@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.10

package/dist/fanout-sidecar-OFWN3NM7.js

@@ -0,0 +1,74 @@
+import {
+  openEnvelopeJson
+} from "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "./chunk-3OPY6MK2.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-formula/derivations/fanout-sidecar.ts
+var FANOUT_DEK_COLLECTION = "_meta";
+function recordId(source, sourceId, outputKey) {
+  return `derivations-fanout/${source}/${sourceId}/${outputKey}`;
+}
+async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
+  const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
+  if (!envelope) return void 0;
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const parsed = JSON.parse(json);
+  if (parsed._noydb_fanout !== 1) return void 0;
+  if (!Array.isArray(parsed.keys)) return void 0;
+  return parsed;
+}
+async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
+  const doc = {
+    _noydb_fanout: 1,
+    source: payload.source,
+    sourceId: payload.sourceId,
+    outputKey: payload.outputKey,
+    outputCollection: payload.outputCollection,
+    keys: payload.keys,
+    emittedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const id = recordId(payload.source, payload.sourceId, payload.outputKey);
+  const prior = await store.get(vault, "_meta", id);
+  const json = JSON.stringify(doc);
+  let envelope;
+  if (!encrypted) {
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: json
+    };
+  } else {
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: iv,
+      _data: data
+    };
+  }
+  await store.put(vault, "_meta", id, envelope);
+}
+async function deleteFanoutSidecar(store, vault, source, sourceId, outputKey) {
+  await store.delete(vault, "_meta", recordId(source, sourceId, outputKey));
+}
+export {
+  deleteFanoutSidecar,
+  loadFanoutSidecar,
+  saveFanoutSidecar
+};
+//# sourceMappingURL=fanout-sidecar-OFWN3NM7.js.map

package/dist/fanout-sidecar-OFWN3NM7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: json,\n    }\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION))\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: iv,\n      _data: data,\n    }\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,UAAU,MAAM,OAAO,qBAAqB,CAAC;AACxE,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,CAAC;AAC5E,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/fence-watcher-DHQ775JB.js

@@ -0,0 +1,69 @@
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/schema-update/fence-watcher.ts
+var FenceWatcher = class {
+  #coordination;
+  #vault;
+  #writerId;
+  #sessionId;
+  #onFlush;
+  #now;
+  #emit;
+  #lastState = null;
+  #quiescedAtVersion = null;
+  #timer;
+  constructor(opts) {
+    this.#coordination = opts.coordination;
+    this.#vault = opts.vault;
+    this.#writerId = opts.clientId;
+    this.#sessionId = opts.sessionId ?? opts.clientId;
+    this.#onFlush = opts.onFlush;
+    this.#now = opts.now ?? (() => Date.now());
+    this.#emit = opts.emit ?? (() => {
+    });
+  }
+  /** Publish liveness (and the current ack) without changing quiesce state. */
+  async beat() {
+    await this.#coordination.reportPresence(this.#vault, {
+      writerId: this.#writerId,
+      sessionId: this.#sessionId,
+      lastSeen: this.#now(),
+      quiescedAtVersion: this.#quiescedAtVersion
+    });
+  }
+  /** Poll the fence; quiesce on draining; emit on transitions. */
+  async check() {
+    const fence = await this.#coordination.readFence(this.#vault);
+    if (fence.fenceState !== this.#lastState) {
+      this.#lastState = fence.fenceState;
+      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState });
+    }
+    if (fence.fenceState === "draining" && this.#quiescedAtVersion !== fence.currentSchemaVersion) {
+      await this.#onFlush();
+      this.#quiescedAtVersion = fence.currentSchemaVersion;
+      await this.beat();
+    }
+    if (fence.fenceState === "normal") {
+      this.#quiescedAtVersion = null;
+    }
+  }
+  start(intervalMs) {
+    if (this.#timer) return;
+    this.#timer = setInterval(() => {
+      void this.beat();
+      void this.check();
+    }, intervalMs);
+    const timer = this.#timer;
+    if (typeof timer.unref === "function") timer.unref();
+  }
+  stop() {
+    if (this.#timer) {
+      clearInterval(this.#timer);
+      this.#timer = void 0;
+    }
+  }
+};
+export {
+  FenceWatcher
+};
+//# sourceMappingURL=fence-watcher-DHQ775JB.js.map

package/dist/fence-watcher-DHQ775JB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence-watcher.ts"],"sourcesContent":["/**\n * Per-client schema-fence watcher. Watches the fence via the injected\n * {@link CoordinationProvider}; on `draining` it drains in-flight writes\n * and reports presence (its ack); emits a same-instance signal on every\n * state transition (for UI). Driven by an interval in production and by\n * explicit `check()`/`beat()` in tests.\n *\n * The transport is the coordination port: the default\n * {@link StoreCoordinationProvider} maps `reportPresence` →\n * `_meta/schema-fence:client:<id>` and `readFence` → `_meta/schema-fence`,\n * so behavior is byte-for-byte the same; `by-tabs` / `by-peer` swap in\n * real-time push transports.\n */\nimport { type FenceState } from './fence.js'\nimport type { CoordinationProvider } from '../../port/by/index.js'\n\nexport interface FenceWatcherEvent {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n}\n\nexport class FenceWatcher {\n  readonly #coordination: CoordinationProvider\n  readonly #vault: string\n  readonly #writerId: string\n  readonly #sessionId: string\n  readonly #onFlush: () => Promise<void>\n  readonly #now: () => number\n  readonly #emit: (e: FenceWatcherEvent) => void\n  #lastState: FenceState | null = null\n  #quiescedAtVersion: number | null = null\n  #timer: ReturnType<typeof setInterval> | undefined\n\n  constructor(opts: {\n    coordination: CoordinationProvider\n    vault: string\n    clientId: string\n    sessionId?: string\n    onFlush: () => Promise<void>\n    now?: () => number\n    emit?: (e: FenceWatcherEvent) => void\n  }) {\n    this.#coordination = opts.coordination\n    this.#vault = opts.vault\n    this.#writerId = opts.clientId\n    this.#sessionId = opts.sessionId ?? opts.clientId\n    this.#onFlush = opts.onFlush\n    this.#now = opts.now ?? (() => Date.now())\n    this.#emit = opts.emit ?? (() => {})\n  }\n\n  /** Publish liveness (and the current ack) without changing quiesce state. */\n  async beat(): Promise<void> {\n    await this.#coordination.reportPresence(this.#vault, {\n      writerId: this.#writerId,\n      sessionId: this.#sessionId,\n      lastSeen: this.#now(),\n      quiescedAtVersion: this.#quiescedAtVersion,\n    })\n  }\n\n  /** Poll the fence; quiesce on draining; emit on transitions. */\n  async check(): Promise<void> {\n    const fence = await this.#coordination.readFence(this.#vault)\n    if (fence.fenceState !== this.#lastState) {\n      this.#lastState = fence.fenceState\n      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState })\n    }\n    if (fence.fenceState === 'draining' && this.#quiescedAtVersion !== fence.currentSchemaVersion) {\n      await this.#onFlush()\n      this.#quiescedAtVersion = fence.currentSchemaVersion\n      await this.beat()\n    }\n    if (fence.fenceState === 'normal') {\n      this.#quiescedAtVersion = null\n    }\n  }\n\n  start(intervalMs: number): void {\n    if (this.#timer) return\n    this.#timer = setInterval(() => { void this.beat(); void this.check() }, intervalMs)\n    const timer = this.#timer as unknown as { unref?: () => void }\n    if (typeof timer.unref === 'function') timer.unref() // don't keep the process alive\n  }\n\n  stop(): void {\n    if (this.#timer) { clearInterval(this.#timer); this.#timer = undefined }\n  }\n}\n"],"mappings":";;;AAqBO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAAgC;AAAA,EAChC,qBAAoC;AAAA,EACpC;AAAA,EAEA,YAAY,MAQT;AACD,SAAK,gBAAgB,KAAK;AAC1B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,WAAW,KAAK;AACrB,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,SAAK,QAAQ,KAAK,SAAS,MAAM;AAAA,IAAC;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,UAAM,KAAK,cAAc,eAAe,KAAK,QAAQ;AAAA,MACnD,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK,KAAK;AAAA,MACpB,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,KAAK,MAAM;AAC5D,QAAI,MAAM,eAAe,KAAK,YAAY;AACxC,WAAK,aAAa,MAAM;AACxB,WAAK,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,YAAY,MAAM,WAAW,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,eAAe,cAAc,KAAK,uBAAuB,MAAM,sBAAsB;AAC7F,YAAM,KAAK,SAAS;AACpB,WAAK,qBAAqB,MAAM;AAChC,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,QAAI,MAAM,eAAe,UAAU;AACjC,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,YAA0B;AAC9B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS,YAAY,MAAM;AAAE,WAAK,KAAK,KAAK;AAAG,WAAK,KAAK,MAAM;AAAA,IAAE,GAAG,UAAU;AACnF,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EACrD;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAQ;AAAE,oBAAc,KAAK,MAAM;AAAG,WAAK,SAAS;AAAA,IAAU;AAAA,EACzE;AACF;","names":[]}

package/dist/find-BNGBJNKP.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-BNGBJNKP.js.map

package/dist/forget/index.d.ts

@@ -0,0 +1,36 @@
+import { S as SubjectDeclaration, F as ForgetStrategy } from '../subject-index-CyOgGMJL.js';
+export { a as ForgetResult, N as NO_FORGET, b as SUBJECT_INDEX_COLLECTION, c as SubjectRef } from '../subject-index-CyOgGMJL.js';
+
+/**
+ * `withForgetCascade` — the active factory for GDPR right-to-erasure via
+ * per-record CEK crypto-shred. Mirrors the canonical
+ * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split
+ * used by the other services.
+ *
+ * @module
+ */
+
+/**
+ * Declare GDPR crypto-shred for one or more collections.
+ *
+ * Each declared collection is forced to `perRecordKeys: true` (a shred can
+ * only guarantee erasure of a record whose body is keyed off a per-record
+ * CEK). On write, Noydb extracts `record[subjectField]` and maintains an
+ * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so
+ * `vault.forget(subjectId)` can find every record for a subject and rewrite
+ * each to a tombstone (body + history permanently undecryptable) while the
+ * collection DEK and every other record stay intact.
+ *
+ * @example
+ * ```ts
+ * createNoydb({
+ *   secret, user,
+ *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),
+ * })
+ * const result = await vault.forget('buyer-123')
+ * // → { subject, recordsShredded, historyVersionsShredded, collections, … }
+ * ```
+ */
+declare function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy;
+
+export { ForgetStrategy, SubjectDeclaration, withForgetCascade };

package/dist/forget/index.js

@@ -0,0 +1,25 @@
+import {
+  NO_FORGET,
+  SUBJECT_INDEX_COLLECTION
+} from "../chunk-ANB77BVV.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-audit/forget/active.ts
+function withForgetCascade(opts) {
+  return { subjects: { ...opts.subjects } };
+}
+export {
+  NO_FORGET,
+  SUBJECT_INDEX_COLLECTION,
+  withForgetCascade
+};
+//# sourceMappingURL=index.js.map

package/dist/forget/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects } }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE;AAC1C;","names":[]}

package/dist/guards/index.d.ts

@@ -1,11 +1,8 @@
-export { w as withGuard } from '../with-guard-qube6BMI.js';
-import { as as GuardStrategy, at as GuardChange, au as GuardContext } from '../types-Df28QFKb.js';
-export { av as GuardRegistry, aw as GuardStrategyHandle, ax as ReadOnlyVaultFacade } from '../types-Df28QFKb.js';
-export { A as AmendmentForbiddenError, F as FieldFrozenError, I as InvariantError, e as RecordLockedError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from '../transition-guard-DI-krBsZ.js';
+import { bc as GuardStrategy, bd as GuardChange, be as GuardContext } from '../index-DjWbxsjb.js';
+export { bf as AmendmentForbiddenError, bg as FieldFrozenError, bh as GuardRegistry, bi as GuardStrategyHandle, bj as IllegalTransitionError, bk as InvariantError, bl as ReadOnlyVaultFacade, bm as RecordLockedError } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**
@@ -19,8 +16,14 @@ declare const GuardExecutor: {
      * Compare existing vs incoming for each `frozenFields.fields` entry
      * when `frozenFields.when(existing)` is true. Throws
      * `FieldFrozenError` listing every changed frozen field.
+     *
+     * @param skipFields — field names that are schema-owned computed fields.
+     *   These are excluded from the comparison because `incoming` carries the
+     *   raw user input (computed fields not yet evaluated), so comparing
+     *   `existing[field]` vs `incoming[field]` would always look like a
+     *   change even when the computed result is unchanged.
      */
-    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T): Promise<void>;
+    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
     /**
      * Run a single guard's invariant over its slice of the change-set.
      * Any throw is converted to `InvariantError` unless it already is one.

package/dist/guards/index.js

@@ -1,29 +1,36 @@
 import {
+  immutableGuard,
+  transitionGuard,
   withGuard
-} from "../chunk-OQ6PIGHA.js";
+} from "../chunk-F4CEK5YM.js";
 import {
   GuardRegistry
-} from "../chunk-A3JMGXPG.js";
+} from "../chunk-YMUGBZN2.js";
 import {
   ReadOnlyVaultFacade
-} from "../chunk-UMLVJTYV.js";
+} from "../chunk-JK733I5V.js";
 import {
   GuardExecutor
-} from "../chunk-NONAAENK.js";
+} from "../chunk-VWRRVE6D.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
+  IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,
   FieldFrozenError,
   GuardExecutor,
   GuardRegistry,
+  IllegalTransitionError,
   InvariantError,
   ReadOnlyVaultFacade,
   RecordLockedError,
+  immutableGuard,
+  transitionGuard,
   withGuard
 };
 //# sourceMappingURL=index.js.map

package/dist/{hash-DdpVypUp.d.cts → hash-DAJjMsCE.d.ts}

@@ -1,4 +1,4 @@
-import { b5 as EncryptedEnvelope } from './types-DyXYr8rE.cjs';
+import { d0 as EncryptedEnvelope } from './index-DjWbxsjb.js';
 
 /**
  * Ledger storage constants — pinned in their own leaf module so
@@ -54,6 +54,15 @@ declare const LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
  * delete (hash the previous envelope) paths, and by
  * `DictionaryHandle` so its ledger entries match the same contract.
  *
+ * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext
+ * map (`_sealed`) when a record carries one — so the ledger attests to
+ * both the open body AND every sealed value … and the verify-digest
+ * ciphertext map (`_vdig`), each bound only when present — the `_vdig`
+ * binding is the temporal-rollback detector for the C1 splice class.
+ * `rotateRecordCek` rewrites `_vdig` with no ledger entry, the same
+ * pre-existing rotation property `_sealed`/`_cek` already have
+ * (`verifyBackupIntegrity` flags rotated records until re-anchored).
+ *
  * Returns the empty string when there is no envelope (delete of a
  * never-existed record). The empty string tolerated by the ledger
  * entry's `payloadHash` field as the canonical "nothing here" value.

package/dist/history/index.d.ts

@@ -1,11 +1,8 @@
-import { b2 as HistoryStrategy, b3 as NoydbStore, b4 as HistoryOptions, b5 as EncryptedEnvelope, b6 as PruneOptions } from '../types-Df28QFKb.js';
-export { b7 as AppendInput, b8 as ChangeType, b9 as CollectionInstant, ba as DiffEntry, bb as JsonPatch, bc as JsonPatchOp, bd as LedgerEntry, be as LedgerStore, bf as VaultEngine, bg as VaultInstant, bh as VerifyResult, bi as applyPatch, bj as canonicalJson, bk as computePatch, bl as diff, bm as formatDiff, bn as hashEntry, bo as paddedIndex, bp as parseIndex, bq as sha256Hex } from '../types-Df28QFKb.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-HJqD14vS.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { cZ as HistoryStrategy, c_ as NoydbStore, c$ as HistoryOptions, d0 as EncryptedEnvelope, d1 as PruneOptions } from '../index-DjWbxsjb.js';
+export { d2 as AppendInput, d3 as ChangeType, d4 as CollectionInstant, c7 as DiffEntry, d5 as JsonPatch, d6 as JsonPatchOp, d7 as LedgerStore, d8 as VaultEngine, d9 as VaultInstant, da as VerifyResult, db as applyPatch, dc as computePatch, dd as diff, de as formatDiff } from '../index-DjWbxsjb.js';
+export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from '../subject-index-CyOgGMJL.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-DAJjMsCE.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/history/index.js

@@ -2,20 +2,25 @@ import {
   CollectionInstant,
   VaultInstant,
   clearHistory,
-  diff,
-  formatDiff,
   getHistory,
   getVersionEnvelope,
   pruneHistory,
-  saveHistory
-} from "../chunk-F3GDRNUT.js";
+  saveHistory,
+  tombstoneHistory
+} from "../chunk-IVLTXX4W.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
 import {
-  LEDGER_COLLECTION,
-  LEDGER_DELTAS_COLLECTION,
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-PE2FR4J3.js";
+} from "../chunk-3JXPAHOZ.js";
+import {
+  LEDGER_COLLECTION,
+  LEDGER_DELTAS_COLLECTION
+} from "../chunk-I7FD46FF.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -23,12 +28,19 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-Z6FNBOTC.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-UF362QVH.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/history/active.ts
+// src/with-commit/history/active.ts
 function withHistory() {
   return {
     saveHistory,
@@ -36,6 +48,7 @@ function withHistory() {
     getVersionEnvelope,
     pruneHistory,
     clearHistory,
+    tombstoneHistory,
     envelopePayloadHash,
     computePatch,
     diff,

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.d.ts

@@ -1,12 +1,29 @@
-import { I as I18nStrategy } from '../types-Df28QFKb.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-Df28QFKb.js';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, T as TranslatorNotConfiguredError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+import { ck as I18nStrategy } from '../index-DjWbxsjb.js';
+export { cl as DICT_COLLECTION_PREFIX, cm as DictEntry, cn as DictKeyDescriptor, co as DictKeyInUseError, cp as DictKeyMissingError, cq as DictionaryHandle, cr as DictionaryOptions, cs as I18nMap, ct as I18nTextDescriptor, cu as I18nTextOptions, cv as Layer, cw as LocaleNotSpecifiedError, cx as MissingTranslationError, cy as OnMissing, cz as OnMissingPolicy, cA as ReservedCollectionNameError, cB as ResolveI18nOptions, cC as ScriptViolationError, cD as ScriptWarning, cE as StaticDictDescriptor, cF as StaticDictReadonlyError, cG as TranslatorNotConfiguredError, cH as UnknownDictCodeError, cI as applyI18nLocale, cJ as dictCollectionName, cK as dictKey, cL as enforceScript, cM as i18nText, cN as inferScripts, cO as isDictCollectionName, cP as isDictKeyDescriptor, cQ as isI18nTextDescriptor, cR as isStaticDictDescriptor, cS as presentI18nForJoin, cT as resolveI18nText, cU as resolvePolicy, cV as staticDict, cW as stripI18nFilled, cX as validateI18nTextValue } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
+/**
+ * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:
+ * these carry zero i18n logic — they were extracted out of
+ * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time
+ * validation, densify) can import them without a spine→service edge.
+ *
+ * @internal
+ */
+/**
+ * Return all leaf values at `path`, expanding `[].` array wildcards.
+ *
+ * - `'name'`              → `[obj.name]`
+ * - `'address.lineOne'`   → `[obj.address.lineOne]`
+ * - `'contacts[].title'`  → `[obj.contacts[0].title, obj.contacts[1].title, …]`
+ *
+ * Returns an empty array when the path does not resolve (missing key,
+ * wrong type, etc.). Used by `enforceI18nOnPut` to validate nested fields.
+ */
+declare function getAtPath(obj: Record<string, unknown>, path: string): unknown[];
+
 /**
  * Active i18n strategy — `withI18n()` returns the real implementation
  * that wires multi-locale resolution, i18nText validation, and the
@@ -36,4 +53,4 @@ import '@noy-db/attestation';
 
 declare function withI18n(): I18nStrategy;
 
-export { I18nStrategy, withI18n };
+export { I18nStrategy, getAtPath, withI18n };