@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.2

package/dist/history/index.js

@@ -2,20 +2,25 @@ import {
   CollectionInstant,
   VaultInstant,
   clearHistory,
-  diff,
-  formatDiff,
   getHistory,
   getVersionEnvelope,
   pruneHistory,
-  saveHistory
-} from "../chunk-F3GDRNUT.js";
+  saveHistory,
+  tombstoneHistory
+} from "../chunk-MD3Y6J3L.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
 import {
-  LEDGER_COLLECTION,
-  LEDGER_DELTAS_COLLECTION,
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-PE2FR4J3.js";
+} from "../chunk-LXQT4WMP.js";
+import {
+  LEDGER_COLLECTION,
+  LEDGER_DELTAS_COLLECTION
+} from "../chunk-I7FD46FF.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -23,12 +28,13 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-Z6FNBOTC.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
-import "../chunk-B6PB7JLN.js";
+} from "../chunk-AIWULCUO.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
 
-// src/history/active.ts
+// src/with-commit/history/active.ts
 function withHistory() {
   return {
     saveHistory,
@@ -36,6 +42,7 @@ function withHistory() {
     getVersionEnvelope,
     pruneHistory,
     clearHistory,
+    tombstoneHistory,
     envelopePayloadHash,
     computePatch,
     diff,

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.d.ts

@@ -1,10 +1,8 @@
-import { I as I18nStrategy } from '../types-Df28QFKb.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, L as Layer, O as OnMissing, h as OnMissingPolicy, R as ResolveI18nOptions, S as ScriptWarning, i as applyI18nLocale, j as dictCollectionName, k as dictKey, l as enforceScript, m as getAtPath, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, s as resolveI18nText, t as resolvePolicy, u as setAtPathInPlace, v as validateI18nTextValue } from '../types-Df28QFKb.js';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, S as ScriptViolationError, T as TranslatorNotConfiguredError } from '../index-D8I_pyJD.js';
-import '../lazy-builder-7tIpFyWN.js';
-import '../predicate-BSAGEyu5.js';
-import '../strategy-DSTrsZ8t.js';
-import '../strategy-BSxFXGzb.js';
+import { I as I18nStrategy } from '../index-_6At2_9_.js';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictKeyInUseError, d as DictKeyMissingError, e as DictionaryHandle, f as DictionaryOptions, g as I18nMap, h as I18nTextDescriptor, i as I18nTextOptions, L as Layer, j as LocaleNotSpecifiedError, M as MissingTranslationError, O as OnMissing, k as OnMissingPolicy, R as ReservedCollectionNameError, l as ResolveI18nOptions, S as ScriptViolationError, m as ScriptWarning, n as StaticDictDescriptor, o as StaticDictReadonlyError, T as TranslatorNotConfiguredError, U as UnknownDictCodeError, p as applyI18nLocale, q as dictCollectionName, r as dictKey, s as enforceScript, t as getAtPath, u as i18nText, v as inferScripts, w as isDictCollectionName, x as isDictKeyDescriptor, y as isI18nTextDescriptor, z as isStaticDictDescriptor, A as resolveI18nText, B as resolvePolicy, C as setAtPathInPlace, E as staticDict, F as stripI18nFilled, G as validateI18nTextValue } from '../index-_6At2_9_.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-Ccd1hS7a.js';
+import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
 /**

package/dist/i18n/index.js

@@ -1,27 +1,31 @@
-import {
-  enforceScript,
-  inferScripts
-} from "../chunk-6STK5TQP.js";
 import {
   DICT_COLLECTION_PREFIX,
   DictionaryHandle,
-  applyI18nLocale,
   dictCollectionName,
   dictKey,
-  getAtPath,
-  i18nText,
   isDictCollectionName,
   isDictKeyDescriptor,
+  isStaticDictDescriptor,
+  staticDict
+} from "../chunk-LFLXAY2W.js";
+import "../chunk-WWGT2MDV.js";
+import "../chunk-ITNUCOXM.js";
+import "../chunk-AIWULCUO.js";
+import "../chunk-5O3AOPDT.js";
+import "../chunk-5TDJ56JE.js";
+import {
+  applyI18nLocale,
+  enforceScript,
+  getAtPath,
+  i18nText,
+  inferScripts,
   isI18nTextDescriptor,
   resolveI18nText,
   resolvePolicy,
   setAtPathInPlace,
+  stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-22DWZL57.js";
-import "../chunk-DONMZAD2.js";
-import "../chunk-Z6FNBOTC.js";
-import "../chunk-WIRRPTFH.js";
-import "../chunk-PP6W64Y3.js";
+} from "../chunk-5LUY7UTV.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -29,15 +33,95 @@ import {
   MissingTranslationError,
   ReservedCollectionNameError,
   ScriptViolationError,
-  TranslatorNotConfiguredError
-} from "../chunk-B6PB7JLN.js";
+  StaticDictReadonlyError,
+  TranslatorNotConfiguredError,
+  UnknownDictCodeError
+} from "../chunk-ZYUC53LT.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-shape/i18n/densify.ts
+var MARKER = "_i18nFilled";
+function priorFilled(prior, field) {
+  if (!prior) return /* @__PURE__ */ new Set();
+  const marker = prior[MARKER];
+  return new Set(marker?.[field] ?? []);
+}
+function singleLeaf(record, field) {
+  const leaves = getAtPath(record, field);
+  if (leaves.length !== 1) return void 0;
+  const leaf = leaves[0];
+  if (!leaf || typeof leaf !== "object" || Array.isArray(leaf)) return void 0;
+  return leaf;
+}
+function computeExemptFills(prior, incoming, fields) {
+  const out = /* @__PURE__ */ new Map();
+  if (!prior) return out;
+  for (const field of Object.keys(fields)) {
+    const filled = priorFilled(prior, field);
+    if (filled.size === 0) continue;
+    const priorLeaf = singleLeaf(prior, field);
+    const incLeaf = singleLeaf(incoming, field);
+    if (!priorLeaf || !incLeaf) continue;
+    const exempt = /* @__PURE__ */ new Set();
+    for (const loc of filled) {
+      if (incLeaf[loc] !== void 0 && incLeaf[loc] !== "" && incLeaf[loc] === priorLeaf[loc]) {
+        exempt.add(loc);
+      }
+    }
+    if (exempt.size > 0) out.set(field, exempt);
+  }
+  return out;
+}
+function densify(record, prior, fields) {
+  let marker = record[MARKER];
+  for (const [field, descriptor] of Object.entries(fields)) {
+    const leaf = singleLeaf(record, field);
+    if (!leaf) continue;
+    const { languages, substitute, smartSubstitute } = descriptor.options;
+    const filledSet = priorFilled(prior, field);
+    const priorLeaf = singleLeaf(prior ?? {}, field);
+    const isUnchangedFill = (loc) => filledSet.has(loc) && priorLeaf?.[loc] !== void 0 && leaf[loc] === priorLeaf[loc];
+    const authored = {};
+    for (const [loc, val] of Object.entries(leaf)) {
+      if (typeof val === "string" && val !== "" && !isUnchangedFill(loc)) authored[loc] = val;
+    }
+    const filled = [];
+    for (const loc of languages) {
+      if (authored[loc] !== void 0) continue;
+      const sub = resolveI18nText(authored, loc, void 0, field, {
+        policy: "substitute",
+        substitute: substitute ?? ["any"],
+        ...smartSubstitute ? { smartSubstitute } : {}
+      });
+      if (typeof sub === "string" && sub !== "") {
+        leaf[loc] = sub;
+        filled.push(loc);
+      } else if (isUnchangedFill(loc)) {
+        delete leaf[loc];
+      }
+    }
+    if (filled.length > 0) {
+      marker ??= {};
+      marker[field] = filled;
+    } else if (marker) {
+      delete marker[field];
+    }
+  }
+  if (marker && Object.keys(marker).length > 0) {
+    record[MARKER] = marker;
+  } else {
+    delete record[MARKER];
+  }
+}
 
-// src/i18n/active.ts
+// src/with-shape/i18n/active.ts
 function withI18n() {
   return {
     applyI18nLocale,
     validateI18nTextValue,
     enforceScript,
+    computeExemptFills,
+    densify,
     buildDictionaryHandle(opts) {
       return new DictionaryHandle(
         opts.adapter,
@@ -63,7 +147,9 @@ export {
   MissingTranslationError,
   ReservedCollectionNameError,
   ScriptViolationError,
+  StaticDictReadonlyError,
   TranslatorNotConfiguredError,
+  UnknownDictCodeError,
   applyI18nLocale,
   dictCollectionName,
   dictKey,
@@ -74,9 +160,12 @@ export {
   isDictCollectionName,
   isDictKeyDescriptor,
   isI18nTextDescriptor,
+  isStaticDictDescriptor,
   resolveI18nText,
   resolvePolicy,
   setAtPathInPlace,
+  staticDict,
+  stripI18nFilled,
   validateI18nTextValue,
   withI18n
 };

package/dist/i18n/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/i18n/active.ts"],"sourcesContent":["/**\n * Active i18n strategy — `withI18n()` returns the real implementation\n * that wires multi-locale resolution, i18nText validation, and the\n * `DictionaryHandle` for `dictKey` fields into the core read/write\n * paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withI18n } from '@noy-db/hub/i18n'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   i18nStrategy: withI18n(),\n * })\n * ```\n *\n * The factory delegates to the existing `core.ts` and `dictionary.ts`\n * modules. Splitting the import chain through this file is what lets\n * tsup tree-shake the `~854 LOC` of dictionary + locale resolution\n * out of the default bundle when no `withI18n()` import is present.\n *\n * @public\n */\n\nimport type { I18nStrategy, BuildDictionaryHandleOptions } from './strategy.js'\nimport { applyI18nLocale, validateI18nTextValue } from './core.js'\nimport { enforceScript } from './script.js'\nimport { DictionaryHandle } from './dictionary.js'\n\nexport function withI18n(): I18nStrategy {\n  return {\n    applyI18nLocale,\n    validateI18nTextValue,\n    enforceScript,\n    buildDictionaryHandle<Keys extends string = string>(\n      opts: BuildDictionaryHandleOptions<Keys>,\n    ): DictionaryHandle<Keys> {\n      return new DictionaryHandle<Keys>(\n        opts.adapter,\n        opts.compartmentName,\n        opts.dictionaryName,\n        opts.keyring,\n        opts.getDEK,\n        opts.encrypted,\n        opts.ledger,\n        opts.options,\n        opts.findAndUpdateReferences,\n        opts.emitter,\n      )\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBACE,MACwB;AACxB,aAAO,IAAI;AAAA,QACT,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-shape/i18n/densify.ts","../../src/with-shape/i18n/active.ts"],"sourcesContent":["/**\n * `densifyOnWrite` — eager-fill empty i18n slots from each field's\n * substitute chain at write time, recording provenance in the internal\n * `_i18nFilled` marker (decision A: dense map + prior-read).\n *\n * Pure functions over plain records; all DB wiring lives in collection.ts.\n * Only single-leaf i18n fields are supported (array-wildcard paths are\n * skipped, mirroring auto-translate).\n */\nimport { getAtPath, resolveI18nText } from './core.js'\nimport type { I18nTextDescriptor } from './core.js'\n\nconst MARKER = '_i18nFilled'\n\ntype Leaf = Record<string, string>\n\n/** Locales recorded as densify-filled on the prior record for `field`. */\nfunction priorFilled(prior: Record<string, unknown> | undefined, field: string): Set<string> {\n  if (!prior) return new Set()\n  const marker = prior[MARKER] as Record<string, string[]> | undefined\n  return new Set(marker?.[field] ?? [])\n}\n\n/** The single leaf map for `field`, or undefined for absent / array-wildcard / non-object. */\nfunction singleLeaf(record: Record<string, unknown>, field: string): Leaf | undefined {\n  const leaves = getAtPath(record, field)\n  if (leaves.length !== 1) return undefined\n  const leaf = leaves[0]\n  if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) return undefined\n  return leaf as Leaf\n}\n\n/**\n * Per field, the locales that are UNCHANGED round-tripped densify fills — i.e.\n * marked filled on the prior record AND identical in the incoming record.\n * These are exempt from write-time script enforcement (they are derived copies,\n * not authored text). Slots the user changed are NOT exempt (validated as authored).\n */\nexport function computeExemptFills(\n  prior: Record<string, unknown> | undefined,\n  incoming: Record<string, unknown>,\n  fields: Record<string, I18nTextDescriptor>,\n): Map<string, Set<string>> {\n  const out = new Map<string, Set<string>>()\n  if (!prior) return out\n  for (const field of Object.keys(fields)) {\n    const filled = priorFilled(prior, field)\n    if (filled.size === 0) continue\n    const priorLeaf = singleLeaf(prior, field)\n    const incLeaf = singleLeaf(incoming, field)\n    if (!priorLeaf || !incLeaf) continue\n    const exempt = new Set<string>()\n    for (const loc of filled) {\n      if (incLeaf[loc] !== undefined && incLeaf[loc] !== '' && incLeaf[loc] === priorLeaf[loc]) {\n        exempt.add(loc)\n      }\n    }\n    if (exempt.size > 0) out.set(field, exempt)\n  }\n  return out\n}\n\n/**\n * Mutate `record` in place: fill empty declared-language slots for each\n * densify-enabled field from the field's substitute chain, recompute unchanged\n * prior fills, clear marks for slots that became authored, and write the\n * resulting `_i18nFilled` marker (removed when empty).\n *\n * `prior` is read-only — it is never mutated.\n *\n * Provenance uses value-equality (decision A): a slot counts as an unchanged\n * fill when it was prior-marked AND its value still equals the prior value. A\n * consequence is that re-authoring a value byte-identical to the existing fill\n * keeps it classified as a fill (the visible value is unchanged either way; the\n * slot stays script-exempt and will auto-refresh if its source later changes).\n * This is inherent to value-equality provenance, not a bug.\n */\nexport function densify(\n  record: Record<string, unknown>,\n  prior: Record<string, unknown> | undefined,\n  fields: Record<string, I18nTextDescriptor>,\n): void {\n  let marker = record[MARKER] as Record<string, string[]> | undefined\n\n  for (const [field, descriptor] of Object.entries(fields)) {\n    const leaf = singleLeaf(record, field)\n    if (!leaf) continue\n    const { languages, substitute, smartSubstitute } = descriptor.options\n    const filledSet = priorFilled(prior, field)\n    const priorLeaf = singleLeaf(prior ?? {}, field)\n    const isUnchangedFill = (loc: string): boolean =>\n      filledSet.has(loc) && priorLeaf?.[loc] !== undefined && leaf[loc] === priorLeaf[loc]\n\n    // Authored source = present, non-empty, NOT an unchanged prior fill.\n    const authored: Leaf = {}\n    for (const [loc, val] of Object.entries(leaf)) {\n      if (typeof val === 'string' && val !== '' && !isUnchangedFill(loc)) authored[loc] = val\n    }\n\n    const filled: string[] = []\n    for (const loc of languages) {\n      if (authored[loc] !== undefined) continue // real value present → not a fill\n      const sub = resolveI18nText(authored, loc, undefined, field, {\n        policy: 'substitute',\n        substitute: substitute ?? ['any'],\n        ...(smartSubstitute ? { smartSubstitute } : {}),\n      })\n      if (typeof sub === 'string' && sub !== '') {\n        leaf[loc] = sub\n        filled.push(loc)\n      } else if (isUnchangedFill(loc)) {\n        delete leaf[loc] // stale fill with no source left → drop it\n      }\n    }\n\n    if (filled.length > 0) {\n      marker ??= {}\n      marker[field] = filled\n    } else if (marker) {\n      delete marker[field]\n    }\n  }\n\n  if (marker && Object.keys(marker).length > 0) {\n    record[MARKER] = marker\n  } else {\n    delete record[MARKER]\n  }\n}\n","/**\n * Active i18n strategy — `withI18n()` returns the real implementation\n * that wires multi-locale resolution, i18nText validation, and the\n * `DictionaryHandle` for `dictKey` fields into the core read/write\n * paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withI18n } from '@noy-db/hub/i18n'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   i18nStrategy: withI18n(),\n * })\n * ```\n *\n * The factory delegates to the existing `core.ts` and `dictionary.ts`\n * modules. Splitting the import chain through this file is what lets\n * tsup tree-shake the `~854 LOC` of dictionary + locale resolution\n * out of the default bundle when no `withI18n()` import is present.\n *\n * @public\n */\n\nimport type { I18nStrategy, BuildDictionaryHandleOptions } from './strategy.js'\nimport { applyI18nLocale, validateI18nTextValue } from './core.js'\nimport { enforceScript } from './script.js'\nimport { computeExemptFills, densify } from './densify.js'\nimport { DictionaryHandle } from './dictionary.js'\n\nexport function withI18n(): I18nStrategy {\n  return {\n    applyI18nLocale,\n    validateI18nTextValue,\n    enforceScript,\n    computeExemptFills,\n    densify,\n    buildDictionaryHandle<Keys extends string = string>(\n      opts: BuildDictionaryHandleOptions<Keys>,\n    ): DictionaryHandle<Keys> {\n      return new DictionaryHandle<Keys>(\n        opts.adapter,\n        opts.compartmentName,\n        opts.dictionaryName,\n        opts.keyring,\n        opts.getDEK,\n        opts.encrypted,\n        opts.ledger,\n        opts.options,\n        opts.findAndUpdateReferences,\n        opts.emitter,\n      )\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAM,SAAS;AAKf,SAAS,YAAY,OAA4C,OAA4B;AAC3F,MAAI,CAAC,MAAO,QAAO,oBAAI,IAAI;AAC3B,QAAM,SAAS,MAAM,MAAM;AAC3B,SAAO,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC;AACtC;AAGA,SAAS,WAAW,QAAiC,OAAiC;AACpF,QAAM,SAAS,UAAU,QAAQ,KAAK;AACtC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,OAAO,OAAO,CAAC;AACrB,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,SAAO;AACT;AAQO,SAAS,mBACd,OACA,UACA,QAC0B;AAC1B,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,UAAM,SAAS,YAAY,OAAO,KAAK;AACvC,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,YAAY,WAAW,OAAO,KAAK;AACzC,UAAM,UAAU,WAAW,UAAU,KAAK;AAC1C,QAAI,CAAC,aAAa,CAAC,QAAS;AAC5B,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,QAAQ;AACxB,UAAI,QAAQ,GAAG,MAAM,UAAa,QAAQ,GAAG,MAAM,MAAM,QAAQ,GAAG,MAAM,UAAU,GAAG,GAAG;AACxF,eAAO,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,EAAG,KAAI,IAAI,OAAO,MAAM;AAAA,EAC5C;AACA,SAAO;AACT;AAiBO,SAAS,QACd,QACA,OACA,QACM;AACN,MAAI,SAAS,OAAO,MAAM;AAE1B,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,QAAI,CAAC,KAAM;AACX,UAAM,EAAE,WAAW,YAAY,gBAAgB,IAAI,WAAW;AAC9D,UAAM,YAAY,YAAY,OAAO,KAAK;AAC1C,UAAM,YAAY,WAAW,SAAS,CAAC,GAAG,KAAK;AAC/C,UAAM,kBAAkB,CAAC,QACvB,UAAU,IAAI,GAAG,KAAK,YAAY,GAAG,MAAM,UAAa,KAAK,GAAG,MAAM,UAAU,GAAG;AAGrF,UAAM,WAAiB,CAAC;AACxB,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC7C,UAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,CAAC,gBAAgB,GAAG,EAAG,UAAS,GAAG,IAAI;AAAA,IACtF;AAEA,UAAM,SAAmB,CAAC;AAC1B,eAAW,OAAO,WAAW;AAC3B,UAAI,SAAS,GAAG,MAAM,OAAW;AACjC,YAAM,MAAM,gBAAgB,UAAU,KAAK,QAAW,OAAO;AAAA,QAC3D,QAAQ;AAAA,QACR,YAAY,cAAc,CAAC,KAAK;AAAA,QAChC,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC/C,CAAC;AACD,UAAI,OAAO,QAAQ,YAAY,QAAQ,IAAI;AACzC,aAAK,GAAG,IAAI;AACZ,eAAO,KAAK,GAAG;AAAA,MACjB,WAAW,gBAAgB,GAAG,GAAG;AAC/B,eAAO,KAAK,GAAG;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,iBAAW,CAAC;AACZ,aAAO,KAAK,IAAI;AAAA,IAClB,WAAW,QAAQ;AACjB,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAC5C,WAAO,MAAM,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,OAAO,MAAM;AAAA,EACtB;AACF;;;AC/FO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBACE,MACwB;AACxB,aAAO,IAAI;AAAA,QACT,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/in/index.d.ts

@@ -0,0 +1,5 @@
+export { ey as ChangeEvent, ci as Collection, gg as LiveQuery, gR as Noydb, dS as Query, V as Vault } from '../index-_6At2_9_.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-Ccd1hS7a.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/in/index.js

@@ -0,0 +1 @@
+//# sourceMappingURL=index.js.map

package/dist/in/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index-B9QdHytu.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Hub-level write lifecycle hooks. `onBeforeWrite` may abort (throw);
+ * `onAfterWrite` is awaited and its errors are warned, not thrown. A
+ * re-entrancy flag suppresses nested firing so a handler that writes can't
+ * loop. Held on the Noydb instance, threaded into every Collection.
+ */
+interface WriteEvent {
+    readonly op: 'create' | 'update' | 'delete';
+    readonly vault: string;
+    readonly collection: string;
+    readonly docId: string;
+    readonly before: unknown;
+    readonly after: unknown;
+    readonly baseVersion: number;
+    readonly version: number;
+    readonly userId: string;
+    readonly timestamp: number;
+    readonly txId: string;
+}
+type WriteHook = (event: WriteEvent) => void | Promise<void>;
+type Unsubscribe = () => void;
+declare class WriteHookRegistry {
+    #private;
+    /** True while handlers are running — used by the write path to skip nested firing. */
+    get suppressed(): boolean;
+    /** True when any hook is registered (cheap gate for the write path). */
+    get hasHandlers(): boolean;
+    onBeforeWrite(handler: WriteHook): Unsubscribe;
+    onAfterWrite(handler: WriteHook): Unsubscribe;
+    /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+    runBefore(event: WriteEvent): Promise<void>;
+    /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+    runAfter(event: WriteEvent): Promise<void>;
+}
+
+/**
+ * Kernel coordination port — the injected `CoordinationProvider` seam for the
+ * schema-fence drain-barrier.
+ *
+ * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement
+ * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)
+ * drives it through the `Noydb` handle without ever naming a `by-*` package.
+ * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.
+ *
+ * This module carries only the port TYPES plus two pure-ish helpers:
+ * {@link isQuorum} (a pure quorum predicate extracted from the legacy
+ * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol
+ * the migration cutover and klum both call).
+ *
+ * @module
+ */
+
+/** Vault fence state (the existing FenceDoc shape). */
+interface FenceState {
+    readonly currentSchemaVersion: number;
+    readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
+}
+/** A writer's presence + ack, tagged with the session that owns it. */
+interface WriterPresence {
+    /** = today's clientId (one per tab/peer). */
+    readonly writerId: string;
+    /** Groups one user's writers across vaults (consolidation is klum's job). */
+    readonly sessionId: string;
+    readonly lastSeen: number;
+    readonly quiescedAtVersion: number | null;
+}
+/** Session-addressable drain-barrier coordination transport. Per-vault ops. */
+interface CoordinationProvider {
+    /** orchestrator → all writers */
+    setFence(vault: string, fence: FenceState): Promise<void>;
+    /**
+     * Fresh one-shot fence read for the write-path gate (`assertWritable`).
+     * A direct read (not a cached `observeFence` snapshot) avoids a staleness
+     * window and keeps the timing-sensitive cutover gate exact. The store
+     * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.
+     */
+    readFence(vault: string): Promise<FenceState>;
+    /** writer observes fence changes (default: poll-emit; by-*: push) */
+    observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe;
+    /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */
+    reportPresence(vault: string, p: WriterPresence): Promise<void>;
+    /** orchestrator observes presence changes (default: poll-emit; by-*: push) */
+    observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe;
+    /** orchestrator one-shot snapshot of reachable writers (quorum input) */
+    reachableWriters(vault: string, o: {
+        staleMs: number;
+        now: number;
+    }): Promise<readonly WriterPresence[]>;
+}
+/**
+ * Pure quorum predicate: true when every writer (other than `excludeWriterId`)
+ * has acked at exactly `generation`. An empty set is trivially a quorum.
+ *
+ * Extracted from the legacy `activeQuiesced` store-polling check so the
+ * migration cutover, the store default provider, and `by-*` real-time
+ * providers all share one definition of "everyone has drained".
+ */
+declare function isQuorum(writers: readonly WriterPresence[], generation: number, excludeWriterId?: string): boolean;
+/** Inputs for {@link runDrainBarrier}. */
+interface DrainBarrierOptions {
+    readonly vault: string;
+    readonly generation: number;
+    readonly writerId: string;
+    readonly onFlush: () => Promise<void>;
+    readonly staleMs: number;
+    readonly quiesceTimeoutMs: number;
+    readonly now: () => number;
+    /** Optional seam (mainly for deterministic tests) run before each poll tick. */
+    readonly onPoll?: () => Promise<void>;
+}
+/**
+ * The reusable drain-barrier protocol shared by the migration cutover and klum:
+ *
+ *   drain self → setFence(draining) → await quorum (presence push + isQuorum,
+ *   polling as a fallback, or timeout) → run() → release-by-caller.
+ *
+ * Resolves once every reachable writer (excluding `writerId`) has quiesced at
+ * `generation`, at which point `run` is invoked exactly once. Rejects with
+ * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.
+ */
+declare function runDrainBarrier(provider: CoordinationProvider, o: DrainBarrierOptions, run: () => Promise<void>): Promise<void>;
+
+export { type CoordinationProvider as C, type DrainBarrierOptions as D, type FenceState as F, type Unsubscribe as U, type WriteEvent as W, type WriteHook as a, WriteHookRegistry as b, type WriterPresence as c, isQuorum as i, runDrainBarrier as r };

package/dist/index-CGLLRtFc.d.ts

@@ -0,0 +1,123 @@
+import { cT as NoydbStore, dg as SealingKeyProvider, cF as UnlockedKeyring, ex as CargoStrategy } from './index-_6At2_9_.js';
+import './ulid-DRH25k3y.js';
+import './index-B9QdHytu.js';
+import './kernel/index.js';
+import './describe-Ccd1hS7a.js';
+import './vault-diff-BtpiBvic.js';
+
+/**
+ * Hub-core constants that must be referenceable without pulling any
+ * service chunk. Kept import-free.
+ */
+/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
+declare const STATE_VAULT_NAME = "__noydb_state__";
+/**
+ * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
+ * typical profile + preferences + small app annex is ~1 KiB); rejects
+ * accidental "stuff app state in here" anti-patterns.
+ */
+declare const USER_ENVELOPE_MAX_BYTES: number;
+/**
+ * Reserved store collection name for user envelopes. Starts with `_` so the
+ * keyring grant machinery propagates the DEK to every granted user via the
+ * existing system-collection DEK propagation path in `team/keyring.ts`.
+ */
+declare const USER_ENVELOPE_COLLECTION = "_users";
+
+/**
+ * FR-6 — Deed: sealed / hidden-owner provisioning.
+ *
+ * A **Deed** is a vault owned by a *latent* principal who never
+ * authenticates. The owner credential (the random passphrase that
+ * derives `KEK_owner`) is minted machine-side and sealed under a
+ * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
+ * the cryptographic *inalienability anchor*: whoever holds the
+ * provider (the client / their KMS) is the only party that can ever
+ * re-derive `KEK_owner`. A firm-side custodian operates the vault
+ * fully but can never reach the owner key — there is deliberately NO
+ * firm-controlled fallback.
+ *
+ * Provisioning reuses the managed-mode seam:
+ *   - {@link resolveManagedSecret} mints + seals + persists the random
+ *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     subsequent open through the same provider).
+ *   - {@link createOwnerKeyring} derives `KEK_owner` from that
+ *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *
+ * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
+ * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
+ * sealing boundary protects them, so it must be readable without
+ * unlocking the vault (a custodian or auditor inspecting the vault must
+ * be able to see "this is a Deed vault, owner = X, sealed under Y"
+ * without any key). The marker itself is therefore never sealed; only
+ * the owner *credential* is.
+ *
+ * @module
+ */
+
+/** Reserved id for the Deed marker under `_meta`. */
+declare const DEED_RECORD_ID: "deed";
+/**
+ * Plaintext metadata recording a vault's latent-owner Deed. Persisted
+ * at `_meta/deed`. Readable without unlocking the vault by design — it
+ * carries no secret material, only the identity of the latent owner
+ * and the sealing boundary that anchors inalienability.
+ */
+interface DeedMarker {
+    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
+    readonly ownerUserId: string;
+    /**
+     * The `SealingKeyProvider.id` the owner credential is sealed under.
+     * The inalienability anchor: only the holder of this (non-firm)
+     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
+     */
+    readonly sealedUnder: string;
+    /** Always `true` for a Deed — the owner never authenticates interactively. */
+    readonly latent: true;
+    /** ISO-8601 timestamp the Deed was issued. */
+    readonly issuedAt: string;
+    /**
+     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
+     * via the audited Liberate ceremony), if any. Absent until liberation.
+     */
+    readonly liberatedAt?: string;
+}
+/**
+ * Provision a Deed: a latent owner whose credential is sealed under
+ * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * via {@link resolveManagedSecret}, derives the owner keyring via
+ * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
+ * marker. Returns the unlocked owner keyring.
+ *
+ * The returned keyring is the only in-memory window onto `KEK_owner`
+ * for this call; the persistent re-entry point is the sealing provider
+ * (re-run {@link resolveManagedSecret} with the same provider to
+ * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive passphrase is ever required).
+ *
+ * There is deliberately no firm-controlled fallback: the marker's
+ * `sealedUnder` is the single cryptographic anchor of ownership.
+ */
+declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
+/**
+ * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
+ * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
+ * unlocking required.
+ */
+declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
+/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
+declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
+
+/**
+ * Enable the cargo (partition extraction) capability.
+ * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side
+ * `extractPartition(vault, ...)` free function live. The extraction crypto
+ * engine is dynamically imported here, so it stays out of the floor bundle
+ * until opted in. The recipient-side `adoptPartition` /
+ * `decryptExtractedPartition` free functions — and `diffVault` (shared
+ * import/merge infra) — are ungated and unaffected.
+ */
+
+declare function withCargo(): CargoStrategy;
+
+export { DEED_RECORD_ID as D, STATE_VAULT_NAME as S, USER_ENVELOPE_COLLECTION as U, type DeedMarker as a, USER_ENVELOPE_MAX_BYTES as b, createDeedOwner as c, isDeedVault as i, loadDeedMarker as l, withCargo as w };