@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/{chunk-6QVKPHBF.js → chunk-QHG7GQKM.js}

@@ -1,7 +1,7 @@
 import {
   envelopeBodyForHash,
   sha256Hex
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -65,4 +65,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-6QVKPHBF.js.map
+//# sourceMappingURL=chunk-QHG7GQKM.js.map

package/dist/chunk-QJNAHPVT.js

@@ -0,0 +1,91 @@
+// src/with-shape/introspection/field-meta.ts
+var FieldMetaUnknownFieldError = class extends Error {
+  constructor(collection, key) {
+    super(`fieldMeta for collection "${collection}" references unknown field "${key}". Declare it in the schema/config or remove the fieldMeta entry.`);
+    this.collection = collection;
+    this.key = key;
+    this.name = "FieldMetaUnknownFieldError";
+  }
+  collection;
+  key;
+};
+function validateFieldMetaKeys(collection, fieldMeta, knownFields) {
+  for (const key of Object.keys(fieldMeta)) {
+    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key);
+  }
+}
+function humanizeFieldKey(key) {
+  return key.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function resolveFieldMeta(key, inputs) {
+  const { channel, zodMeta, inferred } = inputs;
+  const pick = (k) => channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k];
+  const description = pick("description");
+  const semanticType = pick("semanticType");
+  const unit = pick("unit");
+  const sensitivity = pick("sensitivity");
+  const bulk = pick("bulk");
+  const aggregate = pick("aggregate");
+  const aliases = pick("aliases");
+  const displayFor = pick("displayFor");
+  const widget = pick("widget");
+  const group = pick("group");
+  const order = pick("order");
+  return {
+    label: pick("label") ?? humanizeFieldKey(key),
+    ...description !== void 0 ? { description } : {},
+    ...semanticType !== void 0 ? { semanticType } : {},
+    ...unit !== void 0 ? { unit } : {},
+    ...sensitivity !== void 0 ? { sensitivity } : {},
+    ...bulk !== void 0 ? { bulk } : {},
+    ...aggregate !== void 0 ? { aggregate } : {},
+    ...aliases !== void 0 ? { aliases } : {},
+    ...displayFor !== void 0 ? { displayFor } : {},
+    ...widget !== void 0 ? { widget } : {},
+    ...group !== void 0 ? { group } : {},
+    ...order !== void 0 ? { order } : {}
+  };
+}
+function schemaFieldKeys(schema) {
+  let s = schema;
+  for (let depth = 0; depth < 10; depth++) {
+    if (s === null || typeof s !== "object") return void 0;
+    const shape = s.shape;
+    if (shape !== null && typeof shape === "object") {
+      const keys = Object.keys(shape);
+      return keys.length > 0 ? keys : void 0;
+    }
+    const def = s._def;
+    const effect = def?.effect?.type;
+    if (def?.schema !== void 0 && (effect === "refinement" || effect === "preprocess")) {
+      s = def.schema;
+      continue;
+    }
+    if (def?.out !== void 0) {
+      s = def.out;
+      continue;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function validateFieldMetaAtRegistration(input) {
+  if (input.fieldMeta === void 0) return;
+  const validatorKeys = schemaFieldKeys(input.schema);
+  if (validatorKeys === void 0) return;
+  validateFieldMetaKeys(
+    input.collection,
+    input.fieldMeta,
+    /* @__PURE__ */ new Set([...validatorKeys, ...input.configKeys])
+  );
+}
+
+export {
+  FieldMetaUnknownFieldError,
+  validateFieldMetaKeys,
+  humanizeFieldKey,
+  resolveFieldMeta,
+  schemaFieldKeys,
+  validateFieldMetaAtRegistration
+};
+//# sourceMappingURL=chunk-QJNAHPVT.js.map

package/dist/chunk-QJNAHPVT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/field-meta.ts"],"sourcesContent":["/**\n * Consumer-neutral, data-relatable field descriptors — the canonical,\n * validator-agnostic authoring channel. Merged by `collection.describe()`.\n *\n * Descriptive, never prescriptive: label/semanticType/unit/sensitivity/\n * aggregate/aliases/displayFor only. Layout, styling, and active-locale\n * selection stay app-side.\n *\n * @module\n */\n\n/** Known semantic types; the union is open — unknown strings pass through. */\nexport type SemanticType =\n  | 'date' | 'datetime' | 'email' | 'url' | 'currency' | 'percent'\n  | 'country' | 'vat' | 'iban' | 'entity'\n  | (string & {})\n\nexport interface FieldMeta {\n  /** Human label for any displayable field. Required. */\n  label: string\n  description?: string\n  semanticType?: SemanticType\n  /** Display unit, e.g. '€', '%', 'kg'. */\n  unit?: string\n  /** Data classification driving redaction/inspector masking. */\n  sensitivity?: 'public' | 'pii' | 'secret'\n  /**\n   * Sensitivity that is a property of the READ SHAPE, not the value (#1251).\n   *\n   * ⚠️ Declaring this prevents nothing. Against an insider holding the device\n   * and local keys it is TELEMETRY: it lets an opt-in sensor make bulk\n   * extraction visible early, attributable and loud. The real remediation is\n   * key custody — tiers and per-collection DEKs — not this label.\n   *\n   * Reads as: *this field's collection is a corpus whose COVERAGE is a\n   * protected quantity.* Deliberately ORTHOGONAL to {@link FieldMeta.sensitivity}:\n   * a company tax id stays `'public'` (it is public by law) and is still\n   * `bulk: 'sensitive'`, because the book of business is the set, not the value.\n   *\n   * The kernel does NOTHING with it beyond carrying it through introspection\n   * (`describe()` / `dumpSchema()`), so a sensor can discover which\n   * collections to account for. Zero runtime cost when unused.\n   */\n  bulk?: 'sensitive'\n  /** Default aggregation for this field. */\n  aggregate?: 'sum' | 'count' | 'distinct' | 'none'\n  /** Canonical search synonyms (data vocabulary, not UI). */\n  aliases?: readonly string[]\n  /** Entity pairing: the field holding the human label for this id (buyerId → buyerName). */\n  displayFor?: string\n  /**\n   * Override the widget hint derived from semanticType/type.\n   * e.g. 'textarea', 'date', 'money', 'select', 'checkbox', 'number', 'text'.\n   * When absent, the widget is derived automatically by buildDescription.\n   */\n  widget?: string\n  /**\n   * Card/section grouping hint for detail & form layouts (e.g. 'Identity',\n   * 'Amounts'). Purely descriptive metadata — consumers group; describe()\n   * keeps emitting fields alphabetically.\n   */\n  group?: string\n  /** Relative ordering hint within (and across) groups. Lower renders first. */\n  order?: number\n}\n\nexport class FieldMetaUnknownFieldError extends Error {\n  constructor(public readonly collection: string, public readonly key: string) {\n    super(`fieldMeta for collection \"${collection}\" references unknown field \"${key}\". `\n      + `Declare it in the schema/config or remove the fieldMeta entry.`)\n    this.name = 'FieldMetaUnknownFieldError'\n  }\n}\n\n/** Reject fieldMeta keys that are not known fields (typo guard), fail-loud. */\nexport function validateFieldMetaKeys(\n  collection: string,\n  fieldMeta: Record<string, FieldMeta>,\n  knownFields: ReadonlySet<string>,\n): void {\n  for (const key of Object.keys(fieldMeta)) {\n    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key)\n  }\n}\n\nexport interface MergeInputs {\n  channel?: FieldMeta\n  zodMeta?: Partial<FieldMeta>\n  inferred?: Partial<FieldMeta>\n}\nexport interface ResolvedMeta extends Partial<FieldMeta> { label: string }\n\n/** camelCase / snake_case → Title Case words. */\nexport function humanizeFieldKey(key: string): string {\n  return key\n    .replace(/[_-]+/g, ' ')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .trim()\n    .split(/\\s+/)\n    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n    .join(' ')\n}\n\n/** Merge one field's metadata: channel > zodMeta > inferred; label always present. */\nexport function resolveFieldMeta(key: string, inputs: MergeInputs): ResolvedMeta {\n  const { channel, zodMeta, inferred } = inputs\n  const pick = <K extends keyof FieldMeta>(k: K): FieldMeta[K] | undefined =>\n    channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k]\n  const description = pick('description')\n  const semanticType = pick('semanticType')\n  const unit = pick('unit')\n  const sensitivity = pick('sensitivity')\n  const bulk = pick('bulk')\n  const aggregate = pick('aggregate')\n  const aliases = pick('aliases')\n  const displayFor = pick('displayFor')\n  const widget = pick('widget')\n  const group = pick('group')\n  const order = pick('order')\n  return {\n    label: pick('label') ?? humanizeFieldKey(key),\n    ...(description !== undefined ? { description } : {}),\n    ...(semanticType !== undefined ? { semanticType } : {}),\n    ...(unit !== undefined ? { unit } : {}),\n    ...(sensitivity !== undefined ? { sensitivity } : {}),\n    ...(bulk !== undefined ? { bulk } : {}),\n    ...(aggregate !== undefined ? { aggregate } : {}),\n    ...(aliases !== undefined ? { aliases } : {}),\n    ...(displayFor !== undefined ? { displayFor } : {}),\n    ...(widget !== undefined ? { widget } : {}),\n    ...(group !== undefined ? { group } : {}),\n    ...(order !== undefined ? { order } : {}),\n  }\n}\n\n/**\n * Field KEYS from a configured validator, synchronously — the complement to\n * {@link deriveZodFields}, which derives field TYPES and must be async.\n *\n * The distinction is the whole point (#1253). `describe()`'s sync path passed\n * `zodFields: undefined`, so `fieldMeta` key-validation could never run there\n * and a typo'd key became a PHANTOM FIELD carrying its declared `sensitivity`\n * while the real field went undescribed — an inventory wrong in both\n * directions, silently, on the surface `sensitivity` exists to serve.\n *\n * That was read as unavoidable (\"the sync path cannot know the schema's\n * fields\"), which is true of types and false of keys: a Zod object exposes\n * `.shape` directly, on both v3 and v4, with no JSON-Schema derivation and no\n * `zod-to-json-schema` peer. The latter matters — on Zod 3 that peer is\n * required for the async path, so the sync path is the only one some\n * consumers can reach.\n *\n * A duck-typed probe, not a Zod dependency: an unrecognised validator returns\n * `undefined` and the caller stays silent rather than guessing, so a validator\n * hub cannot read never produces a false \"unknown field\" error.\n *\n * Wrappers (reported by the pilot on #1249's guard, and it equally affected\n * #1253's): a wrapped object's `.shape` is undefined, so \"has a schema\" and\n * \"hub can enumerate its fields\" silently diverged for exactly the schemas\n * most worth guarding — validated ones.\n *\n * ONE RULE UNWRAPS ALL OF THEM: FOLLOW THE OUTPUT SIDE. These keys describe\n * the PARSED record, so the only question a wrapper raises is whether it\n * changes the parsed shape.\n *\n *   Zod 3 `ZodEffects`  — `.refine()`/`.superRefine()` (`effect.type` is\n *     `'refinement'`) and `z.preprocess()` (`'preprocess'`) both parse WITH\n *     the inner schema, so the output is the inner object: follow\n *     `_def.schema`. `.transform()` REPLACES the output, so the inner keys\n *     would be a lie: stay `undefined`, deliberately.\n *   Zod 4 `ZodPipe`     — `z.preprocess()` is `pipe(transform -> object)` and\n *     `.transform()` is `pipe(object -> transform)`. Following `_def.out`\n *     resolves both correctly with no effect-kind test: preprocess reaches the\n *     object, transform reaches a `ZodTransform` that has no shape and no\n *     inner schema, so the loop returns `undefined` on its own.\n *\n * `preprocess` was the pilot's second finding (#1262): the first fix followed\n * refinements only, which left four of their registered collections unguarded\n * — including the one carrying their only `fieldMeta` PII declaration, i.e.\n * precisely the collection #1253 was written for. It is one string away from\n * `transform` and means the opposite thing, so a test pins the two apart.\n *\n * A duck-typed probe throughout: an unrecognised validator returns `undefined`\n * and the caller stays silent rather than guessing. Bounded depth, so a cyclic\n * duck cannot hang us.\n */\nexport function schemaFieldKeys(schema: unknown): readonly string[] | undefined {\n  let s: unknown = schema\n  for (let depth = 0; depth < 10; depth++) {\n    if (s === null || typeof s !== 'object') return undefined\n    const shape: unknown = (s as { shape?: unknown }).shape\n    if (shape !== null && typeof shape === 'object') {\n      const keys = Object.keys(shape as Record<string, unknown>)\n      return keys.length > 0 ? keys : undefined\n    }\n    const def = (s as {\n      _def?: { effect?: { type?: unknown }; schema?: unknown; out?: unknown }\n    })._def\n    // Zod 3 ZodEffects: refinement and preprocess parse WITH the inner schema,\n    // so the output shape is the inner object's. `transform` replaces it.\n    const effect = def?.effect?.type\n    if (def?.schema !== undefined && (effect === 'refinement' || effect === 'preprocess')) {\n      s = def.schema\n      continue\n    }\n    // Zod 4 ZodPipe: the output side IS the parsed shape. `z.preprocess` puts\n    // the object there; `.transform()` puts a shapeless ZodTransform there,\n    // which falls out of the loop as `undefined` on the next pass.\n    if (def?.out !== undefined) {\n      s = def.out\n      continue\n    }\n    return undefined\n  }\n  return undefined\n}\n\n/**\n * Registration-time `fieldMeta` key check (#1253 follow-up, the \"refuse as early\n * as the information allows\" pass).\n *\n * The same validation `buildDescription` runs, hoisted to collection\n * construction so a typo is refused when it is DECLARED rather than when\n * someone happens to call `describe()`. A collection nobody describes was\n * previously never checked at all — and `fieldMeta` is what carries\n * `sensitivity`, so the un-checked case was the one with a data-classification\n * inventory hanging off it.\n *\n * Deliberately NOT a replacement for the check inside `buildDescription`. There\n * are three tiers of knowability, not two:\n *\n *   always      — a name declared in the config itself (see the virtual-field\n *                 refusal in the derivation registry: \"declared and never\n *                 stored\" needs no schema at all)\n *   at reg.     — a validator whose `.shape` is readable synchronously: THIS\n *   at describe — a validator whose fields only exist after async JSON-Schema\n *                 derivation (Zod 3 + `zod-to-json-schema`)\n *\n * The third tier is why `buildDescription` keeps its own call. Hoisting alone\n * would move the check earlier for some collections and REMOVE it for others.\n *\n * Silent when the field set cannot be enumerated, exactly as the describe-time\n * check is: a TS-generic collection names real fields that appear in no runtime\n * config, and rejecting those teaches people to stop declaring `fieldMeta`.\n */\nexport function validateFieldMetaAtRegistration(input: {\n  readonly collection: string\n  readonly schema?: unknown\n  readonly fieldMeta?: Record<string, unknown> | undefined\n  readonly configKeys: readonly string[]\n}): void {\n  if (input.fieldMeta === undefined) return\n  const validatorKeys = schemaFieldKeys(input.schema)\n  if (validatorKeys === undefined) return\n  validateFieldMetaKeys(\n    input.collection,\n    input.fieldMeta as Parameters<typeof validateFieldMetaKeys>[1],\n    new Set<string>([...validatorKeys, ...input.configKeys]),\n  )\n}\n"],"mappings":";AAkEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,KAAa;AAC3E,UAAM,6BAA6B,UAAU,+BAA+B,GAAG,mEACX;AAF1C;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAGO,SAAS,sBACd,YACA,WACA,aACM;AACN,aAAW,OAAO,OAAO,KAAK,SAAS,GAAG;AACxC,QAAI,CAAC,YAAY,IAAI,GAAG,EAAG,OAAM,IAAI,2BAA2B,YAAY,GAAG;AAAA,EACjF;AACF;AAUO,SAAS,iBAAiB,KAAqB;AACpD,SAAO,IACJ,QAAQ,UAAU,GAAG,EACrB,QAAQ,sBAAsB,OAAO,EACrC,KAAK,EACL,MAAM,KAAK,EACX,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,GAAG;AACb;AAGO,SAAS,iBAAiB,KAAa,QAAmC;AAC/E,QAAM,EAAE,SAAS,SAAS,SAAS,IAAI;AACvC,QAAM,OAAO,CAA4B,MACvC,UAAU,CAAC,KAAK,UAAU,CAAC,KAAK,WAAW,CAAC;AAC9C,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,eAAe,KAAK,cAAc;AACxC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,cAAc,KAAK,aAAa;AACtC,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,YAAY,KAAK,WAAW;AAClC,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,KAAK,YAAY;AACpC,QAAM,SAAS,KAAK,QAAQ;AAC5B,QAAM,QAAQ,KAAK,OAAO;AAC1B,QAAM,QAAQ,KAAK,OAAO;AAC1B,SAAO;AAAA,IACL,OAAO,KAAK,OAAO,KAAK,iBAAiB,GAAG;AAAA,IAC5C,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,IACrD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IAC/C,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,IACjD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,IACvC,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACF;AAqDO,SAAS,gBAAgB,QAAgD;AAC9E,MAAI,IAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,QAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,UAAM,QAAkB,EAA0B;AAClD,QAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,YAAM,OAAO,OAAO,KAAK,KAAgC;AACzD,aAAO,KAAK,SAAS,IAAI,OAAO;AAAA,IAClC;AACA,UAAM,MAAO,EAEV;AAGH,UAAM,SAAS,KAAK,QAAQ;AAC5B,QAAI,KAAK,WAAW,WAAc,WAAW,gBAAgB,WAAW,eAAe;AACrF,UAAI,IAAI;AACR;AAAA,IACF;AAIA,QAAI,KAAK,QAAQ,QAAW;AAC1B,UAAI,IAAI;AACR;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA8BO,SAAS,gCAAgC,OAKvC;AACP,MAAI,MAAM,cAAc,OAAW;AACnC,QAAM,gBAAgB,gBAAgB,MAAM,MAAM;AAClD,MAAI,kBAAkB,OAAW;AACjC;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,oBAAI,IAAY,CAAC,GAAG,eAAe,GAAG,MAAM,UAAU,CAAC;AAAA,EACzD;AACF;","names":[]}

package/dist/{chunk-LIOVX5TJ.js → chunk-QT5ITL25.js}

@@ -3,13 +3,13 @@ import {
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   ConflictError,
   USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES,
   UserEnvelopeOversizedError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-party/directory/storage.ts
 var META_COLLECTION = "_meta";
@@ -138,4 +138,4 @@ export {
   deleteUserEnvelope,
   listUserEnvelopeIds
 };
-//# sourceMappingURL=chunk-LIOVX5TJ.js.map
+//# sourceMappingURL=chunk-QT5ITL25.js.map

package/dist/{chunk-IMQKWR46.js → chunk-R2ZULFXU.js}

@@ -1,14 +1,14 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-EJLV62NI.js";
+} from "./chunk-KN4LUMH6.js";
 import {
   buildRecordEnvelope,
   sha256Hex
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   ReadOnlyError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -109,10 +109,9 @@ async function withdrawAccessibleData(vault, opts) {
 }
 
 export {
-  FROZEN_SNAPSHOTS_COLLECTION,
   randomId,
   freezeSnapshotOnly,
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-IMQKWR46.js.map
+//# sourceMappingURL=chunk-R2ZULFXU.js.map

package/dist/chunk-R2ZULFXU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope, sha256Hex } from '../../capsule/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nconst FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner secret. */\n  readonly reKey?: { readonly secret: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    buildRecordEnvelope(\n      { collection: FROZEN_SNAPSHOTS_COLLECTION, id: withdrawalId, by: opts.actorUserId, version: 1 },\n      { ts: frozenAt, iv: '', data: body},\n    ),\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAM,8BAA8B;AACpC,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,EAAE,YAAY,6BAA6B,IAAI,cAAc,IAAI,KAAK,aAAa,SAAS,EAAE;AAAA,MAC9F,EAAE,IAAI,UAAU,IAAI,IAAI,MAAM,KAAI;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}

package/dist/{chunk-Q2XRFWOI.js → chunk-RRTQAQ3N.js}

@@ -1,7 +1,7 @@
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-QMWY2FDS.js";
+} from "./chunk-THQ3BHLM.js";
 
 // src/capsule/plumbing/sign.ts
 var ALG = "Ed25519";
@@ -37,4 +37,4 @@ export {
   signBytes,
   verifyBytes
 };
-//# sourceMappingURL=chunk-Q2XRFWOI.js.map
+//# sourceMappingURL=chunk-RRTQAQ3N.js.map