@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/README.md

@@ -178,6 +178,132 @@ Core has zero `node:` imports — it runs unchanged in browsers, Node, Bun, Deno
 
 CSV, XML, xlsx, and the rest of the plaintext tier — plus encrypted `.noydb` bundles under the `as-noydb` encrypted tier — all live in the [`@noy-db/as-*`](https://www.npmjs.com/search?q=%40noy-db%2Fas-) family. Every invocation is gated by the two-tier authorization model (`canExportPlaintext` default off, `canExportBundle` default on for owner/admin) and lands in the audit ledger.
 
+## Money fields
+
+`money()` is a schema-layer field descriptor (a sibling of `i18nText()` / `dictKey()`) for currency-safe, exact decimal values. Money is stored as a scaled integer encoded as a **digit string**, so it is exact for any magnitude — past `Number.MAX_SAFE_INTEGER` included (a JSON number would silently truncate at 2^53).
+
+```ts
+vault.collection('invoices', {
+  schema: z.object({ id: z.string(), total: z.union([z.number(), z.string()]) }),
+  moneyFields: { total: money({ currency: 'EUR', scale: 2 }) }, // scale optional — ISO-4217 default
+})
+
+await invoices.put('a', { id: 'a', total: '123.45' })          // stored as '12345'
+const inv = await invoices.get('a', { locale: 'de-DE' })
+// inv.total           → '123.45'   (exact decimal string)
+// inv.totalFormatted  → '123,45 €' (Intl, full precision)
+// inv.totalNumber     → 123.45     (convenience JS number; lossy past 2^53)
+
+// Exact aggregation — sum/min/max run in BigInt, no float drift:
+invoices.query().aggregate({ total: sum('total') }).run() // → '0.60', never 0.6000000000000001
+```
+
+- **Rounding:** excess precision is **rejected** by default; opt in per field with `money({ ..., rounding: 'half-even' })` (`half-up` / `half-even` / `half-down` / `up` / `down` / `ceil` / `floor`).
+- **Multi-currency:** opt in with `money({ currencies: 'any' | ['EUR','USD'] })` — currency travels per record as `{ amount, currency }`; `sum` returns an exact per-currency map (`{ EUR: '15.50', USD: '3.00' }`), or one figure with `sum('total', { convertTo: 'EUR', fx })`.
+- Money `sum`/`min`/`max` implement incremental `remove()`, so they stay exact under live aggregation and materialized-view maintenance.
+
+## Computed fields
+
+`computed` declares schema-owned scalar fields derived on write — keeping the arithmetic next to the schema instead of scattered across handlers. Each function is pure and synchronous; they run **first** in the write pipeline (before schema validation), in declaration order, so a later field can read an earlier one. The result is **materialized** on the record — stored, queryable, and `aggregate(sum())`-able like any field.
+
+```ts
+vault.collection('lines', {
+  schema: z.object({
+    id: z.string(), unitPrice: z.number(), qty: z.number(),
+    netAmount: z.number().optional(), taxAmount: z.number().optional(), total: z.number().optional(),
+  }),
+  computed: {
+    netAmount: (r) => r.unitPrice * r.qty,
+    taxAmount: (r) => r.netAmount * 0.22,   // reads the field computed above
+    total:     (r) => r.netAmount + r.taxAmount,
+  },
+})
+
+await lines.put('a', { id: 'a', unitPrice: 10, qty: 3 })  // computed fields not supplied
+const line = await lines.get('a')   // → { …, netAmount: 30, taxAmount: 6.6, total: 36.6 }
+```
+
+- A computed field **overwrites** any user-supplied value of the same name (the field is schema-owned); a throwing function rejects the write with `ComputedFieldError`.
+- **Composes with `money()`** — declare a computed field as a money field too and it's quantized after evaluation, so `sum()` over it is exact.
+
+## Immutable collections (WORM)
+
+`immutableGuard` makes a collection write-once after a condition holds — issued invoices/DDTs that must never change. It's declarative sugar over `guards`: it generates the block-on-`check`/`onDelete` + ledgered admin-`amendment` strategy, so it reuses the whole guard machinery (and composes with `periods`/`history`).
+
+```ts
+import { createNoydb, immutableGuard } from '@noy-db/hub'
+
+await createNoydb({
+  store, user, secret,
+  guardStrategies: [
+    immutableGuard({ collection: 'invoices', after: (r) => r.status === 'issued' }),
+  ],
+})
+
+await invoices.put('a', { id: 'a', status: 'draft',  total: 100 }) // ok
+await invoices.put('a', { id: 'a', status: 'issued', total: 100 }) // ok — the transition write
+await invoices.put('a', { id: 'a', status: 'issued', total: 999 }) // ✗ RecordLockedError
+await invoices.delete('a')                                          // ✗ RecordLockedError
+
+// the sanctioned, ledgered override:
+await db.transaction({ amendment: true, reason: 'correct issued total' }, async (tx) => {
+  tx.vault('books').collection('invoices').put('a', { id: 'a', status: 'issued', total: 110 })
+})
+```
+
+- `after(record)` is evaluated on the **existing** record, so inserts and the write that *first* makes a record immutable are allowed; everything after is blocked.
+- `appendOnly: true` is shorthand for `after: () => true` — immutable from creation.
+- The admin/owner `amendment` path is the only way through, and every amendment is appended to the audit ledger.
+
+## Retention, legal-hold & archival
+
+For retention-bound data (e.g. 10-year fiscal records), two facilities share one rule — **a legal hold blocks eviction**.
+
+**Blob retention** (`vault.compact()`) gains a hold and a period-bound floor:
+
+```ts
+vault.collection('invoices', {
+  blobFields: {
+    pdf: {
+      retainDays: 3650,                              // base TTL
+      legalHold:  (r) => r.underLitigation === true, // never evict while held
+      retainUntil:(r) => r.fiscalYearEnd,            // floor: keep until period obligation ends
+    },
+  },
+})
+const { evicted, held } = await vault.compact() // held = retained-by-hold count
+```
+
+**Record archival** (`withArchive`) relocates sealed records to a cold store — envelope-level, no re-encryption — and restores on demand:
+
+```ts
+import { createNoydb, withArchive } from '@noy-db/hub'
+
+const db = await createNoydb({ store: primary, archiveStrategy: withArchive({ store: coldStore }) })
+vault.collection('invoices', {
+  archive: { archiveWhen: (r) => r.fiscalYear <= thisYear - 1, legalHold: (r) => r.underHold },
+})
+
+await vault.archive()                       // → { archived, held, scanned }
+await vault.listArchived('invoices')        // → [{ collection, id }, …]
+await vault.restore('invoices', 'inv-2020') // relocate back to primary (decryptable)
+```
+
+Archival uses low-level relocation, so it **bypasses guards** (issued/immutable records over a sealed period can still be archived) and doesn't recompute finalized aggregates. Archived records read `null` from the primary store until restored; a `legalHold` predicate blocks archival entirely.
+
+## Atomic sequences
+
+`vault.sequence(name)` gives gap-free, exactly-once numbering — the primitive fiscal/ERP/ticketing apps need for invoice or DDT numbers — backed by an optimistic compare-and-swap counter.
+
+```ts
+const n = await vault.sequence('invoice-2026').next()   // 1, then 2, 3, … no gaps, no duplicates
+const cur = await vault.sequence('invoice-2026').peek()  // read current value without allocating
+```
+
+- **Independent per name** — `sequence('invoice-2026')` and `sequence('ddt-2026')` are separate counters.
+- **Concurrency-safe** — concurrent `next()` calls retry on CAS contention (jittered backoff); a genuine burst beyond the retry budget surfaces `SequenceContentionError` so the caller can retry or queue.
+- **Online-only — by design.** Gap-free numbering needs single-authority serialization, which an offline writer can't provide. `next()` throws `SequenceOfflineError` unless the store advertises `capabilities.casAtomic`. This is the honest wall: assign each `next()` value to its record in the same operation (a discarded value is a gap in *usage*, not in the sequence).
+
 ## Status
 
 **Pre-release** (`0.1.0-pre.1`). API may change before `1.0`. Install from the `next` dist-tag:

package/dist/adapter/index.d.ts

@@ -0,0 +1,9 @@
+export { aY as EncryptedEnvelope, d0 as ListPageResult, aw as NoydbBundleStore, aW as NoydbStore, eu as StoreCapabilities, ev as StoreTime, eP as TxOp, f4 as VaultSnapshot } from '../index-DHn9lEP0.js';
+export { x as BundleVersionConflictError, J as ConflictError, ag as NetworkError, aC as StoreCapabilityError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
+import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
+import '@noy-db/attestation';

package/dist/adapter/index.js

@@ -0,0 +1,14 @@
+import {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  StoreCapabilityError
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  StoreCapabilityError
+};
+//# sourceMappingURL=index.js.map

package/dist/aggregate/index.d.ts

@@ -1,5 +1,6 @@
-import { A as AggregateStrategy } from '../strategy-DSTrsZ8t.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, m as buildLiveAggregation, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, s as resetGroupByWarnings, t as sum } from '../strategy-DSTrsZ8t.js';
+import { A as AggregateStrategy } from '../strategy-8QGs5KQE.js';
+export { j as AggregateResult, k as AggregateSpec, l as Aggregation, m as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, n as GROUPBY_WARN_CARDINALITY, o as GroupedAggregation, p as GroupedQuery, q as GroupedQueryN, t as GroupedRow, u as GroupedRowN, w as LiveAggregation, x as Reducer, y as ReducerOptions, z as avg, B as buildLiveAggregation, C as count, D as groupAndReduce, E as max, F as min, H as reduceRecords, J as resetGroupByWarnings, K as sum } from '../strategy-8QGs5KQE.js';
+import '../errors-BAWO5Z5a.js';
 
 /**
  * Active aggregate strategy factory. Calling `withAggregate()` returns

package/dist/aggregate/index.js

@@ -4,7 +4,7 @@ import {
   max,
   min,
   sum
-} from "../chunk-5ZGZ6HIZ.js";
+} from "../chunk-DEE4CRYN.js";
 import {
   Aggregation,
   GROUPBY_MAX_CARDINALITY,
@@ -16,9 +16,11 @@ import {
   groupAndReduce,
   reduceRecords,
   resetGroupByWarnings
-} from "../chunk-KYKMKLJ6.js";
-import "../chunk-MRIBLZL3.js";
-import "../chunk-YDLAFP36.js";
+} from "../chunk-K6NVSHAH.js";
+import "../chunk-KJ3K5VZM.js";
+import "../chunk-QXWJQ7UU.js";
+import "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 
 // src/aggregate/active.ts
 function withAggregate() {
@@ -26,11 +28,11 @@ function withAggregate() {
     aggregate(executeRecords, spec, upstreams) {
       return new Aggregation(executeRecords, spec, upstreams);
     },
-    groupBy(executeRecords, field, upstreams, dictLabelResolver) {
-      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver);
+    groupBy(executeRecords, field, upstreams, dictLabelResolver, moneyFields) {
+      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, moneyFields);
     },
-    groupByN(executeRecords, fields, upstreams) {
-      return new GroupedQueryN(executeRecords, fields, upstreams);
+    groupByN(executeRecords, fields, upstreams, moneyFields) {
+      return new GroupedQueryN(executeRecords, fields, upstreams, void 0, moneyFields);
     },
     async scanAggregate(iter, spec) {
       const collected = [];

package/dist/aggregate/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/aggregate/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withAggregate()` returns\n * an `AggregateStrategy` whose methods construct real `Aggregation` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/aggregate`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Aggregation, reduceRecords } from './aggregation.js'\nimport type { AggregateSpec, AggregateResult } from './aggregation.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { AggregateStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ aggregateStrategy: withAggregate() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withAggregate, sum, count } from '@noy-db/hub/aggregate'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   aggregateStrategy: withAggregate(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withAggregate(): AggregateStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Aggregation(executeRecords, spec as unknown as AggregateSpec, upstreams) as unknown as Aggregation<AggregateResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver)\n    },\n    groupByN(executeRecords, fields, upstreams) {\n      return new GroupedQueryN(executeRecords, fields, upstreams)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as AggregateSpec) as unknown as AggregateResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,gBAAmC;AACjD,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,YAAY,gBAAgB,MAAkC,SAAS;AAAA,IACpF;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB;AAC3D,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,iBAAiB;AAAA,IAC7E;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,aAAO,IAAI,cAAc,gBAAgB,QAAQ,SAAS;AAAA,IAC5D;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAAgC;AAAA,IAClE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/aggregate/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withAggregate()` returns\n * an `AggregateStrategy` whose methods construct real `Aggregation` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/aggregate`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Aggregation, reduceRecords } from './aggregation.js'\nimport type { AggregateSpec, AggregateResult } from './aggregation.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { AggregateStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ aggregateStrategy: withAggregate() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withAggregate, sum, count } from '@noy-db/hub/aggregate'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   aggregateStrategy: withAggregate(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withAggregate(): AggregateStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Aggregation(executeRecords, spec as unknown as AggregateSpec, upstreams) as unknown as Aggregation<AggregateResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver, moneyFields) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, moneyFields)\n    },\n    groupByN(executeRecords, fields, upstreams, moneyFields) {\n      return new GroupedQueryN(executeRecords, fields, upstreams, undefined, moneyFields)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as AggregateSpec) as unknown as AggregateResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,gBAAmC;AACjD,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,YAAY,gBAAgB,MAAkC,SAAS;AAAA,IACpF;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB,aAAa;AACxE,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,mBAAmB,WAAW;AAAA,IAC1F;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW,aAAa;AACvD,aAAO,IAAI,cAAc,gBAAgB,QAAQ,WAAW,QAAW,WAAW;AAAA,IACpF;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAAgC;AAAA,IAClE;AAAA,EACF;AACF;","names":[]}

package/dist/attestation/index.d.ts

@@ -1,11 +1,13 @@
-import { aO as NoydbStore } from '../types-D9eB0Rvh.js';
+import { aW as NoydbStore } from '../index-DHn9lEP0.js';
 import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
-export { m as AttestationError } from '../index-BF1B2HB9.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+export { s as AttestationError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
 import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 
 /** Everything issueAttestationCore needs from the Vault, injected for testability. */
 interface IssueContext {

package/dist/attestation/index.js

@@ -1,21 +1,22 @@
 import {
   issueAttestationCore
-} from "../chunk-75QDHSE4.js";
+} from "../chunk-2QDWRK3B.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-UVPGJXVO.js";
+} from "../chunk-JOJPBZSZ.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-ZUMGGHRB.js";
+} from "../chunk-5PTX7PKD.js";
 import "../chunk-FZU343FL.js";
-import "../chunk-FXQYZNOW.js";
-import "../chunk-UOF74WQY.js";
+import "../chunk-A7DNZVAV.js";
+import "../chunk-E2MDPPOC.js";
 import {
   AttestationError
-} from "../chunk-YDLAFP36.js";
+} from "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 
 // src/attestation/index.ts
 import { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from "@noy-db/attestation";

package/dist/attestation/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/attestation/index.ts"],"sourcesContent":["/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAaA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":[]}
+{"version":3,"sources":["../../src/attestation/index.ts"],"sourcesContent":["/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAaA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":[]}

package/dist/blobs/index.d.ts

@@ -1,11 +1,13 @@
-import { B as BlobStrategy } from '../types-D9eB0Rvh.js';
-export { p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, s as BLOB_EVICTION_AUDIT_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, x as BlobEvictionEntry, y as BlobFieldPolicy, z as BlobFieldsConfig, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, G as BlobStrategyOpenArgs, H as CompactRunOptions, J as CompactionContext, K as CompactionResult, L as DEFAULT_CHUNK_SIZE, M as EXPORT_AUDIT_COLLECTION, N as ExportBlobsAbortedError, O as ExportBlobsAuditEntry, Q as ExportBlobsHandle, R as ExportBlobsOptions, T as ExportedBlob, U as SlotInfo, V as SlotRecord, W as VersionRecord, X as createExportBlobsHandle, Y as runCompaction } from '../types-D9eB0Rvh.js';
-export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from '../mime-magic-CBBSOkjm.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+import { B as BlobStrategy } from '../index-DHn9lEP0.js';
+export { o as BLOB_CHUNKS_COLLECTION, p as BLOB_COLLECTION, q as BLOB_EVICTION_AUDIT_COLLECTION, r as BLOB_INDEX_COLLECTION, t as BLOB_SLOTS_PREFIX, u as BLOB_VERSIONS_PREFIX, w as BlobEvictionEntry, x as BlobFieldPolicy, y as BlobFieldsConfig, z as BlobObject, A as BlobPutOptions, C as BlobResponseOptions, E as BlobSet, F as BlobStrategyOpenArgs, G as CompactRunOptions, H as CompactionContext, J as CompactionResult, K as DEFAULT_CHUNK_SIZE, L as EXPORT_AUDIT_COLLECTION, M as ExportBlobsAbortedError, N as ExportBlobsAuditEntry, O as ExportBlobsHandle, Q as ExportBlobsOptions, R as ExportedBlob, T as ObjectListEntry, U as ObjectMeta, V as ObjectProjection, W as ObjectUrlOptions, X as PutObjectOptions, Y as PutUrlOptions, Z as SlotInfo, _ as SlotRecord, $ as VersionRecord, a0 as createExportBlobsHandle, a1 as memoryObjectProjection, a2 as runCompaction } from '../index-DHn9lEP0.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from '../mime-magic-JeLKHRng.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
+import '../errors-BAWO5Z5a.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-BF1B2HB9.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 /**

package/dist/blobs/index.js

@@ -8,18 +8,22 @@ import {
   DEFAULT_CHUNK_SIZE,
   detectMagic,
   detectMimeType,
-  isPreCompressed
-} from "../chunk-FBMXWVGP.js";
+  importExternalObjects,
+  isPreCompressed,
+  memoryObjectProjection
+} from "../chunk-ZK66B5EY.js";
 import {
   BLOB_EVICTION_AUDIT_COLLECTION,
   EXPORT_AUDIT_COLLECTION,
   ExportBlobsAbortedError,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-LOL725S4.js";
-import "../chunk-FXQYZNOW.js";
-import "../chunk-UOF74WQY.js";
-import "../chunk-YDLAFP36.js";
+} from "../chunk-XYW2CSCI.js";
+import "../chunk-LXKBG52H.js";
+import "../chunk-A7DNZVAV.js";
+import "../chunk-E2MDPPOC.js";
+import "../chunk-JZ5DS4DP.js";
+import "../chunk-PZ5AY32C.js";
 
 // src/blobs/active.ts
 function withBlobs() {
@@ -43,7 +47,9 @@ export {
   createExportBlobsHandle,
   detectMagic,
   detectMimeType,
+  importExternalObjects,
   isPreCompressed,
+  memoryObjectProjection,
   runCompaction,
   withBlobs
 };

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/blobs/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from './blob-set.js'\nimport type { BlobStrategy } from './strategy.js'\n\n/**\n * Build a default `BlobStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(): BlobStrategy {\n  return {\n    openSlot(args) {\n      return new BlobSet(args)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,YAA0B;AACxC,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/blobs/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from './blob-set.js'\nimport type { BlobStrategy } from './strategy.js'\n\n/**\n * Build a default `BlobStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(): BlobStrategy {\n  return {\n    openSlot(args) {\n      return new BlobSet(args)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCO,SAAS,YAA0B;AACxC,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/bundle/index.d.ts

@@ -1,15 +1,18 @@
-import { T as TransferSealPayload } from '../ulid-CiM2OAeM.js';
-export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as encodeBundleHeader, j as generateULID, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, m as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../ulid-CiM2OAeM.js';
-import { bf as Vault, aO as NoydbStore, bb as SealingKeyProvider, bg as RecoveryEnrollmentInput, bh as ShamirRecoveryProvider } from '../types-D9eB0Rvh.js';
-export { n as AdoptionStateError, B as BackupCorruptedError, o as BackupLedgerError, p as BundleIntegrityError, q as BundleSealMismatchError, r as BundleVersionConflictError, P as PartitionExtractionError, s as TransferSealError } from '../index-BF1B2HB9.js';
-import '../lazy-builder-Rpd-V3jP.js';
-import '../predicate-Dnu81tsS.js';
-import '../strategy-DSTrsZ8t.js';
+import { T as TransferSealPayload } from '../decrypt-partition-CXS5KopB.js';
+export { C as COMPRESSION_BROTLI, a as COMPRESSION_GZIP, b as COMPRESSION_NONE, c as CompressionAlgo, D as DecryptedRecord, F as FLAG_COMPRESSED, d as FLAG_HAS_INTEGRITY_HASH, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, j as encodeBundleHeader, r as readNoydbBundle, k as readNoydbBundleHeader, l as resetBrotliSupportCache, v as validateBundleHeader, w as writeNoydbBundle } from '../decrypt-partition-CXS5KopB.js';
+export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.js';
+import { bh as Vault, aW as NoydbStore, bd as SealingKeyProvider, bi as RecoveryEnrollmentInput, bj as ShamirRecoveryProvider } from '../index-DHn9lEP0.js';
+export { t as AdoptionStateError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, P as PartitionExtractionError, y as TransferSealError } from '../errors-BAWO5Z5a.js';
+import '../lazy-builder-ChSqcF5t.js';
+import '../predicate-BmhBSPCH.js';
+import '../strategy-8QGs5KQE.js';
 import '../strategy-BSxFXGzb.js';
+import '../index-BMmajblo.js';
+import '../index-Ddm8D3Oo.js';
 import '@noy-db/attestation';
 
 /**
- * Transitive-closure FK walker (#201). Computes the set of
+ * Transitive-closure FK walker. Computes the set of
  * (collection, id) tuples reachable from seed predicates, so a
  * partition extraction ships a referentially-complete subset.
  *
@@ -48,7 +51,7 @@ interface ClosureResult {
 declare function walkClosure(vault: Vault, opts: WalkClosureOptions): Promise<ClosureResult>;
 
 /**
- * Partition-extraction dry-run (#202). Read-only preview of what an
+ * Partition-extraction dry-run. Read-only preview of what an
  * `extractPartition` would move: record counts, byte totals, and the
  * timestamp span per collection — computed from raw encrypted
  * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.
@@ -81,7 +84,7 @@ interface ExtractionPreview {
 declare function describeExtraction(vault: Vault, opts: WalkClosureOptions): Promise<ExtractionPreview>;
 
 /**
- * Partition extraction (#203 + #206). Walks the FK closure, re-encrypts
+ * Partition extraction. Walks the FK closure, re-encrypts
  * the selected records under fresh per-collection DEKs, seals those DEKs
  * under a one-time transfer key, and serializes an unowned
  * `extracted-partition` bundle.
@@ -96,18 +99,26 @@ interface ExtractPartitionResult {
     readonly sealId: string;
 }
 /**
- * Extract a re-keyed, transfer-sealed partition (#203 + #206). Owner-only
- * (#198 invariant 5): producing a standalone re-keyed vault is an
+ * Extract a re-keyed, transfer-sealed partition. Owner-only
+ * (invariant 5): producing a standalone re-keyed vault is an
  * ownership operation. Non-destructive on the source.
  */
 declare function extractPartition(vault: Vault, opts: WalkClosureOptions & {
     readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none';
     readonly carrySchemas?: boolean;
     readonly carryLedger?: boolean;
+    /**
+     * FR-7 structural field projection: per-collection allow-list of fields
+     * to keep. Non-listed fields are dropped from each record BEFORE
+     * re-encryption (so they never travel in the bundle); `id` is always
+     * preserved. A projected collection's persisted schema is NOT carried.
+     * Absent/empty → un-projected behavior (byte-identical to today).
+     */
+    readonly fieldProjection?: Record<string, readonly string[]>;
 }): Promise<ExtractPartitionResult>;
 
 /**
- * Reverse of `sealDeks` (#206). Imports the transfer key, decrypts the
+ * Reverse of `sealDeks`. Imports the transfer key, decrypts the
  * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and
  * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a
  * wrong key (AES-GCM auth-tag failure) or malformed payload.
@@ -135,10 +146,10 @@ interface CreateOwnerStandardOptions {
     readonly transferKey: Uint8Array;
 }
 /**
- * Managed-mode owner (#208 follow-up): the passphrase is minted + sealed under
+ * Managed-mode owner: the passphrase is minted + sealed under
  * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
- * (Shamir) recovery profile at creation (#195), which needs the
+ * (Shamir) recovery profile at creation, which needs the
  * `shamirRecovery` provider injected.
  */
 interface CreateOwnerManagedOptions {
@@ -151,12 +162,12 @@ interface CreateOwnerManagedOptions {
 }
 type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions;
 /**
- * Mint the first owner keyring on an adopted-but-unowned partition (#208),
- * then destroy the transfer seal (#209).
+ * Mint the first owner keyring on an adopted-but-unowned partition,
+ * then destroy the transfer seal.
  *
  * Standard mode: the recipient supplies a passphrase. Managed mode: the
  * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
- * (Shamir) recovery profile is enrolled (#195) — orchestrated via the existing
+ * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *
  * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base