@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/{chunk-O2IMQSNA.js → chunk-4UIP3QNW.js}

@@ -2,7 +2,7 @@ import {
   IllegalTransitionError,
   RecordLockedError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/guards/with-guard.ts
 function withGuard(strategy) {
@@ -124,4 +124,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-O2IMQSNA.js.map
+//# sourceMappingURL=chunk-4UIP3QNW.js.map

package/dist/{chunk-EJLV62NI.js → chunk-55P6OBB7.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-KZXDLBY6.js";
+} from "./chunk-RDOEOPOI.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-EJLV62NI.js.map
+//# sourceMappingURL=chunk-55P6OBB7.js.map

package/dist/{chunk-Y3LPTBG7.js → chunk-5HNW4ZTA.js}

@@ -4,7 +4,7 @@ import {
   embeddingSourceText,
   encodeVecId,
   isVecIdFor
-} from "./chunk-M5B2W6YY.js";
+} from "./chunk-YKGJ44Z7.js";
 import {
   buildBlobFieldEntries,
   buildDictKeyFieldEntries,
@@ -13,20 +13,20 @@ import {
   extractSnippet,
   searchScan,
   segmentTokenizer
-} from "./chunk-RB4DOPGZ.js";
+} from "./chunk-TZYTMZZY.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
 import {
   isStaticDictDescriptor,
   stripI18nFilled
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-V55JASXO.js";
 import {
   liveRecordIsElevated
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-RIZTZJX6.js";
 import {
   EmbeddingDimMismatchError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-lookup/search/collection-facade.ts
 async function search(ctx, field, query, opts = {}) {
@@ -374,9 +374,6 @@ async function syncTierSearch(ctx, id, record, version) {
 
 export {
   search,
-  buildRetrievalDocs,
-  positionBuildOptions,
-  hasIndexedBlobFields,
   flushIndex,
   buildPersistedIndexCallbacks,
   warmIndex,
@@ -386,4 +383,4 @@ export {
   rebuildEmbeddings,
   syncTierSearch
 };
-//# sourceMappingURL=chunk-Y3LPTBG7.js.map
+//# sourceMappingURL=chunk-5HNW4ZTA.js.map

package/dist/chunk-5HNW4ZTA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/search/collection-facade.ts"],"sourcesContent":["/**\n * Collection-level search / retrieval (`search` / `retrieve` / `similarTo` +\n * the lexical-index build/flush/warm machinery).\n *\n * This is the retrieval surface: a pure client-side lexical scan\n * (`search`), the persisted-or-in-memory inverted-index lifecycle\n * (`flushIndex` / `warmIndex` / `buildRetrievalDocs` + the dict-label / blob-\n * filename resolvers that feed it), and the lexical / semantic / hybrid\n * `retrieve` fan-out plus raw-vector kNN (`similarTo`). None of it touches the\n * write path — it reads the live eager cache and the encrypted `_vec` / `_ftindex`\n * side-cars.\n *\n * Every function takes a small {@link SearchContext} instead of `this`,\n * mirroring the `record-keys/` siblings.\n *\n * The `cache` is the SAME `Map` reference `Collection` owns (passed by\n * reference, never copied) so the index always builds over the live working\n * set. {@link buildPersistedIndexCallbacks} is special: it is invoked from the\n * `Collection` constructor *before* `this.codec` exists, so it takes a context\n * THUNK and resolves the context lazily at each callback invocation.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { RecordCodec } from '../../capsule/index.js'\nimport { stripI18nFilled, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { isStaticDictDescriptor, type DictKeyDescriptor, type StaticDictDescriptor, type DictionaryHandle } from '../../via/i18n/dictionary.js'\nimport type { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport type { Query } from '../../kernel/query/index.js'\nimport { embeddingSourceText, deriveChunkVectors, type VectorSet, type EmbeddingDescriptor, type StoredVector, type StoredChunk } from '../embeddings/index.js'\nimport { encodeVecId, decodeVecId, isVecIdFor } from '../embeddings/vec-id.js'\nimport { EmbeddingDimMismatchError } from '../../kernel/errors.js'\nimport { liveRecordIsElevated } from '../../kernel/tier-visibility.js'\nimport { searchScan, fuseRetrieval, segmentTokenizer, type SearchOptions, type SearchResult } from './index.js'\nimport type { IndexStore } from './index-store.js'\nimport type { PersistedIndexCallbacks } from './persisted-index-store.js'\nimport { extractSnippet } from './snippet.js'\nimport { buildStringFieldEntries, buildI18nFieldEntries, buildDictKeyFieldEntries, buildBlobFieldEntries } from './build-docs.js'\nimport type { IndexDoc, IndexHit, IndexBuildOptions } from './inverted-index.js'\nimport type { RetrieveOptions, RetrieveHit, SimilarToOptions } from './retrieve-types.js'\n\n/** Everything the moving search/retrieval methods touched on `this.*`. */\nexport interface SearchContext<T> {\n  /** Collection name — error context + `_ftindex` row key. */\n  readonly name: string\n  /** Vault namespace the side-cars (`_vec`, `_ftindex`) live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The record codec — decrypts the `_vec` / `_ftindex` side-car bodies. */\n  readonly codec: RecordCodec<T>\n  /** The eager working-set cache (SHARED `Map` reference, never copied). */\n  readonly cache: Map<string, { record: T; version: number }>\n  /** True in lazy mode — search/retrieve/warm require eager mode. */\n  readonly lazy: boolean\n  /** Declared text-index fields, or undefined. */\n  readonly textIndexes: readonly string[] | undefined\n  /** Subset of `textIndexes` recording token positions for phrase / proximity (#1354). */\n  readonly textIndexPositions: readonly string[] | undefined\n  /** Declared i18n fields, or undefined. */\n  readonly i18nFields: Record<string, I18nTextDescriptor> | undefined\n  /** Declared dictionary-key fields, or undefined. */\n  readonly dictKeyFields: Record<string, DictKeyDescriptor | StaticDictDescriptor> | undefined\n  /** Declared blob fields, or undefined. */\n  readonly blobFields: BlobFieldsConfig | undefined\n  /** Dictionary handle resolver (dynamic dict-key labels), or undefined. */\n  readonly getDictionary: ((name: string) => Promise<DictionaryHandle>) | undefined\n  /** The lexical inverted-index store (in-memory or persisted), or undefined. */\n  readonly searchIndexStore: IndexStore | undefined\n  /** The vector set for semantic retrieval, or undefined. */\n  readonly vectorSet: VectorSet | undefined\n  /** The embeddings descriptor, or undefined. */\n  readonly embeddings: EmbeddingDescriptor | undefined\n  /** Hydrate the eager cache before reading it. */\n  ensureHydrated(): Promise<void>\n  /** Open the blob facade for a record (used to list indexed blob filenames). */\n  blob(id: string): BlobSet\n}\n\n/**\n * Client-side lexical scan over the live eager cache. Eager mode only;\n * nothing searchable is written to the store.\n */\nexport async function search<T>(ctx: SearchContext<T>, field: string, query: string, opts: SearchOptions = {}): Promise<SearchResult<T>[]> {\n  if (ctx.lazy) {\n    throw new Error(\n      `Collection \"${ctx.name}\": search() (scan mode) requires eager mode (prefetch: true). ` +\n        `A store-usable blind index for lazy / at-scale search is a separate gated opt-in (#308).`,\n    )\n  }\n  await ctx.ensureHydrated()\n  const entries: { id: string; record: T }[] = []\n  // Strip the internal densify marker from the user-facing records.\n  // Non-mutating: never touches the cached record object. The search index\n  // is built over the same (marker-free) record, which is fine — the marker\n  // is never a searchable field.\n  for (const [id, e] of ctx.cache) entries.push({ id, record: stripI18nFilled(e.record as Record<string, unknown>) as T })\n  return searchScan(entries, field, query, opts)\n}\n\n/** L1 — build IndexDoc[] for the configured text fields over the live cache. */\nfunction buildRetrievalDocs<T>(\n  ctx: SearchContext<T>,\n  labelMaps: Map<string, Map<string, Record<string, string>>>,\n  blobFilenames: Map<string, Map<string, string[]>>,\n  only?: readonly string[],\n): IndexDoc[] {\n  const docs: IndexDoc[] = []\n  for (const [id, e] of ctx.cache) {\n    const rec = stripI18nFilled(e.record as Record<string, unknown>)\n    const fields = buildStringFieldEntries(rec, ctx.textIndexes ?? [], only)\n    if (ctx.i18nFields) fields.push(...buildI18nFieldEntries(rec, ctx.i18nFields, ctx.textIndexes ?? [], only))\n    if (ctx.dictKeyFields) fields.push(...buildDictKeyFieldEntries(rec, ctx.dictKeyFields, labelMaps, ctx.textIndexes ?? [], only))\n    const blobNames = blobFilenames.get(id)\n    if (blobNames) fields.push(...buildBlobFieldEntries(blobNames))\n    if (fields.length > 0) docs.push({ id, fields })\n  }\n  return docs\n}\n\n/**\n * L1 — the positional-postings opt-in for this collection (#1354), or\n * `undefined` when nothing opted in. Returning `undefined` rather than\n * `{ positions: [] }` keeps the no-opt-in path byte-identical to a caller that\n * never heard of positions.\n */\nfunction positionBuildOptions<T>(ctx: SearchContext<T>): IndexBuildOptions | undefined {\n  const fields = ctx.textIndexPositions\n  return fields && fields.length > 0 ? { positions: fields } : undefined\n}\n\n/** L1 — true iff any configured text index is also a blob field (gates ALL slot I/O). */\nfunction hasIndexedBlobFields<T>(ctx: SearchContext<T>, only?: readonly string[]): boolean {\n  if (!ctx.blobFields || !ctx.textIndexes) return false\n  const fields = only ? ctx.textIndexes.filter((f) => only.includes(f)) : ctx.textIndexes\n  return fields.some((f) => f in ctx.blobFields!)\n}\n\n/**\n * L1 — resolve `recordId -> (blobField -> filenames[])` by listing slots\n * for the configured blob fields of each cached record. Blob slot metadata is\n * NOT inline on the record: it lives in a separate `_blob_slots_*` collection,\n * so this costs ONE `blob(id).list()` (a `listSlots`) per record at build time\n * — the heaviest indexing source. Fully gated by {@link hasIndexedBlobFields};\n * non-blob (and blob-but-not-indexed) collections do ZERO slot I/O.\n */\nasync function resolveBlobFilenames<T>(ctx: SearchContext<T>, only?: readonly string[]): Promise<Map<string, Map<string, string[]>>> {\n  const out = new Map<string, Map<string, string[]>>()\n  if (!hasIndexedBlobFields(ctx, only)) return out\n  const indexed = (only ? ctx.textIndexes!.filter((f) => only.includes(f)) : ctx.textIndexes!)\n    .filter((f) => f in ctx.blobFields!)\n  const indexedSet = new Set(indexed)\n  for (const id of ctx.cache.keys()) {\n    let slots\n    try {\n      slots = await ctx.blob(id).list()\n    } catch {\n      continue\n    }\n    let byField: Map<string, string[]> | undefined\n    for (const slot of slots) {\n      if (!indexedSet.has(slot.name) || !slot.filename) continue\n      if (!byField) { byField = new Map(); out.set(id, byField) }\n      const names = byField.get(slot.name)\n      if (names) names.push(slot.filename)\n      else byField.set(slot.name, [slot.filename])\n    }\n  }\n  return out\n}\n\n/** L1 — field -> (key -> {locale->label}) for dictKey fields; static from table, dynamic via getDictionary().list(). */\nasync function resolveDictLabelMaps<T>(ctx: SearchContext<T>): Promise<Map<string, Map<string, Record<string, string>>>> {\n  const maps = new Map<string, Map<string, Record<string, string>>>()\n  if (!ctx.dictKeyFields || !ctx.textIndexes) return maps\n  for (const field of ctx.textIndexes) {\n    const desc = ctx.dictKeyFields[field]\n    if (!desc) continue\n    const m = new Map<string, Record<string, string>>()\n    if (isStaticDictDescriptor(desc)) {\n      for (const [key, labels] of Object.entries(desc.table)) m.set(key, labels as Record<string, string>)\n    } else {\n      if (ctx.getDictionary) {\n        const handle = await ctx.getDictionary(desc.name)\n        for (const e of await handle.list()) m.set(e.key, e.labels)\n      }\n    }\n    maps.set(field, m)\n  }\n  return maps\n}\n\n/** L1.5 — force-persist the lexical index now (e.g. on save/idle). Persists only when textIndexPersist is enabled; a no-op otherwise. */\nexport async function flushIndex<T>(ctx: SearchContext<T>): Promise<void> {\n  if (!ctx.searchIndexStore) return\n  await ctx.ensureHydrated()\n  const labelMaps = await resolveDictLabelMaps(ctx)\n  const blobFilenames = await resolveBlobFilenames(ctx)\n  await ctx.searchIndexStore.ensureBuilt(() => buildRetrievalDocs(ctx, labelMaps, blobFilenames), positionBuildOptions(ctx))\n  await ctx.searchIndexStore.flush?.()\n}\n\n/** L2 — load + decrypt all _vec sidecars into StoredVector[] for the VectorSet. */\nfunction buildVectorLoad<T>(ctx: SearchContext<T>): () => Promise<StoredVector[]> {\n  return async () => {\n    const ids = await ctx.adapter.list(ctx.vault, '_vec')\n    const out: StoredVector[] = []\n    for (const vecId of ids) {\n      // #726: _vec is a vault-wide bucket namespaced by collection prefix —\n      // skip rows belonging to other collections before touching this one's.\n      if (!isVecIdFor(ctx.name, vecId)) continue\n      const id = decodeVecId(ctx.name, vecId)!\n      // #721 defense-in-depth: a _vec row carries no _tier of its own; the purge\n      // on elevate is best-effort and cannot reach a legacy sidecar, so gate on\n      // the owning record's live tier. Envelope peek, no decryption.\n      if (await liveRecordIsElevated(ctx.adapter, ctx.vault, ctx.name, id)) continue\n      const env = await ctx.adapter.get(ctx.vault, '_vec', vecId)\n      if (!env) continue\n      // #726 fails-safe: a row can pass isVecIdFor's prefix filter yet still\n      // be undecryptable under THIS collection's DEK — a surviving legacy\n      // bare-id row whose record id happens to start with `<thisCollection>/`,\n      // or plain corruption. _vec sidecars are derived, re-derivable\n      // artifacts (embedOnWrite regenerates them on the record's next put()),\n      // so best-effort skip is correct: never let one poison row crash\n      // similarTo()/retrieve() for the whole collection.\n      let body: string | null\n      try {\n        body = await ctx.codec.decryptJsonString({ collection: '_vec', id: vecId }, env)\n      } catch {\n        continue\n      }\n      if (body === null) continue\n      // #1360: a body carries EITHER `vec` (whole-record, the original shape,\n      // still written whenever no `chunk` hook is declared) or `chunks`\n      // (sub-document). Reading both shapes is what makes chunking adoptable\n      // without a rewrite: existing `_vec` rows keep loading unchanged.\n      const parsed = JSON.parse(body) as { vec?: number[]; chunks?: { id: string; start: number; end: number; vec: number[] }[]; model: string }\n      if (parsed.chunks && parsed.chunks.length > 0) {\n        const chunks: StoredChunk[] = parsed.chunks.map((c) => ({ id: c.id, start: c.start, end: c.end, vec: new Float32Array(c.vec) }))\n        out.push({ id, model: parsed.model, chunks })\n      } else if (parsed.vec) {\n        out.push({ id, vec: new Float32Array(parsed.vec), model: parsed.model })\n      }\n    }\n    return out\n  }\n}\n\n/**\n * L1.5 — build the PersistedIndexCallbacks bridge: crypto lives here\n * (collection has getDEK / encryptJsonString / decryptJsonString / adapter),\n * the index store itself is crypto-free.\n *\n * Fingerprint encoding: body-wrap approach — save(json, fp) stores\n * JSON.stringify({ fp, idx: json }) as the encrypted body so the standard\n * EncryptedEnvelope shape is never extended. load() decrypts and JSON.parses\n * the wrapper back out.\n *\n * Cache shape: ctx.cache stores { record, version } — currentFingerprint()\n * iterates over e.version.\n *\n * NOTE: this factory is invoked from the `Collection` constructor *before*\n * `this.codec` is assigned, so it takes a context THUNK and resolves the\n * context lazily inside each callback — by the time a callback actually runs,\n * the codec and cache are fully wired.\n */\nexport function buildPersistedIndexCallbacks<T>(provideCtx: () => SearchContext<T>): PersistedIndexCallbacks {\n  const FT = '_ftindex'\n  return {\n    load: async () => {\n      const ctx = provideCtx()\n      const env = await ctx.adapter.get(ctx.vault, FT, ctx.name)\n      if (!env) return null\n      const body = await ctx.codec.decryptJsonString({ collection: FT, id: ctx.name }, env)\n      if (body === null) return null\n      try {\n        const wrapped = JSON.parse(body) as { fp: { count: number; maxVersion: number }; idx: string }\n        return { json: wrapped.idx, fingerprint: wrapped.fp }\n      } catch {\n        return null\n      }\n    },\n    save: async (json, fp, isStale) => {\n      const ctx = provideCtx()\n      const body = JSON.stringify({ fp, idx: json })\n      const env = await ctx.codec.encryptJsonString({ collection: FT, id: ctx.name }, body, fp.count)\n      // #725 review: a purge (removePersisted) can land while the encrypt above was\n      // in flight — check right before the write and skip it rather than resurrect a\n      // purged/forgotten record's blob. PersistedIndexStore's own post-save epoch\n      // check is the backstop for every other ordering (incl. a purge landing during\n      // this very put).\n      if (isStale()) return\n      await ctx.adapter.put(ctx.vault, FT, ctx.name, env)\n    },\n    remove: async () => { const ctx = provideCtx(); await ctx.adapter.delete(ctx.vault, FT, ctx.name) },\n    currentFingerprint: () => {\n      const ctx = provideCtx()\n      let maxVersion = 0\n      for (const e of ctx.cache.values()) if (e.version > maxVersion) maxVersion = e.version\n      return { count: ctx.cache.size, maxVersion }\n    },\n  }\n}\n\n/** L1 — pre-build the lexical index (e.g. on open) so the first retrieve() pays no build scan. */\nexport async function warmIndex<T>(ctx: SearchContext<T>): Promise<void> {\n  if (!ctx.searchIndexStore) return\n  if (ctx.lazy) {\n    throw new Error(\n      `Collection \"${ctx.name}\": warmIndex() requires eager mode (prefetch: true).`,\n    )\n  }\n  await ctx.ensureHydrated()\n  const built = ctx.searchIndexStore.built\n  const labelMaps = built ? new Map() : await resolveDictLabelMaps(ctx)\n  const blobFilenames = built ? new Map() : await resolveBlobFilenames(ctx)\n  await ctx.searchIndexStore.ensureBuilt(() => buildRetrievalDocs(ctx, labelMaps, blobFilenames), positionBuildOptions(ctx))\n}\n\n/**\n * Sentinel `limit` pushed into the mode branches when a `within` is present, so\n * the branch's own truncation (`InvertedIndex.query`'s slice, `cosineTopK`'s\n * `k`, `fuseRetrieval`'s `limit`) becomes a no-op and the caller's real `limit`\n * can be applied AFTER narrowing. `slice(0, Infinity)` is the whole list.\n */\nconst NO_LIMIT = Number.POSITIVE_INFINITY\n\n/**\n * Retrieval. mode: 'lexical' (default) | 'semantic' (L2) | 'hybrid' (L3).\n *\n * ## `within` — the typed half of retrieval (#1343)\n *\n * Money / number / date / boolean fields are NOT tokenised into the lexical\n * index and never will be: instead of a second (typed-token) index format, a\n * typed match is expressed as an ordinary `Query` and handed to `within`, so\n * the comparison runs in the query engine — over the sorted / compound range\n * indexes — in each field's CANONICAL space (money as its scaled integer, not\n * as a lexically-compared string). `retrieve()` contributes the text half and\n * intersects.\n *\n * Two ordering properties, both load-bearing:\n *\n * - **Scoring is global; narrowing is not.** BM25 runs over the WHOLE corpus\n *   (df / N / avgdl unchanged by `within`), so a document's score is the same\n *   whichever `within` it is paired with — a filter re-ranks nothing. Narrowing\n *   the postings instead would make IDF filter-dependent and scores\n *   incomparable between two calls. It also costs nothing to score first: the\n *   index already scores every doc and only slices at the end.\n * - **`limit` counts hits from the NARROWED set.** Truncating corpus-wide first\n *   and filtering after would under-return (`limit: 10` yielding 1), so the\n *   mode branches run unlimited and the caller's `limit` is applied last.\n *\n * An empty `within` result set yields NO hits — never all of them.\n *\n * A `within` with an empty text query is **typed-only retrieval**: the typed\n * predicate is the whole query, returned in the usual hit shape (score 0,\n * `field: '(within)'`, empty snippet) so a typed and a text search are read the\n * same way. An empty query with NO `within` still matches nothing.\n */\nexport async function retrieve<T>(ctx: SearchContext<T>, query: string, opts: RetrieveOptions<T> = {}): Promise<RetrieveHit<T>[]> {\n  if (opts.within === undefined) {\n    return opts.mode === 'semantic' ? retrieveSemantic(ctx, query, opts)\n      : opts.mode === 'hybrid' ? retrieveHybrid(ctx, query, opts)\n      : retrieveLexical(ctx, query, opts)\n  }\n  // Typed-only: no query terms to score, so the whole answer is the id set.\n  // Checked before the mode branches so it needs neither a textIndexes config\n  // nor an embeddings config — a collection of pure money/number fields is a\n  // legitimate `retrieve({ within })` target.\n  if (segmentTokenizer(query).length === 0) return retrieveWithinOnly(ctx, opts, opts.within)\n  const unlimited: RetrieveOptions<T> = { ...opts, limit: NO_LIMIT }\n  const hits =\n    opts.mode === 'semantic' ? await retrieveSemantic(ctx, query, unlimited)\n    : opts.mode === 'hybrid' ? await retrieveHybrid(ctx, query, unlimited)\n    : await retrieveLexical(ctx, query, unlimited)\n  return applyWithin(hits, opts.within, opts.limit)\n}\n\n/**\n * L3 — keep only hits whose id matches the structured query, truncate to the\n * caller's `limit` (the mode branches ran unlimited), re-rank 1-based.\n */\nfunction applyWithin<T>(hits: RetrieveHit<T>[], within: Query<T>, limit: number | undefined): RetrieveHit<T>[] {\n  const ids = new Set(within._idArray())\n  const kept = hits.filter(h => ids.has(h.id))\n  const limited = limit !== undefined ? kept.slice(0, limit) : kept\n  return limited.map((h, i) => ({ ...h, rank: i + 1 }))\n}\n\n/**\n * #1343 — typed-only retrieval: `retrieve('', { within })`. The hits are the\n * `within` ids in query order, presented like any other hit so callers need no\n * second result shape. `score` is 0 and `field` is `'(within)'` because nothing\n * was scored — a structured predicate either matches or does not, and faking a\n * BM25 number would invite sorting by it.\n */\nasync function retrieveWithinOnly<T>(ctx: SearchContext<T>, opts: RetrieveOptions<T>, within: Query<T>): Promise<RetrieveHit<T>[]> {\n  if (ctx.lazy) {\n    throw new Error(`Collection \"${ctx.name}\": retrieve() requires eager mode (prefetch: true).`)\n  }\n  await ctx.ensureHydrated()\n  const ids = within._idArray()\n  const limited = opts.limit !== undefined ? ids.slice(0, opts.limit) : ids\n  return limited.map((id, i) => {\n    const base: RetrieveHit<T> = { id, score: 0, rank: i + 1, field: '(within)', snippet: '' }\n    if (opts.includeRecord) {\n      const e = ctx.cache.get(id)\n      if (e) (base as { record?: T }).record = stripI18nFilled(e.record as Record<string, unknown>) as T\n    }\n    return base\n  })\n}\n\n/** L1 — client-side lexical retrieval; ranked { id, score, field, snippet, locale? }. */\nasync function retrieveLexical<T>(ctx: SearchContext<T>, query: string, opts: RetrieveOptions<T>): Promise<RetrieveHit<T>[]> {\n  if (!ctx.searchIndexStore) {\n    throw new Error(`Collection \"${ctx.name}\": retrieve() requires a textIndexes config.`)\n  }\n  if (ctx.lazy) {\n    throw new Error(\n      `Collection \"${ctx.name}\": retrieve() requires eager mode (prefetch: true).`,\n    )\n  }\n  await ctx.ensureHydrated()\n  const built = ctx.searchIndexStore.built\n  const labelMaps = built ? new Map() : await resolveDictLabelMaps(ctx)\n  const blobFilenames = built ? new Map() : await resolveBlobFilenames(ctx)\n  const index = await ctx.searchIndexStore.ensureBuilt(() => buildRetrievalDocs(ctx, labelMaps, blobFilenames), positionBuildOptions(ctx))\n  const hits = index.query(query, {\n    ...(opts.limit !== undefined ? { limit: opts.limit } : {}),\n    ...(opts.match ? { match: opts.match } : {}),\n    ...(opts.prefix ? { prefix: opts.prefix } : {}),\n    ...(opts.fields ? { fields: opts.fields } : {}),\n    ...(opts.boost ? { boost: opts.boost } : {}),\n  })\n  const window = opts.snippetWindow ?? 80\n  return hits.map((h: IndexHit, i: number) => {\n    const base: RetrieveHit<T> = {\n      id: h.id,\n      score: h.score,\n      rank: i + 1,\n      field: h.field,\n      snippet: extractSnippet(h.text, h.offset, window),\n      ...(h.locale !== undefined ? { locale: h.locale } : {}),\n      ...(opts.includeRecord\n        ? (() => {\n            const e = ctx.cache.get(h.id)\n            return e ? { record: stripI18nFilled(e.record as Record<string, unknown>) as T } : {}\n          })()\n        : {}),\n    }\n    return base\n  })\n}\n\n/** L3 — hybrid: fuse lexical (L1) + semantic (L2) by RRF. Requires embeddings. */\nasync function retrieveHybrid<T>(ctx: SearchContext<T>, query: string, opts: RetrieveOptions<T>): Promise<RetrieveHit<T>[]> {\n  if (!ctx.embeddings) {\n    throw new Error(`Collection \"${ctx.name}\": retrieve({mode:'hybrid'}) requires an embeddings config.`)\n  }\n  const [lex, sem] = await Promise.all([\n    retrieveLexical(ctx, query, opts),\n    retrieveSemantic(ctx, query, opts),\n  ])\n  return fuseRetrieval([lex, sem], opts.limit !== undefined ? { limit: opts.limit } : {})\n}\n\n/** L2 — semantic branch of retrieve(): encode query → similarTo(). */\nasync function retrieveSemantic<T>(ctx: SearchContext<T>, query: string, opts: RetrieveOptions<T>): Promise<RetrieveHit<T>[]> {\n  if (!ctx.embeddings) throw new Error(`Collection \"${ctx.name}\": retrieve({mode:'semantic'}) requires an embeddings config.`)\n  if (ctx.lazy) throw new Error(`Collection \"${ctx.name}\": retrieve() requires eager mode (prefetch: true).`)\n  const qVec = await ctx.embeddings.encode(query)\n  return similarTo(ctx, qVec, {\n    ...(opts.limit !== undefined ? { k: opts.limit } : {}),\n    ...(opts.minScore !== undefined ? { minScore: opts.minScore } : {}),\n    ...(opts.includeRecord ? { includeRecord: true } : {}),\n    ...(opts.exact !== undefined ? { exact: opts.exact } : {}),\n    ...(opts.nprobe !== undefined ? { nprobe: opts.nprobe } : {}),\n  })\n}\n\n/** L2 — raw-vector kNN over the encrypted vector set (decrypted in the trusted tier).\n *  Snippet is '' for vector hits in v1 (semantic match isn't span-located). */\nexport async function similarTo<T>(ctx: SearchContext<T>, vector: Float32Array, opts: SimilarToOptions = {}): Promise<RetrieveHit<T>[]> {\n  if (!ctx.embeddings || !ctx.vectorSet) throw new Error(`Collection \"${ctx.name}\": similarTo() requires an embeddings config.`)\n  if (ctx.lazy) throw new Error(`Collection \"${ctx.name}\": similarTo() requires eager mode (prefetch: true).`)\n  await ctx.ensureHydrated()\n  await ctx.vectorSet.ensureLoaded(buildVectorLoad(ctx))\n  // #1360 part 2: `topK` picks exact vs approximate from the collection's\n  // `embeddings.index` opt-in, the live vector count and this call's `exact`.\n  // With no opt-in it IS `cosineTopK` — same function, same numbers.\n  const hits = await ctx.vectorSet.topK(vector, opts.k ?? 10, {\n    ...(opts.minScore !== undefined ? { minScore: opts.minScore } : {}),\n    ...(opts.exact !== undefined ? { exact: opts.exact } : {}),\n    ...(opts.nprobe !== undefined ? { nprobe: opts.nprobe } : {}),\n    expectModel: ctx.embeddings.model,\n  })\n  return hits.map((h, i) => {\n    const e = ctx.cache.get(h.id)\n    // #1360: for a chunk hit the snippet IS the matched span — resolved by\n    // re-deriving the record's joined source text and slicing it at the same\n    // offsets the writer used, so the returned span and the returned snippet\n    // cannot disagree. Unchunked hits keep snippet '' (a whole-record vector\n    // match is not span-located).\n    let snippet = ''\n    if (h.chunk && e && ctx.embeddings) {\n      snippet = embeddingSourceText(e.record as Record<string, unknown>, ctx.embeddings.source).slice(h.chunk.start, h.chunk.end)\n    }\n    const base: RetrieveHit<T> = { id: h.id, score: h.score, rank: i + 1, field: '(vector)', snippet, ...(h.chunk ? { chunk: h.chunk } : {}) }\n    if (opts.includeRecord && e) (base as { record?: T }).record = stripI18nFilled(e.record as Record<string, unknown>) as T\n    return base\n  })\n}\n\n/**\n * L2 — the embedding write-hook: derive a record's embedding vector at\n * write and persist it as the encrypted `_vec` side-car. Routed through the\n * search strategy so it runs only when `withSearch()` is opted in — computing\n * vectors that no gated `similarTo` / semantic `retrieve` could query would be\n * dead weight, so the compute is paired with the search capability. The caller\n * (`Collection.put`) only invokes this when `embeddings` is declared.\n */\nexport async function embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void> {\n  if (!ctx.embeddings) return\n  const text = embeddingSourceText(record as Record<string, unknown>, ctx.embeddings.source)\n  // #1360 — sub-document chunking. When a `chunk` hook is declared and yields\n  // usable spans, the sidecar holds ONE VECTOR PER CHUNK and no whole-record\n  // vector: the whole-record encode is the thing chunking exists to avoid (it\n  // averages a long document's topics away, and can exceed the model's context\n  // window — the very case that motivates chunking). No chunk hook, or no\n  // usable span, and the body is byte-for-byte the pre-#1360 single-vector\n  // shape. Both live in the SAME encrypted `_vec` sidecar: no new store\n  // collection, no new plaintext surface.\n  const chunks = await deriveChunkVectors(text, ctx.embeddings)\n  let body: string\n  let writtenVec: Float32Array | undefined\n  if (chunks.length > 0) {\n    for (const c of chunks) {\n      if (c.vec.length !== ctx.embeddings.dim) throw new EmbeddingDimMismatchError('embeddings', ctx.embeddings.dim, c.vec.length)\n    }\n    body = JSON.stringify({\n      chunks: chunks.map((c) => ({ id: c.id, start: c.start, end: c.end, vec: Array.from(c.vec) })),\n      model: ctx.embeddings.model,\n      dim: ctx.embeddings.dim,\n    })\n  } else {\n    const vec = await ctx.embeddings.encode(text)\n    if (vec.length !== ctx.embeddings.dim) throw new EmbeddingDimMismatchError('embeddings', ctx.embeddings.dim, vec.length)\n    writtenVec = vec\n    body = JSON.stringify({ vec: Array.from(vec), model: ctx.embeddings.model, dim: ctx.embeddings.dim })\n  }\n  const vecEnv = await ctx.codec.encryptJsonString({ collection: '_vec', id: encodeVecId(ctx.name, id) }, body, version)\n  await ctx.adapter.put(ctx.vault, '_vec', encodeVecId(ctx.name, id), vecEnv)\n  // #1360 part 2 — hand the just-computed vectors to the in-memory set rather\n  // than dropping it. Equivalent to the old `markDirty()` by construction: the\n  // sidecar we just wrote is exactly what a reload would decrypt back, so the\n  // next query sees the same vectors either way. The difference is cost —\n  // `markDirty()` re-reads and re-decrypts every sidecar in the collection on\n  // the next query, and would additionally rebuild the approximate index from\n  // scratch after every single `put()`.\n  if (chunks.length > 0) {\n    ctx.vectorSet?.upsert({ id, model: ctx.embeddings.model, chunks: chunks.map((c) => ({ id: c.id, start: c.start, end: c.end, vec: c.vec })) })\n  } else {\n    ctx.vectorSet?.upsert({ id, model: ctx.embeddings.model, vec: writtenVec! })\n  }\n}\n\n/**\n * Force-re-derive every eligible tier-0 record's `_vec` sidecar once (#788).\n * Opt-in bulk repair for the #726 re-namespace: legacy bare-id rows are\n * unreachable to `buildVectorLoad` (it only recognises `<collection>/<id>`\n * keys) and otherwise self-heal only when a record is next `put()` — this\n * lets an adopter recover recall immediately instead of waiting on writes.\n *\n * **Skips elevated records** (`liveRecordIsElevated`) rather than refusing\n * the whole walk — the OPPOSITE of `_applyCutoverTransform`'s\n * `assertCutoverTierSafe` refuse-whole-batch precedent. An elevated record is\n * SUPPOSED to have no `_vec` (`syncTierSearch` purges it on elevate);\n * re-embedding one here would write searchable plaintext-derived data above\n * tier 0. Load-bearing: never write a `_vec` row for an elevated record.\n *\n * Tombstones, delete markers, and a raw `get` racing a delete between `list`\n * and `get` all decrypt to `null` (`decryptRecord` already folds\n * tombstone/delete-marker into that null) and are skipped the same way.\n * Unconditional re-derive, no already-migrated check — safe to re-run after\n * a partial failure (each id is independently idempotent).\n */\nexport async function rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{ rebuilt: number; skipped: number }> {\n  if (!ctx.embeddings) return { rebuilt: 0, skipped: 0 }\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  let rebuilt = 0\n  let skipped = 0\n  for (const id of ids) {\n    if (await liveRecordIsElevated(ctx.adapter, ctx.vault, ctx.name, id)) { skipped++; continue }\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) { skipped++; continue }\n    const decoded = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env)\n    if (decoded === null) { skipped++; continue }\n    await embedOnWrite(ctx, id, decoded, env._v ?? 1)\n    rebuilt++\n  }\n  return { rebuilt, skipped }\n}\n\n/**\n * Sync the collection's SEARCH artifacts after a tier move (#721). Both the\n * lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under\n * the tier-0 DEK and hold the record's derived plaintext (full field text /\n * a text-invertible vector), so leaving them means elevation never hid what\n * the record was searchable by — the `forget()` precedent, unapplied to\n * elevate. `null` → the record left tier 0: purge its `_vec` sidecar (mirrors\n * `Collection._purgeVector`), and invalidate the `_ftindex` blob (mirrors\n * `Collection._purgeSearchIndex`: deletes the persisted blob when persisted,\n * else drops the in-memory index) so the next `retrieve()` rebuilds from the\n * elevated-free `ctx.cache`. A record → it is tier-0 again: re-embed it via\n * {@link embedOnWrite}, then invalidate `_ftindex` so the rebuild includes it\n * again. No-op fast when the collection has neither a lexical index nor a\n * vector set.\n */\nexport async function syncTierSearch<T>(\n  ctx: SearchContext<T>,\n  id: string,\n  record: T | null,\n  version?: number,\n): Promise<void> {\n  if (!ctx.searchIndexStore && !ctx.vectorSet) return\n  if (record === null) {\n    await ctx.adapter.delete(ctx.vault, '_vec', encodeVecId(ctx.name, id))\n    ctx.vectorSet?.removeRecord(id)\n  } else {\n    await embedOnWrite(ctx, id, record, version ?? 1)\n  }\n  const store = ctx.searchIndexStore\n  if (store && 'removePersisted' in store) await (store as { removePersisted(): Promise<void> }).removePersisted()\n  else store?.markDirty()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,eAAsB,OAAU,KAAuB,OAAe,OAAe,OAAsB,CAAC,GAA+B;AACzI,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACA,QAAM,IAAI,eAAe;AACzB,QAAM,UAAuC,CAAC;AAK9C,aAAW,CAAC,IAAI,CAAC,KAAK,IAAI,MAAO,SAAQ,KAAK,EAAE,IAAI,QAAQ,gBAAgB,EAAE,MAAiC,EAAO,CAAC;AACvH,SAAO,WAAW,SAAS,OAAO,OAAO,IAAI;AAC/C;AAGA,SAAS,mBACP,KACA,WACA,eACA,MACY;AACZ,QAAM,OAAmB,CAAC;AAC1B,aAAW,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO;AAC/B,UAAM,MAAM,gBAAgB,EAAE,MAAiC;AAC/D,UAAM,SAAS,wBAAwB,KAAK,IAAI,eAAe,CAAC,GAAG,IAAI;AACvE,QAAI,IAAI,WAAY,QAAO,KAAK,GAAG,sBAAsB,KAAK,IAAI,YAAY,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC;AAC1G,QAAI,IAAI,cAAe,QAAO,KAAK,GAAG,yBAAyB,KAAK,IAAI,eAAe,WAAW,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC;AAC9H,UAAM,YAAY,cAAc,IAAI,EAAE;AACtC,QAAI,UAAW,QAAO,KAAK,GAAG,sBAAsB,SAAS,CAAC;AAC9D,QAAI,OAAO,SAAS,EAAG,MAAK,KAAK,EAAE,IAAI,OAAO,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAQA,SAAS,qBAAwB,KAAsD;AACrF,QAAM,SAAS,IAAI;AACnB,SAAO,UAAU,OAAO,SAAS,IAAI,EAAE,WAAW,OAAO,IAAI;AAC/D;AAGA,SAAS,qBAAwB,KAAuB,MAAmC;AACzF,MAAI,CAAC,IAAI,cAAc,CAAC,IAAI,YAAa,QAAO;AAChD,QAAM,SAAS,OAAO,IAAI,YAAY,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI;AAC5E,SAAO,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,UAAW;AAChD;AAUA,eAAe,qBAAwB,KAAuB,MAAuE;AACnI,QAAM,MAAM,oBAAI,IAAmC;AACnD,MAAI,CAAC,qBAAqB,KAAK,IAAI,EAAG,QAAO;AAC7C,QAAM,WAAW,OAAO,IAAI,YAAa,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI,aAC5E,OAAO,CAAC,MAAM,KAAK,IAAI,UAAW;AACrC,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,MAAM,IAAI,MAAM,KAAK,GAAG;AACjC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,IAAI,KAAK,EAAE,EAAE,KAAK;AAAA,IAClC,QAAQ;AACN;AAAA,IACF;AACA,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,WAAW,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,SAAU;AAClD,UAAI,CAAC,SAAS;AAAE,kBAAU,oBAAI,IAAI;AAAG,YAAI,IAAI,IAAI,OAAO;AAAA,MAAE;AAC1D,YAAM,QAAQ,QAAQ,IAAI,KAAK,IAAI;AACnC,UAAI,MAAO,OAAM,KAAK,KAAK,QAAQ;AAAA,UAC9B,SAAQ,IAAI,KAAK,MAAM,CAAC,KAAK,QAAQ,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,qBAAwB,KAAkF;AACvH,QAAM,OAAO,oBAAI,IAAiD;AAClE,MAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,YAAa,QAAO;AACnD,aAAW,SAAS,IAAI,aAAa;AACnC,UAAM,OAAO,IAAI,cAAc,KAAK;AACpC,QAAI,CAAC,KAAM;AACX,UAAM,IAAI,oBAAI,IAAoC;AAClD,QAAI,uBAAuB,IAAI,GAAG;AAChC,iBAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK,EAAG,GAAE,IAAI,KAAK,MAAgC;AAAA,IACrG,OAAO;AACL,UAAI,IAAI,eAAe;AACrB,cAAM,SAAS,MAAM,IAAI,cAAc,KAAK,IAAI;AAChD,mBAAW,KAAK,MAAM,OAAO,KAAK,EAAG,GAAE,IAAI,EAAE,KAAK,EAAE,MAAM;AAAA,MAC5D;AAAA,IACF;AACA,SAAK,IAAI,OAAO,CAAC;AAAA,EACnB;AACA,SAAO;AACT;AAGA,eAAsB,WAAc,KAAsC;AACxE,MAAI,CAAC,IAAI,iBAAkB;AAC3B,QAAM,IAAI,eAAe;AACzB,QAAM,YAAY,MAAM,qBAAqB,GAAG;AAChD,QAAM,gBAAgB,MAAM,qBAAqB,GAAG;AACpD,QAAM,IAAI,iBAAiB,YAAY,MAAM,mBAAmB,KAAK,WAAW,aAAa,GAAG,qBAAqB,GAAG,CAAC;AACzH,QAAM,IAAI,iBAAiB,QAAQ;AACrC;AAGA,SAAS,gBAAmB,KAAsD;AAChF,SAAO,YAAY;AACjB,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,MAAM;AACpD,UAAM,MAAsB,CAAC;AAC7B,eAAW,SAAS,KAAK;AAGvB,UAAI,CAAC,WAAW,IAAI,MAAM,KAAK,EAAG;AAClC,YAAM,KAAK,YAAY,IAAI,MAAM,KAAK;AAItC,UAAI,MAAM,qBAAqB,IAAI,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,EAAG;AACtE,YAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,QAAQ,KAAK;AAC1D,UAAI,CAAC,IAAK;AAQV,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,IAAI,MAAM,kBAAkB,EAAE,YAAY,QAAQ,IAAI,MAAM,GAAG,GAAG;AAAA,MACjF,QAAQ;AACN;AAAA,MACF;AACA,UAAI,SAAS,KAAM;AAKnB,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GAAG;AAC7C,cAAM,SAAwB,OAAO,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,KAAK,EAAE,KAAK,KAAK,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE;AAC/H,YAAI,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,OAAO,CAAC;AAAA,MAC9C,WAAW,OAAO,KAAK;AACrB,YAAI,KAAK,EAAE,IAAI,KAAK,IAAI,aAAa,OAAO,GAAG,GAAG,OAAO,OAAO,MAAM,CAAC;AAAA,MACzE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAoBO,SAAS,6BAAgC,YAA6D;AAC3G,QAAM,KAAK;AACX,SAAO;AAAA,IACL,MAAM,YAAY;AAChB,YAAM,MAAM,WAAW;AACvB,YAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI;AACzD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,OAAO,MAAM,IAAI,MAAM,kBAAkB,EAAE,YAAY,IAAI,IAAI,IAAI,KAAK,GAAG,GAAG;AACpF,UAAI,SAAS,KAAM,QAAO;AAC1B,UAAI;AACF,cAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,eAAO,EAAE,MAAM,QAAQ,KAAK,aAAa,QAAQ,GAAG;AAAA,MACtD,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,IAAI,YAAY;AACjC,YAAM,MAAM,WAAW;AACvB,YAAM,OAAO,KAAK,UAAU,EAAE,IAAI,KAAK,KAAK,CAAC;AAC7C,YAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,EAAE,YAAY,IAAI,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG,KAAK;AAM9F,UAAI,QAAQ,EAAG;AACf,YAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,IAAI,MAAM,GAAG;AAAA,IACpD;AAAA,IACA,QAAQ,YAAY;AAAE,YAAM,MAAM,WAAW;AAAG,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;AAAA,IAAE;AAAA,IAClG,oBAAoB,MAAM;AACxB,YAAM,MAAM,WAAW;AACvB,UAAI,aAAa;AACjB,iBAAW,KAAK,IAAI,MAAM,OAAO,EAAG,KAAI,EAAE,UAAU,WAAY,cAAa,EAAE;AAC/E,aAAO,EAAE,OAAO,IAAI,MAAM,MAAM,WAAW;AAAA,IAC7C;AAAA,EACF;AACF;AAGA,eAAsB,UAAa,KAAsC;AACvE,MAAI,CAAC,IAAI,iBAAkB;AAC3B,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IACzB;AAAA,EACF;AACA,QAAM,IAAI,eAAe;AACzB,QAAM,QAAQ,IAAI,iBAAiB;AACnC,QAAM,YAAY,QAAQ,oBAAI,IAAI,IAAI,MAAM,qBAAqB,GAAG;AACpE,QAAM,gBAAgB,QAAQ,oBAAI,IAAI,IAAI,MAAM,qBAAqB,GAAG;AACxE,QAAM,IAAI,iBAAiB,YAAY,MAAM,mBAAmB,KAAK,WAAW,aAAa,GAAG,qBAAqB,GAAG,CAAC;AAC3H;AAQA,IAAM,WAAW,OAAO;AAkCxB,eAAsB,SAAY,KAAuB,OAAe,OAA2B,CAAC,GAA8B;AAChI,MAAI,KAAK,WAAW,QAAW;AAC7B,WAAO,KAAK,SAAS,aAAa,iBAAiB,KAAK,OAAO,IAAI,IAC/D,KAAK,SAAS,WAAW,eAAe,KAAK,OAAO,IAAI,IACxD,gBAAgB,KAAK,OAAO,IAAI;AAAA,EACtC;AAKA,MAAI,iBAAiB,KAAK,EAAE,WAAW,EAAG,QAAO,mBAAmB,KAAK,MAAM,KAAK,MAAM;AAC1F,QAAM,YAAgC,EAAE,GAAG,MAAM,OAAO,SAAS;AACjE,QAAM,OACJ,KAAK,SAAS,aAAa,MAAM,iBAAiB,KAAK,OAAO,SAAS,IACrE,KAAK,SAAS,WAAW,MAAM,eAAe,KAAK,OAAO,SAAS,IACnE,MAAM,gBAAgB,KAAK,OAAO,SAAS;AAC/C,SAAO,YAAY,MAAM,KAAK,QAAQ,KAAK,KAAK;AAClD;AAMA,SAAS,YAAe,MAAwB,QAAkB,OAA6C;AAC7G,QAAM,MAAM,IAAI,IAAI,OAAO,SAAS,CAAC;AACrC,QAAM,OAAO,KAAK,OAAO,OAAK,IAAI,IAAI,EAAE,EAAE,CAAC;AAC3C,QAAM,UAAU,UAAU,SAAY,KAAK,MAAM,GAAG,KAAK,IAAI;AAC7D,SAAO,QAAQ,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE;AACtD;AASA,eAAe,mBAAsB,KAAuB,MAA0B,QAA6C;AACjI,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,qDAAqD;AAAA,EAC9F;AACA,QAAM,IAAI,eAAe;AACzB,QAAM,MAAM,OAAO,SAAS;AAC5B,QAAM,UAAU,KAAK,UAAU,SAAY,IAAI,MAAM,GAAG,KAAK,KAAK,IAAI;AACtE,SAAO,QAAQ,IAAI,CAAC,IAAI,MAAM;AAC5B,UAAM,OAAuB,EAAE,IAAI,OAAO,GAAG,MAAM,IAAI,GAAG,OAAO,YAAY,SAAS,GAAG;AACzF,QAAI,KAAK,eAAe;AACtB,YAAM,IAAI,IAAI,MAAM,IAAI,EAAE;AAC1B,UAAI,EAAG,CAAC,KAAwB,SAAS,gBAAgB,EAAE,MAAiC;AAAA,IAC9F;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGA,eAAe,gBAAmB,KAAuB,OAAe,MAAqD;AAC3H,MAAI,CAAC,IAAI,kBAAkB;AACzB,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,8CAA8C;AAAA,EACvF;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IACzB;AAAA,EACF;AACA,QAAM,IAAI,eAAe;AACzB,QAAM,QAAQ,IAAI,iBAAiB;AACnC,QAAM,YAAY,QAAQ,oBAAI,IAAI,IAAI,MAAM,qBAAqB,GAAG;AACpE,QAAM,gBAAgB,QAAQ,oBAAI,IAAI,IAAI,MAAM,qBAAqB,GAAG;AACxE,QAAM,QAAQ,MAAM,IAAI,iBAAiB,YAAY,MAAM,mBAAmB,KAAK,WAAW,aAAa,GAAG,qBAAqB,GAAG,CAAC;AACvI,QAAM,OAAO,MAAM,MAAM,OAAO;AAAA,IAC9B,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC1C,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC7C,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC7C,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,EAC5C,CAAC;AACD,QAAM,SAAS,KAAK,iBAAiB;AACrC,SAAO,KAAK,IAAI,CAAC,GAAa,MAAc;AAC1C,UAAM,OAAuB;AAAA,MAC3B,IAAI,EAAE;AAAA,MACN,OAAO,EAAE;AAAA,MACT,MAAM,IAAI;AAAA,MACV,OAAO,EAAE;AAAA,MACT,SAAS,eAAe,EAAE,MAAM,EAAE,QAAQ,MAAM;AAAA,MAChD,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,iBACJ,MAAM;AACL,cAAM,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE;AAC5B,eAAO,IAAI,EAAE,QAAQ,gBAAgB,EAAE,MAAiC,EAAO,IAAI,CAAC;AAAA,MACtF,GAAG,IACH,CAAC;AAAA,IACP;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGA,eAAe,eAAkB,KAAuB,OAAe,MAAqD;AAC1H,MAAI,CAAC,IAAI,YAAY;AACnB,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,6DAA6D;AAAA,EACtG;AACA,QAAM,CAAC,KAAK,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,IACnC,gBAAgB,KAAK,OAAO,IAAI;AAAA,IAChC,iBAAiB,KAAK,OAAO,IAAI;AAAA,EACnC,CAAC;AACD,SAAO,cAAc,CAAC,KAAK,GAAG,GAAG,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;AACxF;AAGA,eAAe,iBAAoB,KAAuB,OAAe,MAAqD;AAC5H,MAAI,CAAC,IAAI,WAAY,OAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+DAA+D;AAC3H,MAAI,IAAI,KAAM,OAAM,IAAI,MAAM,eAAe,IAAI,IAAI,qDAAqD;AAC1G,QAAM,OAAO,MAAM,IAAI,WAAW,OAAO,KAAK;AAC9C,SAAO,UAAU,KAAK,MAAM;AAAA,IAC1B,GAAI,KAAK,UAAU,SAAY,EAAE,GAAG,KAAK,MAAM,IAAI,CAAC;AAAA,IACpD,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,IACjE,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC;AAAA,IACpD,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,EAC7D,CAAC;AACH;AAIA,eAAsB,UAAa,KAAuB,QAAsB,OAAyB,CAAC,GAA8B;AACtI,MAAI,CAAC,IAAI,cAAc,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C;AAC7H,MAAI,IAAI,KAAM,OAAM,IAAI,MAAM,eAAe,IAAI,IAAI,sDAAsD;AAC3G,QAAM,IAAI,eAAe;AACzB,QAAM,IAAI,UAAU,aAAa,gBAAgB,GAAG,CAAC;AAIrD,QAAM,OAAO,MAAM,IAAI,UAAU,KAAK,QAAQ,KAAK,KAAK,IAAI;AAAA,IAC1D,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,IACjE,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC3D,aAAa,IAAI,WAAW;AAAA,EAC9B,CAAC;AACD,SAAO,KAAK,IAAI,CAAC,GAAG,MAAM;AACxB,UAAM,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE;AAM5B,QAAI,UAAU;AACd,QAAI,EAAE,SAAS,KAAK,IAAI,YAAY;AAClC,gBAAU,oBAAoB,EAAE,QAAmC,IAAI,WAAW,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,GAAG;AAAA,IAC5H;AACA,UAAM,OAAuB,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,MAAM,IAAI,GAAG,OAAO,YAAY,SAAS,GAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAG;AACzI,QAAI,KAAK,iBAAiB,EAAG,CAAC,KAAwB,SAAS,gBAAgB,EAAE,MAAiC;AAClH,WAAO;AAAA,EACT,CAAC;AACH;AAUA,eAAsB,aAAgB,KAAuB,IAAY,QAAW,SAAgC;AAClH,MAAI,CAAC,IAAI,WAAY;AACrB,QAAM,OAAO,oBAAoB,QAAmC,IAAI,WAAW,MAAM;AASzF,QAAM,SAAS,MAAM,mBAAmB,MAAM,IAAI,UAAU;AAC5D,MAAI;AACJ,MAAI;AACJ,MAAI,OAAO,SAAS,GAAG;AACrB,eAAW,KAAK,QAAQ;AACtB,UAAI,EAAE,IAAI,WAAW,IAAI,WAAW,IAAK,OAAM,IAAI,0BAA0B,cAAc,IAAI,WAAW,KAAK,EAAE,IAAI,MAAM;AAAA,IAC7H;AACA,WAAO,KAAK,UAAU;AAAA,MACpB,QAAQ,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,KAAK,EAAE,KAAK,KAAK,MAAM,KAAK,EAAE,GAAG,EAAE,EAAE;AAAA,MAC5F,OAAO,IAAI,WAAW;AAAA,MACtB,KAAK,IAAI,WAAW;AAAA,IACtB,CAAC;AAAA,EACH,OAAO;AACL,UAAM,MAAM,MAAM,IAAI,WAAW,OAAO,IAAI;AAC5C,QAAI,IAAI,WAAW,IAAI,WAAW,IAAK,OAAM,IAAI,0BAA0B,cAAc,IAAI,WAAW,KAAK,IAAI,MAAM;AACvH,iBAAa;AACb,WAAO,KAAK,UAAU,EAAE,KAAK,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,IAAI,CAAC;AAAA,EACtG;AACA,QAAM,SAAS,MAAM,IAAI,MAAM,kBAAkB,EAAE,YAAY,QAAQ,IAAI,YAAY,IAAI,MAAM,EAAE,EAAE,GAAG,MAAM,OAAO;AACrH,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,QAAQ,YAAY,IAAI,MAAM,EAAE,GAAG,MAAM;AAQ1E,MAAI,OAAO,SAAS,GAAG;AACrB,QAAI,WAAW,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,OAAO,QAAQ,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,KAAK,EAAE,KAAK,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;AAAA,EAC9I,OAAO;AACL,QAAI,WAAW,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,OAAO,KAAK,WAAY,CAAC;AAAA,EAC7E;AACF;AAsBA,eAAsB,kBAAqB,KAAsE;AAC/G,MAAI,CAAC,IAAI,WAAY,QAAO,EAAE,SAAS,GAAG,SAAS,EAAE;AACrD,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,MAAI,UAAU;AACd,MAAI,UAAU;AACd,aAAW,MAAM,KAAK;AACpB,QAAI,MAAM,qBAAqB,IAAI,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,GAAG;AAAE;AAAW;AAAA,IAAS;AAC5F,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,KAAK;AAAE;AAAW;AAAA,IAAS;AAChC,UAAM,UAAU,MAAM,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,GAAG;AAC/E,QAAI,YAAY,MAAM;AAAE;AAAW;AAAA,IAAS;AAC5C,UAAM,aAAa,KAAK,IAAI,SAAS,IAAI,MAAM,CAAC;AAChD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,QAAQ;AAC5B;AAiBA,eAAsB,eACpB,KACA,IACA,QACA,SACe;AACf,MAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,UAAW;AAC7C,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,QAAQ,YAAY,IAAI,MAAM,EAAE,CAAC;AACrE,QAAI,WAAW,aAAa,EAAE;AAAA,EAChC,OAAO;AACL,UAAM,aAAa,KAAK,IAAI,QAAQ,WAAW,CAAC;AAAA,EAClD;AACA,QAAM,QAAQ,IAAI;AAClB,MAAI,SAAS,qBAAqB,MAAO,OAAO,MAA+C,gBAAgB;AAAA,MAC1G,QAAO,UAAU;AACxB;","names":[]}

package/dist/{chunk-TEHHROZL.js → chunk-5LMCVBMY.js}

@@ -3,20 +3,20 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-VAORSCSU.js";
+} from "./chunk-BMHQHH7Q.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-3L2NBKDR.js";
+} from "./chunk-H3YM66EI.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-6QVKPHBF.js";
+} from "./chunk-2WJKJZSO.js";
 import {
   buildSealedRecordEnvelope,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -84,4 +84,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-TEHHROZL.js.map
+//# sourceMappingURL=chunk-5LMCVBMY.js.map

package/dist/{chunk-4V3Q35WG.js → chunk-5UUJE4FP.js}

@@ -1,10 +1,10 @@
 import {
   compareKeys,
   toSortKey
-} from "./chunk-LGNDFRYC.js";
+} from "./chunk-4CFHL5RY.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-BUE7R3B5.js";
 
 // src/kernel/query/relate/join-on.ts
 var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between"]);
@@ -201,4 +201,4 @@ export {
   joinOnDispatch,
   matchDeclaredJoin
 };
-//# sourceMappingURL=chunk-4V3Q35WG.js.map
+//# sourceMappingURL=chunk-5UUJE4FP.js.map

package/dist/{chunk-JWWYRR4Q.js → chunk-5XONHAFD.js}

@@ -1,7 +1,7 @@
 import {
   signBytes,
   verifyBytes
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 
 // src/with-audit/attestation/scheme.ts
 var ENCLAVE_SCHEME = { sign: signBytes, verify: verifyBytes };
@@ -9,4 +9,4 @@ var ENCLAVE_SCHEME = { sign: signBytes, verify: verifyBytes };
 export {
   ENCLAVE_SCHEME
 };
-//# sourceMappingURL=chunk-JWWYRR4Q.js.map
+//# sourceMappingURL=chunk-5XONHAFD.js.map

package/dist/{chunk-PD64727P.js → chunk-6QLCS7ET.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-PD64727P.js.map
+//# sourceMappingURL=chunk-6QLCS7ET.js.map

package/dist/chunk-6QLCS7ET.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/strategy.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { RevocationList } from './types.js'\nimport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nimport type { RevokeContext } from './revoke.js'\nimport { AttestationNotEnabledError } from '../../kernel/errors.js'\n\n/**\n * Deps the signing-public-key lookup needs. Unlike issue/revoke there is no\n * per-call context object for it, so the vault facade assembles this at call\n * time (reading `role` fresh).\n */\ninterface SignerLookupDeps {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  /** The invoking keyring's role, read fresh by the caller per call. */\n  readonly role: string\n  /** Per-collection DEK resolver (bound `vault.getDEK`). */\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n}\n\n/**\n * Attestation capability strategy — the six on-demand methods the vault's\n * attestation delegators route through. The active engine ({@link withAttestation})\n * dynamically imports the issue/revoke/signer cores (keeping them out of the floor\n * bundle); {@link NO_ATTESTATION} throws. The vault-side {@link VaultAttestation}\n * facade holds the per-collection field-schema registry and builds the per-call\n * contexts, then delegates here.\n * @internal\n */\nexport interface AttestationStrategy {\n  issueAttestation(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>\n  getDocumentSigningPublicKey(deps: SignerLookupDeps): Promise<{ keyId: string; publicKeyB64: string }>\n  revokeAttestation(ctx: RevokeContext, docId: string): Promise<void>\n  unrevokeAttestation(ctx: RevokeContext, docId: string): Promise<void>\n  getRevokedDocIds(ctx: RevokeContext): Promise<string[]>\n  publishRevocationList(ctx: RevokeContext): Promise<RevocationList>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link AttestationNotEnabledError}; opt in with\n * `attestationStrategy: withAttestation()` in createNoydb. @internal\n */\nexport const NO_ATTESTATION: AttestationStrategy = {\n  async issueAttestation() { throw new AttestationNotEnabledError() },\n  async getDocumentSigningPublicKey() { throw new AttestationNotEnabledError() },\n  async revokeAttestation() { throw new AttestationNotEnabledError() },\n  async unrevokeAttestation() { throw new AttestationNotEnabledError() },\n  async getRevokedDocIds() { throw new AttestationNotEnabledError() },\n  async publishRevocationList() { throw new AttestationNotEnabledError() },\n}\n"],"mappings":";;;;;AA4CO,IAAM,iBAAsC;AAAA,EACjD,MAAM,mBAAmB;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AAAA,EAClE,MAAM,8BAA8B;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AAAA,EAC7E,MAAM,oBAAoB;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AAAA,EACnE,MAAM,sBAAsB;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AAAA,EACrE,MAAM,mBAAmB;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AAAA,EAClE,MAAM,wBAAwB;AAAE,UAAM,IAAI,2BAA2B;AAAA,EAAE;AACzE;","names":[]}

package/dist/{chunk-QBLT6POL.js → chunk-6WS35E6X.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-QBLT6POL.js.map
+//# sourceMappingURL=chunk-6WS35E6X.js.map

package/dist/{chunk-IUBMZPHM.js → chunk-6Y5E4SJU.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-IMQKWR46.js";
+} from "./chunk-SNM7LSYG.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-EJLV62NI.js";
+} from "./chunk-55P6OBB7.js";
 import {
   buildRecordEnvelope
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   NoydbError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -151,11 +151,10 @@ async function rejectWithdrawal(vault, requestId, opts = {}) {
 }
 
 export {
-  WITHDRAWAL_REQUESTS_COLLECTION,
   WithdrawalRequestError,
   requestWithdrawal,
   listWithdrawalRequests,
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-IUBMZPHM.js.map
+//# sourceMappingURL=chunk-6Y5E4SJU.js.map

package/dist/chunk-6Y5E4SJU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO secret: the re-key secret is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nconst WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const actor = req.decidedBy ?? req.requester\n  const env = buildRecordEnvelope(\n    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },\n    { ts: req.decidedAt ?? req.requestedAt, iv: '', data: body},\n  )\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data ?? '') as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data ?? '') as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a secret the requester will use. */\n  readonly reKey?: { readonly secret: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,IAAM,iCAAiC;AAGhC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,QAAQ,IAAI,aAAa,IAAI;AACnC,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,gCAAgC,IAAI,IAAI,WAAW,IAAI,OAAO,SAAS,kBAAkB,EAAE;AAAA,IACzG,EAAE,IAAI,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,MAAM,KAAI;AAAA,EAC5D;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,SAAS,EAAE,GAAwB,SAAS,IAAI,GAAG;AAClF;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE;AACtC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-GZT3NQRA.js → chunk-72XBVN4J.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -12,6 +12,12 @@ var NO_BROKER = {
   },
   credentialSource() {
     throw new BrokerNotEnabledError();
+  },
+  // grant()/revoke() must keep working without a broker — these two are the
+  // only members of this stub that do NOT throw.
+  async enrolMember() {
+  },
+  async revokeMember() {
   }
 };
 function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
@@ -27,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-GZT3NQRA.js.map
+//# sourceMappingURL=chunk-72XBVN4J.js.map

package/dist/{chunk-GZT3NQRA.js.map → chunk-72XBVN4J.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAkFO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AACzD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n  /**\n   * core#73 — called by the kernel right after `grant()`: register the\n   * grantee with the broker host under its own per-member key. Needs the\n   * grantee's `secret` because the member's `_broker_member` DEK can only be\n   * opened with it, and only at this moment does the grantor hold it. A\n   * no-op for owner/admin grantees (they use the shared seed) and for the\n   * floor stub (no broker ⇒ nothing to register).\n   */\n  enrolMember(ctx: BrokerCtx, member: { readonly userId: string; readonly secret: string }): Promise<void>\n  /** core#73 — called by the kernel right after `revoke()`: de-register the member with the host and drop its record. */\n  revokeMember(ctx: BrokerCtx, userId: string): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n  // grant()/revoke() must keep working without a broker — these two are the\n  // only members of this stub that do NOT throw.\n  async enrolMember() { /* no broker configured */ },\n  async revokeMember() { /* no broker configured */ },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AA6FO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA;AAAA;AAAA,EAGvD,MAAM,cAAc;AAAA,EAA6B;AAAA,EACjD,MAAM,eAAe;AAAA,EAA6B;AACpD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/{chunk-EYG2CY2X.js → chunk-7BMOS4JQ.js}

@@ -4,27 +4,27 @@ import {
   resolveLegOwner,
   ungatedMvContext,
   wrapDbWithPredicates
-} from "./chunk-JIBUPZHA.js";
+} from "./chunk-D4V5JJAK.js";
 import {
   canonicalizeMoneyFieldsAsDecimal,
   decodeMoneyFields,
   exactMath
-} from "./chunk-BPWYQ25R.js";
+} from "./chunk-OJU67C23.js";
 import {
   applyWindow
-} from "./chunk-O46CHQT7.js";
+} from "./chunk-LGGIFKJP.js";
 import {
   groupAndReduce
-} from "./chunk-N7UDP5VU.js";
+} from "./chunk-WHOKGHJ3.js";
 import {
   putDerivedOutput
-} from "./chunk-MILI22XQ.js";
+} from "./chunk-CAD7N6HQ.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   bindDistinctReducers
-} from "./chunk-MBMTND6D.js";
+} from "./chunk-BJH77UY2.js";
 import {
   groupKeyName,
   isDateTruncKey,
@@ -32,19 +32,19 @@ import {
 } from "./chunk-XBKH4FOC.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-NCO25JZO.js";
+} from "./chunk-PT2YCQVK.js";
 import {
   applyI18nLocale
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-V55JASXO.js";
 import {
   viaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-PTJY5R3O.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-formula/materialized-views/window-stage.ts
 function isWindowFn(v) {
@@ -449,4 +449,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-EYG2CY2X.js.map
+//# sourceMappingURL=chunk-7BMOS4JQ.js.map