@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/walk-2RWEOCAS.js

@@ -0,0 +1,241 @@
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema
+} from "./chunk-QLLKLFE2.js";
+import {
+  loadPersistedSchema
+} from "./chunk-C7NTK5I3.js";
+import "./chunk-QQJXBZCO.js";
+import "./chunk-FQQF23MC.js";
+import "./chunk-MSPNM2OM.js";
+import "./chunk-SYMS4546.js";
+import "./chunk-X6CMGUAG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-HUS3J5WM.js";
+import "./chunk-CKZW6P5V.js";
+import "./chunk-FH542DDY.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/introspection/walk.ts
+var INTERNAL_PREFIX = "_";
+var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
+async function dumpVaultSchema(vault, opts) {
+  const state = vault._introspectState();
+  const sampleSize = opts.sampleSize ?? 50;
+  const withStats = opts.withStats === true;
+  const cacheNames = [...state.collectionCache.keys()];
+  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
+  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
+  const collections = {};
+  for (const name of allNames) {
+    collections[name] = await describeCollection(state, name, sampleSize, withStats);
+  }
+  const materializedViews = describeMVs(state.mvRegistry);
+  const overlayViews = describeOverlays(state.overlayRegistry);
+  const derivations = describeDerivations(state.derivationRegistry);
+  let internal;
+  if (withStats) {
+    internal = {};
+    for (const name of KNOWN_INTERNAL_NAMES) {
+      const stats = await statsForCollection(state.adapter, state.name, name);
+      if (stats.records > 0) {
+        internal[name] = { records: stats.records, bytes: stats.bytes };
+      }
+    }
+  }
+  const snap = {
+    _noydb_snapshot: 1,
+    vault: state.name,
+    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    subsystems: state.subsystems,
+    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
+    collections,
+    materializedViews,
+    overlayViews,
+    derivations,
+    ...internal !== void 0 ? { internal } : {}
+  };
+  return snap;
+}
+async function safeListAllCollections(adapter, vault) {
+  try {
+    const snap = await adapter.loadAll(vault);
+    return Object.keys(snap);
+  } catch {
+    return [];
+  }
+}
+async function describeCollection(state, collectionName, sampleSize, withStats) {
+  let fields = {};
+  let validator;
+  const refsRaw = state.refRegistry.getOutbound(collectionName);
+  const refs = {};
+  for (const [name, desc] of Object.entries(refsRaw)) {
+    refs[name] = { target: desc.target, mode: desc.mode };
+  }
+  try {
+    const dek = await state.getDEK(collectionName);
+    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
+    if (persisted) {
+      validator = { kind: persisted.kind, source: "persisted" };
+      if (persisted.jsonSchema) {
+        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
+      }
+    }
+  } catch {
+  }
+  const liveColl = state.collectionCache.get(collectionName);
+  if (!validator) {
+    const schema = liveColl?.getSchema();
+    if (schema) {
+      try {
+        const derived = await derivePersistedSchema(schema);
+        validator = { kind: derived.kind, source: "live-validator" };
+        if (derived.jsonSchema) {
+          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
+        }
+      } catch {
+      }
+    }
+  }
+  if (Object.keys(fields).length === 0 && sampleSize > 0) {
+  }
+  const collMeta = liveColl?.getMeta();
+  const collConfig = liveColl?.getConfig();
+  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
+  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
+  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
+  let mergedConfig;
+  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
+    mergedConfig = {
+      ...collConfig ?? {},
+      ...archivePresent ? { archive: true } : {},
+      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
+    };
+  }
+  const descriptor = {
+    fields,
+    indexes: [],
+    refs,
+    ...validator ? { validator } : {},
+    ...collMeta !== void 0 ? { meta: collMeta } : {},
+    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
+  };
+  if (withStats) {
+    const stats = await statsForCollection(state.adapter, state.name, collectionName);
+    descriptor.stats = stats;
+  }
+  return descriptor;
+}
+async function statsForCollection(adapter, vault, collection) {
+  const ids = await adapter.list(vault, collection);
+  if (ids.length === 0) {
+    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
+  }
+  let total = 0;
+  let min = Number.POSITIVE_INFINITY;
+  let max = 0;
+  let oldest = "\uFFFF";
+  let newest = "";
+  for (const id of ids) {
+    const env = await adapter.get(vault, collection, id);
+    if (!env) continue;
+    const size = env._data.length;
+    total += size;
+    if (size < min) min = size;
+    if (size > max) max = size;
+    if (env._ts < oldest) oldest = env._ts;
+    if (env._ts > newest) newest = env._ts;
+  }
+  return {
+    records: ids.length,
+    bytes: total,
+    bytesAvg: Math.round(total / ids.length),
+    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
+    bytesMax: max,
+    oldest: oldest === "\uFFFF" ? "" : oldest,
+    newest
+  };
+}
+function describeMVs(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const spec = reg.spec;
+    if (!spec?.name) continue;
+    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
+    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
+    const aggregate = spec.aggregate ? Object.fromEntries(
+      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
+    ) : void 0;
+    out[spec.name] = {
+      sources,
+      ...groupBy ? { groupBy } : {},
+      ...aggregate ? { aggregate } : {},
+      refresh: spec.refresh ?? "eager"
+    };
+  }
+  return out;
+}
+function describeOverlays(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const specs = listFromRegistry(registry);
+  const out = {};
+  for (const spec of specs) {
+    const s = spec;
+    if (!s.name || !s.base || !s.overlay) continue;
+    out[s.name] = { base: s.base, overlay: s.overlay };
+  }
+  return out;
+}
+function describeDerivations(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const s = reg.spec ?? reg;
+    if (!s.source) continue;
+    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
+    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
+    out[key] = {
+      source: s.source,
+      outputs: outputCollections
+    };
+  }
+  return out;
+}
+function listFromRegistry(reg) {
+  for (const method of ["all", "list", "specs", "values"]) {
+    const fn = reg[method];
+    if (typeof fn === "function") {
+      try {
+        const out = fn.call(reg);
+        if (Array.isArray(out)) return out;
+        if (out && typeof out.values === "function") {
+          return [...out.values()];
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+  return [];
+}
+function summariseAggregateOp(value) {
+  if (value && typeof value === "object") {
+    const op = value.op ?? value.kind;
+    const field = value.field;
+    if (op && field) return `${op}(${field})`;
+    if (op) return op;
+  }
+  return String(value);
+}
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-2RWEOCAS.js.map

package/dist/walk-2RWEOCAS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/walk.ts"],"sourcesContent":["/**\n * Orchestrate the structural walk of a Vault, producing a\n * {@link VaultSchemaSnapshot}. Called from `Vault.dumpSchema()`.\n *\n * @module\n */\n\nimport { derivePersistedSchema } from '../persisted-schemas/derive.js'\nimport { loadPersistedSchema } from '../persisted-schemas/storage.js'\nimport { jsonSchemaToFields } from './fields.js'\nimport type {\n  CollectionConfig,\n  CollectionDescriptor,\n  CollectionStats,\n  DumpSchemaOptions,\n  FieldDescriptor,\n  InternalCollectionStats,\n  MaterializedViewDescriptor,\n  OverlayViewDescriptor,\n  DerivationDescriptor,\n  VaultSchemaSnapshot,\n} from './types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { RefRegistry } from '../../kernel/refs.js'\nimport type { VaultMeta } from './meta.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * The minimal slice of Vault internal state the walker needs.\n * Exposed via `vault._introspectState()` to keep the public Vault\n * surface narrow.\n *\n * @internal\n */\nexport interface VaultIntrospectState {\n  readonly name: string\n  readonly adapter: NoydbStore\n  readonly collectionCache: Map<string, Collection<unknown>>\n  readonly refRegistry: RefRegistry\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  /** The active unlocked keyring — role/permissions/userId for access-scoped ops. */\n  readonly keyring: UnlockedKeyring\n  readonly subsystems: Record<string, boolean>\n  /** Vault-level descriptive metadata, when set via `openVault({meta})`. */\n  readonly vaultMeta?: VaultMeta\n  // Typed loosely on purpose — these are private service registries\n  // accessed only for \"is anything registered\" enumeration.\n  readonly mvRegistry: unknown\n  readonly overlayRegistry: unknown\n  readonly derivationRegistry: unknown\n  /**\n   * Returns the registered schema-update strategy names for a collection,\n   * or `undefined` when none are registered. Populated from\n   * `vault.#schemaUpdateNames` in `_introspectState()`.\n   */\n  readonly getCollectionSchemaUpdateNames?: (col: string) => readonly string[] | undefined\n  /**\n   * Returns `true` when the collection has an archive policy registered\n   * in `vault.archiveRegistry`, `false` otherwise. Populated from\n   * `vault.archiveRegistry` in `_introspectState()`.\n   */\n  readonly hasCollectionArchive?: (col: string) => boolean\n}\n\nconst INTERNAL_PREFIX = '_'\n\n/** Reserved internal collections always present in any real vault. */\nconst KNOWN_INTERNAL_NAMES = ['_keyring', '_ledger', '_meta', '_schemas', '_deltas']\n\nexport async function dumpVaultSchema(\n  vault: { _introspectState(): VaultIntrospectState },\n  opts: DumpSchemaOptions,\n): Promise<VaultSchemaSnapshot> {\n  const state = vault._introspectState()\n  const sampleSize = opts.sampleSize ?? 50\n  const withStats = opts.withStats === true\n\n  // 1. User-facing collections — alphabetical for diff stability\n  const cacheNames = [...state.collectionCache.keys()]\n  const storageNames = (await safeListAllCollections(state.adapter, state.name))\n    .filter((n) => !n.startsWith(INTERNAL_PREFIX))\n  const allNames = Array.from(new Set([...cacheNames, ...storageNames])).sort()\n\n  const collections: Record<string, CollectionDescriptor> = {}\n  for (const name of allNames) {\n    collections[name] = await describeCollection(state, name, sampleSize, withStats)\n  }\n\n  // 2. Materialized views (placeholder — real walk in MV slice 2 follow-up)\n  const materializedViews = describeMVs(state.mvRegistry)\n  // 3. Overlay views\n  const overlayViews = describeOverlays(state.overlayRegistry)\n  // 4. Derivations\n  const derivations = describeDerivations(state.derivationRegistry)\n\n  // 5. Internal collections — only with stats\n  let internal: Record<string, InternalCollectionStats> | undefined\n  if (withStats) {\n    internal = {}\n    for (const name of KNOWN_INTERNAL_NAMES) {\n      const stats = await statsForCollection(state.adapter, state.name, name)\n      if (stats.records > 0) {\n        internal[name] = { records: stats.records, bytes: stats.bytes }\n      }\n    }\n  }\n\n  const snap: VaultSchemaSnapshot = {\n    _noydb_snapshot: 1,\n    vault: state.name,\n    emittedAt: new Date().toISOString(),\n    subsystems: state.subsystems,\n    ...(state.vaultMeta !== undefined ? { meta: state.vaultMeta } : {}),\n    collections,\n    materializedViews,\n    overlayViews,\n    derivations,\n    ...(internal !== undefined ? { internal } : {}),\n  }\n  return snap\n}\n\nasync function safeListAllCollections(adapter: NoydbStore, vault: string): Promise<string[]> {\n  try {\n    const snap = await adapter.loadAll(vault)\n    return Object.keys(snap)\n  } catch {\n    return []\n  }\n}\n\nasync function describeCollection(\n  state: VaultIntrospectState,\n  collectionName: string,\n  sampleSize: number,\n  withStats: boolean,\n): Promise<CollectionDescriptor> {\n  let fields: Record<string, FieldDescriptor> = {}\n  let validator: CollectionDescriptor['validator']\n\n  const refsRaw = state.refRegistry.getOutbound(collectionName)\n  const refs: CollectionDescriptor['refs'] = {}\n  for (const [name, desc] of Object.entries(refsRaw)) {\n    refs[name] = { target: desc.target, mode: desc.mode }\n  }\n\n  // 1. Try the persisted Route B envelope first.\n  try {\n    const dek = await state.getDEK(collectionName)\n    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek)\n    if (persisted) {\n      validator = { kind: persisted.kind, source: 'persisted' }\n      if (persisted.jsonSchema) {\n        fields = jsonSchemaToFields(persisted.jsonSchema, 'persisted', refsRaw)\n      }\n    }\n  } catch {\n    // No DEK or decrypt failure — fall through to live-validator\n  }\n\n  const liveColl = state.collectionCache.get(collectionName)\n\n  // 2. Try the live in-process validator (when no persisted envelope).\n  if (!validator) {\n    const schema = liveColl?.getSchema()\n    if (schema) {\n      try {\n        const derived = await derivePersistedSchema(schema)\n        validator = { kind: derived.kind, source: 'live-validator' }\n        if (derived.jsonSchema) {\n          fields = jsonSchemaToFields(derived.jsonSchema, 'live-validator', refsRaw)\n        }\n      } catch {\n        // Derivation failed (e.g. missing peer-dep) — silently leave fields empty\n      }\n    }\n  }\n\n  // 3. Sampling fallback — deferred to a follow-up. For now: empty when no schema.\n  if (Object.keys(fields).length === 0 && sampleSize > 0) {\n    // Sampling path not implemented in baseline slice 2; reserved for follow-up.\n  }\n\n  // Populate collection-level meta and config from the live collection when available.\n  const collMeta = liveColl?.getMeta()\n  const collConfig = liveColl?.getConfig()\n\n  // Thread vault-level config (archive + schemaUpdate) that the Collection cannot see.\n  const archivePresent = state.hasCollectionArchive?.(collectionName) === true\n  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName)\n  const hasSchemaUpdate = schemaUpdateNames !== undefined && schemaUpdateNames.length > 0\n\n  // Merge Collection-level config with vault-level fields. Omit config entirely\n  // when all sources are empty.\n  let mergedConfig: CollectionConfig | undefined\n  if (collConfig !== undefined || archivePresent || hasSchemaUpdate) {\n    mergedConfig = {\n      ...(collConfig ?? {}),\n      ...(archivePresent ? { archive: true as const } : {}),\n      ...(hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}),\n    }\n  }\n\n  const descriptor: CollectionDescriptor = {\n    fields,\n    indexes: [],\n    refs,\n    ...(validator ? { validator } : {}),\n    ...(collMeta !== undefined ? { meta: collMeta } : {}),\n    ...(mergedConfig !== undefined ? { config: mergedConfig } : {}),\n  }\n  if (withStats) {\n    const stats = await statsForCollection(state.adapter, state.name, collectionName)\n    ;(descriptor as { stats?: CollectionStats }).stats = stats\n  }\n  return descriptor\n}\n\nasync function statsForCollection(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n): Promise<CollectionStats> {\n  const ids = await adapter.list(vault, collection)\n  if (ids.length === 0) {\n    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: '', newest: '' }\n  }\n  let total = 0\n  let min = Number.POSITIVE_INFINITY\n  let max = 0\n  let oldest = '￿'\n  let newest = ''\n  for (const id of ids) {\n    const env = await adapter.get(vault, collection, id)\n    if (!env) continue\n    const size = env._data.length\n    total += size\n    if (size < min) min = size\n    if (size > max) max = size\n    if (env._ts < oldest) oldest = env._ts\n    if (env._ts > newest) newest = env._ts\n  }\n  return {\n    records: ids.length,\n    bytes: total,\n    bytesAvg: Math.round(total / ids.length),\n    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,\n    bytesMax: max,\n    oldest: oldest === '￿' ? '' : oldest,\n    newest,\n  }\n}\n\nfunction describeMVs(registry: unknown): Record<string, MaterializedViewDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const items = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, MaterializedViewDescriptor> = {}\n  // Each item is RegisteredMV { spec, dependencies, outputCollection, ... }\n  for (const item of items) {\n    const reg = item as {\n      spec?: {\n        name?: string\n        unionSources?: ReadonlyArray<{ collection: string }>\n        groupBy?: string | ReadonlyArray<string>\n        aggregate?: Record<string, unknown>\n        refresh?: string\n      }\n      dependencies?: ReadonlySet<string>\n    }\n    const spec = reg.spec\n    if (!spec?.name) continue\n    const sources = spec.unionSources\n      ? spec.unionSources.map((u) => u.collection)\n      : (reg.dependencies ? [...reg.dependencies].sort() : [])\n    const groupBy = spec.groupBy\n      ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy]\n      : undefined\n    const aggregate = spec.aggregate ? Object.fromEntries(\n      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)]),\n    ) : undefined\n    out[spec.name] = {\n      sources,\n      ...(groupBy ? { groupBy } : {}),\n      ...(aggregate ? { aggregate } : {}),\n      refresh: spec.refresh ?? 'eager',\n    }\n  }\n  return out\n}\n\nfunction describeOverlays(registry: unknown): Record<string, OverlayViewDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const specs = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, OverlayViewDescriptor> = {}\n  for (const spec of specs) {\n    const s = spec as { name?: string; base?: string; overlay?: string }\n    if (!s.name || !s.base || !s.overlay) continue\n    out[s.name] = { base: s.base, overlay: s.overlay }\n  }\n  return out\n}\n\nfunction describeDerivations(registry: unknown): Record<string, DerivationDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const items = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, DerivationDescriptor> = {}\n  for (const item of items) {\n    // `all()` on DerivationRegistry returns RegisteredStrategy objects:\n    // { spec: DerivationStrategy, strategyHash }. Read `spec` and fall\n    // back to the item itself for forward-compat with other registries.\n    const reg = item as { spec?: { source?: string; outputs?: Record<string, { collection: string }> }; source?: string; outputs?: Record<string, { collection: string }> }\n    const s = reg.spec ?? reg\n    if (!s.source) continue\n    const outputCollections = s.outputs\n      ? Object.values(s.outputs).map((o) => (o as { collection: string }).collection)\n      : []\n    // Key by sorted output-collection names so co-sourced derivations don't\n    // collide. A single-output derivation keys as just that collection name\n    // (e.g. 'billSummary'); multi-output keys as sorted join (e.g. 'a+b').\n    // Falls back to source when no outputs are declared (defensive).\n    const key = outputCollections.length > 0\n      ? [...outputCollections].sort().join('+')\n      : s.source\n    out[key] = {\n      source: s.source,\n      outputs: outputCollections,\n    }\n  }\n  return out\n}\n\nfunction listFromRegistry(reg: Record<string, unknown>): readonly unknown[] {\n  // Registries expose different accessor methods; try the common ones.\n  for (const method of ['all', 'list', 'specs', 'values']) {\n    const fn = reg[method]\n    if (typeof fn === 'function') {\n      try {\n        const out = (fn as () => unknown).call(reg)\n        if (Array.isArray(out)) return out\n        if (out && typeof (out as { values?: () => unknown }).values === 'function') {\n          return [...(out as { values: () => Iterable<unknown> }).values()]\n        }\n      } catch {\n        continue\n      }\n    }\n  }\n  return []\n}\n\nfunction summariseAggregateOp(value: unknown): string {\n  if (value && typeof value === 'object') {\n    const op = (value as { op?: string; kind?: string; field?: string }).op\n      ?? (value as { kind?: string }).kind\n    const field = (value as { field?: string }).field\n    if (op && field) return `${op}(${field})`\n    if (op) return op\n  }\n  return String(value)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkEA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB,CAAC,YAAY,WAAW,SAAS,YAAY,SAAS;AAEnF,eAAsB,gBACpB,OACA,MAC8B;AAC9B,QAAM,QAAQ,MAAM,iBAAiB;AACrC,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,YAAY,KAAK,cAAc;AAGrC,QAAM,aAAa,CAAC,GAAG,MAAM,gBAAgB,KAAK,CAAC;AACnD,QAAM,gBAAgB,MAAM,uBAAuB,MAAM,SAAS,MAAM,IAAI,GACzE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,eAAe,CAAC;AAC/C,QAAM,WAAW,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,EAAE,KAAK;AAE5E,QAAM,cAAoD,CAAC;AAC3D,aAAW,QAAQ,UAAU;AAC3B,gBAAY,IAAI,IAAI,MAAM,mBAAmB,OAAO,MAAM,YAAY,SAAS;AAAA,EACjF;AAGA,QAAM,oBAAoB,YAAY,MAAM,UAAU;AAEtD,QAAM,eAAe,iBAAiB,MAAM,eAAe;AAE3D,QAAM,cAAc,oBAAoB,MAAM,kBAAkB;AAGhE,MAAI;AACJ,MAAI,WAAW;AACb,eAAW,CAAC;AACZ,eAAW,QAAQ,sBAAsB;AACvC,YAAM,QAAQ,MAAM,mBAAmB,MAAM,SAAS,MAAM,MAAM,IAAI;AACtE,UAAI,MAAM,UAAU,GAAG;AACrB,iBAAS,IAAI,IAAI,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAA4B;AAAA,IAChC,iBAAiB;AAAA,IACjB,OAAO,MAAM;AAAA,IACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,cAAc,SAAY,EAAE,MAAM,MAAM,UAAU,IAAI,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,eAAe,uBAAuB,SAAqB,OAAkC;AAC3F,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,WAAO,OAAO,KAAK,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,mBACb,OACA,gBACA,YACA,WAC+B;AAC/B,MAAI,SAA0C,CAAC;AAC/C,MAAI;AAEJ,QAAM,UAAU,MAAM,YAAY,YAAY,cAAc;AAC5D,QAAM,OAAqC,CAAC;AAC5C,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,SAAK,IAAI,IAAI,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,KAAK;AAAA,EACtD;AAGA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,OAAO,cAAc;AAC7C,UAAM,YAAY,MAAM,oBAAoB,MAAM,SAAS,MAAM,MAAM,gBAAgB,GAAG;AAC1F,QAAI,WAAW;AACb,kBAAY,EAAE,MAAM,UAAU,MAAM,QAAQ,YAAY;AACxD,UAAI,UAAU,YAAY;AACxB,iBAAS,mBAAmB,UAAU,YAAY,aAAa,OAAO;AAAA,MACxE;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,WAAW,MAAM,gBAAgB,IAAI,cAAc;AAGzD,MAAI,CAAC,WAAW;AACd,UAAM,SAAS,UAAU,UAAU;AACnC,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,UAAU,MAAM,sBAAsB,MAAM;AAClD,oBAAY,EAAE,MAAM,QAAQ,MAAM,QAAQ,iBAAiB;AAC3D,YAAI,QAAQ,YAAY;AACtB,mBAAS,mBAAmB,QAAQ,YAAY,kBAAkB,OAAO;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,aAAa,GAAG;AAAA,EAExD;AAGA,QAAM,WAAW,UAAU,QAAQ;AACnC,QAAM,aAAa,UAAU,UAAU;AAGvC,QAAM,iBAAiB,MAAM,uBAAuB,cAAc,MAAM;AACxE,QAAM,oBAAoB,MAAM,iCAAiC,cAAc;AAC/E,QAAM,kBAAkB,sBAAsB,UAAa,kBAAkB,SAAS;AAItF,MAAI;AACJ,MAAI,eAAe,UAAa,kBAAkB,iBAAiB;AACjE,mBAAe;AAAA,MACb,GAAI,cAAc,CAAC;AAAA,MACnB,GAAI,iBAAiB,EAAE,SAAS,KAAc,IAAI,CAAC;AAAA,MACnD,GAAI,kBAAkB,EAAE,cAAc,kBAAkB,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,aAAmC;AAAA,IACvC;AAAA,IACA,SAAS,CAAC;AAAA,IACV;AAAA,IACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC,GAAI,aAAa,SAAY,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,IACnD,GAAI,iBAAiB,SAAY,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,EAC/D;AACA,MAAI,WAAW;AACb,UAAM,QAAQ,MAAM,mBAAmB,MAAM,SAAS,MAAM,MAAM,cAAc;AAC/E,IAAC,WAA2C,QAAQ;AAAA,EACvD;AACA,SAAO;AACT;AAEA,eAAe,mBACb,SACA,OACA,YAC0B;AAC1B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAC/F;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,OAAO;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,SAAS;AACb,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,MAAM;AACvB,aAAS;AACT,QAAI,OAAO,IAAK,OAAM;AACtB,QAAI,OAAO,IAAK,OAAM;AACtB,QAAI,IAAI,MAAM,OAAQ,UAAS,IAAI;AACnC,QAAI,IAAI,MAAM,OAAQ,UAAS,IAAI;AAAA,EACrC;AACA,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb,OAAO;AAAA,IACP,UAAU,KAAK,MAAM,QAAQ,IAAI,MAAM;AAAA,IACvC,UAAU,QAAQ,OAAO,oBAAoB,IAAI;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,WAAW,WAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,YAAY,UAA+D;AAClF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAAkD,CAAC;AAEzD,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM;AAUZ,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,KAAM;AACjB,UAAM,UAAU,KAAK,eACjB,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,UAAU,IACxC,IAAI,eAAe,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK,IAAI,CAAC;AACxD,UAAM,UAAU,KAAK,UACjB,MAAM,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAC/D;AACJ,UAAM,YAAY,KAAK,YAAY,OAAO;AAAA,MACxC,OAAO,QAAQ,KAAK,SAAS,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;AAAA,IAC7E,IAAI;AACJ,QAAI,KAAK,IAAI,IAAI;AAAA,MACf;AAAA,MACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,SAAS,KAAK,WAAW;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,UAA0D;AAClF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAA6C,CAAC;AACpD,aAAW,QAAQ,OAAO;AACxB,UAAM,IAAI;AACV,QAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAS;AACtC,QAAI,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAyD;AACpF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAA4C,CAAC;AACnD,aAAW,QAAQ,OAAO;AAIxB,UAAM,MAAM;AACZ,UAAM,IAAI,IAAI,QAAQ;AACtB,QAAI,CAAC,EAAE,OAAQ;AACf,UAAM,oBAAoB,EAAE,UACxB,OAAO,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAO,EAA6B,UAAU,IAC5E,CAAC;AAKL,UAAM,MAAM,kBAAkB,SAAS,IACnC,CAAC,GAAG,iBAAiB,EAAE,KAAK,EAAE,KAAK,GAAG,IACtC,EAAE;AACN,QAAI,GAAG,IAAI;AAAA,MACT,QAAQ,EAAE;AAAA,MACV,SAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,KAAkD;AAE1E,aAAW,UAAU,CAAC,OAAO,QAAQ,SAAS,QAAQ,GAAG;AACvD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,OAAO,OAAO,YAAY;AAC5B,UAAI;AACF,cAAM,MAAO,GAAqB,KAAK,GAAG;AAC1C,YAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,YAAI,OAAO,OAAQ,IAAmC,WAAW,YAAY;AAC3E,iBAAO,CAAC,GAAI,IAA4C,OAAO,CAAC;AAAA,QAClE;AAAA,MACF,QAAQ;AACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,KAAM,MAAyD,MAC/D,MAA4B;AAClC,UAAM,QAAS,MAA6B;AAC5C,QAAI,MAAM,MAAO,QAAO,GAAG,EAAE,IAAI,KAAK;AACtC,QAAI,GAAI,QAAO;AAAA,EACjB;AACA,SAAO,OAAO,KAAK;AACrB;","names":[]}

package/dist/with/index.js

@@ -6,12 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-5R3ERCDH.js";
-import "../chunk-WWGT2MDV.js";
-import "../chunk-ITNUCOXM.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+} from "../chunk-JOQ53DMI.js";
+import "../chunk-5ZOSG3RJ.js";
+import "../chunk-4N5QFSNQ.js";
+import "../chunk-QQJXBZCO.js";
+import "../chunk-FQQF23MC.js";
+import "../chunk-MSPNM2OM.js";
+import "../chunk-SYMS4546.js";
+import "../chunk-X6CMGUAG.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-HUS3J5WM.js";
+import "../chunk-CKZW6P5V.js";
+import "../chunk-FH542DDY.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-audit/attestation/active.d.ts

@@ -0,0 +1,10 @@
+import type { AttestationStrategy } from './strategy.js';
+/**
+ * Enable the attestation capability.
+ * Pass to `createNoydb({ attestationStrategy: withAttestation() })` to make the
+ * vault's `issueAttestation` / `getDocumentSigningPublicKey` / `revokeAttestation`
+ * / `unrevokeAttestation` / `getRevokedDocIds` / `publishRevocationList` methods
+ * live. The issue/revoke/signer engines are dynamically imported here, so they
+ * stay out of the floor bundle until opted in.
+ */
+export declare function withAttestation(): AttestationStrategy;

package/dist/with-audit/attestation/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @category capability
+ * Document attestation — issue side. Mint a signed, per-field commitment
+ * for a record and emit a QR credential verifiable offline via
+ * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.
+ */
+export { withAttestation } from './active.js';
+export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
+export { AttestationNotEnabledError } from '../../kernel/errors.js';
+export { issueAttestationCore } from './issue.js';
+export type { IssueContext, IssueArgs, IssueResult } from './issue.js';
+export { ATTESTATIONS_COLLECTION } from './signer.js';
+export { revokeDocCore, unrevokeDocCore, getRevokedDocIdsCore, publishRevocationListCore } from './revoke.js';
+export type { RevokeContext } from './revoke.js';
+export { AttestationError } from '../../kernel/errors.js';
+export { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList, type QrPayload, type AttestationFieldSchema, type VerifyResult, type VerifyInput, type RevocationList } from '@noy-db/attestation';

package/dist/with-audit/attestation/issue.d.ts

@@ -0,0 +1,29 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type AttestationFieldSchema, type QrPayload } from '@noy-db/attestation';
+/** Everything issueAttestationCore needs from the Vault, injected for testability. */
+export interface IssueContext {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly role: string;
+    /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */
+    getDEK(): Promise<EnclaveKey>;
+    /** Decrypted source record + its envelope version, or null if absent. */
+    readRecord(collection: string, id: string): Promise<{
+        record: Record<string, unknown>;
+        version: number;
+    } | null>;
+}
+export interface IssueArgs {
+    readonly collection: string;
+    readonly id: string;
+    readonly fieldSchema: AttestationFieldSchema;
+}
+export interface IssueResult {
+    readonly docId: string;
+    readonly qr: string;
+    readonly payload: QrPayload;
+    readonly keyId: string;
+    readonly publicKeyB64: string;
+}
+export declare function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>;

package/dist/with-audit/attestation/revoke.d.ts

@@ -0,0 +1,15 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type RevocationList } from '@noy-db/attestation';
+/** Everything the revoke core needs from the Vault, injected for testability. */
+export interface RevokeContext {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly role: string;
+    /** The _attestations collection DEK. */
+    getDEK(): Promise<EnclaveKey>;
+}
+export declare function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
+export declare function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void>;
+export declare function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]>;
+export declare function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList>;

package/dist/with-audit/attestation/signer.d.ts

@@ -0,0 +1,33 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+export declare const ATTESTATIONS_COLLECTION = "_attestations";
+export declare const SIGNER_RECORD_ID = "_signer";
+export declare const REVOKED_RECORD_ID = "_revoked";
+export interface DocSigner {
+    readonly keyId: string;
+    readonly publicKeyB64: string;
+    readonly privateKeyPkcs8B64: string;
+}
+/**
+ * Pure read: return the firm's persisted document-signing keypair, or `null`
+ * if none has been minted yet. Never writes — callers that must NOT mint
+ * (e.g. an ungated public-key getter) use this instead of `loadOrCreateSigner`.
+ *
+ * Stored as an encrypted record `_attestations/_signer` under the
+ * `_attestations` collection DEK (resolved via `getDEK`, which is
+ * AES-KW-wrapped under the owner KEK + persisted by the keyring). The KEK
+ * itself is AES-KW-only and cannot AES-GCM-encrypt these bytes — hence
+ * storage under a normal collection DEK.
+ */
+export declare function loadSigner(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<DocSigner | null>;
+/**
+ * Lazily mint (or load) the firm's Ed25519 document-signing keypair.
+ *
+ * On a concurrent first-mint, two callers can both read `null` and both mint
+ * distinct keypairs. The `put(…, expectedVersion: 0)` ("must not already
+ * exist") lets exactly one win; the loser catches `ConflictError`, re-reads,
+ * and returns the winner's signer — converging on a single keypair rather than
+ * clobbering it or surfacing a raw conflict. (All real stores treat a missing
+ * record + `ev: 0` as a no-conflict write, so the catch fires on lost-race only.)
+ */
+export declare function loadOrCreateSigner(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<DocSigner>;

package/dist/with-audit/attestation/strategy.d.ts

@@ -0,0 +1,44 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { RevocationList } from '@noy-db/attestation';
+import type { IssueContext, IssueArgs, IssueResult } from './issue.js';
+import type { RevokeContext } from './revoke.js';
+/**
+ * Deps the signing-public-key lookup needs. Unlike issue/revoke there is no
+ * per-call context object for it, so the vault facade assembles this at call
+ * time (reading `role` fresh).
+ */
+export interface SignerLookupDeps {
+    readonly adapter: NoydbStore;
+    readonly vault: string;
+    /** The invoking keyring's role, read fresh by the caller per call. */
+    readonly role: string;
+    /** Per-collection DEK resolver (bound `vault.getDEK`). */
+    readonly getDEK: (collection: string) => Promise<EnclaveKey>;
+}
+/**
+ * Attestation capability strategy — the six on-demand methods the vault's
+ * attestation delegators route through. The active engine ({@link withAttestation})
+ * dynamically imports the issue/revoke/signer cores (keeping them out of the floor
+ * bundle); {@link NO_ATTESTATION} throws. The vault-side {@link VaultAttestation}
+ * facade holds the per-collection field-schema registry and builds the per-call
+ * contexts, then delegates here.
+ * @internal
+ */
+export interface AttestationStrategy {
+    issueAttestation(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>;
+    getDocumentSigningPublicKey(deps: SignerLookupDeps): Promise<{
+        keyId: string;
+        publicKeyB64: string;
+    }>;
+    revokeAttestation(ctx: RevokeContext, docId: string): Promise<void>;
+    unrevokeAttestation(ctx: RevokeContext, docId: string): Promise<void>;
+    getRevokedDocIds(ctx: RevokeContext): Promise<string[]>;
+    publishRevocationList(ctx: RevokeContext): Promise<RevocationList>;
+}
+/**
+ * No-op stub — the floor default. Every capability method throws
+ * {@link AttestationNotEnabledError}; opt in with
+ * `attestationStrategy: withAttestation()` in createNoydb. @internal
+ */
+export declare const NO_ATTESTATION: AttestationStrategy;

package/dist/with-audit/attestation/vault-facade.d.ts

@@ -0,0 +1,62 @@
+import type { NoydbStore } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
+import type { AttestationStrategy } from './strategy.js';
+export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
+/** Everything the moving attestation methods touched on the vault's `this.*`. */
+export interface VaultAttestationDeps {
+    /** The ciphertext store. */
+    readonly adapter: NoydbStore;
+    /** Vault namespace name. */
+    readonly vault: string;
+    /** Per-collection DEK resolver (bound `vault.getDEK`). */
+    readonly getDEK: (collection: string) => Promise<EnclaveKey>;
+    /** The invoking keyring's role (read fresh per call). */
+    role(): string;
+    /** Decrypt a collection record at `locale: 'raw'` (issue side reads the live record). */
+    getRawRecord(collection: string, id: string): Promise<Record<string, unknown> | null>;
+}
+export declare class VaultAttestation {
+    private readonly deps;
+    /**
+     * Opt-in capability gate. `NO_ATTESTATION` when
+     * `createNoydb({ attestationStrategy })` was omitted — every issue/revoke/
+     * signer call then throws `AttestationNotEnabledError`. The facade always
+     * exists (it holds the per-collection field-schema registry populated at
+     * `collection()` time); only the capability methods are gated.
+     */
+    private readonly strategy;
+    /**
+     * Per-collection attestation field-schema (issue side). Populated on
+     * `collection({ attestation })` via {@link register} and read by
+     * {@link issue}. Indexed by collection name.
+     */
+    private readonly registry;
+    constructor(deps: VaultAttestationDeps, 
+    /**
+     * Opt-in capability gate. `NO_ATTESTATION` when
+     * `createNoydb({ attestationStrategy })` was omitted — every issue/revoke/
+     * signer call then throws `AttestationNotEnabledError`. The facade always
+     * exists (it holds the per-collection field-schema registry populated at
+     * `collection()` time); only the capability methods are gated.
+     */
+    strategy: AttestationStrategy);
+    /** Register a collection's attestation field-schema (from `vault.collection`). */
+    register(collection: string, schema: AttestationFieldSchema): void;
+    issue(collectionName: string, id: string): Promise<{
+        docId: string;
+        qr: string;
+        keyId: string;
+        publicKeyB64: string;
+    }>;
+    getDocumentSigningPublicKey(): Promise<{
+        keyId: string;
+        publicKeyB64: string;
+    }>;
+    private makeIssueContext;
+    revoke(docId: string): Promise<void>;
+    unrevoke(docId: string): Promise<void>;
+    getRevokedDocIds(): Promise<string[]>;
+    publishRevocationList(): Promise<RevocationList>;
+    private makeRevokeContext;
+}

package/dist/with-audit/consent/active.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Active consent strategy. Calling `withConsent()` returns a
+ * `ConsentStrategy` that delegates to the real
+ * `writeConsentEntry` / `loadConsentEntries` functions. Only
+ * reachable through the `@noy-db/hub/consent` subpath.
+ */
+import type { ConsentStrategy } from './strategy.js';
+/**
+ * Build the default consent strategy. Pass into
+ * `createNoydb({ consentStrategy: withConsent() })` to enable
+ * per-operation audit writes into the reserved `_consent_audit`
+ * collection.
+ */
+export declare function withConsent(): ConsentStrategy;

package/dist/with-audit/consent/consent.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Consent boundaries — per-access audit log.
+ *
+ * ```ts
+ * const audit = await vault.withConsent(
+ *   { purpose: 'quarterly-review', consentHash: '7f3a...' },
+ *   async () => {
+ *     const invoices = await vault.collection<Invoice>('invoices').list()
+ *     return invoices
+ *   },
+ * )
+ *
+ * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })
+ * // → entries: { actor, purpose, consentHash, ts, op, collection, id }
+ * ```
+ *
+ * ## Contract
+ *
+ * Every `get` / `put` / `delete` that happens inside a `withConsent`
+ * callback writes one entry to the reserved `_consent_audit`
+ * collection. Entries are encrypted with the vault's consent-audit
+ * DEK (separate from per-user-collection DEKs so access-log queries
+ * don't require unwrapping individual collection keys). Outside a
+ * `withConsent` scope, no entries are written — consent is
+ * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*
+ * consent).
+ *
+ * ## Why store the hash, not the consent text?
+ *
+ * The `consentHash` is the sha256 of whatever consent receipt the
+ * actor presented (a signed GDPR banner click, a HIPAA authorisation
+ * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:
+ *
+ *   1. Keeps the audit log small and indexable.
+ *   2. Preserves zero-knowledge at the adapter — adapters see
+ *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,
+ *      op, collection, id }`, never the consent record itself.
+ *   3. Lets the regulator verify a presented consent doc matches
+ *      the logged hash at audit time without the system ever
+ *      possessing the doc.
+ *
+ * ## Concurrency
+ *
+ * The consent context lives on the {@link Vault} instance. Two
+ * concurrent `withConsent` calls on the same Vault would stomp each
+ * other — documented limitation; adopters needing per-flight scope
+ * should use separate Vault instances or an AsyncLocalStorage shim.
+ *
+ * @module
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/** Reserved collection for consent-audit entries. */
+export declare const CONSENT_AUDIT_COLLECTION = "_consent_audit";
+/**
+ * The consent scope active for a block of work. Set via
+ * `vault.withConsent()`; observed by the collection's access hooks.
+ */
+export interface ConsentContext {
+    /**
+     * What this access is for. Used by the audit query (`consentAudit
+     * ({ purpose })`) and carried in the stored entry. Free-form; the
+     * regulator or compliance tooling decides the vocabulary.
+     */
+    readonly purpose: string;
+    /**
+     * Hex-encoded sha256 of whatever consent artefact the actor
+     * presented. Stored as-is in each entry.
+     */
+    readonly consentHash: string;
+}
+/**
+ * Access operation recorded in an audit entry.
+ *
+ * Union-widening checklist (I-2) — these three sites widen together or a
+ * downstream exhaustive switch breaks at its next in-range minor:
+ *   1. `ConsentOp` here (public, re-exported at `index.ts`).
+ *   2. `onAccess` op union on `kernel/collection-config.ts`.
+ *   3. classified ctx `onAccess` op union on `port/with/classified-strategy.ts`
+ *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).
+ */
+export type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find';
+/** One consent-audit record, as decrypted for the caller. */
+export interface ConsentAuditEntry {
+    /** ULID — stable insertion-order key. */
+    readonly id: string;
+    readonly timestamp: string;
+    readonly actor: string;
+    readonly purpose: string;
+    readonly consentHash: string;
+    readonly op: ConsentOp;
+    readonly collection: string;
+    readonly recordId: string;
+}
+/** Filter passed to `vault.consentAudit()`. */
+export interface ConsentAuditFilter {
+    /** Only entries at or after this ISO timestamp. */
+    readonly since?: string;
+    /** Only entries at or before this ISO timestamp. */
+    readonly until?: string;
+    /** Match entries targeting this collection. */
+    readonly collection?: string;
+    /** Match entries written by this actor. */
+    readonly actor?: string;
+    /** Match entries with this purpose. */
+    readonly purpose?: string;
+}
+/**
+ * Write one audit entry. Called by Vault's onAccess hook when a
+ * consent context is active.
+ */
+export declare function writeConsentEntry(adapter: NoydbStore, vault: string, encrypted: boolean, entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<void>;
+/** Load + decrypt + filter all entries. */
+export declare function loadConsentEntries(adapter: NoydbStore, vault: string, encrypted: boolean, getDEK: (collection: string) => Promise<EnclaveKey>, filter?: ConsentAuditFilter): Promise<ConsentAuditEntry[]>;