@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.3

package/dist/{chunk-IELYAOGG.js → chunk-YTIAXSUE.js}

@@ -1,11 +1,11 @@
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-AIWULCUO.js";
+} from "./chunk-6EVZXETK.js";
 import {
   PeriodClosedError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-audit/periods/periods.ts
 var PERIODS_COLLECTION = "_periods";
@@ -56,7 +56,7 @@ function validatePeriodName(name, existing) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-RYI35CDS.js");
+  const { envelopePayloadHash } = await import("./ledger-YUAJUNFP.js");
   await ledger.append({
     op: "put",
     collection: PERIODS_COLLECTION,
@@ -75,4 +75,4 @@ export {
   validatePeriodName,
   appendPeriodLedgerEntry
 };
-//# sourceMappingURL=chunk-IELYAOGG.js.map
+//# sourceMappingURL=chunk-YTIAXSUE.js.map

package/dist/{chunk-TJYQIGAP.js → chunk-Z44OY24N.js}

@@ -1,7 +1,7 @@
 import {
   CargoNotEnabledError,
   CustodyNotEnabledError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -20,7 +20,7 @@ function withCustody() {
       return host._revokeCustodianImpl(vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-CRPZEV7O.js");
+      const { liberateVault } = await import("./liberate-6LDETRIW.js");
       return liberateVault(vault, opts);
     }
   };
@@ -79,4 +79,4 @@ export {
   NO_CUSTODY,
   CustodyApi
 };
-//# sourceMappingURL=chunk-TJYQIGAP.js.map
+//# sourceMappingURL=chunk-Z44OY24N.js.map

package/dist/{chunk-VCTFO5CO.js → chunk-ZAWD6O46.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-VCTFO5CO.js.map
+//# sourceMappingURL=chunk-ZAWD6O46.js.map

package/dist/{chunk-PKHL44ER.js → chunk-ZD4D7UM6.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-PKHL44ER.js.map
+//# sourceMappingURL=chunk-ZD4D7UM6.js.map

package/dist/{chunk-MTMJVJ5W.js → chunk-ZFME46HJ.js}

@@ -2,9 +2,11 @@ import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
-  encrypt,
   openEnvelopeJson
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-5EZAJEES.js";
+import {
+  encrypt
+} from "./chunk-L4IRFTIF.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -70,4 +72,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-MTMJVJ5W.js.map
+//# sourceMappingURL=chunk-ZFME46HJ.js.map

package/dist/chunk-ZFME46HJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/** Access operation recorded in an audit entry. */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: 1,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: 1,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;AAuDO,IAAM,2BAA2B;AAsDxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/{chunk-LMTH2RM6.js → chunk-ZNI3RTFV.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-LMTH2RM6.js.map
+//# sourceMappingURL=chunk-ZNI3RTFV.js.map

package/dist/{chunk-WYSO2NIH.js → chunk-ZRDYQZYH.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-WYSO2NIH.js.map
+//# sourceMappingURL=chunk-ZRDYQZYH.js.map

package/dist/classified/index.d.ts

@@ -0,0 +1,17 @@
+import { dL as ClassifiedFieldSpec, dM as ClassifiedStrategy } from '../index-D05bV0_g.js';
+export { dN as ClassifiedConfigError, dO as ClassifiedEntry, dP as ClassifiedGroup, dQ as ClassifiedList, dR as ClassifiedRevealCtx, dS as ClassifiedRevealError, dT as ClassifiedRider, dU as ClassifiedRotationError, dV as ClassifiedStorage, dW as ClassifiedVerdict, dX as ClassifiedVerifyCtx, dY as ClassifiedVerifyError, dZ as NO_CLASSIFIED, d_ as isClassifiedFieldSpec, d$ as isClassifiedGroup } from '../index-D05bV0_g.js';
+export { C as ClassifiedNeverStoredError, a as ClassifiedValidationError, R as ResolvedClassified, c as classified, l as luhnCheck, r as resolveClassifiedFields } from '../validators-Dzn7T-3x.js';
+import '../subject-index-O75wKshW.js';
+import '../describe-0tiXAjoO.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';
+
+/** Write-path enforcement: storage:'never' rejection + preset validators.
+ *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */
+
+declare function enforceClassifiedWrite(record: Record<string, unknown>, byField: Record<string, ClassifiedFieldSpec>, collection: string): void;
+
+/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */
+declare function withClassified(): ClassifiedStrategy;
+
+export { ClassifiedFieldSpec, ClassifiedStrategy, enforceClassifiedWrite, withClassified };

package/dist/classified/index.js

@@ -0,0 +1,38 @@
+import {
+  classified,
+  luhnCheck,
+  withClassified
+} from "../chunk-NTHKOFVL.js";
+import {
+  ClassifiedNeverStoredError,
+  ClassifiedValidationError,
+  NO_CLASSIFIED,
+  enforceClassifiedWrite,
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  resolveClassifiedFields
+} from "../chunk-MIOLJG2R.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedRevealError,
+  ClassifiedRotationError,
+  ClassifiedVerifyError
+} from "../chunk-BLZRNHMG.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  ClassifiedConfigError,
+  ClassifiedNeverStoredError,
+  ClassifiedRevealError,
+  ClassifiedRotationError,
+  ClassifiedValidationError,
+  ClassifiedVerifyError,
+  NO_CLASSIFIED,
+  classified,
+  enforceClassifiedWrite,
+  isClassifiedFieldSpec,
+  isClassifiedGroup,
+  luhnCheck,
+  resolveClassifiedFields,
+  withClassified
+};
+//# sourceMappingURL=index.js.map

package/dist/collection-facade-XPVRHBGU.js

@@ -0,0 +1,36 @@
+import {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+} from "./chunk-UP6EMMDI.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-PYWW4KLO.js";
+import "./chunk-5A6TC3RQ.js";
+import "./chunk-2N4MUSF3.js";
+import "./chunk-6EVZXETK.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-7IP75FP2.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildPersistedIndexCallbacks,
+  buildRetrievalDocs,
+  embedOnWrite,
+  flushIndex,
+  hasIndexedBlobFields,
+  retrieve,
+  search,
+  similarTo,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-XPVRHBGU.js.map

package/dist/consent/index.d.ts

@@ -1,7 +1,7 @@
-import { bp as ConsentStrategy } from '../index-BzUo1B6n.js';
-export { bq as CONSENT_AUDIT_COLLECTION, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bv as loadConsentEntries, bw as writeConsentEntry } from '../index-BzUo1B6n.js';
+import { bp as ConsentStrategy } from '../index-D05bV0_g.js';
+export { bq as CONSENT_AUDIT_COLLECTION, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bv as loadConsentEntries, bw as writeConsentEntry } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/consent/index.js

@@ -2,11 +2,14 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-MTMJVJ5W.js";
+} from "../chunk-ZFME46HJ.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
-import "../chunk-ZYUC53LT.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
+import "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/crdt/index.d.ts

@@ -1,7 +1,7 @@
-import { bf as CrdtStrategy } from '../index-BzUo1B6n.js';
-export { bg as CrdtMode, bh as CrdtState, bi as LwwMapState, bj as RgaState, bk as YjsState, bl as buildLwwMapState, bm as buildRgaState, bn as mergeCrdtStates, bo as resolveCrdtSnapshot } from '../index-BzUo1B6n.js';
+import { bf as CrdtStrategy } from '../index-D05bV0_g.js';
+export { bg as CrdtMode, bh as CrdtState, bi as LwwMapState, bj as RgaState, bk as YjsState, bl as buildLwwMapState, bm as buildRgaState, bn as mergeCrdtStates, bo as resolveCrdtSnapshot } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/delegation-4HUHUE6T.js

@@ -0,0 +1,22 @@
+import {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+} from "./chunk-YDP2SA5K.js";
+import "./chunk-O5DNEXQC.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DELEGATIONS_COLLECTION,
+  issueDelegation,
+  loadActiveDelegations,
+  revokeDelegation
+};
+//# sourceMappingURL=delegation-4HUHUE6T.js.map

package/dist/derivations/index.d.ts

@@ -1,8 +1,8 @@
-export { w as withDerivation, a as withRollup } from '../with-rollup-BvQo3ROo.js';
-import { c2 as DerivationStrategy, c3 as DerivationContext } from '../index-BzUo1B6n.js';
-export { c4 as ArrayOutputSpec, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, ca as DerivationRegistry, cb as DerivationStrategyHandle, cc as DerivedFromMeta, cd as OutputSpec, ce as RecordOutputSpec } from '../index-BzUo1B6n.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-Bl0sRFEt.js';
+import { c2 as DerivationStrategy, c3 as DerivationContext } from '../index-D05bV0_g.js';
+export { c4 as ArrayOutputSpec, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, ca as DerivationRegistry, cb as DerivationStrategyHandle, cc as DerivedFromMeta, cd as OutputSpec, ce as RecordOutputSpec } from '../index-D05bV0_g.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-aBkJR2sd.js';
+import '../describe-0tiXAjoO.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/derivations/index.js

@@ -1,22 +1,25 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-LMTH2RM6.js";
+} from "../chunk-ZNI3RTFV.js";
 import {
   DerivationRegistry
-} from "../chunk-Q7SS3IME.js";
+} from "../chunk-P6UXDALK.js";
 import {
   DerivationExecutor
-} from "../chunk-PKHL44ER.js";
-import "../chunk-5O3AOPDT.js";
-import "../chunk-5TDJ56JE.js";
+} from "../chunk-ZD4D7UM6.js";
+import "../chunk-5EZAJEES.js";
+import "../chunk-6RASM2J4.js";
+import "../chunk-CPAROOKP.js";
+import "../chunk-L4IRFTIF.js";
+import "../chunk-OCDUQUAP.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-ZYUC53LT.js";
+} from "../chunk-BLZRNHMG.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/describe/index.d.ts

@@ -1 +1 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-aBkJR2sd.js';
+export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-0tiXAjoO.js';

package/dist/{describe-aBkJR2sd.d.ts → describe-0tiXAjoO.d.ts}

@@ -31,6 +31,14 @@ interface FieldMeta {
      * When absent, the widget is derived automatically by buildDescription.
      */
     widget?: string;
+    /**
+     * Card/section grouping hint for detail & form layouts (e.g. 'Identity',
+     * 'Amounts'). Purely descriptive metadata — consumers group; describe()
+     * keeps emitting fields alphabetically.
+     */
+    group?: string;
+    /** Relative ordering hint within (and across) groups. Lower renders first. */
+    order?: number;
 }
 
 /**
@@ -77,6 +85,10 @@ interface DescribedField {
     readonly constraints?: Record<string, unknown>;
     readonly label: string;
     readonly description?: string;
+    /** Card/section grouping hint for detail & form layouts. From fieldMeta/zod .meta(). */
+    readonly group?: string;
+    /** Relative ordering hint within and across groups. Lower renders first. */
+    readonly order?: number;
     readonly semanticType?: string;
     readonly unit?: string;
     readonly sensitivity?: 'public' | 'pii' | 'secret';
@@ -112,6 +124,16 @@ interface DescribedField {
     readonly widget: string;
     /** Whether the field is user-editable. False for computed, id, and provenance-stamped fields. */
     readonly editable: boolean;
+    /** Present when the field is classified. Serialized read-projection contract. */
+    readonly classified?: {
+        readonly preset: string;
+        readonly storage: 'recoverable' | 'never' | 'digest-only';
+        readonly list: 'omit' | {
+            readonly mask: string;
+        } | {
+            readonly rider: string;
+        };
+    };
 }
 interface CollectionDescription {
     readonly collection: string;

package/dist/{dev-unlock-C9Ro3v_O.d.ts → dev-unlock-B_s9DUWa.d.ts}

@@ -1,4 +1,4 @@
-import { cR as Role, cF as UnlockedKeyring } from './index-BzUo1B6n.js';
+import { cR as Role, cF as UnlockedKeyring } from './index-D05bV0_g.js';
 
 /**
  * Session tokens —

package/dist/{enclave-UL5LW66V.js → enclave-IS7HZSQ7.js}

@@ -1,13 +1,36 @@
 import {
   RecordCodec,
   SEALED_CEK_NS,
+  envelopeBodyForHash,
+  findByDet,
+  hasPerRecordKey,
+  openEnvelopeJson,
+  queryByDet,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rotateRecordCek,
+  sealRecordToHost,
+  writeEnvelopeBody
+} from "./chunk-5EZAJEES.js";
+import {
+  buildTombstone,
+  isTombstone
+} from "./chunk-6RASM2J4.js";
+import {
+  ctEqualTags,
+  deriveVdigSlotKey,
+  evaluateKofN,
+  pbkdf2VerifyDigest
+} from "./chunk-CPAROOKP.js";
+import {
   base64ToBuffer,
   bufferToBase64,
-  buildTombstone,
   decrypt,
   decryptBytes,
   decryptBytesWithAAD,
   decryptDeterministic,
+  deriveDeterministicKey,
   deriveKey,
   derivePassphraseKey,
   derivePresenceKey,
@@ -17,31 +40,19 @@ import {
   encryptBytes,
   encryptBytesWithAAD,
   encryptDeterministic,
-  envelopeBodyForHash,
-  findByDet,
   generateDEK,
   generateIV,
   generateSalt,
-  hasPerRecordKey,
   hmacSha256Hex,
   importCek,
-  isTombstone,
-  openEnvelopeJson,
-  queryByDet,
-  resolveStableCek,
-  revokeSealedRecord,
-  rewrapBodyToDek,
-  rotateRecordCek,
-  sealRecordToHost,
   sha256Hex,
   unwrapCek,
   unwrapKey,
   wrapCek,
-  wrapKey,
-  writeEnvelopeBody
-} from "./chunk-5O3AOPDT.js";
-import "./chunk-5TDJ56JE.js";
-import "./chunk-ZYUC53LT.js";
+  wrapKey
+} from "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-BLZRNHMG.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -49,20 +60,24 @@ export {
   base64ToBuffer,
   bufferToBase64,
   buildTombstone,
+  ctEqualTags,
   decrypt,
   decryptBytes,
   decryptBytesWithAAD,
   decryptDeterministic,
+  deriveDeterministicKey,
   deriveKey,
   derivePassphraseKey,
   derivePresenceKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
+  deriveVdigSlotKey,
   encrypt,
   encryptBytes,
   encryptBytesWithAAD,
   encryptDeterministic,
   envelopeBodyForHash,
+  evaluateKofN,
   findByDet,
   generateDEK,
   generateIV,
@@ -72,6 +87,7 @@ export {
   importCek,
   isTombstone,
   openEnvelopeJson,
+  pbkdf2VerifyDigest,
   queryByDet,
   resolveStableCek,
   revokeSealedRecord,
@@ -85,4 +101,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-UL5LW66V.js.map
+//# sourceMappingURL=enclave-IS7HZSQ7.js.map

package/dist/executor-ANFBCOYA.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-ZD4D7UM6.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-ANFBCOYA.js.map

package/dist/executor-IKT47SH2.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-DGUR3CC4.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-IKT47SH2.js.map

package/dist/executor-OIECZXTV.js

@@ -0,0 +1,18 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-CVXLJIAV.js";
+import "./chunk-5Z3RNFJC.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-NPVICKZE.js";
+import "./chunk-QLQS5A7X.js";
+import "./chunk-7IP75FP2.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-OIECZXTV.js.map

package/dist/export-accessible-NZWCFZHL.js

@@ -0,0 +1,20 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-7MHVHGQZ.js";
+import "./chunk-3UDPDRUC.js";
+import "./chunk-VBYVKOMJ.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-NZWCFZHL.js.map

package/dist/extract-partition-52LX6RQH.js

@@ -0,0 +1,33 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-IWVWB7BZ.js";
+import "./chunk-U6OM4E67.js";
+import "./chunk-55HDKLI3.js";
+import "./chunk-3UDPDRUC.js";
+import "./chunk-VBYVKOMJ.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-6EVZXETK.js";
+import "./chunk-5EZAJEES.js";
+import "./chunk-6RASM2J4.js";
+import "./chunk-CPAROOKP.js";
+import "./chunk-L4IRFTIF.js";
+import "./chunk-OCDUQUAP.js";
+import "./chunk-BLZRNHMG.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-52LX6RQH.js.map