@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/consent/index.js

@@ -2,11 +2,17 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-MTMJVJ5W.js";
+} from "../chunk-TMBXVJKT.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/crdt/index.d.ts

@@ -1,7 +1,6 @@
-import { bf as CrdtStrategy } from '../index-BzUo1B6n.js';
-export { bg as CrdtMode, bh as CrdtState, bi as LwwMapState, bj as RgaState, bk as YjsState, bl as buildLwwMapState, bm as buildRgaState, bn as mergeCrdtStates, bo as resolveCrdtSnapshot } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import { aC as CrdtStrategy } from '../index-DjWbxsjb.js';
+export { aD as CrdtMode, aE as CrdtState, aF as LwwMapState, aG as RgaState, aH as YjsState, aI as buildLwwMapState, aJ as buildRgaState, aK as mergeCrdtStates, aL as resolveCrdtSnapshot } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/dead-filter-HQIE2YG7.js

@@ -0,0 +1,28 @@
+import {
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/satellites/dead-filter.ts
+async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
+  const { loadPersistedSchema } = await import("./storage-ADNP2UWI.js");
+  const out = /* @__PURE__ */ new Map();
+  for (const name of collectionNames) {
+    if (name.startsWith("_")) continue;
+    let dek;
+    try {
+      dek = await getDEK(name);
+    } catch {
+      continue;
+    }
+    const persisted = await loadPersistedSchema(store, vaultName, name, dek);
+    const marker = persisted?.satellite;
+    if (!marker) continue;
+    out.set(name, await liveBaseIdSet(store, vaultName, marker.base));
+  }
+  return out;
+}
+export {
+  liveBaseIdSetsForBundle
+};
+//# sourceMappingURL=dead-filter-HQIE2YG7.js.map

package/dist/dead-filter-HQIE2YG7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/delegation-BJP73GAP.js

@@ -0,0 +1,25 @@
+import {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+} from "./chunk-DV4HUP5G.js";
+import "./chunk-7BWJHO2A.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=delegation-BJP73GAP.js.map

package/dist/derivations/index.d.ts

@@ -1,8 +1,7 @@
-export { w as withDerivation, a as withRollup } from '../with-rollup-BvQo3ROo.js';
-import { c2 as DerivationStrategy, c3 as DerivationContext } from '../index-BzUo1B6n.js';
-export { c4 as ArrayOutputSpec, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, ca as DerivationRegistry, cb as DerivationStrategyHandle, cc as DerivedFromMeta, cd as OutputSpec, ce as RecordOutputSpec } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-DEKGI9vb.js';
+import { bx as DerivationStrategy, by as DerivationContext } from '../index-DjWbxsjb.js';
+export { bz as ArrayOutputSpec, bA as DerivationCapExceededError, bB as DerivationCycleError, bC as DerivationDepthError, bD as DerivationOutputShapeError, bE as DerivationOutputUnknownError, bF as DerivationRegistry, bG as DerivationStrategyHandle, bH as DerivedFromMeta, bI as OutputSpec, bJ as RecordOutputSpec } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/derivations/index.js

@@ -1,22 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-LMTH2RM6.js";
+} from "../chunk-KNZB6JMR.js";
 import {
   DerivationRegistry
-} from "../chunk-Q7SS3IME.js";
+} from "../chunk-XUBPSPKD.js";
+import "../chunk-FUOE7UUV.js";
 import {
   DerivationExecutor
-} from "../chunk-PKHL44ER.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-LEJIKBBB.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-BME7HDWO.js

@@ -0,0 +1,21 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-5I35DOHK.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-BME7HDWO.js.map

package/dist/{dev-unlock-C9Ro3v_O.d.ts → dev-unlock-Bmm2pgJ0.d.ts}

@@ -1,4 +1,4 @@
-import { cR as Role, cF as UnlockedKeyring } from './index-BzUo1B6n.js';
+import { cY as Role, c8 as UnlockedKeyring } from './index-DjWbxsjb.js';
 
 /**
  * Session tokens —

package/dist/{enclave-UL5LW66V.js → enclave-NHORSWSF.js}

@@ -1,13 +1,49 @@
 import {
   RecordCodec,
   SEALED_CEK_NS,
+  envelopeBodyForHash,
+  findByDet,
+  hasPerRecordKey,
+  makeReservedEnvelopes,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  writeEnvelopeBody
+} from "./chunk-MCHVVJIA.js";
+import {
+  buildDeleteMarker,
+  buildTombstone,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape
+} from "./chunk-QA2KUPCP.js";
+import {
+  ctEqualTags,
+  deriveVdigSlotKey,
+  evaluateKofN
+} from "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import {
+  computeBidxTarget,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag
+} from "./chunk-HYR4WZZ3.js";
+import {
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
   base64ToBuffer,
   bufferToBase64,
-  buildTombstone,
   decrypt,
   decryptBytes,
   decryptBytesWithAAD,
   decryptDeterministic,
+  deriveDeterministicKey,
   deriveKey,
   derivePassphraseKey,
   derivePresenceKey,
@@ -17,52 +53,48 @@ import {
   encryptBytes,
   encryptBytesWithAAD,
   encryptDeterministic,
-  envelopeBodyForHash,
-  findByDet,
   generateDEK,
   generateIV,
   generateSalt,
-  hasPerRecordKey,
   hmacSha256Hex,
   importCek,
-  isTombstone,
-  openEnvelopeJson,
-  queryByDet,
-  resolveStableCek,
-  revokeSealedRecord,
-  rewrapBodyToDek,
-  rotateRecordCek,
-  sealRecordToHost,
   sha256Hex,
   unwrapCek,
   unwrapKey,
   wrapCek,
-  wrapKey,
-  writeEnvelopeBody
-} from "./chunk-5O3AOPDT.js";
-import "./chunk-5TDJ56JE.js";
-import "./chunk-ZYUC53LT.js";
+  wrapKey
+} from "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
   SEALED_CEK_NS,
   base64ToBuffer,
   bufferToBase64,
+  buildDeleteMarker,
   buildTombstone,
+  computeBidxTarget,
+  ctEqualTags,
   decrypt,
   decryptBytes,
   decryptBytesWithAAD,
   decryptDeterministic,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  deriveDeterministicKey,
   deriveKey,
   derivePassphraseKey,
   derivePresenceKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
+  deriveVdigSlotKey,
   encrypt,
   encryptBytes,
   encryptBytesWithAAD,
   encryptDeterministic,
   envelopeBodyForHash,
+  evaluateKofN,
   findByDet,
   generateDEK,
   generateIV,
@@ -70,8 +102,13 @@ export {
   hasPerRecordKey,
   hmacSha256Hex,
   importCek,
+  isDeleteMarker,
   isTombstone,
+  isTombstoneShape,
+  makeReservedEnvelopes,
+  mintBidxTag,
   openEnvelopeJson,
+  pbkdf2VerifyDigest,
   queryByDet,
   resolveStableCek,
   revokeSealedRecord,
@@ -85,4 +122,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-UL5LW66V.js.map
+//# sourceMappingURL=enclave-NHORSWSF.js.map

package/dist/executor-FE6X4LFX.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-LEJIKBBB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-FE6X4LFX.js.map

package/dist/executor-KSHKRJXP.js

@@ -0,0 +1,25 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-LL2NIVUR.js";
+import "./chunk-WZSCE6RM.js";
+import "./chunk-3QSIU3UT.js";
+import "./chunk-NUEQU36L.js";
+import "./chunk-UF362QVH.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-DFVUTGT2.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-EOXAAJTY.js";
+import "./chunk-VEAVKDDB.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-KSHKRJXP.js.map

package/dist/executor-ZHTJJICG.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-VWRRVE6D.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-ZHTJJICG.js.map

package/dist/export-accessible-DACHM5VT.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-OT76OZL6.js";
+import "./chunk-QSFOZUYL.js";
+import "./chunk-OXCSVM3B.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-DACHM5VT.js.map

package/dist/extract-partition-RNENZZ4T.js

@@ -0,0 +1,36 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-YMVQD5Q5.js";
+import "./chunk-T7WSLRAU.js";
+import "./chunk-XH7XP3OL.js";
+import "./chunk-QSFOZUYL.js";
+import "./chunk-OXCSVM3B.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-UF362QVH.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-RNENZZ4T.js.map

package/dist/{fanout-sidecar-GF3DJ6KR.js → fanout-sidecar-OFWN3NM7.js}

@@ -1,11 +1,18 @@
 import {
-  encrypt,
   openEnvelopeJson
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "./chunk-3OPY6MK2.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
-import "./chunk-ZYUC53LT.js";
+} from "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -16,15 +23,11 @@ function recordId(source, sourceId, outputKey) {
 async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
-  try {
-    const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
-    const parsed = JSON.parse(json);
-    if (parsed._noydb_fanout !== 1) return void 0;
-    if (!Array.isArray(parsed.keys)) return void 0;
-    return parsed;
-  } catch {
-    return void 0;
-  }
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const parsed = JSON.parse(json);
+  if (parsed._noydb_fanout !== 1) return void 0;
+  if (!Array.isArray(parsed.keys)) return void 0;
+  return parsed;
 }
 async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
   const doc = {
@@ -68,4 +71,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-GF3DJ6KR.js.map
+//# sourceMappingURL=fanout-sidecar-OFWN3NM7.js.map

package/dist/fanout-sidecar-OFWN3NM7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: json,\n    }\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION))\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: iv,\n      _data: data,\n    }\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,UAAU,MAAM,OAAO,qBAAqB,CAAC;AACxE,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,CAAC;AAC5E,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/fence-watcher-DHQ775JB.js

@@ -0,0 +1,69 @@
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/schema-update/fence-watcher.ts
+var FenceWatcher = class {
+  #coordination;
+  #vault;
+  #writerId;
+  #sessionId;
+  #onFlush;
+  #now;
+  #emit;
+  #lastState = null;
+  #quiescedAtVersion = null;
+  #timer;
+  constructor(opts) {
+    this.#coordination = opts.coordination;
+    this.#vault = opts.vault;
+    this.#writerId = opts.clientId;
+    this.#sessionId = opts.sessionId ?? opts.clientId;
+    this.#onFlush = opts.onFlush;
+    this.#now = opts.now ?? (() => Date.now());
+    this.#emit = opts.emit ?? (() => {
+    });
+  }
+  /** Publish liveness (and the current ack) without changing quiesce state. */
+  async beat() {
+    await this.#coordination.reportPresence(this.#vault, {
+      writerId: this.#writerId,
+      sessionId: this.#sessionId,
+      lastSeen: this.#now(),
+      quiescedAtVersion: this.#quiescedAtVersion
+    });
+  }
+  /** Poll the fence; quiesce on draining; emit on transitions. */
+  async check() {
+    const fence = await this.#coordination.readFence(this.#vault);
+    if (fence.fenceState !== this.#lastState) {
+      this.#lastState = fence.fenceState;
+      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState });
+    }
+    if (fence.fenceState === "draining" && this.#quiescedAtVersion !== fence.currentSchemaVersion) {
+      await this.#onFlush();
+      this.#quiescedAtVersion = fence.currentSchemaVersion;
+      await this.beat();
+    }
+    if (fence.fenceState === "normal") {
+      this.#quiescedAtVersion = null;
+    }
+  }
+  start(intervalMs) {
+    if (this.#timer) return;
+    this.#timer = setInterval(() => {
+      void this.beat();
+      void this.check();
+    }, intervalMs);
+    const timer = this.#timer;
+    if (typeof timer.unref === "function") timer.unref();
+  }
+  stop() {
+    if (this.#timer) {
+      clearInterval(this.#timer);
+      this.#timer = void 0;
+    }
+  }
+};
+export {
+  FenceWatcher
+};
+//# sourceMappingURL=fence-watcher-DHQ775JB.js.map

package/dist/fence-watcher-DHQ775JB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence-watcher.ts"],"sourcesContent":["/**\n * Per-client schema-fence watcher. Watches the fence via the injected\n * {@link CoordinationProvider}; on `draining` it drains in-flight writes\n * and reports presence (its ack); emits a same-instance signal on every\n * state transition (for UI). Driven by an interval in production and by\n * explicit `check()`/`beat()` in tests.\n *\n * The transport is the coordination port: the default\n * {@link StoreCoordinationProvider} maps `reportPresence` →\n * `_meta/schema-fence:client:<id>` and `readFence` → `_meta/schema-fence`,\n * so behavior is byte-for-byte the same; `by-tabs` / `by-peer` swap in\n * real-time push transports.\n */\nimport { type FenceState } from './fence.js'\nimport type { CoordinationProvider } from '../../port/by/index.js'\n\nexport interface FenceWatcherEvent {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n}\n\nexport class FenceWatcher {\n  readonly #coordination: CoordinationProvider\n  readonly #vault: string\n  readonly #writerId: string\n  readonly #sessionId: string\n  readonly #onFlush: () => Promise<void>\n  readonly #now: () => number\n  readonly #emit: (e: FenceWatcherEvent) => void\n  #lastState: FenceState | null = null\n  #quiescedAtVersion: number | null = null\n  #timer: ReturnType<typeof setInterval> | undefined\n\n  constructor(opts: {\n    coordination: CoordinationProvider\n    vault: string\n    clientId: string\n    sessionId?: string\n    onFlush: () => Promise<void>\n    now?: () => number\n    emit?: (e: FenceWatcherEvent) => void\n  }) {\n    this.#coordination = opts.coordination\n    this.#vault = opts.vault\n    this.#writerId = opts.clientId\n    this.#sessionId = opts.sessionId ?? opts.clientId\n    this.#onFlush = opts.onFlush\n    this.#now = opts.now ?? (() => Date.now())\n    this.#emit = opts.emit ?? (() => {})\n  }\n\n  /** Publish liveness (and the current ack) without changing quiesce state. */\n  async beat(): Promise<void> {\n    await this.#coordination.reportPresence(this.#vault, {\n      writerId: this.#writerId,\n      sessionId: this.#sessionId,\n      lastSeen: this.#now(),\n      quiescedAtVersion: this.#quiescedAtVersion,\n    })\n  }\n\n  /** Poll the fence; quiesce on draining; emit on transitions. */\n  async check(): Promise<void> {\n    const fence = await this.#coordination.readFence(this.#vault)\n    if (fence.fenceState !== this.#lastState) {\n      this.#lastState = fence.fenceState\n      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState })\n    }\n    if (fence.fenceState === 'draining' && this.#quiescedAtVersion !== fence.currentSchemaVersion) {\n      await this.#onFlush()\n      this.#quiescedAtVersion = fence.currentSchemaVersion\n      await this.beat()\n    }\n    if (fence.fenceState === 'normal') {\n      this.#quiescedAtVersion = null\n    }\n  }\n\n  start(intervalMs: number): void {\n    if (this.#timer) return\n    this.#timer = setInterval(() => { void this.beat(); void this.check() }, intervalMs)\n    const timer = this.#timer as unknown as { unref?: () => void }\n    if (typeof timer.unref === 'function') timer.unref() // don't keep the process alive\n  }\n\n  stop(): void {\n    if (this.#timer) { clearInterval(this.#timer); this.#timer = undefined }\n  }\n}\n"],"mappings":";;;AAqBO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAAgC;AAAA,EAChC,qBAAoC;AAAA,EACpC;AAAA,EAEA,YAAY,MAQT;AACD,SAAK,gBAAgB,KAAK;AAC1B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,WAAW,KAAK;AACrB,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,SAAK,QAAQ,KAAK,SAAS,MAAM;AAAA,IAAC;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,UAAM,KAAK,cAAc,eAAe,KAAK,QAAQ;AAAA,MACnD,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK,KAAK;AAAA,MACpB,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,KAAK,MAAM;AAC5D,QAAI,MAAM,eAAe,KAAK,YAAY;AACxC,WAAK,aAAa,MAAM;AACxB,WAAK,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,YAAY,MAAM,WAAW,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,eAAe,cAAc,KAAK,uBAAuB,MAAM,sBAAsB;AAC7F,YAAM,KAAK,SAAS;AACpB,WAAK,qBAAqB,MAAM;AAChC,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,QAAI,MAAM,eAAe,UAAU;AACjC,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,YAA0B;AAC9B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS,YAAY,MAAM;AAAE,WAAK,KAAK,KAAK;AAAG,WAAK,KAAK,MAAM;AAAA,IAAE,GAAG,UAAU;AACnF,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EACrD;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAQ;AAAE,oBAAc,KAAK,MAAM;AAAG,WAAK,SAAS;AAAA,IAAU;AAAA,EACzE;AACF;","names":[]}

package/dist/find-BNGBJNKP.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-BNGBJNKP.js.map

package/dist/forget/index.d.ts

@@ -1,5 +1,5 @@
-import { S as SubjectDeclaration, F as ForgetStrategy } from '../subject-index-O75wKshW.js';
-export { a as ForgetResult, N as NO_FORGET, b as SUBJECT_INDEX_COLLECTION, c as SubjectRef } from '../subject-index-O75wKshW.js';
+import { S as SubjectDeclaration, F as ForgetStrategy } from '../subject-index-CyOgGMJL.js';
+export { a as ForgetResult, N as NO_FORGET, b as SUBJECT_INDEX_COLLECTION, c as SubjectRef } from '../subject-index-CyOgGMJL.js';
 
 /**
  * `withForgetCascade` — the active factory for GDPR right-to-erasure via

package/dist/forget/index.js

@@ -1,10 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-SRB2XEWB.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-ANB77BVV.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/forget/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects } }\n}\n"],"mappings":";;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE;AAC1C;","names":[]}
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects } }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE;AAC1C;","names":[]}