@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-7P2SDJG3.js

@@ -1,279 +0,0 @@
-import {
-  assertTierAccess,
-  dekKey
-} from "./chunk-7BWJHO2A.js";
-import {
-  rewrapBodyToDek
-} from "./chunk-MCHVVJIA.js";
-import {
-  decrypt,
-  encrypt,
-  unwrapCek
-} from "./chunk-3OPY6MK2.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YN5IAHN6.js";
-import {
-  TierDemoteDeniedError,
-  TiersNotEnabledError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-audit/tiers/active.ts
-function withTiers() {
-  return {
-    async putAtTier(ctx, id, record, tier, opts) {
-      const { putAtTier: putAtTier2 } = await import("./tiers/index.js");
-      return putAtTier2(ctx, id, record, tier, opts);
-    },
-    async getAtTier(ctx, id) {
-      const { getAtTier: getAtTier2 } = await import("./tiers/index.js");
-      return getAtTier2(ctx, id);
-    },
-    async listAtTier(ctx) {
-      const { listAtTier: listAtTier2 } = await import("./tiers/index.js");
-      return listAtTier2(ctx);
-    },
-    async elevate(ctx, id, toTier) {
-      const { elevate: elevate2 } = await import("./tiers/index.js");
-      return elevate2(ctx, id, toTier);
-    },
-    async demote(ctx, id, toTier) {
-      const { demote: demote2 } = await import("./tiers/index.js");
-      return demote2(ctx, id, toTier);
-    }
-  };
-}
-
-// src/with-audit/tiers/strategy.ts
-var NO_TIERS = {
-  async putAtTier() {
-    throw new TiersNotEnabledError();
-  },
-  async getAtTier() {
-    throw new TiersNotEnabledError();
-  },
-  async listAtTier() {
-    throw new TiersNotEnabledError();
-  },
-  async elevate() {
-    throw new TiersNotEnabledError();
-  },
-  async demote() {
-    throw new TiersNotEnabledError();
-  }
-};
-
-// src/with-audit/tiers/index.ts
-function assertTiersEnabled(ctx) {
-  if (!ctx.tiers) {
-    throw new Error(
-      `Collection "${ctx.name}": hierarchical tiers are not enabled. Pass { tiers: [0, 1, 2, \u2026] } to vault.collection() to opt in.`
-    );
-  }
-}
-function assertDeclaredTier(ctx, tier) {
-  if (tier < 0 || !Number.isInteger(tier)) {
-    throw new Error(`Collection "${ctx.name}": tier must be a non-negative integer, got ${tier}`);
-  }
-  if (tier === 0) return;
-  if (!ctx.tiers || !ctx.tiers.has(tier)) {
-    throw new Error(
-      `Collection "${ctx.name}": tier ${tier} is not declared in { tiers: [...] }`
-    );
-  }
-}
-function isElevatorOrOwner(ctx) {
-  return ctx.keyring.role === "owner" || ctx.keyring.role === "admin";
-}
-async function putAtTier(ctx, id, record, tier, opts) {
-  assertTiersEnabled(ctx);
-  assertDeclaredTier(ctx, tier);
-  assertTierAccess(ctx.keyring, ctx.name, tier);
-  const key = dekKey(ctx.name, tier);
-  const dek = await ctx.getDEK(key);
-  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id);
-  const version = existing ? existing._v + 1 : 1;
-  const json = JSON.stringify(record);
-  const { iv, data } = await encrypt(json, dek);
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _by: ctx.keyring.userId,
-    ...tier > 0 && { _tier: tier },
-    ...ctx.provenance && opts?.source !== void 0 ? { _source: opts.source, _sourceTs: opts.sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {}
-  };
-  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope);
-  if (tier > 0) {
-    ctx.emitCrossTierEvent({
-      actor: ctx.keyring.userId,
-      collection: ctx.name,
-      id,
-      tier,
-      authorization: opts?.elevation ? "elevation" : "inherent",
-      op: "put",
-      ts: envelope._ts,
-      ...opts?.elevation && {
-        reason: opts.elevation.reason,
-        elevatedFrom: opts.elevation.fromTier
-      }
-    });
-  }
-}
-async function getAtTier(ctx, id) {
-  assertTiersEnabled(ctx);
-  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
-  if (!envelope) return null;
-  const tier = envelope._tier ?? 0;
-  if (tier === 0) {
-    return ctx.codec.decryptRecord(envelope, { id });
-  }
-  const key = dekKey(ctx.name, tier);
-  if (!ctx.keyring.deks.has(key)) {
-    if (ctx.tierMode === "ghost") {
-      return { _ghost: true, _tier: tier };
-    }
-    return null;
-  }
-  const dek = await ctx.getDEK(key);
-  let plaintext;
-  let cek;
-  if (envelope._cek !== void 0) {
-    cek = await unwrapCek(envelope._cek, dek);
-    ctx.cekCache?.set(id, cek, 1);
-    plaintext = await decrypt(envelope._iv, envelope._data, cek);
-  } else {
-    plaintext = await decrypt(envelope._iv, envelope._data, dek);
-  }
-  let record = JSON.parse(plaintext);
-  if (envelope._sealed !== void 0) {
-    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id });
-  }
-  ctx.emitCrossTierEvent({
-    actor: ctx.keyring.userId,
-    collection: ctx.name,
-    id,
-    tier,
-    authorization: isElevatorOrOwner(ctx) ? "inherent" : "delegation",
-    op: "get",
-    ts: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return record;
-}
-async function listAtTier(ctx) {
-  assertTiersEnabled(ctx);
-  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
-  const out = [];
-  for (const id of ids) {
-    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
-    if (!env) continue;
-    const tier = env._tier ?? 0;
-    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier));
-    if (!readable && ctx.tierMode === "invisibility") continue;
-    out.push({ id, tier, readable });
-  }
-  return out;
-}
-async function elevate(ctx, id, toTier) {
-  assertTiersEnabled(ctx);
-  assertDeclaredTier(ctx, toTier);
-  assertTierAccess(ctx.keyring, ctx.name, toTier);
-  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
-  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
-  const fromTier = envelope._tier ?? 0;
-  if (toTier === fromTier) return;
-  if (toTier < fromTier) {
-    throw new Error(`Use demote() to lower the tier of "${id}" from ${fromTier} to ${toTier}`);
-  }
-  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier);
-  const fromKey = dekKey(ctx.name, fromTier);
-  const toKey = dekKey(ctx.name, toTier);
-  const fromDek = await ctx.getDEK(fromKey);
-  const toDek = await ctx.getDEK(toKey);
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
-  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
-  const next = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: envelope._v + 1,
-    _ts: now,
-    _iv: body._iv,
-    _data: body._data,
-    _by: ctx.keyring.userId,
-    _tier: toTier,
-    _elevatedBy: ctx.keyring.userId,
-    ...body._cek !== void 0 ? { _cek: body._cek } : {}
-  };
-  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
-  ctx.emitCrossTierEvent({
-    actor: ctx.keyring.userId,
-    collection: ctx.name,
-    id,
-    tier: toTier,
-    authorization: "elevation",
-    op: "elevate",
-    ts: now
-  });
-}
-async function demote(ctx, id, toTier) {
-  assertTiersEnabled(ctx);
-  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`);
-  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id);
-  if (!envelope) throw new Error(`Record "${id}" not found in collection "${ctx.name}"`);
-  const fromTier = envelope._tier ?? 0;
-  if (toTier === fromTier) return;
-  if (toTier > fromTier) {
-    throw new Error(`Use elevate() to raise the tier of "${id}" from ${fromTier} to ${toTier}`);
-  }
-  const isOwner = ctx.keyring.role === "owner";
-  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId;
-  if (!isOwner && !isOriginalElevator) {
-    throw new TierDemoteDeniedError(id, fromTier);
-  }
-  assertTierAccess(ctx.keyring, ctx.name, fromTier);
-  if (toTier > 0) assertDeclaredTier(ctx, toTier);
-  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier));
-  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier));
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
-  if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
-  const next = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: envelope._v + 1,
-    _ts: now,
-    _iv: body._iv,
-    _data: body._data,
-    _by: ctx.keyring.userId,
-    ...toTier > 0 && { _tier: toTier },
-    ...body._cek !== void 0 ? { _cek: body._cek } : {}
-  };
-  await ctx.adapter.put(ctx.vault, ctx.name, id, next);
-  ctx.emitCrossTierEvent({
-    actor: ctx.keyring.userId,
-    collection: ctx.name,
-    id,
-    tier: fromTier,
-    authorization: "elevation",
-    op: "demote",
-    ts: now
-  });
-}
-function classifySealedShred(ctx, live) {
-  return ctx.codec.classifySealedShred(live);
-}
-
-export {
-  withTiers,
-  NO_TIERS,
-  assertTiersEnabled,
-  assertDeclaredTier,
-  putAtTier,
-  getAtTier,
-  listAtTier,
-  elevate,
-  demote,
-  classifySealedShred
-};
-//# sourceMappingURL=chunk-7P2SDJG3.js.map

package/dist/chunk-ANB77BVV.js

@@ -1,150 +0,0 @@
-import {
-  openEnvelopeJson
-} from "./chunk-MCHVVJIA.js";
-import {
-  encrypt,
-  hmacSha256Hex,
-  sha256Hex
-} from "./chunk-3OPY6MK2.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YN5IAHN6.js";
-
-// src/with-audit/forget/strategy.ts
-var NO_FORGET = { subjects: {} };
-
-// src/with-audit/forget/subject-index.ts
-var SUBJECT_INDEX_COLLECTION = "_subject_index";
-var REF_LIST_BUCKET = 256;
-async function sha256HexString(input) {
-  return sha256Hex(new TextEncoder().encode(input));
-}
-async function subjectKeys(getDEK, encrypted, subjectId) {
-  const legacy = await sha256HexString(subjectId);
-  if (!encrypted) return [legacy];
-  const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId));
-  return keyed === legacy ? [keyed] : [keyed, legacy];
-}
-async function primarySubjectKey(getDEK, encrypted, subjectId) {
-  return (await subjectKeys(getDEK, encrypted, subjectId))[0];
-}
-function parseRefs(json) {
-  const parsed = JSON.parse(json);
-  return Array.isArray(parsed) ? parsed : parsed.r;
-}
-function serializeRefs(refs) {
-  const base = JSON.stringify({ r: refs, p: "" });
-  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length;
-  return JSON.stringify({ r: refs, p: " ".repeat(pad) });
-}
-async function readRefs(adapter, vault, getDEK, encrypted, key) {
-  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key);
-  if (!env || !env._data) return [];
-  if (!encrypted) return parseRefs(env._data);
-  const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-  const json = await openEnvelopeJson(env, dek);
-  return parseRefs(json);
-}
-async function writeRefs(adapter, vault, getDEK, encrypted, key, refs) {
-  let env;
-  if (!encrypted) {
-    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: JSON.stringify(refs) };
-  } else {
-    const dek = await getDEK(SUBJECT_INDEX_COLLECTION);
-    const { iv, data } = await encrypt(serializeRefs(refs), dek);
-    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
-  }
-  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env);
-}
-async function addSubjectRef(adapter, vault, getDEK, encrypted, subjectId, ref) {
-  const key = await primarySubjectKey(getDEK, encrypted, subjectId);
-  const refs = await readRefs(adapter, vault, getDEK, encrypted, key);
-  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return;
-  refs.push(ref);
-  await writeRefs(adapter, vault, getDEK, encrypted, key, refs);
-}
-async function removeSubjectRef(adapter, vault, getDEK, encrypted, subjectId, ref) {
-  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {
-    const refs = await readRefs(adapter, vault, getDEK, encrypted, key);
-    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id));
-    if (next.length === refs.length) continue;
-    if (next.length === 0) {
-      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key);
-    } else {
-      await writeRefs(adapter, vault, getDEK, encrypted, key, next);
-    }
-  }
-}
-async function lookupSubject(adapter, vault, getDEK, encrypted, subjectId) {
-  const keys = await subjectKeys(getDEK, encrypted, subjectId);
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const key of keys) {
-    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {
-      const dedup = `${ref.collection}\0${ref.id}`;
-      if (seen.has(dedup)) continue;
-      seen.add(dedup);
-      out.push(ref);
-    }
-  }
-  return out;
-}
-async function rebuildSubjectIndex(adapter, vault, getDEK, encrypted, subjects, decodeRecord) {
-  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION);
-  for (const k of existing) {
-    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k);
-  }
-  const bySubject = /* @__PURE__ */ new Map();
-  for (const [collection, field] of Object.entries(subjects)) {
-    const ids = await adapter.list(vault, collection);
-    for (const id of ids) {
-      if (id.startsWith("_")) continue;
-      const env = await adapter.get(vault, collection, id);
-      if (!env || !env._data) continue;
-      const record = await decodeRecord(collection, id, env);
-      if (record === null) continue;
-      const subjectValue = readDottedPath(record, field);
-      if (subjectValue === void 0 || subjectValue === null) continue;
-      const subjectId = coerceSubjectId(subjectValue);
-      const list = bySubject.get(subjectId) ?? [];
-      list.push({ collection, id });
-      bySubject.set(subjectId, list);
-    }
-  }
-  let entries = 0;
-  for (const [subjectId, refs] of bySubject) {
-    const key = await primarySubjectKey(getDEK, encrypted, subjectId);
-    await writeRefs(adapter, vault, getDEK, encrypted, key, refs);
-    entries++;
-  }
-  return entries;
-}
-function coerceSubjectId(value) {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-}
-function readDottedPath(record, field) {
-  if (!field.includes(".")) return record[field];
-  let cursor = record;
-  for (const segment of field.split(".")) {
-    if (cursor === null || cursor === void 0) return void 0;
-    cursor = cursor[segment];
-  }
-  return cursor;
-}
-
-export {
-  NO_FORGET,
-  SUBJECT_INDEX_COLLECTION,
-  addSubjectRef,
-  removeSubjectRef,
-  lookupSubject,
-  rebuildSubjectIndex,
-  coerceSubjectId,
-  readDottedPath
-};
-//# sourceMappingURL=chunk-ANB77BVV.js.map

package/dist/chunk-ANB77BVV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/forget/strategy.ts","../src/with-audit/forget/subject-index.ts"],"sourcesContent":["/**\n * `withForgetCascade` — declaration surface for GDPR right-to-erasure via\n * per-record CEK crypto-shred.\n *\n * This file holds only the *declaration* shape and the disabled sentinel.\n * The actual erasure machinery lives in:\n *   - `subject-index.ts` — the encrypted `_subject_index` reserved collection\n *   - `vault.ts` `forget()` — the per-record tombstone + ledger flow\n *   - `collection.ts` `_writeTombstone` — the envelope rewrite\n *\n * A `ForgetStrategy` declares which collections carry erasable subject data\n * and the (dotted-path) field on each record that names the data subject.\n * Declaring a collection here ALSO forces `perRecordKeys: true` for it (a\n * shred can only erase a record whose body is keyed off a per-record CEK),\n * so adopters opt into the CEK foundation transitively.\n *\n * @module\n */\nimport type { LedgerEntry } from '../../with-commit/history/ledger/entry.js'\n\n/**\n * User-supplied declaration passed to {@link withForgetCascade}. Maps a\n * collection name to the record field (dotted path supported, e.g.\n * `'billing.buyerId'`) that identifies the data subject for erasure.\n *\n * ```ts\n * withForgetCascade({ subjects: { invoices: 'buyerId', contacts: 'id' } })\n * ```\n */\nexport interface SubjectDeclaration {\n  readonly subjects: Record<string, string>\n}\n\n/**\n * Resolved forget strategy threaded through Noydb → every Vault. Carries\n * the same `subjects` map the user declared. `NO_FORGET` (empty map) is the\n * off-by-default sentinel; `vault.forget()` throws\n * `ForgetStrategyNotConfiguredError` when the map is empty.\n */\nexport interface ForgetStrategy {\n  /** Collection → subject-field (dotted path). Empty under `NO_FORGET`. */\n  readonly subjects: Readonly<Record<string, string>>\n}\n\n/**\n * Disabled sentinel — no collections declare a subject field. `vault.forget()`\n * refuses with `ForgetStrategyNotConfiguredError`; no write hooks register; no\n * collection is forced into `perRecordKeys`. Non-adopters pay nothing.\n */\nexport const NO_FORGET: ForgetStrategy = { subjects: {} }\n\n// The `withForgetCascade` factory lives in `active.ts` (canonical\n// strategy.ts/active.ts/index.ts split); this file holds only the\n// declaration shape + disabled sentinel.\n\n/**\n * The outcome of a `vault.forget(subjectId)` call.\n *\n * `unmigratedRecords` lists `collection:id` pairs that were tombstoned but\n * whose body had NOT been migrated to a per-record CEK at shred time (legacy\n * body still under the shared collection DEK). Those records are tombstoned\n * (live envelope + history stripped) but their pre-shred ciphertext, if it\n * leaked into a backup before migration, remains decryptable under the\n * collection DEK — so erasure-completeness is NOT guaranteed for them. Run\n * the per-record-CEK migration pass, then re-forget, to close the gap.\n *\n * Blob attachments: a shredded record's **erasable** blobs (on a\n * `perRecordKeys` collection) are crypto-shredded inline — `blobsShredded`\n * counts those taken to refCount 0 (BlobObject deleted → chunks permanently\n * undecryptable), `blobsRetainedShared` counts those still referenced by\n * another record (shared content legitimately persists for its other owner).\n * `blobResidueCollections` now lists only collections with blobs that could\n * NOT be crypto-shredded: **legacy** blobs (no per-blob `_cek`, chunks under\n * the shared `_blob` DEK — migrate them), or a session without the blob\n * service loaded. An all-erasable subject yields an empty residue list.\n */\nexport interface ForgetResult {\n  /** The subject id passed to `forget()`. Echoed for caller convenience. */\n  readonly subject: string\n  /** Count of live records rewritten to a tombstone. */\n  readonly recordsShredded: number\n  /** Count of `_history` envelopes tombstoned across all shredded records. */\n  readonly historyVersionsShredded: number\n  /** Distinct collections that had at least one record shredded. */\n  readonly collections: readonly string[]\n  /** `collection:id` pairs shredded while still un-migrated (see type docs). */\n  readonly unmigratedRecords: readonly string[]\n  /** Count of erasable blobs crypto-shredded (refCount → 0, BlobObject deleted). */\n  readonly blobsShredded: number\n  /** Count of erasable blobs retained because still referenced elsewhere (shared). */\n  readonly blobsRetainedShared: number\n  /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */\n  readonly blobResidueCollections: readonly string[]\n  /**\n   * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted\n   * across the shredded records. These live under the retained\n   * collection DEK, so crypto-shred alone would leave the indexed field VALUES\n   * readable — `forget()` must delete them.\n   */\n  readonly indexPostingsPurged: number\n  /**\n   * `collection:id:field` entries whose persisted `_idx` side-car could NOT be\n   * deleted — index residue that still leaks the indexed value under the\n   * retained collection DEK. Non-empty means erasure is INCOMPLETE: retry, or\n   * purge the side-car out of band.\n   */\n  readonly indexResidue: readonly string[]\n  /**\n   * Count of `_sealed[field]` slots dropped from the live store across the\n   * shredded records. For slots written under `sensitive` +\n   * `perRecordKeys` (the current path), the key derives off the per-record CEK,\n   * so tombstoning the record — which drops `_cek` and `_sealed` — also\n   * crypto-shreds the value. A legacy slot (written before per-record CEKs) keys\n   * off the collection DEK instead, so dropping it removes it from the live store but a\n   * pre-forget backup remains recoverable by a DEK holder (same caveat `_data`\n   * carries); migrate by re-`put`ting before forgetting for full crypto-shred.\n   */\n  readonly sealedFieldsShredded: number\n  /** Count of `_sealed_cek` host-delivery envelopes deleted (#H-1). A record sealed to an\n   * at-* host via sealRecordToHost persists its raw CEK there; forget() must destroy them. */\n  readonly sealedCekEnvelopesPurged: number\n  /** `collection:id` whose `_sealed_cek` purge failed (residue — the host-recoverable CEK may survive). */\n  readonly sealedCekResidue: readonly string[]\n  /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded\n   * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */\n  readonly sealedResidue: readonly string[]\n  /** The single `op:'forget'` ledger entry appended for this erasure. */\n  readonly ledgerEntry: LedgerEntry\n  /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased\n   *  because their source subject was forgotten. Overlay outputs are intentionally out of\n   *  scope here — an overlay is always sourced from an MV, never directly from a subject\n   *  collection, so the personal-data-bearing MV rows it reads are already erased above. */\n  readonly derivedRecordsErased: number\n  /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */\n  readonly derivedAggregatesRecomputed: number\n  /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen\n   *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */\n  readonly derivedResidueFrozen: readonly string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  readonly lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  readonly lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.\n   *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */\n  readonly lookupReferencesResidue: readonly string[]\n}\n","/**\n * The encrypted subject index.\n *\n * GDPR crypto-shred needs to answer \"which records belong to data subject\n * X?\" portably (the index must travel with the vault/bundle) WITHOUT leaking\n * subject-equivalence to the store. The rejected alternative — an unencrypted\n * subject tag in envelope metadata — would let anyone with store access see\n * which records share a subject. Instead we keep a reserved `_subject_index`\n * collection, encrypted under its OWN DEK (`getDEK('_subject_index')`):\n *\n *   - record id  = `HMAC-SHA256(indexDEK, subjectId)` (M-2). A bare\n *     `sha256Hex(subjectId)` would be offline-computable: an attacker with\n *     store access and a candidate list (emails / customer ids are low-entropy)\n *     could dictionary the hash to confirm \"subject X is present here.\" Keying\n *     the id with the vault-only index DEK removes that capability — without the\n *     DEK the id cannot be derived. (Legacy entries written before M-2 used the\n *     bare sha256 id; the read/remove paths dual-look-up both forms.)\n *   - record body = AES-GCM(JSON `{ r: [{ collection, id }], p }`) under the\n *     index DEK, where `p` pads the plaintext to a bucketed length so the\n *     ciphertext `_data` length does not leak the approximate record count.\n *     Legacy bodies were a bare `[{ collection, id }]` array; reads accept both.\n *\n * ## Concurrency (RISK #3 — known v1 limitation)\n *\n * `addSubjectRef` / `removeSubjectRef` are read-modify-write with no CAS. The\n * design assumes a SINGLE WRITER (the noy-db single-process write model). Two\n * concurrent writers racing on the SAME subject can lose an entry (last-write\n * wins on the ref list). This is documented, not fixed in v1:\n * `rebuildSubjectIndex` performs a full scan to recover a correct index from\n * the canonical records, so a lost ref is recoverable. A CAS-backed index is\n * deferred to a later slice.\n *\n * @module\n */\nimport { encrypt, openEnvelopeJson, hmacSha256Hex, sha256Hex, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\n/** Reserved collection holding the encrypted subject → records index. */\nexport const SUBJECT_INDEX_COLLECTION = '_subject_index'\n\n/**\n * Bucket (bytes) the encrypted ref-list plaintext is padded up to, so the\n * ciphertext `_data` length leaks only `count` rounded up to a bucket — not the\n * exact record count. 256 keeps small subjects (the common case) indistinguishable.\n */\nconst REF_LIST_BUCKET = 256\n\n/** A single record reference held in a subject's index entry. */\nexport interface SubjectRef {\n  readonly collection: string\n  readonly id: string\n}\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** SHA-256 hex of a UTF-8 string. The LEGACY (pre-M-2) subject-index key. */\nasync function sha256HexString(input: string): Promise<string> {\n  return sha256Hex(new TextEncoder().encode(input))\n}\n\n/**\n * The subject-index record id(s) to consult for a subject, most-current first.\n *\n * - Encrypted vault: the PRIMARY id is `HMAC-SHA256(indexDEK, subjectId)` (M-2)\n *   — not offline-computable. The LEGACY `sha256Hex(subjectId)` id is also\n *   returned so reads/removes still find entries written before M-2 (dual-lookup).\n * - Plaintext/debug vault: no DEK to key with, so the only id is the legacy\n *   sha256 form (unchanged behaviour — plaintext mode is not zero-knowledge anyway).\n */\nasync function subjectKeys(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string[]> {\n  const legacy = await sha256HexString(subjectId)\n  if (!encrypted) return [legacy]\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId))\n  return keyed === legacy ? [keyed] : [keyed, legacy]\n}\n\n/** The id new writes land under (keyed when encrypted, else legacy sha256). */\nasync function primarySubjectKey(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string> {\n  return (await subjectKeys(getDEK, encrypted, subjectId))[0]!\n}\n\n/** Parse a stored ref-list body: new padded `{ r, p }` wrapper OR legacy bare array. */\nfunction parseRefs(json: string): SubjectRef[] {\n  const parsed = JSON.parse(json) as SubjectRef[] | { r: SubjectRef[] }\n  return Array.isArray(parsed) ? parsed : parsed.r\n}\n\n/** Serialize + pad the ref list to a bucket boundary (encrypted vaults only). */\nfunction serializeRefs(refs: SubjectRef[]): string {\n  const base = JSON.stringify({ r: refs, p: '' })\n  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length\n  return JSON.stringify({ r: refs, p: ' '.repeat(pad) })\n}\n\n/** Read + decrypt the ref list at a SINGLE index key. Returns `[]` when absent. */\nasync function readRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n): Promise<SubjectRef[]> {\n  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key)\n  if (!env || !env._data) return []\n  if (!encrypted) return parseRefs(env._data)\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const json = await openEnvelopeJson(env, dek)\n  return parseRefs(json)\n}\n\n/** Encrypt + write a ref list for a subject under its derived key. */\nasync function writeRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n  refs: SubjectRef[],\n): Promise<void> {\n  let env: EncryptedEnvelope\n  if (!encrypted) {\n    // Plaintext/debug vault: keep the legacy bare-array form (no padding needed).\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: '', _data: JSON.stringify(refs) }\n  } else {\n    const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n    const { iv, data } = await encrypt(serializeRefs(refs), dek)\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: iv, _data: data }\n  }\n  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env)\n}\n\n/**\n * Add a `{ collection, id }` ref to a subject's index entry (idempotent —\n * a duplicate ref is not appended). Read-modify-write; see the concurrency\n * note in the module docstring.\n */\nexport async function addSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n  const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return\n  refs.push(ref)\n  await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n}\n\n/**\n * Remove a `{ collection, id }` ref from a subject's index entry. When the\n * last ref is removed the (now empty) entry is deleted so the store holds no\n * residual key for an erased subject.\n */\nexport async function removeSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  // Dual-lookup: drop the ref from BOTH the keyed (M-2) and the legacy sha256\n  // entry, so a pre-M-2 subject is still fully erased.\n  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {\n    const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id))\n    if (next.length === refs.length) continue\n    if (next.length === 0) {\n      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key)\n    } else {\n      await writeRefs(adapter, vault, getDEK, encrypted, key, next)\n    }\n  }\n}\n\n/**\n * Look up every record ref for a subject. Returns `[]` when none exist. Unions\n * the keyed (M-2) and legacy sha256 entries (dual-lookup), deduplicated, so a\n * subject indexed before M-2 is still fully found.\n */\nexport async function lookupSubject(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n): Promise<SubjectRef[]> {\n  const keys = await subjectKeys(getDEK, encrypted, subjectId)\n  const seen = new Set<string>()\n  const out: SubjectRef[] = []\n  for (const key of keys) {\n    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {\n      const dedup = `${ref.collection}\\u0000${ref.id}`\n      if (seen.has(dedup)) continue\n      seen.add(dedup)\n      out.push(ref)\n    }\n  }\n  return out\n}\n\n/**\n * Rebuild the entire subject index from the canonical records (the recovery\n * path for the documented read-modify-write race). Scans each declared\n * collection, reads `record[subjectField]` (dotted path), and rewrites the\n * index from scratch. Tombstoned (already-shredded) records contribute no\n * ref — their body is gone, so they cannot be re-indexed.\n *\n * `decodeRecord` decrypts an envelope to a plain object (or returns null for\n * a tombstone / unreadable record); supplied by the caller so this module\n * stays free of Collection internals.\n */\nexport async function rebuildSubjectIndex(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjects: Readonly<Record<string, string>>,\n  decodeRecord: (collection: string, id: string, env: EncryptedEnvelope) => Promise<Record<string, unknown> | null>,\n): Promise<number> {\n  // Drop every existing index entry first so removed refs don't linger.\n  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION)\n  for (const k of existing) {\n    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k)\n  }\n\n  // subjectId → refs, accumulated across all declared collections.\n  const bySubject = new Map<string, SubjectRef[]>()\n  for (const [collection, field] of Object.entries(subjects)) {\n    const ids = await adapter.list(vault, collection)\n    for (const id of ids) {\n      if (id.startsWith('_')) continue\n      const env = await adapter.get(vault, collection, id)\n      if (!env || !env._data) continue // missing or tombstone\n      const record = await decodeRecord(collection, id, env)\n      if (record === null) continue\n      const subjectValue = readDottedPath(record, field)\n      if (subjectValue === undefined || subjectValue === null) continue\n      const subjectId = coerceSubjectId(subjectValue)\n      const list = bySubject.get(subjectId) ?? []\n      list.push({ collection, id })\n      bySubject.set(subjectId, list)\n    }\n  }\n\n  let entries = 0\n  for (const [subjectId, refs] of bySubject) {\n    const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n    await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n    entries++\n  }\n  return entries\n}\n\n/**\n * Coerce a read subject-field value to a stable string id. Primitives use\n * their natural string form; objects/arrays are JSON-stringified so structural\n * subjects still get a deterministic key (avoids the `[object Object]` trap).\n */\nexport function coerceSubjectId(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value)\n  }\n  return JSON.stringify(value)\n}\n\n/** Read a (possibly dotted) field path from a plain record. */\nexport function readDottedPath(record: Record<string, unknown>, field: string): unknown {\n  if (!field.includes('.')) return record[field]\n  let cursor: unknown = record\n  for (const segment of field.split('.')) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n"],"mappings":";;;;;;;;;;;;;AAiDO,IAAM,YAA4B,EAAE,UAAU,CAAC,EAAE;;;ACVjD,IAAM,2BAA2B;AAOxC,IAAM,kBAAkB;AAWxB,eAAe,gBAAgB,OAAgC;AAC7D,SAAO,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAClD;AAWA,eAAe,YAAY,QAAgB,WAAoB,WAAsC;AACnG,QAAM,SAAS,MAAM,gBAAgB,SAAS;AAC9C,MAAI,CAAC,UAAW,QAAO,CAAC,MAAM;AAC9B,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAC1E,SAAO,UAAU,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,MAAM;AACpD;AAGA,eAAe,kBAAkB,QAAgB,WAAoB,WAAoC;AACvG,UAAQ,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG,CAAC;AAC5D;AAGA,SAAS,UAAU,MAA4B;AAC7C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,SAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO;AACjD;AAGA,SAAS,cAAc,MAA4B;AACjD,QAAM,OAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC;AAC9C,QAAM,MAAM,KAAK,KAAK,KAAK,SAAS,eAAe,IAAI,kBAAkB,KAAK;AAC9E,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,IAAI,OAAO,GAAG,EAAE,CAAC;AACvD;AAGA,eAAe,SACb,SACA,OACA,QACA,WACA,KACuB;AACvB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,0BAA0B,GAAG;AAClE,MAAI,CAAC,OAAO,CAAC,IAAI,MAAO,QAAO,CAAC;AAChC,MAAI,CAAC,UAAW,QAAO,UAAU,IAAI,KAAK;AAC1C,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,OAAO,MAAM,iBAAiB,KAAK,GAAG;AAC5C,SAAO,UAAU,IAAI;AACvB;AAGA,eAAe,UACb,SACA,OACA,QACA,WACA,KACA,MACe;AACf,MAAI;AACJ,MAAI,CAAC,WAAW;AAEd,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK,UAAU,IAAI,EAAE;AAAA,EACnH,OAAO;AACL,UAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,IAAI,GAAG,GAAG;AAC3D,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK;AAAA,EACnG;AACA,QAAM,QAAQ,IAAI,OAAO,0BAA0B,KAAK,GAAG;AAC7D;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACA,KACe;AACf,QAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,QAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,EAAE,EAAG;AAC1E,OAAK,KAAK,GAAG;AACb,QAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC9D;AAOA,eAAsB,iBACpB,SACA,OACA,QACA,WACA,WACA,KACe;AAGf,aAAW,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG;AACjE,UAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,UAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,GAAG;AACrF,QAAI,KAAK,WAAW,KAAK,OAAQ;AACjC,QAAI,KAAK,WAAW,GAAG;AACrB,YAAM,QAAQ,OAAO,OAAO,0BAA0B,GAAG;AAAA,IAC3D,OAAO;AACL,YAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AACF;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACuB;AACvB,QAAM,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS;AAC3D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAoB,CAAC;AAC3B,aAAW,OAAO,MAAM;AACtB,eAAW,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG,GAAG;AACxE,YAAM,QAAQ,GAAG,IAAI,UAAU,KAAS,IAAI,EAAE;AAC9C,UAAI,KAAK,IAAI,KAAK,EAAG;AACrB,WAAK,IAAI,KAAK;AACd,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAaA,eAAsB,oBACpB,SACA,OACA,QACA,WACA,UACA,cACiB;AAEjB,QAAM,WAAW,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AACnE,aAAW,KAAK,UAAU;AACxB,UAAM,QAAQ,OAAO,OAAO,0BAA0B,CAAC;AAAA,EACzD;AAGA,QAAM,YAAY,oBAAI,IAA0B;AAChD,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,eAAW,MAAM,KAAK;AACpB,UAAI,GAAG,WAAW,GAAG,EAAG;AACxB,YAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,UAAI,CAAC,OAAO,CAAC,IAAI,MAAO;AACxB,YAAM,SAAS,MAAM,aAAa,YAAY,IAAI,GAAG;AACrD,UAAI,WAAW,KAAM;AACrB,YAAM,eAAe,eAAe,QAAQ,KAAK;AACjD,UAAI,iBAAiB,UAAa,iBAAiB,KAAM;AACzD,YAAM,YAAY,gBAAgB,YAAY;AAC9C,YAAM,OAAO,UAAU,IAAI,SAAS,KAAK,CAAC;AAC1C,WAAK,KAAK,EAAE,YAAY,GAAG,CAAC;AAC5B,gBAAU,IAAI,WAAW,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,WAAW,IAAI,KAAK,WAAW;AACzC,UAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,UAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC5D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,QAAiC,OAAwB;AACtF,MAAI,CAAC,MAAM,SAAS,GAAG,EAAG,QAAO,OAAO,KAAK;AAC7C,MAAI,SAAkB;AACtB,aAAW,WAAW,MAAM,MAAM,GAAG,GAAG;AACtC,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;","names":[]}