@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/chunk-IQAJ4OR6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/validators.ts","../src/via/classified/presets.ts","../src/via/classified/active.ts"],"sourcesContent":["/** Pure write-time validators. Exported so userland can validate storage:'never'\n *  fields (e.g. CVC) at capture, before dropping them. @module */\n\nexport function luhnCheck(pan: string): boolean {\n  const digits = pan.replace(/[\\s-]/g, '')\n  if (!/^\\d{12,19}$/.test(digits)) return false\n  let sum = 0\n  for (let i = 0; i < digits.length; i++) {\n    let d = Number(digits[digits.length - 1 - i])\n    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9 }\n    sum += d\n  }\n  return sum % 10 === 0\n}\n","/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative\n *  knobs, not read-side callbacks (design law D2/D3). @module */\n\nimport type { ClassifiedFieldSpec, ClassifiedGroup } from './descriptor.js'\nimport { luhnCheck } from './validators.js'\n\nconst digitsOf = (v: unknown): string => String(v).replace(/\\D/g, '')\n\nfunction panSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.pan', storage: 'recoverable',\n    sensitivity: 'secret', list: { kind: 'mask', pattern: '•••• ${last4}' },\n    riders: { last4: (v) => digitsOf(v).slice(-4), bin: (v) => digitsOf(v).slice(0, 6) },\n    validate: (v) => (typeof v === 'string' && luhnCheck(v) ? null : 'not a Luhn-valid card number'),\n  }\n}\n\nfunction expirySpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.expiry', storage: 'recoverable',\n    sensitivity: 'pii', list: { kind: 'mask', pattern: '••/••' },\n    validate: (v) => (typeof v === 'string' && /^(0[1-9]|1[0-2])\\/\\d{2}$/.test(v) ? null : 'expected MM/YY'),\n  }\n}\n\nfunction cvcSpec(): ClassifiedFieldSpec {\n  return {\n    _noydbClassified: true, _viaBrand: 'classified', preset: 'creditCard.cvc', storage: 'never',\n    sensitivity: 'secret', list: { kind: 'omit' },\n    validate: (v) => (typeof v === 'string' && /^\\d{3,4}$/.test(v) ? null : 'expected 3-4 digits'),\n  }\n}\n\nexport const classified = {\n  /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */\n  creditCard(fields: { pan: string; expiry?: string; cvc?: string }): ClassifiedGroup {\n    const members: Record<string, ClassifiedFieldSpec> = { [fields.pan]: panSpec() }\n    if (fields.expiry !== undefined) members[fields.expiry] = expirySpec()\n    if (fields.cvc !== undefined) members[fields.cvc] = cvcSpec()\n    return { _noydbClassifiedGroup: true, _viaBrand: 'classified', preset: 'creditCard', members }\n  },\n\n  /**\n   * A checksummed government or institutional identifier — a national ID, a\n   * tax number, an employer registration.\n   *\n   * ⭐ The preset exists for the FOUR SECURITY-RELEVANT DEFAULTS, not to save\n   * typing (#26). Hand-rolling a `ClassifiedFieldSpec` means choosing\n   * `storage`, `list`, `sensitivity` and `verifyNormalize` yourself, and\n   * getting `sensitivity` or `list` wrong on a national ID is not cosmetic.\n   * Supply the checksum; the posture is decided here.\n   *\n   * Defaults to `recoverable` + a masked list, which is the shape that lets an\n   * advisor open a list screen without reading every identifier in full while\n   * still allowing an authorised `reveal()`.\n   *\n   * ⛔ IT CANNOT BE UNIQUELY INDEXED, and that is by design rather than a gap\n   * (core#20). A recoverable classified field is sealed, sealed fields are\n   * excluded from the deterministic index, and unique constraints read the\n   * DECRYPTED record — where the value is a `Sealed` handle, not a string. If\n   * you need exact-equality dedup on this identifier, it must stay a plain\n   * field with `unique: true`; the two properties are mutually exclusive.\n   *\n   * @param validate returns `null` when the value passes, or a message. Use\n   *   {@link luhnCheck} for Luhn; supply your own for mod-11 and friends.\n   */\n  checksummed(options: {\n    validate: (value: unknown) => string | null\n    sensitivity?: ClassifiedFieldSpec['sensitivity']\n    list?: ClassifiedFieldSpec['list']\n  }): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'checksummed',\n      storage: 'recoverable',\n      sensitivity: options.sensitivity ?? 'pii',\n      list: options.list ?? { kind: 'omit' },\n      validate: options.validate,\n    }\n  },\n\n  birthDate(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'birthDate', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '${yob}-••-••' },\n      riders: { yob: (v) => String(v).slice(0, 4) },\n      validate: (v) => {\n        if (typeof v !== 'string' || !/^\\d{4}-\\d{2}-\\d{2}$/.test(v)) return 'expected ISO yyyy-mm-dd'\n        const parts = v.split('-').map(Number)\n        const year = parts[0]!, month = parts[1]!, day = parts[2]!\n        if (month < 1 || month > 12) return 'not a valid calendar date'\n        const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]\n        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0\n        const maxDay = month === 2 && isLeapYear ? 29 : daysInMonth[month - 1]!\n        if (day < 1 || day > maxDay) return 'not a valid calendar date'\n        return null\n      },\n    }\n  },\n\n  email(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'email', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••@${domain}' },\n      riders: { domain: (v) => String(v).split('@')[1] ?? '' },\n      validate: (v) => (typeof v === 'string' && v.includes('@') ? null : 'expected an email address'),\n    }\n  },\n\n  phone(): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'phone', storage: 'recoverable',\n      sensitivity: 'pii', list: { kind: 'mask', pattern: '•••••${last2}' },\n      riders: { last2: (v) => digitsOf(v).slice(-2) },\n      validate: (v) => (digitsOf(v).length >= 5 ? null : 'expected at least 5 digits'),\n    }\n  },\n\n  /** Digest-only password: verify-without-reveal; never listed, never revealed.\n   *  Enumeration math is on the caller for low-entropy values — see the\n   *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  password(opts: { minLength?: number; rotateDays?: number; notLastN?: number; equatable?: true } = {}): ClassifiedFieldSpec {\n    const minLength = opts.minLength ?? 10\n    const notLastN = opts.notLastN ?? 0\n    if (!Number.isInteger(notLastN) || notLastN < 0 || notLastN > 8) {\n      throw new Error(`classified.password: notLastN must be an integer 0..8 (write cost is n × 600K PBKDF2; ring blast radius is documented), got ${notLastN}`)\n    }\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'password', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'password',\n      ...(opts.rotateDays !== undefined ? { rotateDays: opts.rotateDays } : {}),\n      ...(notLastN > 0 ? { notLastN } : {}),\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string' && v.normalize('NFC').length >= minLength\n        ? null : `password must be at least ${minLength} characters`),\n    }\n  },\n\n  /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable\n   *  into k-of-n matchGroup challenges. Low-entropy by nature — document the\n   *  enumeration math to your users; add app-side rate limiting.\n   *\n   *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables\n   *  `findByDigest`). Cost band you are accepting:\n   *\n   *  equal values produce equal store-visible tags: anyone with store access\n   *  learns which records share this secret and how many share each value —\n   *  never the value itself. A collection-DEK holder can additionally test\n   *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),\n   *  which is GPU/ASIC-friendly — an offline attacker runs on the order of\n   *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret\n   *  answers) offline recovery of the equality partition is seconds-to-hours, not\n   *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the\n   *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the\n   *  hardest primitive available; the iteration count raises the price but does\n   *  not make a low-entropy field safe. The real control for low-entropy fields\n   *  is the DOOR — do not enable `equatable` for them unless the partition being\n   *  learnable is acceptable — not the iteration count. Pre-forget backups retain\n   *  tags. */\n  secretAnswer(opts: { equatable?: true } = {}): ClassifiedFieldSpec {\n    return {\n      _noydbClassified: true, _viaBrand: 'classified', preset: 'secretAnswer', storage: 'digest-only',\n      sensitivity: 'secret', list: { kind: 'omit' },\n      verifyNormalize: 'secret-answer', verifyGroupMember: true,\n      ...(opts.equatable === true ? { equatable: true as const } : {}),\n      validate: (v) => (typeof v === 'string'\n        && v.normalize('NFC').toLowerCase().trim().replace(/\\s+/g, ' ').length > 0\n        ? null : 'secret answer must be non-empty after normalization'),\n    }\n  },\n}\n","import type { ClassifiedStrategy, ClassifiedVerifyCtx } from './strategy.js'\nimport type { VdigFieldPolicy } from '../../kernel/types.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\nfunction policyOf(spec: ClassifiedFieldSpec): VdigFieldPolicy {\n  return {\n    normalize: spec.verifyNormalize ?? 'password',\n    notLastN: spec.notLastN ?? 0,\n    equatable: spec.equatable === true,\n    ...(spec.rotateDays !== undefined ? { rotateDays: spec.rotateDays } : {}),\n  }\n}\n\nconst engineCtx = (ctx: ClassifiedVerifyCtx) => ({\n  collection: ctx.collection,\n  getEnvelope: ctx.getEnvelope,\n  resolveCek: ctx.resolveCek,\n  getDEK: ctx.getDEK,\n  now: ctx.now,\n})\n\n/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */\nexport function withClassified(): ClassifiedStrategy {\n  return {\n    async reveal(ctx, id, field) {\n      const { revealSealedField } = await import('../../capsule/enclave-aes/classify/reveal.js')\n      const value = await revealSealedField({\n        collection: ctx.collection, encrypted: ctx.encrypted,\n        getEnvelope: ctx.getEnvelope, resolveCek: ctx.resolveCek, getDEK: ctx.getDEK,\n      }, id, field)\n      await ctx.onAccess?.('reveal', id)\n      return value\n    },\n    async verify(ctx, id, field, candidate) {\n      const { verifyDigestField } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec))\n      await ctx.onAccess?.('verify', id)                    // fires on ok AND fail (attempt audit)\n      return verdict\n    },\n    async verifyText(ctx, id, field, candidate) {\n      const { verifyTextField } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? 'password')\n      await ctx.onAccess?.('verify', id)\n      return verdict\n    },\n    async matchGroup(ctx, id, answers, opts) {\n      const { matchGroupFields } = await import('../../capsule/enclave-aes/classify/verify.js')\n      const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }))\n      const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts)\n      await ctx.onAccess?.('verify', id)                    // ONE entry per call (Q6)\n      return result\n    },\n    async computeTarget(ctx, field, candidate, costByte) {\n      const { computeBidxTarget } = await import('../../capsule/enclave-aes/classify/find.js')\n      const dek = await ctx.getDEK()\n      return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte)\n    },\n  }\n}\n"],"mappings":";AAGO,SAAS,UAAU,KAAsB;AAC9C,QAAM,SAAS,IAAI,QAAQ,UAAU,EAAE;AACvC,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,IAAI,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC;AAC5C,QAAI,IAAI,MAAM,GAAG;AAAE,WAAK;AAAG,UAAI,IAAI,EAAG,MAAK;AAAA,IAAE;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,MAAM,OAAO;AACtB;;;ACPA,IAAM,WAAW,CAAC,MAAuB,OAAO,CAAC,EAAE,QAAQ,OAAO,EAAE;AAEpE,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,QAAQ,SAAS,oCAAgB;AAAA,IACtE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,IACnF,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,UAAU,CAAC,IAAI,OAAO;AAAA,EACnE;AACF;AAEA,SAAS,aAAkC;AACzC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAqB,SAAS;AAAA,IACvF,aAAa;AAAA,IAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,4BAAQ;AAAA,IAC3D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,2BAA2B,KAAK,CAAC,IAAI,OAAO;AAAA,EACzF;AACF;AAEA,SAAS,UAA+B;AACtC,SAAO;AAAA,IACL,kBAAkB;AAAA,IAAM,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAkB,SAAS;AAAA,IACpF,aAAa;AAAA,IAAU,MAAM,EAAE,MAAM,OAAO;AAAA,IAC5C,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,YAAY,KAAK,CAAC,IAAI,OAAO;AAAA,EAC1E;AACF;AAEO,IAAM,aAAa;AAAA;AAAA,EAExB,WAAW,QAAyE;AAClF,UAAM,UAA+C,EAAE,CAAC,OAAO,GAAG,GAAG,QAAQ,EAAE;AAC/E,QAAI,OAAO,WAAW,OAAW,SAAQ,OAAO,MAAM,IAAI,WAAW;AACrE,QAAI,OAAO,QAAQ,OAAW,SAAQ,OAAO,GAAG,IAAI,QAAQ;AAC5D,WAAO,EAAE,uBAAuB,MAAM,WAAW,cAAc,QAAQ,cAAc,QAAQ;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,YAAY,SAIY;AACtB,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MACzD,SAAS;AAAA,MACT,aAAa,QAAQ,eAAe;AAAA,MACpC,MAAM,QAAQ,QAAQ,EAAE,MAAM,OAAO;AAAA,MACrC,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,YAAiC;AAC/B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAa,SAAS;AAAA,MAC/E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,mCAAe;AAAA,MAClE,QAAQ,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,MAC5C,UAAU,CAAC,MAAM;AACf,YAAI,OAAO,MAAM,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAAG,QAAO;AACpE,cAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACrC,cAAM,OAAO,MAAM,CAAC,GAAI,QAAQ,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC;AACxD,YAAI,QAAQ,KAAK,QAAQ,GAAI,QAAO;AACpC,cAAM,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnE,cAAM,aAAc,OAAO,MAAM,KAAK,OAAO,QAAQ,KAAM,OAAO,QAAQ;AAC1E,cAAM,SAAS,UAAU,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AACrE,YAAI,MAAM,KAAK,MAAM,OAAQ,QAAO;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,+BAAgB;AAAA,MACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAAA,MACvD,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,GAAG,IAAI,OAAO;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,QAA6B;AAC3B,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAS,SAAS;AAAA,MAC3E,aAAa;AAAA,MAAO,MAAM,EAAE,MAAM,QAAQ,SAAS,yCAAgB;AAAA,MACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAAA,MAC9C,UAAU,CAAC,MAAO,SAAS,CAAC,EAAE,UAAU,IAAI,OAAO;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,SAAS,OAAyF,CAAC,GAAwB;AACzH,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,WAAW,KAAK,YAAY;AAClC,QAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,GAAG;AAC/D,YAAM,IAAI,MAAM,kIAA+H,QAAQ,EAAE;AAAA,IAC3J;AACA,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAY,SAAS;AAAA,MAC9E,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MACjB,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACvE,GAAI,WAAW,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACnC,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,UAAU,KAAK,EAAE,UAAU,YACpE,OAAO,6BAA6B,SAAS;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,aAAa,OAA6B,CAAC,GAAwB;AACjE,WAAO;AAAA,MACL,kBAAkB;AAAA,MAAM,WAAW;AAAA,MAAc,QAAQ;AAAA,MAAgB,SAAS;AAAA,MAClF,aAAa;AAAA,MAAU,MAAM,EAAE,MAAM,OAAO;AAAA,MAC5C,iBAAiB;AAAA,MAAiB,mBAAmB;AAAA,MACrD,GAAI,KAAK,cAAc,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC9D,UAAU,CAAC,MAAO,OAAO,MAAM,YAC1B,EAAE,UAAU,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,SAAS,IACvE,OAAO;AAAA,IACb;AAAA,EACF;AACF;;;ACxLA,SAAS,SAAS,MAA4C;AAC5D,SAAO;AAAA,IACL,WAAW,KAAK,mBAAmB;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,WAAW,KAAK,cAAc;AAAA,IAC9B,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,EACzE;AACF;AAEA,IAAM,YAAY,CAAC,SAA8B;AAAA,EAC/C,YAAY,IAAI;AAAA,EAChB,aAAa,IAAI;AAAA,EACjB,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI;AAAA,EACZ,KAAK,IAAI;AACX;AAGO,SAAS,iBAAqC;AACnD,SAAO;AAAA,IACL,MAAM,OAAO,KAAK,IAAI,OAAO;AAC3B,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAA8C;AACzF,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,YAAY,IAAI;AAAA,QAAY,WAAW,IAAI;AAAA,QAC3C,aAAa,IAAI;AAAA,QAAa,YAAY,IAAI;AAAA,QAAY,QAAQ,IAAI;AAAA,MACxE,GAAG,IAAI,KAAK;AACZ,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,OAAO,WAAW;AACtC,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAA8C;AACzF,YAAM,UAAU,MAAM,kBAAkB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,SAAS,IAAI,IAAI,CAAC;AAChG,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,OAAO,WAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAA8C;AACvF,YAAM,UAAU,MAAM,gBAAgB,UAAU,GAAG,GAAG,IAAI,OAAO,WAAW,IAAI,KAAK,mBAAmB,UAAU;AAClH,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,KAAK,IAAI,SAAS,MAAM;AACvC,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,sBAA8C;AACxF,YAAM,WAAW,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,QAAQ,SAAS,EAAE,IAAI,EAAE,EAAE;AAClG,YAAM,SAAS,MAAM,iBAAiB,UAAU,GAAG,GAAG,IAAI,SAAS,SAAS,IAAI;AAChF,YAAM,IAAI,WAAW,UAAU,EAAE;AACjC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,KAAK,OAAO,WAAW,UAAU;AACnD,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAA4C;AACvF,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,kBAAkB,WAAW,SAAS,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,YAAY,OAAO,QAAQ;AAAA,IACxG;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-IUT3GWP3.js → chunk-IUD7WU67.js}

@@ -1,30 +1,37 @@
 import {
   VectorSet
-} from "./chunk-M5B2W6YY.js";
+} from "./chunk-TDJVQTXD.js";
 import {
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-GUZET4SG.js";
+} from "./chunk-JAQHWHUN.js";
+import {
+  humanizeFieldKey,
+  resolveFieldMeta,
+  schemaFieldKeys,
+  validateFieldMetaAtRegistration,
+  validateFieldMetaKeys
+} from "./chunk-QJNAHPVT.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-747G6CT3.js";
+} from "./chunk-UORWAG7K.js";
 import {
   loadPersistedSchema
-} from "./chunk-3L2NBKDR.js";
+} from "./chunk-IF2M43G4.js";
 import {
   buildPresentForJoin,
   isLookupDescriptor
-} from "./chunk-244QBK7Z.js";
+} from "./chunk-C4XV3PSJ.js";
 import {
   Lru
 } from "./chunk-V4PXLYWM.js";
 import {
   ViaPipeline
-} from "./chunk-3EWS67C7.js";
+} from "./chunk-4TG2ITRW.js";
 import {
   groupKeySourceField
 } from "./chunk-XBKH4FOC.js";
@@ -33,99 +40,17 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-PR7ILCIH.js";
 import {
   viaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-NCTN2FW4.js";
 import {
   ClassifiedConfigError,
   DerivationCycleError,
   MaterializedViewCycleError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
-
-// src/with-shape/introspection/field-meta.ts
-var FieldMetaUnknownFieldError = class extends Error {
-  constructor(collection, key) {
-    super(`fieldMeta for collection "${collection}" references unknown field "${key}". Declare it in the schema/config or remove the fieldMeta entry.`);
-    this.collection = collection;
-    this.key = key;
-    this.name = "FieldMetaUnknownFieldError";
-  }
-  collection;
-  key;
-};
-function validateFieldMetaKeys(collection, fieldMeta, knownFields) {
-  for (const key of Object.keys(fieldMeta)) {
-    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key);
-  }
-}
-function humanizeFieldKey(key) {
-  return key.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-}
-function resolveFieldMeta(key, inputs) {
-  const { channel, zodMeta, inferred } = inputs;
-  const pick = (k) => channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k];
-  const description = pick("description");
-  const semanticType = pick("semanticType");
-  const unit = pick("unit");
-  const sensitivity = pick("sensitivity");
-  const bulk = pick("bulk");
-  const aggregate = pick("aggregate");
-  const aliases = pick("aliases");
-  const displayFor = pick("displayFor");
-  const widget = pick("widget");
-  const group = pick("group");
-  const order = pick("order");
-  return {
-    label: pick("label") ?? humanizeFieldKey(key),
-    ...description !== void 0 ? { description } : {},
-    ...semanticType !== void 0 ? { semanticType } : {},
-    ...unit !== void 0 ? { unit } : {},
-    ...sensitivity !== void 0 ? { sensitivity } : {},
-    ...bulk !== void 0 ? { bulk } : {},
-    ...aggregate !== void 0 ? { aggregate } : {},
-    ...aliases !== void 0 ? { aliases } : {},
-    ...displayFor !== void 0 ? { displayFor } : {},
-    ...widget !== void 0 ? { widget } : {},
-    ...group !== void 0 ? { group } : {},
-    ...order !== void 0 ? { order } : {}
-  };
-}
-function schemaFieldKeys(schema) {
-  let s = schema;
-  for (let depth = 0; depth < 10; depth++) {
-    if (s === null || typeof s !== "object") return void 0;
-    const shape = s.shape;
-    if (shape !== null && typeof shape === "object") {
-      const keys = Object.keys(shape);
-      return keys.length > 0 ? keys : void 0;
-    }
-    const def = s._def;
-    const effect = def?.effect?.type;
-    if (def?.schema !== void 0 && (effect === "refinement" || effect === "preprocess")) {
-      s = def.schema;
-      continue;
-    }
-    if (def?.out !== void 0) {
-      s = def.out;
-      continue;
-    }
-    return void 0;
-  }
-  return void 0;
-}
-function validateFieldMetaAtRegistration(input) {
-  if (input.fieldMeta === void 0) return;
-  const validatorKeys = schemaFieldKeys(input.schema);
-  if (validatorKeys === void 0) return;
-  validateFieldMetaKeys(
-    input.collection,
-    input.fieldMeta,
-    /* @__PURE__ */ new Set([...validatorKeys, ...input.configKeys])
-  );
-}
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-shape/introspection/describe.ts
 var ZOD_META_KEYS = /* @__PURE__ */ new Set([
@@ -1321,7 +1246,6 @@ var ViaGraph = class {
 };
 
 export {
-  schemaFieldKeys,
   deriveZodFields,
   resolveDescribeFieldIds,
   buildDescription,
@@ -1338,4 +1262,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-IUT3GWP3.js.map
+//# sourceMappingURL=chunk-IUD7WU67.js.map