@noy-db/hub 0.2.0-pre.8 → 0.3.0-pre.1

package/dist/team/index.d.ts

@@ -1,10 +1,8 @@
-import { b1 as NoydbStore, a$ as UnlockedKeyring } from '../types-DGU60JDt.js';
-export { br as BundleRecipient, ce as EnrollAuthenticatorOptions, cf as EnrollAuthenticatorWrappingDEKsOptions, cg as EnrollAuthenticatorWrappingKEKOptions, cL as ListUsersOptions, d7 as PaperRecoveryEntry, df as PresenceHandle, dB as RecoverPassphraseInput, dC as RecoverPassphraseResult, dD as RecoverUserOptions, dE as RecoveryProof, dH as RotatePassphraseInput, dT as SlotRewrapCeremony, dU as SlotRewrapContext, d$ as SyncEngine, e7 as SyncTransaction, ek as UpdateAuthenticatorOptions, ez as WrappedDeksBlob, eF as buildRecipientKeyringFile, eG as burnPaperRecoveryEntry, fp as changeSecret, fq as createOwnerKeyring, eJ as deriveMagicLinkContentKey, eK as enrollAuthenticator, fr as ensureCollectionDEK, eM as evaluateExportCapability, eN as evaluateImportCapability, eO as findAuthenticator, fs as grant, eP as hasExportCapability, eQ as hasImportCapability, eS as isMagicLinkGrantExpired, eX as listMagicLinkGrants, eY as listUsers, eZ as listUsersWithEnvelopes, ft as loadKeyring, e$ as loadPaperRecoveryEntries, f2 as magicLinkGrantRecordId, f3 as mintPaperRecoveryEntry, f5 as mintWrappedDeksBlob, fu as persistKeyring, f7 as readMagicLinkGrantRecord, eV as recoverPassphrase, f8 as recoverUser, f9 as removeAuthenticator, fv as revoke, fc as revokeMagicLinkGrant, eW as rotatePassphrase, fd as savePaperRecoveryEntries, fg as unwrapDeksFromBlob, fh as unwrapDeksFromPaperEntry, fj as unwrapMagicLinkGrant, fw as updateAuthenticator, fx as updateKeyringIdentity, fo as writeMagicLinkGrant } from '../types-DGU60JDt.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { cT as NoydbStore, cF as UnlockedKeyring } from '../index-BzUo1B6n.js';
+export { dM as BundleRecipient, fg as EnrollAuthenticatorOptions, fh as EnrollAuthenticatorWrappingDEKsOptions, fi as EnrollAuthenticatorWrappingKEKOptions, gf as ListUsersOptions, h2 as PaperRecoveryEntry, he as PresenceHandle, hI as RecoverPassphraseInput, hJ as RecoverPassphraseResult, hK as RecoverUserOptions, hN as RecoveryProof, hZ as RotatePassphraseInput, iw as SlotRewrapCeremony, ix as SlotRewrapContext, iG as SyncEngine, iO as SyncTransaction, j6 as UpdateAuthenticatorOptions, jn as WrappedDeksBlob, jy as buildRecipientKeyringFile, jz as burnPaperRecoveryEntry, kO as changeSecret, kP as createOwnerKeyring, jF as deriveMagicLinkContentKey, jJ as enrollAuthenticator, kQ as ensureCollectionDEK, jN as evaluateExportCapability, jP as evaluateImportCapability, jS as findAuthenticator, kR as grant, jT as hasExportCapability, jU as hasImportCapability, jX as isMagicLinkGrantExpired, k4 as listMagicLinkGrants, k5 as listUsers, k6 as listUsersWithEnvelopes, kS as loadKeyring, k9 as loadPaperRecoveryEntries, kc as magicLinkGrantRecordId, kd as mintPaperRecoveryEntry, kf as mintWrappedDeksBlob, kT as persistKeyring, kk as readMagicLinkGrantRecord, k1 as recoverPassphrase, km as recoverUser, kq as removeAuthenticator, kU as revoke, kw as revokeMagicLinkGrant, k2 as rotatePassphrase, ky as savePaperRecoveryEntries, kC as unwrapDeksFromBlob, kD as unwrapDeksFromPaperEntry, kF as unwrapMagicLinkGrant, kV as updateAuthenticator, kW as updateKeyringIdentity, kN as writeMagicLinkGrant } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/team/index.js

@@ -5,37 +5,40 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "../chunk-ZYWZWG6G.js";
+} from "../chunk-DGDI2D4M.js";
 import {
-  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
   isMagicLinkGrantExpired,
   listMagicLinkGrants,
-  loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
-  mintPaperRecoveryEntry,
-  mintWrappedDeksBlob,
   readMagicLinkGrantRecord,
   recoverPassphrase,
   recoverUser,
   removeAuthenticator,
   revokeMagicLinkGrant,
   rotatePassphrase,
-  savePaperRecoveryEntries,
-  unwrapDeksFromBlob,
-  unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-3YPCK6JX.js";
-import "../chunk-U26HQ6KJ.js";
+} from "../chunk-UPJNJGGA.js";
+import {
+  burnPaperRecoveryEntry,
+  loadPaperRecoveryEntries,
+  mintPaperRecoveryEntry,
+  mintWrappedDeksBlob,
+  savePaperRecoveryEntries,
+  unwrapDeksFromBlob,
+  unwrapDeksFromPaperEntry
+} from "../chunk-IGUYVGGI.js";
+import "../chunk-IO6GRPT6.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-WPLVTJ5D.js";
+} from "../chunk-IUEN57TV.js";
+import "../chunk-VQNJ7UZL.js";
 import {
   buildRecipientKeyringFile,
   changeSecret,
@@ -52,11 +55,12 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-DONMZAD2.js";
-import "../chunk-2QR2PQTT.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-WWGT2MDV.js";
+import "../chunk-ITNUCOXM.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 export {
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,

package/dist/tiers/index.d.ts

@@ -0,0 +1,5 @@
+export { l0 as NO_TIERS, l1 as TiersContext, iZ as TiersNotEnabledError, l2 as TiersStrategy, l3 as assertDeclaredTier, l4 as assertTiersEnabled, l5 as classifySealedShred, l6 as demote, l7 as elevate, l8 as getAtTier, l9 as listAtTier, la as putAtTier, lb as withTiers } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -0,0 +1,33 @@
+import {
+  NO_TIERS,
+  assertDeclaredTier,
+  assertTiersEnabled,
+  classifySealedShred,
+  demote,
+  elevate,
+  getAtTier,
+  listAtTier,
+  putAtTier,
+  withTiers
+} from "../chunk-IPB7FTQX.js";
+import "../chunk-IO6GRPT6.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import {
+  TiersNotEnabledError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  NO_TIERS,
+  TiersNotEnabledError,
+  assertDeclaredTier,
+  assertTiersEnabled,
+  classifySealedShred,
+  demote,
+  elevate,
+  getAtTier,
+  listAtTier,
+  putAtTier,
+  withTiers
+};
+//# sourceMappingURL=index.js.map

package/dist/tiers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/to/index.d.ts

@@ -0,0 +1,5 @@
+export { dq as BundleVersionConflictError, eJ as ConflictError, cV as EncryptedEnvelope, ge as ListPageResult, gM as NetworkError, gS as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, j1 as TxOp, jg as VaultSnapshot } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/to/index.js

@@ -0,0 +1,17 @@
+import "../chunk-K2WCO3NX.js";
+import {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  PodVersionConflictError,
+  StoreCapabilityError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  PodVersionConflictError,
+  StoreCapabilityError
+};
+//# sourceMappingURL=index.js.map

package/dist/to/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/transition-guard-C7ol6oPw.d.ts

@@ -0,0 +1,165 @@
+import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-BzUo1B6n.js';
+
+/**
+ * Register a guard for a collection. Guards run on every `put()` /
+ * `delete()` for the named collection (after permissions, before
+ * encryption) and may:
+ *
+ *   - `check` — block writes by throwing (typically `RecordLockedError`)
+ *   - `frozenFields` — freeze specific fields once a condition is true
+ *   - `amendment` — declare an authorized-override path with invariant
+ *
+ * Pass the returned handle to `createNoydb({ strategies: [...] })`.
+ *
+ * @see docs/superpowers/specs/2026-05-18-guards-design.md
+ */
+declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
+
+/**
+ * `immutableGuard` — declarative WORM / append-only sugar over the guard
+ * service.
+ *
+ * Issued fiscal documents (invoices, DDTs) must be immutable after issue.
+ * That is expressible today with a hand-rolled `withGuard` (block on
+ * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is
+ * repetitive and easy to get subtly wrong. `immutableGuard` generates
+ * exactly that guard from a declarative config, reusing the guard
+ * machinery wholesale — `check`/`onDelete` rejection, the ledgered
+ * `amendment` override, and composition with `periods`/`history`.
+ *
+ * ```ts
+ * createNoydb({ guardStrategies: [
+ *   immutableGuard({
+ *     collection: 'invoices',
+ *     after: (r) => r.status === 'issued',   // immutable once issued
+ *   }),
+ * ] })
+ * ```
+ *
+ * A record is mutable until `after(record)` holds; from then on, updates
+ * and deletes throw `RecordLockedError` unless performed inside an
+ * `amendment` transaction by an authorized role (the override is
+ * ledgered by the guard amendment mechanism). `appendOnly: true` is
+ * shorthand for `after: () => true` — immutable from creation.
+ */
+
+interface ImmutableGuardConfig<T extends Record<string, unknown>> {
+    /** The collection to make WORM. */
+    collection: string;
+    /**
+     * A record becomes immutable once this predicate holds. Evaluated on
+     * the *existing* (already-persisted) record, so the write that first
+     * makes it true is still allowed; subsequent writes are blocked.
+     * Mutually exclusive with `appendOnly`.
+     */
+    after?: (record: T) => boolean;
+    /** Shorthand for `after: () => true` — immutable from creation. */
+    appendOnly?: boolean;
+    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
+    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
+    /**
+     * Optional set-level invariant run over the amendment change-set after
+     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * exactly: it receives every {before, after} pair touching this
+     * collection in the amendment plus the guard context; throwing reverts
+     * the whole amendment and surfaces as `InvariantError`.
+     *
+     * Use this to keep a constraint inviolable EVEN under amendment — e.g.
+     * forbid deleting an issued document by re-throwing on any
+     * `before !== null && after === null` change, or assert a cross-record
+     * sum is preserved. When omitted the amendment is unconditionally
+     * allowed (the amendment itself is the sanctioned, ledgered override) —
+     * this is the backward-compatible default.
+     */
+    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
+}
+/**
+ * Build an immutability guard. Pass the returned handle to
+ * `createNoydb({ guardStrategies: [...] })`.
+ */
+declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
+
+/**
+ * `transitionGuard` — declarative state-machine sugar over the guard
+ * service.
+ *
+ * Any record with a lifecycle field (invoice `status`, order state,
+ * ticket workflow, subscription phase) needs transition validation: a
+ * write may only move the field along a declared arc. That is expressible
+ * with a hand-rolled `withGuard({ check })`, but every consumer
+ * re-implements the same graph lookup + error. `transitionGuard`
+ * generates exactly that guard from a state graph, reusing the guard
+ * machinery wholesale — `check` rejection, the ledgered `amendment`
+ * override, and composition with `periods`/`history`.
+ *
+ * It generalizes {@link immutableGuard}: WORM is the special case "every
+ * state has no outgoing arcs", i.e. `transitions` mapping each state to `[]`.
+ *
+ * ```ts
+ * createNoydb({ guardStrategies: [
+ *   transitionGuard<Sale>({
+ *     collection: 'sales', field: 'status',
+ *     transitions: {                          // absence of an arc = forbidden
+ *       draft: ['to_verify', 'cancelled'],
+ *       to_verify: ['proforma', 'draft', 'cancelled'],
+ *       proforma: ['invoiced', 'cancelled'],
+ *       invoiced: ['paid'], paid: [], cancelled: [],
+ *     },
+ *     initial: ['draft', 'to_verify'],        // allowed status on insert
+ *   }),
+ * ] })
+ * ```
+ *
+ * Semantics:
+ * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in
+ *   `initial`. When `initial` is omitted, any value is allowed on insert.
+ * - **Update**: the arc `(existing[field] → incoming[field])` must be
+ *   listed in `transitions[from]`, else `IllegalTransitionError`. A
+ *   same-value write (`from === to`) is allowed when `allowIdempotent`
+ *   (default `true`) — so writes that touch other fields without moving
+ *   state pass.
+ * - **Override**: inside an `amendment` transaction by an authorized role
+ *   the check is skipped and the change is ledgered (mirrors every guard).
+ *
+ * The status graph is caller-supplied data — no UI, no domain logic.
+ */
+
+interface TransitionGuardConfig<T extends Record<string, unknown>> {
+    /** The collection whose state field is governed. */
+    collection: string;
+    /** The state field on the record (e.g. `'status'`). */
+    field: keyof T & string;
+    /**
+     * The transition graph: each state maps to the states it may move to.
+     * A state absent from the map (or mapped to `[]`) is terminal — no
+     * outgoing arc, so any non-idempotent write from it is rejected.
+     */
+    transitions: Readonly<Record<string, readonly string[]>>;
+    /**
+     * States allowed as the initial value on insert (`existing === null`).
+     * Omit to allow any value on insert.
+     */
+    initial?: readonly string[];
+    /**
+     * Allow a same-value write (`from === to`) on update. Default `true` —
+     * lets a put that changes other fields, but not the state, through.
+     */
+    allowIdempotent?: boolean;
+    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
+    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
+    /**
+     * Optional set-level invariant run over the amendment change-set after
+     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * exactly. When omitted the amendment is unconditionally allowed (the
+     * amendment itself is the sanctioned, ledgered override) — the
+     * backward-compatible default. Mirrors {@link immutableGuard}.
+     */
+    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
+}
+/**
+ * Build a state-machine transition guard. Pass the returned handle to
+ * `createNoydb({ guardStrategies: [...] })`.
+ */
+declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
+
+export { type ImmutableGuardConfig as I, type TransitionGuardConfig as T, immutableGuard as i, transitionGuard as t, withGuard as w };

package/dist/tx/index.d.ts

@@ -1,21 +1,35 @@
-import { aF as TxStrategy } from '../types-DGU60JDt.js';
-export { aG as AmendmentTxOptions, aH as TxCollection, aI as TxContext, aJ as TxVault, aK as runTransaction } from '../types-DGU60JDt.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { i_ as TransactionInvariant, kX as TxStrategy } from '../index-BzUo1B6n.js';
+export { kY as AmendmentTxOptions, j0 as TxCollection, dP as TxContext, j2 as TxVault, kx as runTransaction } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**
  * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.
  */
 
+/**
+ * Options for {@link withTransactions}. Currently only commit-time
+ * changeset `invariants` (see {@link TransactionInvariant}).
+ */
+interface TransactionStrategyOptions {
+    /**
+     * Commit-time set-level invariants run over the changeset on every
+     * commit (ordinary AND amendment). See {@link TransactionInvariant}.
+     */
+    invariants?: ReadonlyArray<TransactionInvariant>;
+}
 /**
  * Build the default transactions strategy. Pass into
  * `createNoydb({ txStrategy: withTransactions() })` to enable
  * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).
+ *
+ * Supply `{ invariants }` to register commit-time changeset invariants —
+ * set-level constraints that fire after the writes commit and revert the
+ * transaction on a throw. Unlike `amendment.invariant`, these run for
+ * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.
  */
-declare function withTransactions(): TxStrategy;
+declare function withTransactions(opts?: TransactionStrategyOptions): TxStrategy;
 
-export { TxStrategy, withTransactions };
+export { TransactionInvariant, type TransactionStrategyOptions, TxStrategy, withTransactions };

package/dist/tx/index.js

@@ -3,11 +3,12 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-TFBP23BX.js";
-import "../chunk-FZU343FL.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-SKF73JOP.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/tx/dry-run.ts
+// src/with-commit/tx/dry-run.ts
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {
@@ -43,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-5PNY7LGW.js");
+      const { GuardExecutor } = await import("../executor-QZ7BXICW.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }
@@ -59,9 +60,13 @@ async function runDryRun(db, fn) {
   return { affected, guardViolations };
 }
 
-// src/tx/active.ts
-function withTransactions() {
-  return { runTransaction, runDryRun };
+// src/with-commit/tx/active.ts
+function withTransactions(opts) {
+  const invariants = opts?.invariants ?? [];
+  return {
+    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),
+    runDryRun
+  };
 }
 export {
   TxCollection,

package/dist/tx/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tx/dry-run.ts","../../src/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection.putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\nimport type { GuardExecutor as GuardExecutorType } from '../guards/executor.js'\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection.putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = (await import('../guards/executor.js')) as { GuardExecutor: typeof GuardExecutorType }\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n */\nexport function withTransactions(): TxStrategy {\n  return { runTransaction, runDryRun }\n}\n"],"mappings":";;;;;;;;;;AAiCA,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAK,MAAM,OAAO,yBAAuB;AAC/D,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;ACpFO,SAAS,mBAA+B;AAC7C,SAAO,EAAE,gBAAgB,UAAU;AACrC;","names":[]}
+{"version":3,"sources":["../../src/with-commit/tx/dry-run.ts","../../src/with-commit/tx/active.ts"],"sourcesContent":["/**\n * Dry-run transactions. Runs the tx body to STAGE ops, then builds\n * the directly-affected diff (before = current committed via collection.get,\n * after = staged record) and collects guard violations — without executing\n * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation\n * cascade is NOT simulated (v2). Mirrors the guard loop in\n * `Collection._putInternal` — keep the two in sync.\n */\nimport type { Noydb } from '../../kernel/noydb.js'\nimport { TxContext, type StagedOp } from './transaction.js'\nimport type { GuardExecutor as GuardExecutorType } from '../../with-audit/guards/executor.js'\n\nexport interface AffectedDocument {\n  readonly vault: string\n  readonly op: 'create' | 'update' | 'delete'\n  readonly collection: string\n  readonly docId: string\n  readonly before: unknown // current committed record; null when creating\n  readonly after: unknown // staged record; null when deleting\n}\n\nexport interface GuardViolation {\n  readonly vault: string\n  readonly collection: string\n  readonly docId: string\n  readonly message: string\n}\n\nexport interface DryRunResult {\n  readonly affected: ReadonlyArray<AffectedDocument>\n  readonly guardViolations: ReadonlyArray<GuardViolation>\n}\n\nconst SEP = ' '\nconst keyOf = (op: StagedOp) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`\n\nexport async function runDryRun(\n  db: Noydb,\n  fn: (tx: TxContext) => unknown,\n): Promise<DryRunResult> {\n  const ctx = new TxContext(db)\n  await fn(ctx) // stage ops (reads see staged writes via TxCollection); nothing committed\n\n  // Dedup by (vault, collection, id) — last staged op wins.\n  const lastOp = new Map<string, StagedOp>()\n  for (const op of ctx._ops) lastOp.set(keyOf(op), op)\n\n  const affected: AffectedDocument[] = []\n  const guardViolations: GuardViolation[] = []\n\n  for (const op of lastOp.values()) {\n    const v = db.vault(op.vaultName)\n    const coll = v.collection(op.collectionName)\n    const before = await coll.get(op.id)\n\n    if (op.type === 'delete') {\n      affected.push({ vault: op.vaultName, op: 'delete', collection: op.collectionName, docId: op.id, before, after: null })\n      continue\n    }\n\n    const after = op.record ?? null\n    affected.push({\n      vault: op.vaultName,\n      op: before === null ? 'create' : 'update',\n      collection: op.collectionName,\n      docId: op.id,\n      before,\n      after,\n    })\n\n    // Guard violations — run the SAME checks Collection._putInternal does,\n    // with the SAME ctx (existing + read-only facade + userId + role), but\n    // collect the first thrown error instead of aborting.\n    const registry = v._getGuardRegistry()\n    if (!registry) continue\n    const guards = registry.guardsFor(op.collectionName)\n    if (guards.length === 0) continue\n    const facade = v._getReadOnlyFacade()\n    if (!facade) continue\n    const gctx = { existing: before as Record<string, unknown> | null, vault: facade, userId: v.userId, role: v.role }\n    try {\n      await registry.runChecks(op.collectionName, after as Record<string, unknown>, gctx)\n      const { GuardExecutor } = (await import('../../with-audit/guards/executor.js')) as { GuardExecutor: typeof GuardExecutorType }\n      for (const g of guards) {\n        await GuardExecutor.checkFrozenFields(g, op.id, before as Record<string, unknown> | null, after as Record<string, unknown>)\n      }\n    } catch (err) {\n      guardViolations.push({\n        vault: op.vaultName,\n        collection: op.collectionName,\n        docId: op.id,\n        message: err instanceof Error ? err.message : String(err),\n      })\n    }\n  }\n\n  return { affected, guardViolations }\n}\n","/**\n * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.\n */\n\nimport { runTransaction } from './transaction.js'\nimport { runDryRun } from './dry-run.js'\nimport type { TxStrategy } from './strategy.js'\nimport type { TransactionInvariant } from './invariants.js'\n\n/**\n * Options for {@link withTransactions}. Currently only commit-time\n * changeset `invariants` (see {@link TransactionInvariant}).\n */\nexport interface TransactionStrategyOptions {\n  /**\n   * Commit-time set-level invariants run over the changeset on every\n   * commit (ordinary AND amendment). See {@link TransactionInvariant}.\n   */\n  invariants?: ReadonlyArray<TransactionInvariant>\n}\n\n/**\n * Build the default transactions strategy. Pass into\n * `createNoydb({ txStrategy: withTransactions() })` to enable\n * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).\n *\n * Supply `{ invariants }` to register commit-time changeset invariants —\n * set-level constraints that fire after the writes commit and revert the\n * transaction on a throw. Unlike `amendment.invariant`, these run for\n * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.\n */\nexport function withTransactions(opts?: TransactionStrategyOptions): TxStrategy {\n  const invariants = opts?.invariants ?? []\n  return {\n    runTransaction: (db, fn, options) => runTransaction(db, fn, options, invariants),\n    runDryRun,\n  }\n}\n"],"mappings":";;;;;;;;;;;AAiCA,IAAM,MAAM;AACZ,IAAM,QAAQ,CAAC,OAAiB,GAAG,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,EAAE;AAEvF,eAAsB,UACpB,IACA,IACuB;AACvB,QAAM,MAAM,IAAI,UAAU,EAAE;AAC5B,QAAM,GAAG,GAAG;AAGZ,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,MAAM,IAAI,KAAM,QAAO,IAAI,MAAM,EAAE,GAAG,EAAE;AAEnD,QAAM,WAA+B,CAAC;AACtC,QAAM,kBAAoC,CAAC;AAE3C,aAAW,MAAM,OAAO,OAAO,GAAG;AAChC,UAAM,IAAI,GAAG,MAAM,GAAG,SAAS;AAC/B,UAAM,OAAO,EAAE,WAAW,GAAG,cAAc;AAC3C,UAAM,SAAS,MAAM,KAAK,IAAI,GAAG,EAAE;AAEnC,QAAI,GAAG,SAAS,UAAU;AACxB,eAAS,KAAK,EAAE,OAAO,GAAG,WAAW,IAAI,UAAU,YAAY,GAAG,gBAAgB,OAAO,GAAG,IAAI,QAAQ,OAAO,KAAK,CAAC;AACrH;AAAA,IACF;AAEA,UAAM,QAAQ,GAAG,UAAU;AAC3B,aAAS,KAAK;AAAA,MACZ,OAAO,GAAG;AAAA,MACV,IAAI,WAAW,OAAO,WAAW;AAAA,MACjC,YAAY,GAAG;AAAA,MACf,OAAO,GAAG;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAKD,UAAM,WAAW,EAAE,kBAAkB;AACrC,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,SAAS,UAAU,GAAG,cAAc;AACnD,QAAI,OAAO,WAAW,EAAG;AACzB,UAAM,SAAS,EAAE,mBAAmB;AACpC,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,EAAE,UAAU,QAA0C,OAAO,QAAQ,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK;AACjH,QAAI;AACF,YAAM,SAAS,UAAU,GAAG,gBAAgB,OAAkC,IAAI;AAClF,YAAM,EAAE,cAAc,IAAK,MAAM,OAAO,yBAAqC;AAC7E,iBAAW,KAAK,QAAQ;AACtB,cAAM,cAAc,kBAAkB,GAAG,GAAG,IAAI,QAA0C,KAAgC;AAAA,MAC5H;AAAA,IACF,SAAS,KAAK;AACZ,sBAAgB,KAAK;AAAA,QACnB,OAAO,GAAG;AAAA,QACV,YAAY,GAAG;AAAA,QACf,OAAO,GAAG;AAAA,QACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,gBAAgB;AACrC;;;AClEO,SAAS,iBAAiB,MAA+C;AAC9E,QAAM,aAAa,MAAM,cAAc,CAAC;AACxC,SAAO;AAAA,IACL,gBAAgB,CAAC,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,SAAS,UAAU;AAAA,IAC/E;AAAA,EACF;AACF;","names":[]}

package/dist/ui/index.d.ts

@@ -0,0 +1 @@
+export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-aBkJR2sd.js';

package/dist/ui/index.js

@@ -0,0 +1 @@
+//# sourceMappingURL=index.js.map

package/dist/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/ulid-DRH25k3y.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Minimal ULID generator — zero dependencies, Web Crypto API only.
+ *
+ *. Used by the bundle writer to generate stable opaque
+ * handles for `.noydb` containers.
+ *
+ * **What's a ULID?** A 128-bit identifier encoded as 26 Crockford
+ * base32 characters. Layout:
+ *
+ * ```
+ *   01HYABCDEFGHJKMNPQRSTVWXYZ
+ *   |--------||---------------|
+ *    48-bit     80-bit
+ *    timestamp  randomness
+ * ```
+ *
+ * The first 10 chars encode a millisecond Unix timestamp (so ULIDs
+ * sort lexicographically by creation time), and the remaining 16
+ * chars are random. Crockford base32 omits I/L/O/U to avoid
+ * ambiguity in handwriting and URLs.
+ *
+ * **Why hand-roll instead of pulling in `ulid`?** The package adds
+ * a dep, the implementation is ~30 lines, and the bundle module
+ * is the only consumer. Adding `ulid` would also drag in its own
+ * crypto polyfill that we don't need on Node 18+ or modern
+ * browsers.
+ *
+ * **Privacy consideration:** the timestamp prefix is observable in
+ * the bundle header. This is a deliberate trade-off:
+ *   - Pro: lexicographic sortability lets bundle adapters list
+ *     newest-first without an extra index.
+ *   - Con: a casual observer can read the bundle's creation time
+ *     from the handle. They cannot read it from any OTHER field
+ *     (the header explicitly forbids `_exported_at`), and a
+ *     creation timestamp is the same kind of metadata that
+ *     filesystem mtime would already expose for a downloaded
+ *     bundle. The leak is therefore equivalent to what's already
+ *     visible from the file's mtime — not a new exposure.
+ *
+ * If a future use case needs timestamp-free handles, a v2 of the
+ * format could specify "use the random portion only" without a
+ * format break — `validateBundleHeader` only checks the regex
+ * shape, not the encoded timestamp.
+ */
+/**
+ * Generate a fresh ULID. Uses `crypto.getRandomValues` for the
+ * randomness portion — same Web Crypto API the rest of the
+ * codebase uses for IVs and salt.
+ *
+ * Returns a 26-character string. Calling twice in the same
+ * millisecond produces two distinct ULIDs (the random portion
+ * differs); ULIDs from the same millisecond are NOT guaranteed
+ * to be monotonically ordered relative to each other, only
+ * relative to ULIDs from a different millisecond. The bundle
+ * format never relies on intra-millisecond ordering.
+ */
+declare function generateULID(): string;
+/**
+ * Validate that a string is a syntactically well-formed ULID. Used
+ * by the bundle header validator. Does NOT verify that the
+ * timestamp portion decodes to a sensible date — the format only
+ * cares about the encoding shape.
+ */
+declare function isULID(value: string): boolean;
+
+export { generateULID as g, isULID as i };

package/dist/ulid-PTAIMDG4.js

@@ -0,0 +1,10 @@
+import {
+  generateULID,
+  isULID
+} from "./chunk-ZJADGNYF.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  generateULID,
+  isULID
+};
+//# sourceMappingURL=ulid-PTAIMDG4.js.map

package/dist/ulid-PTAIMDG4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/util/index.d.ts

@@ -1,3 +1,5 @@
+export { i as isDiscriminant } from '../discriminant-BN9REW3o.js';
+
 /**
  * Target-profile aware filename sanitizer.
  *

package/dist/util/index.js

@@ -1,8 +1,12 @@
+import {
+  isDiscriminant
+} from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/util/sanitize-filename.ts
+// src/kernel/util/sanitize-filename.ts
 var REPLACEMENT = "_";
 var BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g;
 var WINDOWS_RESERVED_CHARS = /[<>:"/\\|?*]/g;
@@ -185,6 +189,7 @@ function truncateToByteCap(s, max) {
   return out;
 }
 export {
+  isDiscriminant,
   sanitizeFilename
 };
 //# sourceMappingURL=index.js.map