@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.2

package/dist/describe-Ccd1hS7a.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Consumer-neutral, data-relatable field descriptors — the canonical,
+ * validator-agnostic authoring channel. Merged by `collection.describe()`.
+ *
+ * Descriptive, never prescriptive: label/semanticType/unit/sensitivity/
+ * aggregate/aliases/displayFor only. Layout, styling, and active-locale
+ * selection stay app-side.
+ *
+ * @module
+ */
+/** Known semantic types; the union is open — unknown strings pass through. */
+type SemanticType = 'date' | 'datetime' | 'email' | 'url' | 'currency' | 'percent' | 'country' | 'vat' | 'iban' | 'entity' | (string & {});
+interface FieldMeta {
+    /** Human label for any displayable field. Required. */
+    label: string;
+    description?: string;
+    semanticType?: SemanticType;
+    /** Display unit, e.g. '€', '%', 'kg'. */
+    unit?: string;
+    /** Data classification driving redaction/inspector masking. */
+    sensitivity?: 'public' | 'pii' | 'secret';
+    /** Default aggregation for this field. */
+    aggregate?: 'sum' | 'count' | 'distinct' | 'none';
+    /** Canonical search synonyms (data vocabulary, not UI). */
+    aliases?: readonly string[];
+    /** Entity pairing: the field holding the human label for this id (buyerId → buyerName). */
+    displayFor?: string;
+    /**
+     * Override the widget hint derived from semanticType/type.
+     * e.g. 'textarea', 'date', 'money', 'select', 'checkbox', 'number', 'text'.
+     * When absent, the widget is derived automatically by buildDescription.
+     */
+    widget?: string;
+    /**
+     * Card/section grouping hint for detail & form layouts (e.g. 'Identity',
+     * 'Amounts'). Purely descriptive metadata — consumers group; describe()
+     * keeps emitting fields alphabetically.
+     */
+    group?: string;
+    /** Relative ordering hint within (and across) groups. Lower renders first. */
+    order?: number;
+}
+
+/**
+ * Descriptive metadata for the collection and vault levels of the metadata
+ * ladder (field level = FieldMeta). Identity, not structure: label /
+ * description / icon only. Descriptive, never prescriptive.
+ * @module
+ */
+/** A collection's own descriptive metadata. */
+interface CollectionMeta {
+    /** Friendly name; falls back to the humanized collection name. */
+    label?: string;
+    description?: string;
+    /** Semantic icon NAME (e.g. a Lucide key), not styling. */
+    icon?: string;
+    /** Plural form for list headers ("Invoice" → "Invoices"). */
+    pluralLabel?: string;
+}
+/** A vault's own descriptive metadata. */
+interface VaultMeta {
+    label?: string;
+    description?: string;
+    icon?: string;
+}
+
+/**
+ * `buildDescription` — pure assembler that merges collection config
+ * (moneyFields / dictKeyFields / refs / computed / fieldMeta) with an
+ * optional validator-derived `zodFields` map into a normalised
+ * {@link CollectionDescription}.
+ *
+ * The sync path (`collection.describe()`) passes `zodFields: undefined`.
+ * The async path supplies a populated map and validator-derived type
+ * strings.
+ *
+ * @module
+ */
+
+interface DescribedField {
+    readonly key: string;
+    /** Sync: inferred from config ('number'|'enum'|'string'|'array'|'unknown'). Async (Task 4): validator-derived. */
+    readonly type: string;
+    readonly optional: boolean;
+    readonly constraints?: Record<string, unknown>;
+    readonly label: string;
+    readonly description?: string;
+    /** Card/section grouping hint for detail & form layouts. From fieldMeta/zod .meta(). */
+    readonly group?: string;
+    /** Relative ordering hint within and across groups. Lower renders first. */
+    readonly order?: number;
+    readonly semanticType?: string;
+    readonly unit?: string;
+    readonly sensitivity?: 'public' | 'pii' | 'secret';
+    readonly aggregate?: 'sum' | 'count' | 'distinct' | 'none';
+    readonly aliases?: readonly string[];
+    readonly ref?: {
+        target: string;
+        mode: string;
+        isArray?: true;
+    };
+    readonly displayFor?: string;
+    readonly money?: {
+        mode: 'fixed' | 'multi';
+        currency?: string;
+        scale?: number;
+        rounding?: string;
+    };
+    readonly dict?: {
+        name: string;
+        static: boolean;
+        values?: readonly {
+            value: string;
+            label?: string;
+        }[];
+    };
+    readonly computed?: true;
+    /** i18n metadata for fields declared with i18nText(). Present only when the field is i18n-enabled. */
+    readonly i18n?: {
+        readonly locales?: readonly string[];
+        readonly densify?: boolean;
+    };
+    /** Widget hint derived from semanticType+type, overridable via fieldMeta.widget. */
+    readonly widget: string;
+    /** Whether the field is user-editable. False for computed, id, and provenance-stamped fields. */
+    readonly editable: boolean;
+}
+interface CollectionDescription {
+    readonly collection: string;
+    readonly fields: readonly DescribedField[];
+    /** Collection-level descriptive metadata; label falls back to the humanized collection name. */
+    readonly meta: CollectionMeta;
+}
+/** Options for the async describe(opts) overload. */
+interface DescribeOptions {
+    /**
+     * When true, resolve dynamic-dict labels from vault.dictionary(name).list()
+     * and populate dict.values[].label for dynamic dictKey fields.
+     */
+    readonly resolveDictLabels?: boolean;
+}
+
+export type { CollectionDescription as C, DescribeOptions as D, FieldMeta as F, SemanticType as S, VaultMeta as V, CollectionMeta as a, DescribedField as b };

package/dist/{dev-unlock-B4kDxep_.d.ts → dev-unlock-h0K-UZTk.d.ts}

@@ -1,4 +1,4 @@
-import { b0 as Role, b1 as UnlockedKeyring } from './types-Df28QFKb.js';
+import { cR as Role, cF as UnlockedKeyring } from './index-_6At2_9_.js';
 
 /**
  * Session tokens —

package/dist/discriminant-BN9REW3o.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Type-guard helper for narrowing discriminated-union records.
+ *
+ * `Collection<T>` correctly threads `T` through `get` / `query` / `scan`, but
+ * accessing member-specific fields after reading from a `Collection<Union>`
+ * still requires a narrowing step in application code. In regular `.ts` files
+ * a simple `if (r.kind === 'IV')` block narrows correctly; in vue-tsc /
+ * template contexts the inline comparison is sometimes not enough, and the
+ * helper below makes the guard portable and avoids `as unknown as …` casts.
+ *
+ * **Usage with Collection<T>**
+ *
+ * ```ts
+ * import { isDiscriminant } from '@noy-db/hub'
+ *
+ * type IV = { kind: 'IV'; invoiceNo: string; amount: number }
+ * type RE = { kind: 'RE'; receiptNo: string; paidAt: string }
+ * type Receipt = IV | RE | ...
+ *
+ * const receipts = await vault.collection<Receipt>('receipts').query().toArray()
+ *
+ * // Filter approach — result is IV[], invoiceNo accessible without cast:
+ * const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ * console.log(ivs[0].invoiceNo)
+ *
+ * // Branch approach:
+ * for (const r of receipts) {
+ *   if (isDiscriminant(r, 'kind', 'IV')) {
+ *     console.log(r.invoiceNo)  // r: IV here
+ *   }
+ * }
+ * ```
+ *
+ * @module
+ */
+/**
+ * Type-guard for narrowing a discriminated-union record by its discriminant.
+ *
+ * Returns `true` when `record[key] === value`, and narrows `record` to
+ * `Extract<T, Record<K, V>>` — the exact union member(s) that carry that
+ * discriminant value.
+ *
+ * The discriminant key is a parameter (not hardcoded to `'kind'`), so this
+ * works with any field name: `'kind'`, `'type'`, `'tag'`, etc.
+ *
+ * @example
+ *   const ivs = receipts.filter(r => isDiscriminant(r, 'kind', 'IV'))
+ *   // ivs: IV[]  — invoiceNo accessible, no cast needed
+ *
+ * @typeParam T - The union type of the record (e.g. `Receipt`). Both type-alias
+ *   unions and interface-extended unions work; use a `type` alias (`type Receipt = IV | RE`) for best
+ *   results.
+ * @typeParam K - The discriminant key (must be a key of `T`).
+ * @typeParam V - The discriminant value to match. The `const` modifier ensures
+ *   TypeScript infers the string literal (e.g. `'IV'`), not the full union
+ *   `T[K]`, so the predicate resolves to the exact member type.
+ */
+declare function isDiscriminant<T, K extends keyof T, const V extends T[K]>(record: T, key: K, value: V): record is Extract<T, Record<K, V>>;
+
+export { isDiscriminant as i };

package/dist/enclave-UL5LW66V.js

@@ -0,0 +1,88 @@
+import {
+  RecordCodec,
+  SEALED_CEK_NS,
+  base64ToBuffer,
+  bufferToBase64,
+  buildTombstone,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  envelopeBodyForHash,
+  findByDet,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hasPerRecordKey,
+  hmacSha256Hex,
+  importCek,
+  isTombstone,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey,
+  writeEnvelopeBody
+} from "./chunk-5O3AOPDT.js";
+import "./chunk-5TDJ56JE.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  RecordCodec,
+  SEALED_CEK_NS,
+  base64ToBuffer,
+  bufferToBase64,
+  buildTombstone,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  envelopeBodyForHash,
+  findByDet,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hasPerRecordKey,
+  hmacSha256Hex,
+  importCek,
+  isTombstone,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey,
+  writeEnvelopeBody
+};
+//# sourceMappingURL=enclave-UL5LW66V.js.map

package/dist/executor-2FWQRLMG.js

@@ -0,0 +1,15 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-AQTBSL7R.js";
+import "./chunk-62QYRORB.js";
+import "./chunk-5O3AOPDT.js";
+import "./chunk-5TDJ56JE.js";
+import "./chunk-LV7M27WM.js";
+import "./chunk-M2YKN37S.js";
+import "./chunk-5LUY7UTV.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-2FWQRLMG.js.map

package/dist/executor-QZ7BXICW.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-RUEKROOS.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-QZ7BXICW.js.map

package/dist/executor-Z5ZLJVTV.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-PKHL44ER.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-Z5ZLJVTV.js.map

package/dist/export-accessible-KRV5W4GH.js

@@ -0,0 +1,17 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-HCIPRAGS.js";
+import "./chunk-FISN7WE4.js";
+import "./chunk-SMXWYP24.js";
+import "./chunk-5O3AOPDT.js";
+import "./chunk-5TDJ56JE.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-KRV5W4GH.js.map

package/dist/extract-partition-GLKBOXFQ.js

@@ -0,0 +1,30 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-76722EBH.js";
+import "./chunk-26LGBE4T.js";
+import "./chunk-DFEMTNPJ.js";
+import "./chunk-FISN7WE4.js";
+import "./chunk-SMXWYP24.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-AIWULCUO.js";
+import "./chunk-5O3AOPDT.js";
+import "./chunk-5TDJ56JE.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-GLKBOXFQ.js.map

package/dist/{fanout-sidecar-OKPMMPLG.js → fanout-sidecar-GF3DJ6KR.js}

@@ -1,16 +1,24 @@
+import {
+  encrypt,
+  openEnvelopeJson
+} from "./chunk-5O3AOPDT.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-WIRRPTFH.js";
+} from "./chunk-5TDJ56JE.js";
+import "./chunk-ZYUC53LT.js";
+import "./chunk-PZ5AY32C.js";
 
-// src/derivations/fanout-sidecar.ts
+// src/with-formula/derivations/fanout-sidecar.ts
+var FANOUT_DEK_COLLECTION = "_meta";
 function recordId(source, sourceId, outputKey) {
   return `derivations-fanout/${source}/${sourceId}/${outputKey}`;
 }
-async function loadFanoutSidecar(store, vault, source, sourceId, outputKey) {
+async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+    const parsed = JSON.parse(json);
     if (parsed._noydb_fanout !== 1) return void 0;
     if (!Array.isArray(parsed.keys)) return void 0;
     return parsed;
@@ -18,7 +26,7 @@ async function loadFanoutSidecar(store, vault, source, sourceId, outputKey) {
     return void 0;
   }
 }
-async function saveFanoutSidecar(store, vault, payload) {
+async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
   const doc = {
     _noydb_fanout: 1,
     source: payload.source,
@@ -30,14 +38,26 @@ async function saveFanoutSidecar(store, vault, payload) {
   };
   const id = recordId(payload.source, payload.sourceId, payload.outputKey);
   const prior = await store.get(vault, "_meta", id);
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — sidecar is system metadata, no user data inside.
-    _iv: "",
-    _data: JSON.stringify(doc)
-  };
+  const json = JSON.stringify(doc);
+  let envelope;
+  if (!encrypted) {
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: json
+    };
+  } else {
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: iv,
+      _data: data
+    };
+  }
   await store.put(vault, "_meta", id, envelope);
 }
 async function deleteFanoutSidecar(store, vault, source, sourceId, outputKey) {
@@ -48,4 +68,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-OKPMMPLG.js.map
+//# sourceMappingURL=fanout-sidecar-GF3DJ6KR.js.map

package/dist/fanout-sidecar-GF3DJ6KR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns empty if absent.\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  try {\n    // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n    const json = (!encrypted || envelope._iv === '')\n      ? envelope._data\n      : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION))\n    const parsed = JSON.parse(json) as FanoutSidecar\n    if (parsed._noydb_fanout !== 1) return undefined\n    if (!Array.isArray(parsed.keys)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: json,\n    }\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION))\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: iv,\n      _data: data,\n    }\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AASA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AAEF,UAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,UAAU,MAAM,OAAO,qBAAqB,CAAC;AACxE,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,QAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,CAAC;AAC5E,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/forget/index.d.ts

@@ -0,0 +1,36 @@
+import { S as SubjectDeclaration, F as ForgetStrategy } from '../subject-index-O75wKshW.js';
+export { a as ForgetResult, N as NO_FORGET, b as SUBJECT_INDEX_COLLECTION, c as SubjectRef } from '../subject-index-O75wKshW.js';
+
+/**
+ * `withForgetCascade` — the active factory for GDPR right-to-erasure via
+ * per-record CEK crypto-shred. Mirrors the canonical
+ * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split
+ * used by the other services.
+ *
+ * @module
+ */
+
+/**
+ * Declare GDPR crypto-shred for one or more collections.
+ *
+ * Each declared collection is forced to `perRecordKeys: true` (a shred can
+ * only guarantee erasure of a record whose body is keyed off a per-record
+ * CEK). On write, Noydb extracts `record[subjectField]` and maintains an
+ * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so
+ * `vault.forget(subjectId)` can find every record for a subject and rewrite
+ * each to a tombstone (body + history permanently undecryptable) while the
+ * collection DEK and every other record stay intact.
+ *
+ * @example
+ * ```ts
+ * createNoydb({
+ *   secret, user,
+ *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),
+ * })
+ * const result = await vault.forget('buyer-123')
+ * // → { subject, recordsShredded, historyVersionsShredded, collections, … }
+ * ```
+ */
+declare function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy;
+
+export { ForgetStrategy, SubjectDeclaration, withForgetCascade };

package/dist/forget/index.js

@@ -0,0 +1,19 @@
+import {
+  NO_FORGET,
+  SUBJECT_INDEX_COLLECTION
+} from "../chunk-SRB2XEWB.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-audit/forget/active.ts
+function withForgetCascade(opts) {
+  return { subjects: { ...opts.subjects } };
+}
+export {
+  NO_FORGET,
+  SUBJECT_INDEX_COLLECTION,
+  withForgetCascade
+};
+//# sourceMappingURL=index.js.map

package/dist/forget/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects } }\n}\n"],"mappings":";;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE;AAC1C;","names":[]}

package/dist/guards/index.d.ts

@@ -1,11 +1,9 @@
-export { w as withGuard } from '../with-guard-qube6BMI.js';
-import { as as GuardStrategy, at as GuardChange, au as GuardContext } from '../types-Df28QFKb.js';
-export { av as GuardRegistry, aw as GuardStrategyHandle, ax as ReadOnlyVaultFacade } from '../types-Df28QFKb.js';
-export { A as AmendmentForbiddenError, F as FieldFrozenError, I as InvariantError, e as RecordLockedError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from '../transition-guard-DqodPNKw.js';
+import { bJ as GuardStrategy, bK as GuardChange, bL as GuardContext } from '../index-_6At2_9_.js';
+export { bM as AmendmentForbiddenError, bN as FieldFrozenError, bO as GuardRegistry, bP as GuardStrategyHandle, bQ as IllegalTransitionError, bR as InvariantError, bS as ReadOnlyVaultFacade, bT as RecordLockedError } from '../index-_6At2_9_.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-Ccd1hS7a.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**
@@ -19,8 +17,14 @@ declare const GuardExecutor: {
      * Compare existing vs incoming for each `frozenFields.fields` entry
      * when `frozenFields.when(existing)` is true. Throws
      * `FieldFrozenError` listing every changed frozen field.
+     *
+     * @param skipFields — field names that are schema-owned computed fields.
+     *   These are excluded from the comparison because `incoming` carries the
+     *   raw user input (computed fields not yet evaluated), so comparing
+     *   `existing[field]` vs `incoming[field]` would always look like a
+     *   change even when the computed result is unchanged.
      */
-    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T): Promise<void>;
+    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
     /**
      * Run a single guard's invariant over its slice of the change-set.
      * Any throw is converted to `InvariantError` unless it already is one.

package/dist/guards/index.js

@@ -1,29 +1,36 @@
 import {
+  immutableGuard,
+  transitionGuard,
   withGuard
-} from "../chunk-OQ6PIGHA.js";
+} from "../chunk-TA66UMI4.js";
 import {
   GuardRegistry
-} from "../chunk-A3JMGXPG.js";
+} from "../chunk-YMUGBZN2.js";
 import {
   ReadOnlyVaultFacade
-} from "../chunk-UMLVJTYV.js";
+} from "../chunk-RUIMKQTA.js";
 import {
   GuardExecutor
-} from "../chunk-NONAAENK.js";
+} from "../chunk-RUEKROOS.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
+  IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-B6PB7JLN.js";
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,
   FieldFrozenError,
   GuardExecutor,
   GuardRegistry,
+  IllegalTransitionError,
   InvariantError,
   ReadOnlyVaultFacade,
   RecordLockedError,
+  immutableGuard,
+  transitionGuard,
   withGuard
 };
 //# sourceMappingURL=index.js.map

package/dist/{hash-DdpVypUp.d.cts → hash-CdSr06sm.d.ts}

@@ -1,4 +1,4 @@
-import { b5 as EncryptedEnvelope } from './types-DyXYr8rE.cjs';
+import { cV as EncryptedEnvelope } from './index-_6At2_9_.js';
 
 /**
  * Ledger storage constants — pinned in their own leaf module so
@@ -54,6 +54,10 @@ declare const LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
  * delete (hash the previous envelope) paths, and by
  * `DictionaryHandle` so its ledger entries match the same contract.
  *
+ * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext
+ * map (`_sealed`) when a record carries one — so the ledger attests to
+ * both the open body AND every sealed value.
+ *
  * Returns the empty string when there is no envelope (delete of a
  * never-existed record). The empty string tolerated by the ledger
  * entry's `payloadHash` field as the canonical "nothing here" value.

package/dist/history/index.d.ts

@@ -1,11 +1,9 @@
-import { b2 as HistoryStrategy, b3 as NoydbStore, b4 as HistoryOptions, b5 as EncryptedEnvelope, b6 as PruneOptions } from '../types-Df28QFKb.js';
-export { b7 as AppendInput, b8 as ChangeType, b9 as CollectionInstant, ba as DiffEntry, bb as JsonPatch, bc as JsonPatchOp, bd as LedgerEntry, be as LedgerStore, bf as VaultEngine, bg as VaultInstant, bh as VerifyResult, bi as applyPatch, bj as canonicalJson, bk as computePatch, bl as diff, bm as formatDiff, bn as hashEntry, bo as paddedIndex, bp as parseIndex, bq as sha256Hex } from '../types-Df28QFKb.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-HJqD14vS.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
-import '../index-D8I_pyJD.js';
+import { cS as HistoryStrategy, cT as NoydbStore, cU as HistoryOptions, cV as EncryptedEnvelope, cW as PruneOptions } from '../index-_6At2_9_.js';
+export { cX as AppendInput, cY as ChangeType, cZ as CollectionInstant, cE as DiffEntry, c_ as JsonPatch, c$ as JsonPatchOp, d0 as LedgerStore, d1 as VaultEngine, d2 as VaultInstant, d3 as VerifyResult, d4 as applyPatch, d5 as computePatch, d6 as diff, d7 as formatDiff } from '../index-_6At2_9_.js';
+export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from '../subject-index-O75wKshW.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from '../hash-CdSr06sm.js';
+import '../describe-Ccd1hS7a.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**