@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.1

package/README.md

@@ -178,6 +178,132 @@ Core has zero `node:` imports — it runs unchanged in browsers, Node, Bun, Deno
 
 CSV, XML, xlsx, and the rest of the plaintext tier — plus encrypted `.noydb` bundles under the `as-noydb` encrypted tier — all live in the [`@noy-db/as-*`](https://www.npmjs.com/search?q=%40noy-db%2Fas-) family. Every invocation is gated by the two-tier authorization model (`canExportPlaintext` default off, `canExportBundle` default on for owner/admin) and lands in the audit ledger.
 
+## Money fields
+
+`money()` is a schema-layer field descriptor (a sibling of `i18nText()` / `dictKey()`) for currency-safe, exact decimal values. Money is stored as a scaled integer encoded as a **digit string**, so it is exact for any magnitude — past `Number.MAX_SAFE_INTEGER` included (a JSON number would silently truncate at 2^53).
+
+```ts
+vault.collection('invoices', {
+  schema: z.object({ id: z.string(), total: z.union([z.number(), z.string()]) }),
+  moneyFields: { total: money({ currency: 'EUR', scale: 2 }) }, // scale optional — ISO-4217 default
+})
+
+await invoices.put('a', { id: 'a', total: '123.45' })          // stored as '12345'
+const inv = await invoices.get('a', { locale: 'de-DE' })
+// inv.total           → '123.45'   (exact decimal string)
+// inv.totalFormatted  → '123,45 €' (Intl, full precision)
+// inv.totalNumber     → 123.45     (convenience JS number; lossy past 2^53)
+
+// Exact aggregation — sum/min/max run in BigInt, no float drift:
+invoices.query().aggregate({ total: sum('total') }).run() // → '0.60', never 0.6000000000000001
+```
+
+- **Rounding:** excess precision is **rejected** by default; opt in per field with `money({ ..., rounding: 'half-even' })` (`half-up` / `half-even` / `half-down` / `up` / `down` / `ceil` / `floor`).
+- **Multi-currency:** opt in with `money({ currencies: 'any' | ['EUR','USD'] })` — currency travels per record as `{ amount, currency }`; `sum` returns an exact per-currency map (`{ EUR: '15.50', USD: '3.00' }`), or one figure with `sum('total', { convertTo: 'EUR', fx })`.
+- Money `sum`/`min`/`max` implement incremental `remove()`, so they stay exact under live aggregation and materialized-view maintenance.
+
+## Computed fields
+
+`computed` declares schema-owned scalar fields derived on write — keeping the arithmetic next to the schema instead of scattered across handlers. Each function is pure and synchronous; they run **first** in the write pipeline (before schema validation), in declaration order, so a later field can read an earlier one. The result is **materialized** on the record — stored, queryable, and `aggregate(sum())`-able like any field.
+
+```ts
+vault.collection('lines', {
+  schema: z.object({
+    id: z.string(), unitPrice: z.number(), qty: z.number(),
+    netAmount: z.number().optional(), taxAmount: z.number().optional(), total: z.number().optional(),
+  }),
+  computed: {
+    netAmount: (r) => r.unitPrice * r.qty,
+    taxAmount: (r) => r.netAmount * 0.22,   // reads the field computed above
+    total:     (r) => r.netAmount + r.taxAmount,
+  },
+})
+
+await lines.put('a', { id: 'a', unitPrice: 10, qty: 3 })  // computed fields not supplied
+const line = await lines.get('a')   // → { …, netAmount: 30, taxAmount: 6.6, total: 36.6 }
+```
+
+- A computed field **overwrites** any user-supplied value of the same name (the field is schema-owned); a throwing function rejects the write with `ComputedFieldError`.
+- **Composes with `money()`** — declare a computed field as a money field too and it's quantized after evaluation, so `sum()` over it is exact.
+
+## Immutable collections (WORM)
+
+`immutableGuard` makes a collection write-once after a condition holds — issued invoices/DDTs that must never change. It's declarative sugar over `guards`: it generates the block-on-`check`/`onDelete` + ledgered admin-`amendment` strategy, so it reuses the whole guard machinery (and composes with `periods`/`history`).
+
+```ts
+import { createNoydb, immutableGuard } from '@noy-db/hub'
+
+await createNoydb({
+  store, user, secret,
+  guardStrategies: [
+    immutableGuard({ collection: 'invoices', after: (r) => r.status === 'issued' }),
+  ],
+})
+
+await invoices.put('a', { id: 'a', status: 'draft',  total: 100 }) // ok
+await invoices.put('a', { id: 'a', status: 'issued', total: 100 }) // ok — the transition write
+await invoices.put('a', { id: 'a', status: 'issued', total: 999 }) // ✗ RecordLockedError
+await invoices.delete('a')                                          // ✗ RecordLockedError
+
+// the sanctioned, ledgered override:
+await db.transaction({ amendment: true, reason: 'correct issued total' }, async (tx) => {
+  tx.vault('books').collection('invoices').put('a', { id: 'a', status: 'issued', total: 110 })
+})
+```
+
+- `after(record)` is evaluated on the **existing** record, so inserts and the write that *first* makes a record immutable are allowed; everything after is blocked.
+- `appendOnly: true` is shorthand for `after: () => true` — immutable from creation.
+- The admin/owner `amendment` path is the only way through, and every amendment is appended to the audit ledger.
+
+## Retention, legal-hold & archival
+
+For retention-bound data (e.g. 10-year fiscal records), two facilities share one rule — **a legal hold blocks eviction**.
+
+**Blob retention** (`vault.compact()`) gains a hold and a period-bound floor:
+
+```ts
+vault.collection('invoices', {
+  blobFields: {
+    pdf: {
+      retainDays: 3650,                              // base TTL
+      legalHold:  (r) => r.underLitigation === true, // never evict while held
+      retainUntil:(r) => r.fiscalYearEnd,            // floor: keep until period obligation ends
+    },
+  },
+})
+const { evicted, held } = await vault.compact() // held = retained-by-hold count
+```
+
+**Record archival** (`withArchive`) relocates sealed records to a cold store — envelope-level, no re-encryption — and restores on demand:
+
+```ts
+import { createNoydb, withArchive } from '@noy-db/hub'
+
+const db = await createNoydb({ store: primary, archiveStrategy: withArchive({ store: coldStore }) })
+vault.collection('invoices', {
+  archive: { archiveWhen: (r) => r.fiscalYear <= thisYear - 1, legalHold: (r) => r.underHold },
+})
+
+await vault.archive()                       // → { archived, held, scanned }
+await vault.listArchived('invoices')        // → [{ collection, id }, …]
+await vault.restore('invoices', 'inv-2020') // relocate back to primary (decryptable)
+```
+
+Archival uses low-level relocation, so it **bypasses guards** (issued/immutable records over a sealed period can still be archived) and doesn't recompute finalized aggregates. Archived records read `null` from the primary store until restored; a `legalHold` predicate blocks archival entirely.
+
+## Atomic sequences
+
+`vault.sequence(name)` gives gap-free, exactly-once numbering — the primitive fiscal/ERP/ticketing apps need for invoice or DDT numbers — backed by an optimistic compare-and-swap counter.
+
+```ts
+const n = await vault.sequence('invoice-2026').next()   // 1, then 2, 3, … no gaps, no duplicates
+const cur = await vault.sequence('invoice-2026').peek()  // read current value without allocating
+```
+
+- **Independent per name** — `sequence('invoice-2026')` and `sequence('ddt-2026')` are separate counters.
+- **Concurrency-safe** — concurrent `next()` calls retry on CAS contention (jittered backoff); a genuine burst beyond the retry budget surfaces `SequenceContentionError` so the caller can retry or queue.
+- **Online-only — by design.** Gap-free numbering needs single-authority serialization, which an offline writer can't provide. `next()` throws `SequenceOfflineError` unless the store advertises `capabilities.casAtomic`. This is the honest wall: assign each `next()` value to its record in the same operation (a discarded value is a gap in *usage*, not in the sequence).
+
 ## Status
 
 **Pre-release** (`0.1.0-pre.1`). API may change before `1.0`. Install from the `next` dist-tag:
@@ -188,9 +314,9 @@ pnpm add @noy-db/hub@next @noy-db/to-memory@next
 
 ## Documentation
 
-- Full docs: <https://github.com/vLannaAi/noy-db#readme>
-- Spec: <https://github.com/vLannaAi/noy-db/blob/main/SPEC.md>
-- Roadmap: <https://github.com/vLannaAi/noy-db/blob/main/ROADMAP.md>
+- Full docs: <https://github.com/vLannaAi/noy-db-docs>
+- Spec: <https://github.com/vLannaAi/noy-db-docs/blob/main/SPEC.md>
+- Roadmap: <https://github.com/vLannaAi/noy-db-docs/blob/main/ROADMAP.md>
 
 ## License
 

package/dist/adapter/index.d.ts

@@ -0,0 +1,5 @@
+export { dq as BundleVersionConflictError, eJ as ConflictError, cV as EncryptedEnvelope, ge as ListPageResult, gM as NetworkError, gS as NoydbBundleStore, cT as NoydbStore, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, j1 as TxOp, jg as VaultSnapshot } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/adapter/index.js

@@ -0,0 +1,15 @@
+import "../chunk-K2WCO3NX.js";
+import {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  StoreCapabilityError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  BundleVersionConflictError,
+  ConflictError,
+  NetworkError,
+  StoreCapabilityError
+};
+//# sourceMappingURL=index.js.map

package/dist/aggregate/index.d.ts

@@ -1,5 +1,9 @@
-import { A as AggregateStrategy } from '../strategy-DSTrsZ8t.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, m as buildLiveAggregation, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, s as resetGroupByWarnings, t as sum } from '../strategy-DSTrsZ8t.js';
+import { aO as AggregateStrategy } from '../index-BzUo1B6n.js';
+export { aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, a_ as LiveAggregation, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, b2 as avg, b3 as buildLiveAggregation, b4 as count, b5 as groupAndReduce, b6 as max, b7 as min, b8 as moneyMax, b9 as moneyMin, ba as moneySum, bb as reduceRecords, bc as reducerBuilder, bd as resetGroupByWarnings, be as sum } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';
 
 /**
  * Active aggregate strategy factory. Calling `withAggregate()` returns

package/dist/aggregate/index.js

@@ -1,10 +1,3 @@
-import {
-  avg,
-  count,
-  max,
-  min,
-  sum
-} from "../chunk-W6EQLGMB.js";
 import {
   Aggregation,
   GROUPBY_MAX_CARDINALITY,
@@ -12,25 +5,36 @@ import {
   GroupedAggregation,
   GroupedQuery,
   GroupedQueryN,
+  avg,
   buildLiveAggregation,
+  count,
   groupAndReduce,
+  max,
+  min,
+  moneyMax,
+  moneyMin,
+  moneySum,
   reduceRecords,
-  resetGroupByWarnings
-} from "../chunk-5XHKQ56N.js";
-import "../chunk-TV3YZ35S.js";
-import "../chunk-B6PB7JLN.js";
+  reducerBuilder,
+  resetGroupByWarnings,
+  sum
+} from "../chunk-LV7M27WM.js";
+import "../chunk-M2YKN37S.js";
+import "../chunk-5LUY7UTV.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/aggregate/active.ts
+// src/with-lookup/aggregate/active.ts
 function withAggregate() {
   return {
     aggregate(executeRecords, spec, upstreams) {
       return new Aggregation(executeRecords, spec, upstreams);
     },
-    groupBy(executeRecords, field, upstreams, dictLabelResolver) {
-      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver);
+    groupBy(executeRecords, field, upstreams, dictLabelResolver, moneyFields) {
+      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, moneyFields);
     },
-    groupByN(executeRecords, fields, upstreams) {
-      return new GroupedQueryN(executeRecords, fields, upstreams);
+    groupByN(executeRecords, fields, upstreams, moneyFields) {
+      return new GroupedQueryN(executeRecords, fields, upstreams, void 0, moneyFields);
     },
     async scanAggregate(iter, spec) {
       const collected = [];
@@ -52,7 +56,11 @@ export {
   groupAndReduce,
   max,
   min,
+  moneyMax,
+  moneyMin,
+  moneySum,
   reduceRecords,
+  reducerBuilder,
   resetGroupByWarnings,
   sum,
   withAggregate

package/dist/aggregate/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/aggregate/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withAggregate()` returns\n * an `AggregateStrategy` whose methods construct real `Aggregation` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/aggregate`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Aggregation, reduceRecords } from './aggregation.js'\nimport type { AggregateSpec, AggregateResult } from './aggregation.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { AggregateStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ aggregateStrategy: withAggregate() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withAggregate, sum, count } from '@noy-db/hub/aggregate'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   aggregateStrategy: withAggregate(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withAggregate(): AggregateStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Aggregation(executeRecords, spec as unknown as AggregateSpec, upstreams) as unknown as Aggregation<AggregateResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver)\n    },\n    groupByN(executeRecords, fields, upstreams) {\n      return new GroupedQueryN(executeRecords, fields, upstreams)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as AggregateSpec) as unknown as AggregateResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,gBAAmC;AACjD,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,YAAY,gBAAgB,MAAkC,SAAS;AAAA,IACpF;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB;AAC3D,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,iBAAiB;AAAA,IAC7E;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,aAAO,IAAI,cAAc,gBAAgB,QAAQ,SAAS;AAAA,IAC5D;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAAgC;AAAA,IAClE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-lookup/aggregate/active.ts"],"sourcesContent":["/**\n * Active aggregate strategy factory. Calling `withAggregate()` returns\n * an `AggregateStrategy` whose methods construct real `Aggregation` /\n * `GroupedQuery` instances and run the streaming reducer protocol.\n *\n * This module is only reachable through the `@noy-db/hub/aggregate`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { Aggregation, reduceRecords } from './aggregation.js'\nimport type { AggregateSpec, AggregateResult } from './aggregation.js'\nimport { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { AggregateStrategy } from './strategy.js'\n\n/**\n * Build the default aggregate strategy. Pass into\n * `createNoydb({ aggregateStrategy: withAggregate() })` to light up\n * `.aggregate()` and `.groupBy()` on `Query` and `ScanBuilder`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withAggregate, sum, count } from '@noy-db/hub/aggregate'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   aggregateStrategy: withAggregate(),\n * })\n *\n * const totals = invoices.query()\n *   .where('status', '==', 'paid')\n *   .groupBy('clientId')\n *   .aggregate({ amount: sum('amount'), n: count() })\n *   .run()\n * ```\n */\nexport function withAggregate(): AggregateStrategy {\n  return {\n    aggregate(executeRecords, spec, upstreams) {\n      return new Aggregation(executeRecords, spec as unknown as AggregateSpec, upstreams) as unknown as Aggregation<AggregateResult<typeof spec>>\n    },\n    groupBy(executeRecords, field, upstreams, dictLabelResolver, moneyFields) {\n      return new GroupedQuery(executeRecords, field, upstreams, dictLabelResolver, moneyFields)\n    },\n    groupByN(executeRecords, fields, upstreams, moneyFields) {\n      return new GroupedQueryN(executeRecords, fields, upstreams, undefined, moneyFields)\n    },\n    async scanAggregate(iter, spec) {\n      const collected: unknown[] = []\n      for await (const record of iter) collected.push(record)\n      return reduceRecords(collected, spec as unknown as AggregateSpec) as unknown as AggregateResult<typeof spec>\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCO,SAAS,gBAAmC;AACjD,SAAO;AAAA,IACL,UAAU,gBAAgB,MAAM,WAAW;AACzC,aAAO,IAAI,YAAY,gBAAgB,MAAkC,SAAS;AAAA,IACpF;AAAA,IACA,QAAQ,gBAAgB,OAAO,WAAW,mBAAmB,aAAa;AACxE,aAAO,IAAI,aAAa,gBAAgB,OAAO,WAAW,mBAAmB,WAAW;AAAA,IAC1F;AAAA,IACA,SAAS,gBAAgB,QAAQ,WAAW,aAAa;AACvD,aAAO,IAAI,cAAc,gBAAgB,QAAQ,WAAW,QAAW,WAAW;AAAA,IACpF;AAAA,IACA,MAAM,cAAc,MAAM,MAAM;AAC9B,YAAM,YAAuB,CAAC;AAC9B,uBAAiB,UAAU,KAAM,WAAU,KAAK,MAAM;AACtD,aAAO,cAAc,WAAW,IAAgC;AAAA,IAClE;AAAA,EACF;AACF;","names":[]}

package/dist/api-RW3KP7WU.js

@@ -0,0 +1,14 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-UDRIWL7A.js";
+import "./chunk-ITNUCOXM.js";
+import "./chunk-5O3AOPDT.js";
+import "./chunk-5TDJ56JE.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-RW3KP7WU.js.map

package/dist/as/index.d.ts

@@ -0,0 +1,7 @@
+export { V as VaultDiff, d as diffVault } from '../vault-diff-B5fYNBL7.js';
+export { N as NoydbPodHeader, W as WritePodOptions, r as readPod, a as readPodHeader, w as writePod } from '../bundle-CH-H06dp.js';
+export { V as Vault } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/as/index.js

@@ -0,0 +1,24 @@
+import "../chunk-CHFZDSE4.js";
+import {
+  diffVault
+} from "../chunk-LB7FD65R.js";
+import "../chunk-AZAOEIKW.js";
+import {
+  readPod,
+  readPodHeader,
+  writePod
+} from "../chunk-FISN7WE4.js";
+import "../chunk-SMXWYP24.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-SVLR4POP.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  diffVault,
+  readPod,
+  readPodHeader,
+  writePod
+};
+//# sourceMappingURL=index.js.map

package/dist/at/index.d.ts

@@ -0,0 +1,5 @@
+export { dg as SealingKeyProvider } from '../index-BzUo1B6n.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/at/index.js

@@ -0,0 +1 @@
+//# sourceMappingURL=index.js.map

package/dist/attestation/index.d.ts

@@ -1,52 +1,20 @@
-import { b3 as NoydbStore } from '../types-Df28QFKb.js';
-import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
+import { dy as AttestationStrategy } from '../index-BzUo1B6n.js';
+export { dz as AttestationError, dA as AttestationNotEnabledError, dB as IssueArgs, dC as IssueContext, dD as IssueResult, dE as NO_ATTESTATION, dF as RevokeContext, dG as getRevokedDocIdsCore, dH as issueAttestationCore, dI as publishRevocationListCore, dJ as revokeDocCore, dK as unrevokeDocCore } from '../index-BzUo1B6n.js';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
-export { o as AttestationError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-aBkJR2sd.js';
+import '../index-B9QdHytu.js';
 
-/** Everything issueAttestationCore needs from the Vault, injected for testability. */
-interface IssueContext {
-    readonly store: NoydbStore;
-    readonly vault: string;
-    readonly role: string;
-    /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */
-    getDEK(): Promise<CryptoKey>;
-    /** Decrypted source record + its envelope version, or null if absent. */
-    readRecord(collection: string, id: string): Promise<{
-        record: Record<string, unknown>;
-        version: number;
-    } | null>;
-}
-interface IssueArgs {
-    readonly collection: string;
-    readonly id: string;
-    readonly fieldSchema: AttestationFieldSchema;
-}
-interface IssueResult {
-    readonly docId: string;
-    readonly qr: string;
-    readonly payload: QrPayload;
-    readonly keyId: string;
-    readonly publicKeyB64: string;
-}
-declare function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>;
+/**
+ * Enable the attestation capability.
+ * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the
+ * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`
+ * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods
+ * live. The issue/revoke/signer engines are dynamically imported here, so they
+ * stay out of the floor bundle until opted in.
+ */
+declare function withAttestation(): AttestationStrategy;
 
 declare const ATTESTATIONS_COLLECTION = "_attestations";
 
-/** Everything the revoke core needs from the Vault, injected for testability. */
-interface RevokeContext {
-    readonly store: NoydbStore;
-    readonly vault: string;
-    readonly role: string;
-    /** The _attestations collection DEK. */
-    getDEK(): Promise<CryptoKey>;
-}
-declare function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
-declare function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
-declare function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]>;
-declare function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList>;
-
-export { ATTESTATIONS_COLLECTION, type IssueArgs, type IssueContext, type IssueResult, type RevokeContext, getRevokedDocIdsCore, issueAttestationCore, publishRevocationListCore, revokeDocCore, unrevokeDocCore };
+export { ATTESTATIONS_COLLECTION, AttestationStrategy, withAttestation };

package/dist/attestation/index.js

@@ -1,27 +1,70 @@
 import {
   issueAttestationCore
-} from "../chunk-53XBRIRT.js";
+} from "../chunk-AXRXJTE2.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-PX35GA7L.js";
+} from "../chunk-I2NOIW44.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-DL3HWOQ5.js";
-import "../chunk-FZU343FL.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
+} from "../chunk-JNUWZ6D3.js";
 import {
-  AttestationError
-} from "../chunk-B6PB7JLN.js";
+  NO_ATTESTATION
+} from "../chunk-WYSO2NIH.js";
+import "../chunk-ZJADGNYF.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import {
+  AttestationError,
+  AttestationNotEnabledError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-audit/attestation/active.ts
+function withAttestation() {
+  return {
+    async issueAttestation(ctx, args) {
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-Y6UVIR43.js");
+      return issueAttestationCore2(ctx, args);
+    },
+    async getDocumentSigningPublicKey(deps) {
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-PNKTBVF7.js");
+      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
+      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
+      if (deps.role !== "owner") {
+        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`);
+      }
+      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK);
+      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
+    },
+    async revokeAttestation(ctx, docId) {
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-TUFRGI6S.js");
+      return revokeDocCore2(ctx, docId);
+    },
+    async unrevokeAttestation(ctx, docId) {
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-TUFRGI6S.js");
+      return unrevokeDocCore2(ctx, docId);
+    },
+    async getRevokedDocIds(ctx) {
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-TUFRGI6S.js");
+      return getRevokedDocIdsCore2(ctx);
+    },
+    async publishRevocationList(ctx) {
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-TUFRGI6S.js");
+      return publishRevocationListCore2(ctx);
+    }
+  };
+}
 
-// src/attestation/index.ts
+// src/with-audit/attestation/index.ts
 import { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from "@noy-db/attestation";
 export {
   ATTESTATIONS_COLLECTION,
   AttestationError,
+  AttestationNotEnabledError,
+  NO_ATTESTATION,
   decodeQr,
   getRevokedDocIdsCore,
   isRevoked,
@@ -31,6 +74,7 @@ export {
   signRevocationList,
   unrevokeDocCore,
   verifyAttestation,
-  verifyRevocationList
+  verifyRevocationList,
+  withAttestation
 };
 //# sourceMappingURL=index.js.map

package/dist/attestation/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/attestation/index.ts"],"sourcesContent":["/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAaA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":[]}
+{"version":3,"sources":["../../src/with-audit/attestation/active.ts","../../src/with-audit/attestation/index.ts"],"sourcesContent":["import { AttestationError } from '../../kernel/errors.js'\nimport type { AttestationStrategy } from './strategy.js'\n\n/**\n * Enable the attestation capability.\n * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the\n * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`\n * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods\n * live. The issue/revoke/signer engines are dynamically imported here, so they\n * stay out of the floor bundle until opted in.\n */\nexport function withAttestation(): AttestationStrategy {\n  return {\n    async issueAttestation(ctx, args) {\n      const { issueAttestationCore } = await import('./issue.js')\n      return issueAttestationCore(ctx, args)\n    },\n    async getDocumentSigningPublicKey(deps) {\n      const { loadSigner, loadOrCreateSigner } = await import('./signer.js')\n      // Reading an existing public key is open to any role that holds the\n      // _attestations DEK — the public key is not secret. But MINTING the\n      // signer is the firm's identity operation (same rule as issueAttestation):\n      // a non-owner read must not silently create it.\n      const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK)\n      if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 }\n      if (deps.role !== 'owner') {\n        throw new AttestationError(`getDocumentSigningPublicKey: no document-signing key exists yet; only the 'owner' may mint it. Caller is '${deps.role}'. Have the owner issue an attestation (or call this) first.`)\n      }\n      const signer = await loadOrCreateSigner(deps.adapter, deps.vault, deps.getDEK)\n      return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n    },\n    async revokeAttestation(ctx, docId) {\n      const { revokeDocCore } = await import('./revoke.js')\n      return revokeDocCore(ctx, docId)\n    },\n    async unrevokeAttestation(ctx, docId) {\n      const { unrevokeDocCore } = await import('./revoke.js')\n      return unrevokeDocCore(ctx, docId)\n    },\n    async getRevokedDocIds(ctx) {\n      const { getRevokedDocIdsCore } = await import('./revoke.js')\n      return getRevokedDocIdsCore(ctx)\n    },\n    async publishRevocationList(ctx) {\n      const { publishRevocationListCore } = await import('./revoke.js')\n      return publishRevocationListCore(ctx)\n    },\n  }\n}\n","/**\n * @category capability\n * Document attestation — issue side. Mint a signed, per-field commitment\n * for a record and emit a QR credential verifiable offline via\n * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.\n */\nexport { withAttestation } from './active.js'\nexport { NO_ATTESTATION, type AttestationStrategy } from './strategy.js'\nexport { AttestationNotEnabledError } from '../../kernel/errors.js'\nexport { issueAttestationCore } from './issue.js'\nexport type { IssueContext, IssueArgs, IssueResult } from './issue.js'\nexport { ATTESTATIONS_COLLECTION } from './signer.js'\nexport { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js'\nexport type { RevokeContext } from './revoke.js'\nexport { AttestationError } from '../../kernel/errors.js'\n// Re-export the pure verifier surface so consumers can verify from one import:\nexport { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,kBAAuC;AACrD,SAAO;AAAA,IACL,MAAM,iBAAiB,KAAK,MAAM;AAChC,YAAM,EAAE,sBAAAA,sBAAqB,IAAI,MAAM,OAAO,sBAAY;AAC1D,aAAOA,sBAAqB,KAAK,IAAI;AAAA,IACvC;AAAA,IACA,MAAM,4BAA4B,MAAM;AACtC,YAAM,EAAE,YAAY,mBAAmB,IAAI,MAAM,OAAO,uBAAa;AAKrE,YAAM,WAAW,MAAM,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AACvE,UAAI,SAAU,QAAO,EAAE,OAAO,SAAS,OAAO,cAAc,SAAS,aAAa;AAClF,UAAI,KAAK,SAAS,SAAS;AACzB,cAAM,IAAI,iBAAiB,6GAA6G,KAAK,IAAI,8DAA8D;AAAA,MACjN;AACA,YAAM,SAAS,MAAM,mBAAmB,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAC7E,aAAO,EAAE,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AAAA,IAClE;AAAA,IACA,MAAM,kBAAkB,KAAK,OAAO;AAClC,YAAM,EAAE,eAAAC,eAAc,IAAI,MAAM,OAAO,uBAAa;AACpD,aAAOA,eAAc,KAAK,KAAK;AAAA,IACjC;AAAA,IACA,MAAM,oBAAoB,KAAK,OAAO;AACpC,YAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAa;AACtD,aAAOA,iBAAgB,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,iBAAiB,KAAK;AAC1B,YAAM,EAAE,sBAAAC,sBAAqB,IAAI,MAAM,OAAO,uBAAa;AAC3D,aAAOA,sBAAqB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,sBAAsB,KAAK;AAC/B,YAAM,EAAE,2BAAAC,2BAA0B,IAAI,MAAM,OAAO,uBAAa;AAChE,aAAOA,2BAA0B,GAAG;AAAA,IACtC;AAAA,EACF;AACF;;;AChCA,SAAS,mBAAmB,UAAU,sBAAsB,WAAW,0BAAiI;","names":["issueAttestationCore","revokeDocCore","unrevokeDocCore","getRevokedDocIdsCore","publishRevocationListCore"]}