldKey(key: string): string {\n  return key\n    .replace(/[_-]+/g, ' ')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .trim()\n    .split(/\\s+/)\n    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n    .join(' ')\n}\n\n/** Merge one field's metadata: channel > zodMeta > inferred; label always present. */\nexport function resolveFieldMeta(key: string, inputs: MergeInputs): ResolvedMeta {\n  const { channel, zodMeta, inferred } = inputs\n  const pick = <K extends keyof FieldMeta>(k: K): FieldMeta[K] | undefined =>\n    channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k]\n  const description = pick('description')\n  const semanticType = pick('semanticType')\n  const unit = pick('unit')\n  const sensitivity = pick('sensitivity')\n  const bulk = pick('bulk')\n  const aggregate = pick('aggregate')\n  const aliases = pick('aliases')\n  const displayFor = pick('displayFor')\n  const widget = pick('widget')\n  const group = pick('group')\n  const order = pick('order')\n  return {\n    label: pick('label') ?? humanizeFieldKey(key),\n    ...(description !== undefined ? { description } : {}),\n    ...(semanticType !== undefined ? { semanticType } : {}),\n    ...(unit !== undefined ? { unit } : {}),\n    ...(sensitivity !== undefined ? { sensitivity } : {}),\n    ...(bulk !== undefined ? { bulk } : {}),\n    ...(aggregate !== undefined ? { aggregate } : {}),\n    ...(aliases !== undefined ? { aliases } : {}),\n    ...(displayFor !== undefined ? { displayFor } : {}),\n    ...(widget !== undefined ? { widget } : {}),\n    ...(group !== undefined ? { group } : {}),\n    ...(order !== undefined ? { order } : {}),\n  }\n}\n\n/**\n * Field KEYS from a configured validator, synchronously — the complement to\n * {@link deriveZodFields}, which derives field TYPES and must be async.\n *\n * The distinction is the whole point (#1253). `describe()`'s sync path passed\n * `zodFields: undefined`, so `fieldMeta` key-validation could never run there\n * and a typo'd key became a PHANTOM FIELD carrying its declared `sensitivity`\n * while the real field went undescribed — an inventory wrong in both\n * directions, silently, on the surface `sensitivity` exists to serve.\n *\n * That was read as unavoidable (\"the sync path cannot know the schema's\n * fields\"), which is true of types and false of keys: a Zod object exposes\n * `.shape` directly, on both v3 and v4, with no JSON-Schema derivation and no\n * `zod-to-json-schema` peer. The latter matters — on Zod 3 that peer is\n * required for the async path, so the sync path is the only one some\n * consumers can reach.\n *\n * A duck-typed probe, not a Zod dependency: an unrecognised validator returns\n * `undefined` and the caller stays silent rather than guessing, so a validator\n * hub cannot read never produces a false \"unknown field\" error.\n *\n * Wrappers (reported by the pilot on #1249's guard, and it equally affected\n * #1253's): a wrapped object's `.shape` is undefined, so \"has a schema\" and\n * \"hub can enumerate its fields\" silently diverged for exactly the schemas\n * most worth guarding — validated ones.\n *\n * ONE RULE UNWRAPS ALL OF THEM: FOLLOW THE OUTPUT SIDE. These keys describe\n * the PARSED record, so the only question a wrapper raises is whether it\n * changes the parsed shape.\n *\n *   Zod 3 `ZodEffects`  — `.refine()`/`.superRefine()` (`effect.type` is\n *     `'refinement'`) and `z.preprocess()` (`'preprocess'`) both parse WITH\n *     the inner schema, so the output is the inner object: follow\n *     `_def.schema`. `.transform()` REPLACES the output, so the inner keys\n *     would be a lie: stay `undefined`, deliberately.\n *   Zod 4 `ZodPipe`     — `z.preprocess()` is `pipe(transform -> object)` and\n *     `.transform()` is `pipe(object -> transform)`. Following `_def.out`\n *     resolves both correctly with no effect-kind test: preprocess reaches the\n *     object, transform reaches a `ZodTransform` that has no shape and no\n *     inner schema, so the loop returns `undefined` on its own.\n *\n * `preprocess` was the pilot's second finding (#1262): the first fix followed\n * refinements only, which left four of their registered collections unguarded\n * — including the one carrying their only `fieldMeta` PII declaration, i.e.\n * precisely the collection #1253 was written for. It is one string away from\n * `transform` and means the opposite thing, so a test pins the two apart.\n *\n * A duck-typed probe throughout: an unrecognised validator returns `undefined`\n * and the caller stays silent rather than guessing. Bounded depth, so a cyclic\n * duck cannot hang us.\n */\nexport function schemaFieldKeys(schema: unknown): readonly string[] | undefined {\n  let s: unknown = schema\n  for (let depth = 0; depth < 10; depth++) {\n    if (s === null || typeof s !== 'object') return undefined\n    const shape: unknown = (s as { shape?: unknown }).shape\n    if (shape !== null && typeof shape === 'object') {\n      const keys = Object.keys(shape as Record<string, unknown>)\n      return keys.length > 0 ? keys : undefined\n    }\n    const def = (s as {\n      _def?: { effect?: { type?: unknown }; schema?: unknown; out?: unknown }\n    })._def\n    // Zod 3 ZodEffects: refinement and preprocess parse WITH the inner schema,\n    // so the output shape is the inner object's. `transform` replaces it.\n    const effect = def?.effect?.type\n    if (def?.schema !== undefined && (effect === 'refinement' || effect === 'preprocess')) {\n      s = def.schema\n      continue\n    }\n    // Zod 4 ZodPipe: the output side IS the parsed shape. `z.preprocess` puts\n    // the object there; `.transform()` puts a shapeless ZodTransform there,\n    // which falls out of the loop as `undefined` on the next pass.\n    if (def?.out !== undefined) {\n      s = def.out\n      continue\n    }\n    return undefined\n  }\n  return undefined\n}\n\n/**\n * Registration-time `fieldMeta` key check (#1253 follow-up, the \"refuse as early\n * as the information allows\" pass).\n *\n * The same validation `buildDescription` runs, hoisted to collection\n * construction so a typo is refused when it is DECLARED rather than when\n * someone happens to call `describe()`. A collection nobody describes was\n * previously never checked at all — and `fieldMeta` is what carries\n * `sensitivity`, so the un-checked case was the one with a data-classification\n * inventory hanging off it.\n *\n * Deliberately NOT a replacement for the check inside `buildDescription`. There\n * are three tiers of knowability, not two:\n *\n *   always      — a name declared in the config itself (see the virtual-field\n *                 refusal in the derivation registry: \"declared and never\n *                 stored\" needs no schema at all)\n *   at reg.     — a validator whose `.shape` is readable synchronously: THIS\n *   at describe — a validator whose fields only exist after async JSON-Schema\n *                 derivation (Zod 3 + `zod-to-json-schema`)\n *\n * The third tier is why `buildDescription` keeps its own call. Hoisting alone\n * would move the check earlier for some collections and REMOVE it for others.\n *\n * Silent when the field set cannot be enumerated, exactly as the describe-time\n * check is: a TS-generic collection names real fields that appear in no runtime\n * config, and rejecting those teaches people to stop declaring `fieldMeta`.\n */\nexport function validateFieldMetaAtRegistration(input: {\n  readonly collection: string\n  readonly schema?: unknown\n  readonly fieldMeta?: Record<string, unknown> | undefined\n  readonly configKeys: readonly string[]\n}): void {\n  if (input.fieldMeta === undefined) return\n  const validatorKeys = schemaFieldKeys(input.schema)\n  if (validatorKeys === undefined) return\n  validateFieldMetaKeys(\n    input.collection,\n    input.fieldMeta as Parameters<typeof validateFieldMetaKeys>[1],\n    new Set<string>([...validatorKeys, ...input.configKeys]),\n  )\n}\n"],"mappings":";AAkEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,KAAa;AAC3E,UAAM,6BAA6B,UAAU,+BAA+B,GAAG,mEACX;AAF1C;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAGO,SAAS,sBACd,YACA,WACA,aACM;AACN,aAAW,OAAO,OAAO,KAAK,SAAS,GAAG;AACxC,QAAI,CAAC,YAAY,IAAI,GAAG,EAAG,OAAM,IAAI,2BAA2B,YAAY,GAAG;AAAA,EACjF;AACF;AAUO,SAAS,iBAAiB,KAAqB;AACpD,SAAO,IACJ,QAAQ,UAAU,GAAG,EACrB,QAAQ,sBAAsB,OAAO,EACrC,KAAK,EACL,MAAM,KAAK,EACX,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,GAAG;AACb;AAGO,SAAS,iBAAiB,KAAa,QAAmC;AAC/E,QAAM,EAAE,SAAS,SAAS,SAAS,IAAI;AACvC,QAAM,OAAO,CAA4B,MACvC,UAAU,CAAC,KAAK,UAAU,CAAC,KAAK,WAAW,CAAC;AAC9C,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,eAAe,KAAK,cAAc;AACxC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,YAAY,KAAK,WAAW;AAClC,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,KAAK,YAAY;AACpC,QAAM,SAAS,KAAK,QAAQ;AAC5B,QAAM,QAAQ,KAAK,OAAO;AAC1B,QAAM,QAAQ,KAAK,OAAO;AAC1B,SAAO;AAAA,IACL,OAAO,KAAK,OAAO,KAAK,iBAAiB,GAAG;AAAA,IAC5C,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,IACrD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IAC/C,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,IACjD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,IACvC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACF;AAqDO,SAAS,gBAAgB,QAAgD;AAC9E,MAAI,IAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,QAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,UAAM,QAAkB,EAA0B;AAClD,QAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,YAAM,OAAO,OAAO,KAAK,KAAgC;AACzD,aAAO,KAAK,SAAS,IAAI,OAAO;AAAA,IAClC;AACA,UAAM,MAAO,EAEV;AAGH,UAAM,SAAS,KAAK,QAAQ;AAC5B,QAAI,KAAK,WAAW,WAAc,WAAW,gBAAgB,WAAW,eAAe;AACrF,UAAI,IAAI;AACR;AAAA,IACF;AAIA,QAAI,KAAK,QAAQ,QAAW;AAC1B,UAAI,IAAI;AACR;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA8BO,SAAS,gCAAgC,OAKvC;AACP,MAAI,MAAM,cAAc,OAAW;AACnC,QAAM,gBAAgB,gBAAgB,MAAM,MAAM;AAClD,MAAI,kBAAkB,OAAW;AACjC;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,oBAAI,IAAY,CAAC,GAAG,eAAe,GAAG,MAAM,UAAU,CAAC;AAAA,EACzD;AACF;","names":[]}

package/dist/{chunk-BK2HHQGN.js → chunk-QSHATAXJ.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-BK2HHQGN.js.map
+//# sourceMappingURL=chunk-QSHATAXJ.js.map