@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/snapshots/index.js

@@ -1,13 +1,19 @@
 import {
   readPod,
   writePod
-} from "../chunk-FISN7WE4.js";
-import "../chunk-SMXWYP24.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-QSFOZUYL.js";
+import "../chunk-OXCSVM3B.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/snapshots/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-fork/snapshots/engine.ts","../../src/with-fork/snapshots/active.ts"],"sourcesContent":["import { writePod, readPod } from '../../with-pod/bundle.js'\nimport { SnapshotNotFoundError } from '../../kernel/errors.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbPodStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private autoKey(vaultName: string): string {\n    return `${vaultName}__auto`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n      // Preserve the rolling auto slot — on-demand snapshots never touch it.\n      ...(index.auto ? { auto: index.auto } : {}),\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  /**\n   * Rolling auto-snapshot. Overwrites the single fixed `<vault>__auto` key and\n   * stores its meta in `index.auto`, separate from the immutable `snapshots`\n   * pool — retention never prunes it. Used by the cadence scheduler.\n   */\n  async autoSnapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.autoKey(vault.name)\n\n    // Unconditional overwrite of the rolling slot.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      label: opts?.label ?? 'auto',\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n      auto: true,\n    }\n\n    index.auto = meta\n    await this.writeIndex(vault.name, index, indexVersion)\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    const immutable = [...index.snapshots].reverse()\n    return index.auto ? [index.auto, ...immutable] : immutable\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readPod(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotStrategy, RetentionPolicy } from './strategy.js'\nimport type { SnapshotPolicy } from './policy.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbPodStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.\n   * Defaults to no retention (all on-demand snapshots kept forever). Never affects\n   * the rolling auto-snapshot.\n   */\n  retention?: RetentionPolicy\n  /**\n   * Automatic-snapshot cadence. Default `mode:'manual'` ⇒ no timers; snapshots\n   * stay on-demand. Set `mode:'debounce'`/`'interval'` to enable auto-snapshots\n   * to the rolling `<vault>__auto` key.\n   */\n  snapshotPolicy?: SnapshotPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n    autoSnapshot(vault, by, snapOpts) {\n      return engine.autoSnapshot(vault as Vault, by, snapOpts)\n    },\n    ...(opts.snapshotPolicy ? { policy: opts.snapshotPolicy } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEQ,QAAQ,WAA2B;AACzC,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA;AAAA,MAEjC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,IAAI;AAGnC,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,OAAO,MAAM,SAAS;AAAA,MACtB,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAEA,UAAM,OAAO;AACb,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO,YAAY;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,UAAM,YAAY,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAC/C,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,GAAG,SAAS,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzIO,SAAS,cAAc,MAA8C;AAC1E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,IACA,aAAa,OAAO,IAAI,UAAU;AAChC,aAAO,OAAO,aAAa,OAAgB,IAAI,QAAQ;AAAA,IACzD;AAAA,IACA,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-fork/snapshots/engine.ts","../../src/with-fork/snapshots/active.ts"],"sourcesContent":["import { writePod, readPod } from '../../with-pod/bundle.js'\nimport { SnapshotNotFoundError } from '../../kernel/errors.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { SnapshotMeta, RetentionPolicy, SnapshotIndex } from './strategy.js'\n\nexport class SnapshotEngine {\n  constructor(\n    private readonly store: NoydbPodStore,\n    private readonly retention: RetentionPolicy,\n  ) {}\n\n  private indexKey(vaultName: string): string {\n    return `${vaultName}__index`\n  }\n\n  private snapKey(vaultName: string, n: number): string {\n    return `${vaultName}__snap_${n.toString().padStart(6, '0')}`\n  }\n\n  private autoKey(vaultName: string): string {\n    return `${vaultName}__auto`\n  }\n\n  private async readIndex(\n    vaultName: string,\n  ): Promise<{ index: SnapshotIndex; indexVersion: string | null }> {\n    const result = await this.store.readBundle(this.indexKey(vaultName))\n    if (!result) return { index: { snapshots: [], nextCounter: 1 }, indexVersion: null }\n    const text = new TextDecoder().decode(result.bytes)\n    return { index: JSON.parse(text) as SnapshotIndex, indexVersion: result.version }\n  }\n\n  private async writeIndex(\n    vaultName: string,\n    index: SnapshotIndex,\n    expectedVersion: string | null,\n  ): Promise<void> {\n    const bytes = new TextEncoder().encode(JSON.stringify(index))\n    await this.store.writeBundle(this.indexKey(vaultName), bytes, expectedVersion)\n  }\n\n  async snapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.snapKey(vault.name, index.nextCounter)\n\n    // Write blob first. If the subsequent index write fails, the next snapshot()\n    // call will re-derive the same key (counter not persisted) and overwrite this blob.\n    // This is an accepted v1 trade-off: failure window is narrow and requires a store\n    // error between the two writes. A retry produces a fresh snapshot at the same key.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      ...(opts?.label !== undefined ? { label: opts.label } : {}),\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n    }\n\n    const newIndex: SnapshotIndex = {\n      snapshots: [...index.snapshots, meta],\n      nextCounter: index.nextCounter + 1,\n      // Preserve the rolling auto slot — on-demand snapshots never touch it.\n      ...(index.auto ? { auto: index.auto } : {}),\n    }\n    const toDelete = this.applyRetention(newIndex)\n    await this.writeIndex(vault.name, newIndex, indexVersion)\n\n    for (const k of toDelete) {\n      await this.store.deleteBundle(k)\n    }\n\n    return meta\n  }\n\n  /**\n   * Rolling auto-snapshot. Overwrites the single fixed `<vault>__auto` key and\n   * stores its meta in `index.auto`, separate from the immutable `snapshots`\n   * pool — retention never prunes it. Used by the cadence scheduler.\n   */\n  async autoSnapshot(\n    vault: Vault,\n    by: string,\n    opts?: { label?: string; note?: string },\n  ): Promise<SnapshotMeta> {\n    const bytes = await writePod(vault, {})\n    const { index, indexVersion } = await this.readIndex(vault.name)\n    const key = this.autoKey(vault.name)\n\n    // Unconditional overwrite of the rolling slot.\n    await this.store.writeBundle(key, bytes, null)\n\n    const meta: SnapshotMeta = {\n      version: key,\n      label: opts?.label ?? 'auto',\n      ...(opts?.note !== undefined ? { note: opts.note } : {}),\n      exportedAt: new Date().toISOString(),\n      exportedBy: by,\n      size: bytes.length,\n      integrity: 'verified',\n      auto: true,\n    }\n\n    index.auto = meta\n    await this.writeIndex(vault.name, index, indexVersion)\n    return meta\n  }\n\n  async listSnapshots(vaultId: string): Promise<SnapshotMeta[]> {\n    const { index } = await this.readIndex(vaultId)\n    const immutable = [...index.snapshots].reverse()\n    return index.auto ? [index.auto, ...immutable] : immutable\n  }\n\n  async restoreSnapshot(vault: Vault, version: string): Promise<void> {\n    if (!version.startsWith(`${vault.name}__`)) throw new SnapshotNotFoundError(version)\n    const result = await this.store.readBundle(version)\n    if (!result) throw new SnapshotNotFoundError(version)\n    const { dumpJson } = await readPod(result.bytes)\n    await vault.load(dumpJson)\n  }\n\n  /**\n   * Applies the configured retention policy to `index`, mutating `index.snapshots`\n   * in place and returning the blob keys that should be deleted from the store.\n   * Called by `snapshot()` before the index is written.\n   *\n   * @internal — public for direct testing only\n   */\n  applyRetention(index: SnapshotIndex): string[] {\n    const prune = this.retention.prune ?? true\n    if (!prune) return []\n\n    const toDelete: string[] = []\n    let remaining = index.snapshots.slice()\n\n    if (this.retention.keepLast !== undefined && remaining.length > this.retention.keepLast) {\n      const excess = remaining.splice(0, remaining.length - this.retention.keepLast)\n      toDelete.push(...excess.map(m => m.version))\n    }\n\n    if (this.retention.maxAgeDays !== undefined) {\n      const cutoffMs = this.retention.maxAgeDays * 86_400_000\n      const now = Date.now()\n      const fresh = remaining.filter(m => now - new Date(m.exportedAt).getTime() <= cutoffMs)\n      toDelete.push(...remaining.filter(m => !fresh.includes(m)).map(m => m.version))\n      remaining = fresh\n    }\n\n    index.snapshots = remaining\n    return toDelete\n  }\n}\n","import { SnapshotEngine } from './engine.js'\nimport type { SnapshotStrategy, RetentionPolicy } from './strategy.js'\nimport type { SnapshotPolicy } from './policy.js'\nimport type { NoydbPodStore } from '../../kernel/types.js'\nimport type { Vault } from '../../kernel/vault.js'\n\nexport interface WithSnapshotsOptions {\n  /** Bundle store where snapshot blobs and the sidecar index are written. */\n  store: NoydbPodStore\n  /**\n   * Declarative retention policy. Enforced eagerly after each on-demand `snapshot()`.\n   * Defaults to no retention (all on-demand snapshots kept forever). Never affects\n   * the rolling auto-snapshot.\n   */\n  retention?: RetentionPolicy\n  /**\n   * Automatic-snapshot cadence. Default `mode:'manual'` ⇒ no timers; snapshots\n   * stay on-demand. Set `mode:'debounce'`/`'interval'` to enable auto-snapshots\n   * to the rolling `<vault>__auto` key.\n   */\n  snapshotPolicy?: SnapshotPolicy\n}\n\nexport function withSnapshots(opts: WithSnapshotsOptions): SnapshotStrategy {\n  const engine = new SnapshotEngine(opts.store, opts.retention ?? {})\n  return {\n    snapshot(vault, by, snapOpts) {\n      return engine.snapshot(vault as Vault, by, snapOpts)\n    },\n    listSnapshots(vaultId) {\n      return engine.listSnapshots(vaultId)\n    },\n    restoreSnapshot(vault, version) {\n      return engine.restoreSnapshot(vault as Vault, version)\n    },\n    autoSnapshot(vault, by, snapOpts) {\n      return engine.autoSnapshot(vault as Vault, by, snapOpts)\n    },\n    ...(opts.snapshotPolicy ? { policy: opts.snapshotPolicy } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YACmB,OACA,WACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGX,SAAS,WAA2B;AAC1C,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEQ,QAAQ,WAAmB,GAAmB;AACpD,WAAO,GAAG,SAAS,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AAAA,EAEQ,QAAQ,WAA2B;AACzC,WAAO,GAAG,SAAS;AAAA,EACrB;AAAA,EAEA,MAAc,UACZ,WACgE;AAChE,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,KAAK,SAAS,SAAS,CAAC;AACnE,QAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,KAAK;AACnF,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,WAAO,EAAE,OAAO,KAAK,MAAM,IAAI,GAAoB,cAAc,OAAO,QAAQ;AAAA,EAClF;AAAA,EAEA,MAAc,WACZ,WACA,OACA,iBACe;AACf,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,UAAM,KAAK,MAAM,YAAY,KAAK,SAAS,SAAS,GAAG,OAAO,eAAe;AAAA,EAC/E;AAAA,EAEA,MAAM,SACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,MAAM,WAAW;AAMtD,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,GAAI,MAAM,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACzD,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,IACb;AAEA,UAAM,WAA0B;AAAA,MAC9B,WAAW,CAAC,GAAG,MAAM,WAAW,IAAI;AAAA,MACpC,aAAa,MAAM,cAAc;AAAA;AAAA,MAEjC,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,WAAW,KAAK,eAAe,QAAQ;AAC7C,UAAM,KAAK,WAAW,MAAM,MAAM,UAAU,YAAY;AAExD,eAAW,KAAK,UAAU;AACxB,YAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,IACA,MACuB;AACvB,UAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC;AACtC,UAAM,EAAE,OAAO,aAAa,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI;AAC/D,UAAM,MAAM,KAAK,QAAQ,MAAM,IAAI;AAGnC,UAAM,KAAK,MAAM,YAAY,KAAK,OAAO,IAAI;AAE7C,UAAM,OAAqB;AAAA,MACzB,SAAS;AAAA,MACT,OAAO,MAAM,SAAS;AAAA,MACtB,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACtD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,YAAY;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAEA,UAAM,OAAO;AACb,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO,YAAY;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA0C;AAC5D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,UAAU,OAAO;AAC9C,UAAM,YAAY,CAAC,GAAG,MAAM,SAAS,EAAE,QAAQ;AAC/C,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,GAAG,SAAS,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,OAAc,SAAgC;AAClE,QAAI,CAAC,QAAQ,WAAW,GAAG,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,sBAAsB,OAAO;AACnF,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,OAAO;AAClD,QAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,OAAO;AACpD,UAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,MAAM,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAe,OAAgC;AAC7C,UAAM,QAAQ,KAAK,UAAU,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO,CAAC;AAEpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,YAAY,MAAM,UAAU,MAAM;AAEtC,QAAI,KAAK,UAAU,aAAa,UAAa,UAAU,SAAS,KAAK,UAAU,UAAU;AACvF,YAAM,SAAS,UAAU,OAAO,GAAG,UAAU,SAAS,KAAK,UAAU,QAAQ;AAC7E,eAAS,KAAK,GAAG,OAAO,IAAI,OAAK,EAAE,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,KAAK,UAAU,eAAe,QAAW;AAC3C,YAAM,WAAW,KAAK,UAAU,aAAa;AAC7C,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,UAAU,OAAO,OAAK,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,KAAK,QAAQ;AACtF,eAAS,KAAK,GAAG,UAAU,OAAO,OAAK,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,OAAK,EAAE,OAAO,CAAC;AAC9E,kBAAY;AAAA,IACd;AAEA,UAAM,YAAY;AAClB,WAAO;AAAA,EACT;AACF;;;ACzIO,SAAS,cAAc,MAA8C;AAC1E,QAAM,SAAS,IAAI,eAAe,KAAK,OAAO,KAAK,aAAa,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,IAAI,UAAU;AAC5B,aAAO,OAAO,SAAS,OAAgB,IAAI,QAAQ;AAAA,IACrD;AAAA,IACA,cAAc,SAAS;AACrB,aAAO,OAAO,cAAc,OAAO;AAAA,IACrC;AAAA,IACA,gBAAgB,OAAO,SAAS;AAC9B,aAAO,OAAO,gBAAgB,OAAgB,OAAO;AAAA,IACvD;AAAA,IACA,aAAa,OAAO,IAAI,UAAU;AAChC,aAAO,OAAO,aAAa,OAAgB,IAAI,QAAQ;AAAA,IACzD;AAAA,IACA,GAAI,KAAK,iBAAiB,EAAE,QAAQ,KAAK,eAAe,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}

package/dist/{stale-3JWHNDIY.js → stale-Z7IW6RIL.js}

@@ -3,7 +3,7 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-BG3SPSR4.js";
+} from "./chunk-2REPHKET.js";
 import "./chunk-PZ5AY32C.js";
 export {
   clearMVStale,
@@ -11,4 +11,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-3JWHNDIY.js.map
+//# sourceMappingURL=stale-Z7IW6RIL.js.map

package/dist/stale-Z7IW6RIL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/storage-ADNP2UWI.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-T7WSLRAU.js";
+import "./chunk-MCHVVJIA.js";
+import "./chunk-QA2KUPCP.js";
+import "./chunk-2OV5NVE7.js";
+import "./chunk-VEPTFUJY.js";
+import "./chunk-HYR4WZZ3.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-3OPY6MK2.js";
+import "./chunk-YN5IAHN6.js";
+import "./chunk-S7VFUQM2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-ADNP2UWI.js.map

package/dist/storage-ADNP2UWI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{store-coordination-provider-3I7XWZZK.js → store-coordination-provider-DTDMI6VL.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-IAGBDSCS.js";
+} from "./chunk-XREOISSI.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-YN5IAHN6.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-3I7XWZZK.js.map
+//# sourceMappingURL=store-coordination-provider-DTDMI6VL.js.map

package/dist/{subject-index-O75wKshW.d.ts → subject-index-CyOgGMJL.d.ts}

@@ -314,6 +314,24 @@ interface ForgetResult {
     readonly sealedResidue: readonly string[];
     /** The single `op:'forget'` ledger entry appended for this erasure. */
     readonly ledgerEntry: LedgerEntry;
+    /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased
+     *  because their source subject was forgotten. Overlay outputs are intentionally out of
+     *  scope here — an overlay is always sourced from an MV, never directly from a subject
+     *  collection, so the personal-data-bearing MV rows it reads are already erased above. */
+    readonly derivedRecordsErased: number;
+    /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */
+    readonly derivedAggregatesRecomputed: number;
+    /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen
+     *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */
+    readonly derivedResidueFrozen: readonly string[];
+    /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */
+    readonly lookupReferencesCascaded: number;
+    /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */
+    readonly lookupReferencesNullified: number;
+    /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,
+     *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.
+     *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */
+    readonly lookupReferencesResidue: readonly string[];
 }
 
 /**

package/dist/sync/index.d.ts

@@ -1,6 +1,5 @@
-import { cr as SyncStrategy } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import { bW as SyncStrategy } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/sync/index.js

@@ -2,11 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-IUEN57TV.js";
+} from "../chunk-TAKWLZZX.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-party/team/sync-active.ts"],"sourcesContent":["/**\n * Active sync strategy — `withSync()` returns the real implementation\n * that wires the `SyncEngine`, `SyncTransaction`, and `PresenceHandle`\n * constructors into the Noydb / Vault / Collection hot paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withSync } from '@noy-db/hub/sync'\n *\n * const db = await createNoydb({\n *   store: localStore,\n *   sync: remoteStore,\n *   user: ...,\n *   syncStrategy: withSync(),\n * })\n * ```\n *\n * The factory delegates to the existing `sync.ts`,\n * `sync-transaction.ts`, and `presence.ts` modules. Splitting the\n * import chain through this file is what lets tsup tree-shake the\n * ~856 LOC of replication + presence machinery out of the default\n * bundle when no `withSync()` import is present.\n *\n * Keyring + grant/revoke/magic-link/delegation stay in the always-on\n * core (or tree-shake via direct named imports) — those are required\n * for any multi-user vault, even purely local ones.\n *\n * @public\n */\n\nimport type { SyncStrategy, BuildSyncEngineOptions } from './sync-strategy.js'\nimport type { PresenceHandleOpts } from './presence.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport { SyncEngine } from './sync.js'\nimport { SyncTransaction } from './sync-transaction.js'\nimport { PresenceHandle } from './presence.js'\n\nexport function withSync(): SyncStrategy {\n  return {\n    buildSyncEngine(opts: BuildSyncEngineOptions): SyncEngine {\n      return new SyncEngine(opts)\n    },\n    buildSyncTransaction(vault: Vault, engine: SyncEngine): SyncTransaction {\n      return new SyncTransaction(vault, engine)\n    },\n    buildPresence<P>(opts: PresenceHandleOpts): PresenceHandle<P> {\n      return new PresenceHandle<P>(opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,gBAAgB,MAA0C;AACxD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,qBAAqB,OAAc,QAAqC;AACtE,aAAO,IAAI,gBAAgB,OAAO,MAAM;AAAA,IAC1C;AAAA,IACA,cAAiB,MAA6C;AAC5D,aAAO,IAAI,eAAkB,IAAI;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}

package/dist/team/index.d.ts

@@ -1,10 +1,50 @@
-import { cT as NoydbStore, cF as UnlockedKeyring } from '../index-BzUo1B6n.js';
-export { dM as BundleRecipient, fg as EnrollAuthenticatorOptions, fh as EnrollAuthenticatorWrappingDEKsOptions, fi as EnrollAuthenticatorWrappingKEKOptions, gf as ListUsersOptions, h2 as PaperRecoveryEntry, he as PresenceHandle, hI as RecoverPassphraseInput, hJ as RecoverPassphraseResult, hK as RecoverUserOptions, hN as RecoveryProof, hZ as RotatePassphraseInput, iw as SlotRewrapCeremony, ix as SlotRewrapContext, iG as SyncEngine, iO as SyncTransaction, j6 as UpdateAuthenticatorOptions, jn as WrappedDeksBlob, jy as buildRecipientKeyringFile, jz as burnPaperRecoveryEntry, kO as changeSecret, kP as createOwnerKeyring, jF as deriveMagicLinkContentKey, jJ as enrollAuthenticator, kQ as ensureCollectionDEK, jN as evaluateExportCapability, jP as evaluateImportCapability, jS as findAuthenticator, kR as grant, jT as hasExportCapability, jU as hasImportCapability, jX as isMagicLinkGrantExpired, k4 as listMagicLinkGrants, k5 as listUsers, k6 as listUsersWithEnvelopes, kS as loadKeyring, k9 as loadPaperRecoveryEntries, kc as magicLinkGrantRecordId, kd as mintPaperRecoveryEntry, kf as mintWrappedDeksBlob, kT as persistKeyring, kk as readMagicLinkGrantRecord, k1 as recoverPassphrase, km as recoverUser, kq as removeAuthenticator, kU as revoke, kw as revokeMagicLinkGrant, k2 as rotatePassphrase, ky as savePaperRecoveryEntries, kC as unwrapDeksFromBlob, kD as unwrapDeksFromPaperEntry, kF as unwrapMagicLinkGrant, kV as updateAuthenticator, kW as updateKeyringIdentity, kN as writeMagicLinkGrant } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import { jA as TeamStrategy, c_ as NoydbStore, c8 as UnlockedKeyring } from '../index-DjWbxsjb.js';
+export { e8 as BundleRecipient, fO as EnrollAuthenticatorOptions, fP as EnrollAuthenticatorWrappingDEKsOptions, fQ as EnrollAuthenticatorWrappingKEKOptions, gQ as ListUsersOptions, hm as NO_TEAM, hF as PaperRecoveryEntry, hR as PresenceHandle, ik as RecoverPassphraseInput, il as RecoverPassphraseResult, im as RecoverUserOptions, iq as RecoveryProof, iD as RotatePassphraseInput, j9 as SlotRewrapCeremony, ja as SlotRewrapContext, jj as SyncEngine, jr as SyncTransaction, jz as TeamNotEnabledError, jO as UpdateAuthenticatorOptions, k7 as WrappedDeksBlob, ki as buildRecipientKeyringFile, kj as burnPaperRecoveryEntry, lD as changeSecret, lE as createOwnerKeyring, kp as deriveMagicLinkContentKey, ku as enrollAuthenticator, lF as ensureCollectionDEK, kz as evaluateExportCapability, kB as evaluateImportCapability, kE as findAuthenticator, lG as grant, kF as hasExportCapability, kG as hasImportCapability, kJ as isMagicLinkGrantExpired, kT as listMagicLinkGrants, kU as listUsers, kV as listUsersWithEnvelopes, lH as loadKeyring, kY as loadPaperRecoveryEntries, l0 as magicLinkGrantRecordId, l1 as mintPaperRecoveryEntry, l3 as mintWrappedDeksBlob, lI as persistKeyring, l8 as readMagicLinkGrantRecord, kQ as recoverPassphrase, la as recoverUser, le as removeAuthenticator, lJ as revoke, lk as revokeMagicLinkGrant, kR as rotatePassphrase, lm as savePaperRecoveryEntries, lq as unwrapDeksFromBlob, lr as unwrapDeksFromPaperEntry, lt as unwrapMagicLinkGrant, lK as updateAuthenticator, lL as updateKeyringIdentity, lC as writeMagicLinkGrant } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 
+/**
+ * Enable the multi-user team capability (#267 Track A tail).
+ *
+ * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /
+ * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines
+ * are statically imported HERE — this module is reachable only through the
+ * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable
+ * re-export), so a single-user floor bundle never carries them. The facade
+ * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +
+ * keyring plumbing and receives the engine as an argument.
+ */
+
+declare function withTeam(): TeamStrategy;
+
+/**
+ * Secret-bearing reserved collections — the `_`-prefixed reserved collections
+ * whose record CONTENTS are directly-usable secrets (transport OAuth tokens,
+ * connection strings, API keys), as opposed to the *operational* reserved
+ * collections (`_ledger`, `_history`, `_sync`, …) whose contents are metadata
+ * (collection names, record ids, ciphertext hashes).
+ *
+ * This distinction matters at two trust-boundary seams:
+ *
+ *  1. `vault.collection()` — a secret-bearing reserved name must never be
+ *     reachable through the generic public collection handle. It is served
+ *     ONLY by its dedicated, role-gated API (e.g. `_sync_credentials` →
+ *     `getCredential`/`putCredential`, which enforce owner/admin access).
+ *
+ *  2. `grant()` DEK propagation — a sub-admin grantee (operator, viewer,
+ *     client, custodian) must NOT receive a secret-bearing collection's DEK.
+ *     Operational reserved DEKs still propagate to every role (grantees must
+ *     write ledger/history entries on every mutation), but handing a
+ *     sub-admin the `_sync_credentials` DEK would let them decrypt the firm's
+ *     transport secrets — a plaintext leak, not a metadata leak.
+ *
+ * Kept dependency-free so both the kernel (`vault.ts`) and the team layer
+ * (`keyring.ts`) can import it without an import cycle.
+ */
+/** Reserved collection holding per-adapter sync transport secrets. */
+declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
+
 /**
  * _sync_credentials reserved collection —
  *
@@ -44,8 +84,6 @@ import '@noy-db/attestation';
  * against the caller's keyring role at call time.
  */
 
-/** The reserved collection name. Never collides with user collections. */
-declare const SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 /**
  * An OAuth/auth token stored in `_sync_credentials`.
  *
@@ -113,4 +151,4 @@ declare function credentialStatus(adapter: NoydbStore, vault: string, keyring: U
     expired: boolean;
 }>;
 
-export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential };
+export { SYNC_CREDENTIALS_COLLECTION, type SyncCredential, TeamStrategy, UnlockedKeyring, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential, withTeam };

package/dist/team/index.js

@@ -1,12 +1,13 @@
 import {
-  SYNC_CREDENTIALS_COLLECTION,
   credentialStatus,
   deleteCredential,
   getCredential,
   listCredentials,
-  putCredential
-} from "../chunk-DGDI2D4M.js";
+  putCredential,
+  withTeam
+} from "../chunk-4OMCIY6F.js";
 import {
+  NO_TEAM,
   deriveMagicLinkContentKey,
   enrollAuthenticator,
   findAuthenticator,
@@ -22,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-UPJNJGGA.js";
+} from "../chunk-KJ2BCBTL.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -31,15 +32,16 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-IGUYVGGI.js";
-import "../chunk-IO6GRPT6.js";
+} from "../chunk-P33LUIML.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-IUEN57TV.js";
+} from "../chunk-TAKWLZZX.js";
 import "../chunk-VQNJ7UZL.js";
+import "../chunk-7BWJHO2A.js";
 import {
+  SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
   changeSecret,
   createOwnerKeyring,
@@ -55,17 +57,27 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-WWGT2MDV.js";
-import "../chunk-ITNUCOXM.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-J4LPNIGK.js";
+import "../chunk-OVYRLHPE.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
+import {
+  TeamNotEnabledError
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 export {
+  NO_TEAM,
   PresenceHandle,
   SYNC_CREDENTIALS_COLLECTION,
   SyncEngine,
   SyncTransaction,
+  TeamNotEnabledError,
   buildRecipientKeyringFile,
   burnPaperRecoveryEntry,
   changeSecret,
@@ -107,6 +119,7 @@ export {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   updateKeyringIdentity,
+  withTeam,
   writeMagicLinkGrant
 };
 //# sourceMappingURL=index.js.map

package/dist/tiers/index.d.ts

@@ -1,5 +1,4 @@
-export { l0 as NO_TIERS, l1 as TiersContext, iZ as TiersNotEnabledError, l2 as TiersStrategy, l3 as assertDeclaredTier, l4 as assertTiersEnabled, l5 as classifySealedShred, l6 as demote, l7 as elevate, l8 as getAtTier, l9 as listAtTier, la as putAtTier, lb as withTiers } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+export { lS as NO_TIERS, lT as TiersContext, jE as TiersNotEnabledError, lU as TiersStrategy, lV as assertDeclaredTier, lW as assertTiersEnabled, lX as classifySealedShred, lY as demote, lZ as elevate, l_ as getAtTier, l$ as listAtTier, m0 as putAtTier, m1 as withTiers } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -9,13 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-IPB7FTQX.js";
-import "../chunk-IO6GRPT6.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-7P2SDJG3.js";
+import "../chunk-7BWJHO2A.js";
+import "../chunk-MCHVVJIA.js";
+import "../chunk-QA2KUPCP.js";
+import "../chunk-2OV5NVE7.js";
+import "../chunk-VEPTFUJY.js";
+import "../chunk-HYR4WZZ3.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-3OPY6MK2.js";
+import "../chunk-YN5IAHN6.js";
 import {
   TiersNotEnabledError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.d.ts

@@ -1,5 +1,4 @@
-export { dq as BundleVersionConflictError, eJ as ConflictError, cV as EncryptedEnvelope, ge as ListPageResult, gM as NetworkError, gS as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, j1 as TxOp, jg as VaultSnapshot } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+export { dx as BundleVersionConflictError, fc as ConflictError, d0 as EncryptedEnvelope, gP as ListPageResult, hn as NetworkError, ht as NoydbBundleStore, bq as NoydbPodStore, c_ as NoydbStore, dB as PodVersionConflictError, jg as StoreCapabilities, jh as StoreCapabilityError, ji as StoreTime, jI as TxOp, jZ as VaultSnapshot } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/to/index.js

@@ -1,11 +1,10 @@
-import "../chunk-K2WCO3NX.js";
 import {
   BundleVersionConflictError,
   ConflictError,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/{transition-guard-C7ol6oPw.d.ts → transition-guard-DI-krBsZ.d.ts}

@@ -1,4 +1,4 @@
-import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-BzUo1B6n.js';
+import { bc as GuardStrategy, bi as GuardStrategyHandle, bd as GuardChange, be as GuardContext } from './index-DjWbxsjb.js';
 
 /**
  * Register a guard for a collection. Guards run on every `put()` /

package/dist/tx/index.d.ts

@@ -1,7 +1,6 @@
-import { i_ as TransactionInvariant, kX as TxStrategy } from '../index-BzUo1B6n.js';
-export { kY as AmendmentTxOptions, j0 as TxCollection, dP as TxContext, j2 as TxVault, kx as runTransaction } from '../index-BzUo1B6n.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import { jF as TransactionInvariant, lN as TxStrategy } from '../index-DjWbxsjb.js';
+export { lO as AmendmentTxOptions, jH as TxCollection, eb as TxContext, jJ as TxVault, ll as runTransaction } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-SKF73JOP.js";
+} from "../chunk-ICXIFFYZ.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-QZ7BXICW.js");
+      const { GuardExecutor } = await import("../executor-ZHTJJICG.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/ui/index.d.ts

@@ -1 +1,4 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-aBkJR2sd.js';
+export { et as CollectionDescription, f5 as CollectionMeta, fB as DescribeOptions, fC as DescribedField, g3 as FieldMeta, iY as SemanticType } from '../index-DjWbxsjb.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-S7VFUQM2.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/validators-BUcli5Nh.d.ts

@@ -0,0 +1,101 @@
+import { dV as ClassifiedEntry, dS as ClassifiedFieldSpec, dW as ClassifiedGroup } from './index-DjWbxsjb.js';
+
+/**
+ * Configuration/write errors for classified fields. @module
+ *
+ * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
+ * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
+ * with-*. Re-exported here under the same names so existing import paths
+ * keep working.
+ */
+
+declare class ClassifiedNeverStoredError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string);
+}
+declare class ClassifiedValidationError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}
+
+/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */
+
+interface ResolvedClassified {
+    readonly byField: Record<string, ClassifiedFieldSpec>;
+    readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>;
+}
+declare function resolveClassifiedFields(collection: string, config: Record<string, ClassifiedEntry>): ResolvedClassified;
+
+/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative
+ *  knobs, not read-side callbacks (design law D2/D3). @module */
+
+declare const classified: {
+    /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
+    creditCard(fields: {
+        pan: string;
+        expiry?: string;
+        cvc?: string;
+    }): ClassifiedGroup;
+    birthDate(): ClassifiedFieldSpec;
+    email(): ClassifiedFieldSpec;
+    phone(): ClassifiedFieldSpec;
+    /** Digest-only password: verify-without-reveal; never listed, never revealed.
+     *  Enumeration math is on the caller for low-entropy values — see the
+     *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
+     *
+     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+     *  `findByDigest`). Cost band you are accepting:
+     *
+     *  equal values produce equal store-visible tags: anyone with store access
+     *  learns which records share this secret and how many share each value —
+     *  never the value itself. A collection-DEK holder can additionally test
+     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+     *  answers) offline recovery of the equality partition is seconds-to-hours, not
+     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+     *  hardest primitive available; the iteration count raises the price but does
+     *  not make a low-entropy field safe. The real control for low-entropy fields
+     *  is the DOOR — do not enable `equatable` for them unless the partition being
+     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+     *  tags. */
+    password(opts?: {
+        minLength?: number;
+        rotateDays?: number;
+        notLastN?: number;
+        equatable?: true;
+    }): ClassifiedFieldSpec;
+    /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
+     *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
+     *  enumeration math to your users; add app-side rate limiting.
+     *
+     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
+     *  `findByDigest`). Cost band you are accepting:
+     *
+     *  equal values produce equal store-visible tags: anyone with store access
+     *  learns which records share this secret and how many share each value —
+     *  never the value itself. A collection-DEK holder can additionally test
+     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
+     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
+     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
+     *  answers) offline recovery of the equality partition is seconds-to-hours, not
+     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
+     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
+     *  hardest primitive available; the iteration count raises the price but does
+     *  not make a low-entropy field safe. The real control for low-entropy fields
+     *  is the DOOR — do not enable `equatable` for them unless the partition being
+     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
+     *  tags. */
+    secretAnswer(opts?: {
+        equatable?: true;
+    }): ClassifiedFieldSpec;
+};
+
+/** Pure write-time validators. Exported so userland can validate storage:'never'
+ *  fields (e.g. CVC) at capture, before dropping them. @module */
+declare function luhnCheck(pan: string): boolean;
+
+export { ClassifiedNeverStoredError as C, type ResolvedClassified as R, ClassifiedValidationError as a, classified as c, luhnCheck as l, resolveClassifiedFields as r };

package/dist/{vault-diff-B5fYNBL7.d.ts → vault-diff-Z2DUayMe.d.ts}

@@ -1,4 +1,4 @@
-import { V as Vault, cE as DiffEntry } from './index-BzUo1B6n.js';
+import { V as Vault, c7 as DiffEntry } from './index-DjWbxsjb.js';
 
 /**
  * Vault-level diff orchestrator.