@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/enclave-VXAQD4XJ.js

@@ -0,0 +1,135 @@
+import {
+  RecordCodec,
+  SEALED_CEK_NS,
+  computeBrokerProof,
+  deriveBrokerProofBits,
+  deriveBrokerProofKey,
+  envelopeBodyForHash,
+  findByDet,
+  hasPerRecordKey,
+  issueChallenge,
+  makeReservedEnvelopes,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  verifyBrokerProof,
+  writeEnvelopeBody
+} from "./chunk-QQJXBZCO.js";
+import {
+  buildDeleteMarker,
+  buildTombstone,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape
+} from "./chunk-FQQF23MC.js";
+import {
+  ctEqualTags,
+  deriveVdigSlotKey,
+  evaluateKofN
+} from "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import {
+  computeBidxTarget,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag
+} from "./chunk-X6CMGUAG.js";
+import {
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveDeterministicKey,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hmacSha256Hex,
+  importCek,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey
+} from "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  RecordCodec,
+  SEALED_CEK_NS,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildTombstone,
+  computeBidxTarget,
+  computeBrokerProof,
+  ctEqualTags,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveBrokerProofBits,
+  deriveBrokerProofKey,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  deriveDeterministicKey,
+  deriveKey,
+  derivePassphraseKey,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveVdigSlotKey,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  envelopeBodyForHash,
+  evaluateKofN,
+  findByDet,
+  generateDEK,
+  generateIV,
+  generateSalt,
+  hasPerRecordKey,
+  hmacSha256Hex,
+  importCek,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  issueChallenge,
+  makeReservedEnvelopes,
+  mintBidxTag,
+  openEnvelopeJson,
+  pbkdf2VerifyDigest,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  sha256Hex,
+  unwrapCek,
+  unwrapKey,
+  verifyBrokerProof,
+  wrapCek,
+  wrapKey,
+  writeEnvelopeBody
+};
+//# sourceMappingURL=enclave-VXAQD4XJ.js.map

package/dist/executor-GTVSUUBX.js

@@ -0,0 +1,25 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-2JMMY7HZ.js";
+import "./chunk-DGH65E7Q.js";
+import "./chunk-3G4KMVUN.js";
+import "./chunk-IGJHJYM6.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-ELNBMFOS.js";
+import "./chunk-BE7N3AXA.js";
+import "./chunk-ARSAMO24.js";
+import "./chunk-25NDNMQ7.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-GTVSUUBX.js.map

package/dist/executor-GZWMTOXB.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-ZP5PL65C.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-GZWMTOXB.js.map

package/dist/executor-XXGS4S3K.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-YSXEFGND.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-XXGS4S3K.js.map

package/dist/export-accessible-BMULIOYB.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-BCYQA5BK.js";
+import "./chunk-K62IUKOD.js";
+import "./chunk-5XIPOCQC.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-BMULIOYB.js.map

package/dist/extract-partition-JUQTWDXR.js

@@ -0,0 +1,36 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-L2SNBIV7.js";
+import "./chunk-C7NTK5I3.js";
+import "./chunk-AOVDSIL3.js";
+import "./chunk-K62IUKOD.js";
+import "./chunk-5XIPOCQC.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-25NDNMQ7.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-JUQTWDXR.js.map

package/dist/fanout-sidecar-CKYFH33E.js

@@ -0,0 +1,74 @@
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-formula/derivations/fanout-sidecar.ts
+var FANOUT_DEK_COLLECTION = "_meta";
+function recordId(source, sourceId, outputKey) {
+  return `derivations-fanout/${source}/${sourceId}/${outputKey}`;
+}
+async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
+  const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
+  if (!envelope) return void 0;
+  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const parsed = JSON.parse(json);
+  if (parsed._noydb_fanout !== 1) return void 0;
+  if (!Array.isArray(parsed.keys)) return void 0;
+  return parsed;
+}
+async function saveFanoutSidecar(store, vault, payload, getDEK, encrypted) {
+  const doc = {
+    _noydb_fanout: 1,
+    source: payload.source,
+    sourceId: payload.sourceId,
+    outputKey: payload.outputKey,
+    outputCollection: payload.outputCollection,
+    keys: payload.keys,
+    emittedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const id = recordId(payload.source, payload.sourceId, payload.outputKey);
+  const prior = await store.get(vault, "_meta", id);
+  const json = JSON.stringify(doc);
+  let envelope;
+  if (!encrypted) {
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: json
+    };
+  } else {
+    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION));
+    envelope = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: (prior?._v ?? 0) + 1,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: iv,
+      _data: data
+    };
+  }
+  await store.put(vault, "_meta", id, envelope);
+}
+async function deleteFanoutSidecar(store, vault, source, sourceId, outputKey) {
+  await store.delete(vault, "_meta", recordId(source, sourceId, outputKey));
+}
+export {
+  deleteFanoutSidecar,
+  loadFanoutSidecar,
+  saveFanoutSidecar
+};
+//# sourceMappingURL=fanout-sidecar-CKYFH33E.js.map

package/dist/fanout-sidecar-CKYFH33E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson(envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: json,\n    }\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION))\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: (prior?._v ?? 0) + 1,\n      _ts: new Date().toISOString(),\n      _iv: iv,\n      _data: data,\n    }\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,UAAU,MAAM,OAAO,qBAAqB,CAAC;AACxE,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,CAAC;AAC5E,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,KAAK,OAAO,MAAM,KAAK;AAAA,MACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/fence-watcher-DHQ775JB.js

@@ -0,0 +1,69 @@
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/schema-update/fence-watcher.ts
+var FenceWatcher = class {
+  #coordination;
+  #vault;
+  #writerId;
+  #sessionId;
+  #onFlush;
+  #now;
+  #emit;
+  #lastState = null;
+  #quiescedAtVersion = null;
+  #timer;
+  constructor(opts) {
+    this.#coordination = opts.coordination;
+    this.#vault = opts.vault;
+    this.#writerId = opts.clientId;
+    this.#sessionId = opts.sessionId ?? opts.clientId;
+    this.#onFlush = opts.onFlush;
+    this.#now = opts.now ?? (() => Date.now());
+    this.#emit = opts.emit ?? (() => {
+    });
+  }
+  /** Publish liveness (and the current ack) without changing quiesce state. */
+  async beat() {
+    await this.#coordination.reportPresence(this.#vault, {
+      writerId: this.#writerId,
+      sessionId: this.#sessionId,
+      lastSeen: this.#now(),
+      quiescedAtVersion: this.#quiescedAtVersion
+    });
+  }
+  /** Poll the fence; quiesce on draining; emit on transitions. */
+  async check() {
+    const fence = await this.#coordination.readFence(this.#vault);
+    if (fence.fenceState !== this.#lastState) {
+      this.#lastState = fence.fenceState;
+      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState });
+    }
+    if (fence.fenceState === "draining" && this.#quiescedAtVersion !== fence.currentSchemaVersion) {
+      await this.#onFlush();
+      this.#quiescedAtVersion = fence.currentSchemaVersion;
+      await this.beat();
+    }
+    if (fence.fenceState === "normal") {
+      this.#quiescedAtVersion = null;
+    }
+  }
+  start(intervalMs) {
+    if (this.#timer) return;
+    this.#timer = setInterval(() => {
+      void this.beat();
+      void this.check();
+    }, intervalMs);
+    const timer = this.#timer;
+    if (typeof timer.unref === "function") timer.unref();
+  }
+  stop() {
+    if (this.#timer) {
+      clearInterval(this.#timer);
+      this.#timer = void 0;
+    }
+  }
+};
+export {
+  FenceWatcher
+};
+//# sourceMappingURL=fence-watcher-DHQ775JB.js.map

package/dist/fence-watcher-DHQ775JB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence-watcher.ts"],"sourcesContent":["/**\n * Per-client schema-fence watcher. Watches the fence via the injected\n * {@link CoordinationProvider}; on `draining` it drains in-flight writes\n * and reports presence (its ack); emits a same-instance signal on every\n * state transition (for UI). Driven by an interval in production and by\n * explicit `check()`/`beat()` in tests.\n *\n * The transport is the coordination port: the default\n * {@link StoreCoordinationProvider} maps `reportPresence` →\n * `_meta/schema-fence:client:<id>` and `readFence` → `_meta/schema-fence`,\n * so behavior is byte-for-byte the same; `by-tabs` / `by-peer` swap in\n * real-time push transports.\n */\nimport { type FenceState } from './fence.js'\nimport type { CoordinationProvider } from '../../port/by/index.js'\n\nexport interface FenceWatcherEvent {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n}\n\nexport class FenceWatcher {\n  readonly #coordination: CoordinationProvider\n  readonly #vault: string\n  readonly #writerId: string\n  readonly #sessionId: string\n  readonly #onFlush: () => Promise<void>\n  readonly #now: () => number\n  readonly #emit: (e: FenceWatcherEvent) => void\n  #lastState: FenceState | null = null\n  #quiescedAtVersion: number | null = null\n  #timer: ReturnType<typeof setInterval> | undefined\n\n  constructor(opts: {\n    coordination: CoordinationProvider\n    vault: string\n    clientId: string\n    sessionId?: string\n    onFlush: () => Promise<void>\n    now?: () => number\n    emit?: (e: FenceWatcherEvent) => void\n  }) {\n    this.#coordination = opts.coordination\n    this.#vault = opts.vault\n    this.#writerId = opts.clientId\n    this.#sessionId = opts.sessionId ?? opts.clientId\n    this.#onFlush = opts.onFlush\n    this.#now = opts.now ?? (() => Date.now())\n    this.#emit = opts.emit ?? (() => {})\n  }\n\n  /** Publish liveness (and the current ack) without changing quiesce state. */\n  async beat(): Promise<void> {\n    await this.#coordination.reportPresence(this.#vault, {\n      writerId: this.#writerId,\n      sessionId: this.#sessionId,\n      lastSeen: this.#now(),\n      quiescedAtVersion: this.#quiescedAtVersion,\n    })\n  }\n\n  /** Poll the fence; quiesce on draining; emit on transitions. */\n  async check(): Promise<void> {\n    const fence = await this.#coordination.readFence(this.#vault)\n    if (fence.fenceState !== this.#lastState) {\n      this.#lastState = fence.fenceState\n      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState })\n    }\n    if (fence.fenceState === 'draining' && this.#quiescedAtVersion !== fence.currentSchemaVersion) {\n      await this.#onFlush()\n      this.#quiescedAtVersion = fence.currentSchemaVersion\n      await this.beat()\n    }\n    if (fence.fenceState === 'normal') {\n      this.#quiescedAtVersion = null\n    }\n  }\n\n  start(intervalMs: number): void {\n    if (this.#timer) return\n    this.#timer = setInterval(() => { void this.beat(); void this.check() }, intervalMs)\n    const timer = this.#timer as unknown as { unref?: () => void }\n    if (typeof timer.unref === 'function') timer.unref() // don't keep the process alive\n  }\n\n  stop(): void {\n    if (this.#timer) { clearInterval(this.#timer); this.#timer = undefined }\n  }\n}\n"],"mappings":";;;AAqBO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAAgC;AAAA,EAChC,qBAAoC;AAAA,EACpC;AAAA,EAEA,YAAY,MAQT;AACD,SAAK,gBAAgB,KAAK;AAC1B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK,aAAa,KAAK;AACzC,SAAK,WAAW,KAAK;AACrB,SAAK,OAAO,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,SAAK,QAAQ,KAAK,SAAS,MAAM;AAAA,IAAC;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,UAAM,KAAK,cAAc,eAAe,KAAK,QAAQ;AAAA,MACnD,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK,KAAK;AAAA,MACpB,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,KAAK,MAAM;AAC5D,QAAI,MAAM,eAAe,KAAK,YAAY;AACxC,WAAK,aAAa,MAAM;AACxB,WAAK,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,YAAY,MAAM,WAAW,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,eAAe,cAAc,KAAK,uBAAuB,MAAM,sBAAsB;AAC7F,YAAM,KAAK,SAAS;AACpB,WAAK,qBAAqB,MAAM;AAChC,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,QAAI,MAAM,eAAe,UAAU;AACjC,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,YAA0B;AAC9B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS,YAAY,MAAM;AAAE,WAAK,KAAK,KAAK;AAAG,WAAK,KAAK,MAAM;AAAA,IAAE,GAAG,UAAU;AACnF,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EACrD;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,QAAQ;AAAE,oBAAc,KAAK,MAAM;AAAG,WAAK,SAAS;AAAA,IAAU;AAAA,EACzE;AACF;","names":[]}

package/dist/find-XRGCNGNN.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-XRGCNGNN.js.map

package/dist/forget/index.js

@@ -1,15 +1,21 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-SRB2XEWB.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-DJ3VKYFA.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
+import "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts
 function withForgetCascade(opts) {
-  return { subjects: { ...opts.subjects } };
+  return { subjects: { ...opts.subjects }, ...opts.scopedPurge !== void 0 ? { scopedPurge: opts.scopedPurge } : {} };
 }
 export {
   NO_FORGET,

package/dist/forget/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects } }\n}\n"],"mappings":";;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,EAAE;AAC1C;","names":[]}
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForgetCascade` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects }, ...(opts.scopedPurge !== undefined ? { scopedPurge: opts.scopedPurge } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BO,SAAS,kBAAkB,MAA0C;AAC1E,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,GAAG,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC,EAAG;AACxH;","names":[]}

package/dist/guards/index.js

@@ -2,23 +2,23 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-TA66UMI4.js";
+} from "../chunk-VA4ZWLFY.js";
 import {
   GuardRegistry
 } from "../chunk-YMUGBZN2.js";
 import {
   ReadOnlyVaultFacade
-} from "../chunk-RUIMKQTA.js";
+} from "../chunk-JK733I5V.js";
 import {
   GuardExecutor
-} from "../chunk-RUEKROOS.js";
+} from "../chunk-ZP5PL65C.js";
 import {
   AmendmentForbiddenError,
   FieldFrozenError,
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,

package/dist/history/index.js

@@ -7,7 +7,7 @@ import {
   pruneHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-MD3Y6J3L.js";
+} from "../chunk-MELR46EF.js";
 import {
   diff,
   formatDiff
@@ -16,7 +16,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-LXQT4WMP.js";
+} from "../chunk-OEAATWH5.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -28,10 +28,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-AIWULCUO.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-25NDNMQ7.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
+import "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/history/active.ts

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}