@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.5

package/dist/chunk-NO272T7Q.js

@@ -0,0 +1,194 @@
+// src/kernel/cache/lru.ts
+var Lru = class {
+  entries = /* @__PURE__ */ new Map();
+  maxRecords;
+  maxBytes;
+  currentBytes = 0;
+  hits = 0;
+  misses = 0;
+  evictions = 0;
+  constructor(options) {
+    if (options.maxRecords === void 0 && options.maxBytes === void 0) {
+      throw new Error("Lru: must specify maxRecords, maxBytes, or both");
+    }
+    this.maxRecords = options.maxRecords;
+    this.maxBytes = options.maxBytes;
+  }
+  /**
+   * Look up a key. Hits promote the entry to most-recently-used; misses
+   * return undefined. Both update the running stats counters.
+   */
+  get(key) {
+    const entry = this.entries.get(key);
+    if (!entry) {
+      this.misses++;
+      return void 0;
+    }
+    this.entries.delete(key);
+    this.entries.set(key, entry);
+    this.hits++;
+    return entry.value;
+  }
+  /**
+   * Insert or update a key. If the key already exists, its size is
+   * accounted for and the entry is promoted to MRU. After insertion,
+   * eviction runs to maintain both budgets.
+   */
+  set(key, value, size) {
+    const existing = this.entries.get(key);
+    if (existing) {
+      this.currentBytes -= existing.size;
+      this.entries.delete(key);
+    }
+    this.entries.set(key, { value, size });
+    this.currentBytes += size;
+    this.evictUntilUnderBudget();
+  }
+  /**
+   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.
+   * Returns true if the key was present.
+   */
+  remove(key) {
+    const existing = this.entries.get(key);
+    if (!existing) return false;
+    this.currentBytes -= existing.size;
+    this.entries.delete(key);
+    return true;
+  }
+  /** True if the cache currently holds an entry for the given key. */
+  has(key) {
+    return this.entries.has(key);
+  }
+  /**
+   * Drop every entry. Stats counters survive — call `resetStats()` if you
+   * want a clean slate. Used by `Collection.invalidate()` on key rotation.
+   */
+  clear() {
+    this.entries.clear();
+    this.currentBytes = 0;
+  }
+  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */
+  resetStats() {
+    this.hits = 0;
+    this.misses = 0;
+    this.evictions = 0;
+  }
+  /** Snapshot of current cache statistics. Cheap — no copying. */
+  stats() {
+    return {
+      hits: this.hits,
+      misses: this.misses,
+      evictions: this.evictions,
+      size: this.entries.size,
+      bytes: this.currentBytes
+    };
+  }
+  /**
+   * Iterate over all currently-cached values. Order is least-recently-used
+   * first. Used by tests and devtools — production callers should use
+   * `Collection.scan()` instead.
+   */
+  *values() {
+    for (const entry of this.entries.values()) yield entry.value;
+  }
+  /**
+   * Walk the cache from the LRU end and drop entries until both budgets
+   * are satisfied. Called after every `set()`. Single pass — entries are
+   * never re-promoted during eviction.
+   */
+  evictUntilUnderBudget() {
+    while (this.overBudget()) {
+      const oldest = this.entries.keys().next();
+      if (oldest.done) return;
+      const key = oldest.value;
+      const entry = this.entries.get(key);
+      if (entry) this.currentBytes -= entry.size;
+      this.entries.delete(key);
+      this.evictions++;
+    }
+  }
+  overBudget() {
+    if (this.maxRecords !== void 0 && this.entries.size > this.maxRecords) return true;
+    if (this.maxBytes !== void 0 && this.currentBytes > this.maxBytes) return true;
+    return false;
+  }
+};
+
+// src/kernel/cache/policy.ts
+var UNITS = {
+  "": 1,
+  "B": 1,
+  "KB": 1024,
+  "MB": 1024 * 1024,
+  "GB": 1024 * 1024 * 1024
+  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.
+};
+function parseBytes(input) {
+  if (typeof input === "number") {
+    if (!Number.isFinite(input) || input <= 0) {
+      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`);
+    }
+    return Math.floor(input);
+  }
+  const trimmed = input.trim();
+  if (trimmed === "") {
+    throw new Error("parseBytes: empty string is not a valid byte budget");
+  }
+  const match = /^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]*)$/.exec(trimmed);
+  if (!match) {
+    throw new Error(`parseBytes: invalid byte budget "${input}". Expected format: "1024", "50KB", "50MB", "1GB"`);
+  }
+  const value = parseFloat(match[1]);
+  const unit = (match[2] ?? "").toUpperCase();
+  if (!(unit in UNITS)) {
+    throw new Error(`parseBytes: unknown unit "${match[2]}" in "${input}". Supported: B, KB, MB, GB`);
+  }
+  const bytes = Math.floor(value * UNITS[unit]);
+  if (bytes <= 0) {
+    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from "${input}"`);
+  }
+  return bytes;
+}
+function estimateRecordBytes(record) {
+  try {
+    return JSON.stringify(record).length;
+  } catch {
+    return 0;
+  }
+}
+
+// src/port/with/lazy-strategy.ts
+function buildLazyCache(collection, cache) {
+  if (!cache || cache.maxRecords === void 0 && cache.maxBytes === void 0) {
+    throw new Error(
+      `Collection "${collection}": lazy mode (prefetch: false) requires a cache option with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`
+    );
+  }
+  const lruOptions = {};
+  if (cache.maxRecords !== void 0) lruOptions.maxRecords = cache.maxRecords;
+  if (cache.maxBytes !== void 0) lruOptions.maxBytes = parseBytes(cache.maxBytes);
+  return new Lru(lruOptions);
+}
+var implicitLazyWarned = false;
+var IMPLICIT_LAZY = {
+  createCache(collection, cache) {
+    if (!implicitLazyWarned) {
+      implicitLazyWarned = true;
+      if (!(typeof process !== "undefined" && process.env["NODE_ENV"] === "test")) {
+        console.warn(
+          `[noy-db] Collection "${collection}": lazy mode (prefetch: false) without the lazy service is deprecated \u2014 pass \`lazyStrategy: withLazy()\` (from "@noy-db/hub/lazy") to createNoydb(). The implicit path will be removed at 1.0.`
+        );
+      }
+    }
+    return buildLazyCache(collection, cache);
+  }
+};
+
+export {
+  Lru,
+  parseBytes,
+  estimateRecordBytes,
+  buildLazyCache,
+  IMPLICIT_LAZY
+};
+//# sourceMappingURL=chunk-NO272T7Q.js.map

package/dist/chunk-NO272T7Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/cache/lru.ts","../src/kernel/cache/policy.ts","../src/port/with/lazy-strategy.ts"],"sourcesContent":["/**\n * Generic LRU cache for `Collection`'s lazy hydration mode.\n *\n * Backed by a JavaScript `Map`, which preserves insertion order. Promotion\n * is implemented as `delete()` + `set()` — O(1) on `Map` since both\n * operations are constant-time. Eviction walks the iterator from the front\n * (least recently used) until both budgets are satisfied.\n *\n * ships in-memory only. The cache is never persisted; on collection\n * close every entry is dropped. Persisting cache state is a follow-up\n * once the access patterns from real consumers tell us whether it would\n * pay back the complexity.\n */\n\nexport interface LruEntry<V> {\n  /** The cached value. */\n  readonly value: V\n  /**\n   * Approximate decrypted byte size of the entry. Used by the byte-budget\n   * eviction path. Callers compute this once at insert time and pass it\n   * in — recomputing on every access would dominate the per-record cost.\n   */\n  readonly size: number\n}\n\nexport interface LruOptions {\n  /** Maximum number of entries before eviction. Required if `maxBytes` is unset. */\n  maxRecords?: number\n  /** Maximum total bytes before eviction. Computed from per-entry `size`. */\n  maxBytes?: number\n}\n\nexport interface LruStats {\n  /** Total cache hits since construction (or `resetStats()`). */\n  hits: number\n  /** Total cache misses since construction (or `resetStats()`). */\n  misses: number\n  /** Total entries evicted since construction (or `resetStats()`). */\n  evictions: number\n  /** Current number of cached entries. */\n  size: number\n  /** Current sum of cached entry sizes (in bytes, approximate). */\n  bytes: number\n}\n\n/**\n * O(1) LRU cache. Both `get()` and `set()` promote the touched entry to\n * the most-recently-used end. Eviction happens after every insert and\n * walks the front of the Map iterator dropping entries until both\n * budgets are satisfied.\n */\nexport class Lru<K, V> {\n  private readonly entries = new Map<K, LruEntry<V>>()\n  private readonly maxRecords: number | undefined\n  private readonly maxBytes: number | undefined\n  private currentBytes = 0\n  private hits = 0\n  private misses = 0\n  private evictions = 0\n\n  constructor(options: LruOptions) {\n    if (options.maxRecords === undefined && options.maxBytes === undefined) {\n      throw new Error('Lru: must specify maxRecords, maxBytes, or both')\n    }\n    this.maxRecords = options.maxRecords\n    this.maxBytes = options.maxBytes\n  }\n\n  /**\n   * Look up a key. Hits promote the entry to most-recently-used; misses\n   * return undefined. Both update the running stats counters.\n   */\n  get(key: K): V | undefined {\n    const entry = this.entries.get(key)\n    if (!entry) {\n      this.misses++\n      return undefined\n    }\n    // Promote: re-insert moves the entry to the end of the iteration order.\n    this.entries.delete(key)\n    this.entries.set(key, entry)\n    this.hits++\n    return entry.value\n  }\n\n  /**\n   * Insert or update a key. If the key already exists, its size is\n   * accounted for and the entry is promoted to MRU. After insertion,\n   * eviction runs to maintain both budgets.\n   */\n  set(key: K, value: V, size: number): void {\n    const existing = this.entries.get(key)\n    if (existing) {\n      // Update path: subtract the old size before adding the new one.\n      this.currentBytes -= existing.size\n      this.entries.delete(key)\n    }\n    this.entries.set(key, { value, size })\n    this.currentBytes += size\n    this.evictUntilUnderBudget()\n  }\n\n  /**\n   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.\n   * Returns true if the key was present.\n   */\n  remove(key: K): boolean {\n    const existing = this.entries.get(key)\n    if (!existing) return false\n    this.currentBytes -= existing.size\n    this.entries.delete(key)\n    return true\n  }\n\n  /** True if the cache currently holds an entry for the given key. */\n  has(key: K): boolean {\n    return this.entries.has(key)\n  }\n\n  /**\n   * Drop every entry. Stats counters survive — call `resetStats()` if you\n   * want a clean slate. Used by `Collection.invalidate()` on key rotation.\n   */\n  clear(): void {\n    this.entries.clear()\n    this.currentBytes = 0\n  }\n\n  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */\n  resetStats(): void {\n    this.hits = 0\n    this.misses = 0\n    this.evictions = 0\n  }\n\n  /** Snapshot of current cache statistics. Cheap — no copying. */\n  stats(): LruStats {\n    return {\n      hits: this.hits,\n      misses: this.misses,\n      evictions: this.evictions,\n      size: this.entries.size,\n      bytes: this.currentBytes,\n    }\n  }\n\n  /**\n   * Iterate over all currently-cached values. Order is least-recently-used\n   * first. Used by tests and devtools — production callers should use\n   * `Collection.scan()` instead.\n   */\n  *values(): IterableIterator<V> {\n    for (const entry of this.entries.values()) yield entry.value\n  }\n\n  /**\n   * Walk the cache from the LRU end and drop entries until both budgets\n   * are satisfied. Called after every `set()`. Single pass — entries are\n   * never re-promoted during eviction.\n   */\n  private evictUntilUnderBudget(): void {\n    while (this.overBudget()) {\n      const oldest = this.entries.keys().next()\n      if (oldest.done) return // empty cache; nothing more to evict\n      const key = oldest.value\n      const entry = this.entries.get(key)\n      if (entry) this.currentBytes -= entry.size\n      this.entries.delete(key)\n      this.evictions++\n    }\n  }\n\n  private overBudget(): boolean {\n    if (this.maxRecords !== undefined && this.entries.size > this.maxRecords) return true\n    if (this.maxBytes !== undefined && this.currentBytes > this.maxBytes) return true\n    return false\n  }\n}\n","/**\n * Cache policy helpers — parse human-friendly byte budgets into raw numbers.\n *\n * Accepted shapes (case-insensitive on suffix):\n *   number       — interpreted as raw bytes\n *   '1024'       — string of digits, raw bytes\n *   '50KB'       — kilobytes (×1024)\n *   '50MB'       — megabytes (×1024²)\n *   '1GB'        — gigabytes (×1024³)\n *\n * Decimals are accepted (`'1.5GB'` → 1610612736 bytes).\n *\n * Anything else throws — better to fail loud at construction time than\n * to silently treat a typo as 0 bytes (which would evict everything).\n */\n\nconst UNITS: Record<string, number> = {\n  '': 1,\n  'B': 1,\n  'KB': 1024,\n  'MB': 1024 * 1024,\n  'GB': 1024 * 1024 * 1024,\n  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.\n}\n\n/** Parse a byte budget into a positive integer number of bytes. */\nexport function parseBytes(input: number | string): number {\n  if (typeof input === 'number') {\n    if (!Number.isFinite(input) || input <= 0) {\n      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`)\n    }\n    return Math.floor(input)\n  }\n\n  const trimmed = input.trim()\n  if (trimmed === '') {\n    throw new Error('parseBytes: empty string is not a valid byte budget')\n  }\n\n  // Accept either a bare number or a number followed by a unit suffix.\n  // Regex: optional sign, digits with optional decimal, optional unit.\n  const match = /^([0-9]+(?:\\.[0-9]+)?)\\s*([A-Za-z]*)$/.exec(trimmed)\n  if (!match) {\n    throw new Error(`parseBytes: invalid byte budget \"${input}\". Expected format: \"1024\", \"50KB\", \"50MB\", \"1GB\"`)\n  }\n\n  const value = parseFloat(match[1]!)\n  const unit = (match[2] ?? '').toUpperCase()\n\n  if (!(unit in UNITS)) {\n    throw new Error(`parseBytes: unknown unit \"${match[2]}\" in \"${input}\". Supported: B, KB, MB, GB`)\n  }\n\n  const bytes = Math.floor(value * UNITS[unit]!)\n  if (bytes <= 0) {\n    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from \"${input}\"`)\n  }\n  return bytes\n}\n\n/**\n * Estimate the in-memory byte size of a decrypted record.\n *\n * Uses `JSON.stringify().length` as a stand-in for actual heap usage.\n * It's a deliberate approximation: real V8 heap size includes pointer\n * overhead, hidden classes, and string interning that we can't measure\n * from JavaScript. The JSON length is a stable, monotonic proxy that\n * costs O(record size) per insert — fine when records are typically\n * < 1 KB and the cache eviction is the slow path anyway.\n *\n * Returns `0` (and the caller must treat it as 1 for accounting) if\n * stringification throws on circular references; this is documented\n * but in practice records always come from JSON-decoded envelopes.\n */\nexport function estimateRecordBytes(record: unknown): number {\n  try {\n    return JSON.stringify(record).length\n  } catch {\n    return 0\n  }\n}\n","/**\n * Lazy-mode capability contract (#267 Track A tail — lazy-mode promoted out\n * of `routing` into its own `lazy` service). Lives on the `/with` port (the\n * one seam the kernel spine may import statically) so `Collection` can hold\n * the back-compat default without a spine→service static import.\n *\n * Lazy mode (`prefetch: false`) skips bulk hydration: reads go per-id\n * against the store and land in a bounded LRU working set. The strategy owns\n * constructing that LRU:\n *\n *  - `withLazy()` (`with-store/lazy/active.ts`, subpath `@noy-db/hub/lazy`)\n *    is the explicit catalog opt-in — silent, forward-stable.\n *  - {@link IMPLICIT_LAZY} is the floor default reached when a collection\n *    declares `prefetch: false` WITHOUT `lazyStrategy: withLazy()`. It keeps\n *    the pre-#267 behavior byte-for-byte (back-compat delegation, pre-1.0)\n *    but emits a one-time deprecation warn outside test env. It will become\n *    a throwing stub at 1.0, letting the LRU leave the floor bundle\n *    entirely once the per-record-CEK cache stops pinning `Lru` there.\n *\n * The on-demand read/write branches themselves stay kernel-resident (they\n * are `if (this.lazy)` forks on the hot get/put/scan paths); the service\n * seam owns cache construction + budget validation, which is where the\n * opt-in and the future tree-shake win live.\n * @internal\n */\nimport { Lru, parseBytes } from '../../kernel/cache/index.js'\nimport type { CacheOptions } from '../../kernel/collection.js'\n\nexport interface LazyStrategy {\n  /**\n   * Build the bounded LRU working-set cache for a lazy collection.\n   * MUST throw when `cache` declares neither `maxRecords` nor `maxBytes` —\n   * an unbounded lazy cache defeats the purpose.\n   */\n  createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V>\n}\n\n/**\n * Shared budget validation + LRU construction — the one implementation both\n * {@link IMPLICIT_LAZY} and `withLazy()` run, so the two paths cannot drift.\n * @internal\n */\nexport function buildLazyCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V> {\n  if (!cache || (cache.maxRecords === undefined && cache.maxBytes === undefined)) {\n    throw new Error(\n      `Collection \"${collection}\": lazy mode (prefetch: false) requires a cache option ` +\n      `with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`,\n    )\n  }\n  const lruOptions: { maxRecords?: number; maxBytes?: number } = {}\n  if (cache.maxRecords !== undefined) lruOptions.maxRecords = cache.maxRecords\n  if (cache.maxBytes !== undefined) lruOptions.maxBytes = parseBytes(cache.maxBytes)\n  return new Lru<string, V>(lruOptions)\n}\n\nlet implicitLazyWarned = false\n\n/**\n * Back-compat default (deprecated): `prefetch: false` without\n * `lazyStrategy: withLazy()`. Identical behavior to the explicit opt-in,\n * plus a one-time deprecation warn (suppressed under NODE_ENV=test,\n * mirroring the listPage fallback warn). @internal\n */\nexport const IMPLICIT_LAZY: LazyStrategy = {\n  createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V> {\n    if (!implicitLazyWarned) {\n      implicitLazyWarned = true\n      if (!(typeof process !== 'undefined' && process.env['NODE_ENV'] === 'test')) {\n        console.warn(\n          `[noy-db] Collection \"${collection}\": lazy mode (prefetch: false) without the lazy ` +\n          `service is deprecated — pass \\`lazyStrategy: withLazy()\\` (from \"@noy-db/hub/lazy\") ` +\n          `to createNoydb(). The implicit path will be removed at 1.0.`,\n        )\n      }\n    }\n    return buildLazyCache<V>(collection, cache)\n  },\n}\n"],"mappings":";AAmDO,IAAM,MAAN,MAAgB;AAAA,EACJ,UAAU,oBAAI,IAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACT,eAAe;AAAA,EACf,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EAEpB,YAAY,SAAqB;AAC/B,QAAI,QAAQ,eAAe,UAAa,QAAQ,aAAa,QAAW;AACtE,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,SAAK,aAAa,QAAQ;AAC1B,SAAK,WAAW,QAAQ;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,KAAuB;AACzB,UAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAClC,QAAI,CAAC,OAAO;AACV,WAAK;AACL,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO,GAAG;AACvB,SAAK,QAAQ,IAAI,KAAK,KAAK;AAC3B,SAAK;AACL,WAAO,MAAM;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,KAAQ,OAAU,MAAoB;AACxC,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AAEZ,WAAK,gBAAgB,SAAS;AAC9B,WAAK,QAAQ,OAAO,GAAG;AAAA,IACzB;AACA,SAAK,QAAQ,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC;AACrC,SAAK,gBAAgB;AACrB,SAAK,sBAAsB;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,KAAiB;AACtB,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,CAAC,SAAU,QAAO;AACtB,SAAK,gBAAgB,SAAS;AAC9B,SAAK,QAAQ,OAAO,GAAG;AACvB,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,KAAiB;AACnB,WAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAc;AACZ,SAAK,QAAQ,MAAM;AACnB,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA,EAGA,QAAkB;AAChB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,CAAC,SAA8B;AAC7B,eAAW,SAAS,KAAK,QAAQ,OAAO,EAAG,OAAM,MAAM;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,wBAA8B;AACpC,WAAO,KAAK,WAAW,GAAG;AACxB,YAAM,SAAS,KAAK,QAAQ,KAAK,EAAE,KAAK;AACxC,UAAI,OAAO,KAAM;AACjB,YAAM,MAAM,OAAO;AACnB,YAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAClC,UAAI,MAAO,MAAK,gBAAgB,MAAM;AACtC,WAAK,QAAQ,OAAO,GAAG;AACvB,WAAK;AAAA,IACP;AAAA,EACF;AAAA,EAEQ,aAAsB;AAC5B,QAAI,KAAK,eAAe,UAAa,KAAK,QAAQ,OAAO,KAAK,WAAY,QAAO;AACjF,QAAI,KAAK,aAAa,UAAa,KAAK,eAAe,KAAK,SAAU,QAAO;AAC7E,WAAO;AAAA,EACT;AACF;;;ACjKA,IAAM,QAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,MAAM;AAAA,EACN,MAAM,OAAO;AAAA,EACb,MAAM,OAAO,OAAO;AAAA;AAEtB;AAGO,SAAS,WAAW,OAAgC;AACzD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACzC,YAAM,IAAI,MAAM,mEAAmE,OAAO,KAAK,CAAC,EAAE;AAAA,IACpG;AACA,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB;AAEA,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,IAAI;AAClB,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAIA,QAAM,QAAQ,wCAAwC,KAAK,OAAO;AAClE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oCAAoC,KAAK,mDAAmD;AAAA,EAC9G;AAEA,QAAM,QAAQ,WAAW,MAAM,CAAC,CAAE;AAClC,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,YAAY;AAE1C,MAAI,EAAE,QAAQ,QAAQ;AACpB,UAAM,IAAI,MAAM,6BAA6B,MAAM,CAAC,CAAC,SAAS,KAAK,6BAA6B;AAAA,EAClG;AAEA,QAAM,QAAQ,KAAK,MAAM,QAAQ,MAAM,IAAI,CAAE;AAC7C,MAAI,SAAS,GAAG;AACd,UAAM,IAAI,MAAM,4CAA4C,KAAK,UAAU,KAAK,GAAG;AAAA,EACrF;AACA,SAAO;AACT;AAgBO,SAAS,oBAAoB,QAAyB;AAC3D,MAAI;AACF,WAAO,KAAK,UAAU,MAAM,EAAE;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACtCO,SAAS,eAAkB,YAAoB,OAAiD;AACrG,MAAI,CAAC,SAAU,MAAM,eAAe,UAAa,MAAM,aAAa,QAAY;AAC9E,UAAM,IAAI;AAAA,MACR,eAAe,UAAU;AAAA,IAE3B;AAAA,EACF;AACA,QAAM,aAAyD,CAAC;AAChE,MAAI,MAAM,eAAe,OAAW,YAAW,aAAa,MAAM;AAClE,MAAI,MAAM,aAAa,OAAW,YAAW,WAAW,WAAW,MAAM,QAAQ;AACjF,SAAO,IAAI,IAAe,UAAU;AACtC;AAEA,IAAI,qBAAqB;AAQlB,IAAM,gBAA8B;AAAA,EACzC,YAAe,YAAoB,OAAiD;AAClF,QAAI,CAAC,oBAAoB;AACvB,2BAAqB;AACrB,UAAI,EAAE,OAAO,YAAY,eAAe,QAAQ,IAAI,UAAU,MAAM,SAAS;AAC3E,gBAAQ;AAAA,UACN,wBAAwB,UAAU;AAAA,QAGpC;AAAA,MACF;AAAA,IACF;AACA,WAAO,eAAkB,YAAY,KAAK;AAAA,EAC5C;AACF;","names":[]}

package/dist/{chunk-NIA5VQ7G.js → chunk-NQVZB3S7.js}

@@ -1,21 +1,39 @@
 import {
-  ensureCollectionDEK
-} from "./chunk-5A6TC3RQ.js";
+  SYNC_CREDENTIALS_COLLECTION,
+  ensureCollectionDEK,
+  grant,
+  revoke,
+  rotateKeys
+} from "./chunk-ZT4GWVTX.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
-import {
-  encrypt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
 import {
   PermissionDeniedError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
+
+// src/with-party/team/active.ts
+function withTeam() {
+  return {
+    async grant(team, vault, options, factors) {
+      return team.runGrant(grant, vault, options, factors);
+    },
+    async revoke(team, vault, options, factors) {
+      return team.runRevoke(revoke, vault, options, factors);
+    },
+    async rotate(team, vault, collections) {
+      return team.runRotate(rotateKeys, vault, collections);
+    }
+  };
+}
 
 // src/with-party/team/sync-credentials.ts
-var SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 function requireAdminAccess(keyring) {
   if (keyring.role !== "owner" && keyring.role !== "admin") {
     throw new PermissionDeniedError(
@@ -71,11 +89,11 @@ async function credentialStatus(adapter, vault, keyring, adapterId) {
 }
 
 export {
-  SYNC_CREDENTIALS_COLLECTION,
+  withTeam,
   putCredential,
   getCredential,
   deleteCredential,
   listCredentials,
   credentialStatus
 };
-//# sourceMappingURL=chunk-NIA5VQ7G.js.map
+//# sourceMappingURL=chunk-NQVZB3S7.js.map

package/dist/chunk-NQVZB3S7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/active.ts","../src/with-party/team/sync-credentials.ts"],"sourcesContent":["/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n","/**\n * _sync_credentials reserved collection —\n *\n * Stores per-adapter OAuth tokens (and any other long-lived sync secrets) as\n * encrypted records inside the vault itself. Tokens are wrapped with the\n * compartment's own DEK, live on disk as ciphertext like any other record, and\n * are accessed only through the dedicated API in this module — never via\n * `vault.collection('_sync_credentials')`.\n *\n * Design decisions\n * ────────────────\n *\n * **Why a reserved collection, not a separate store?**\n * The compartment's existing encryption stack (AES-256-GCM + collection DEK)\n * is exactly the right primitive for protecting OAuth tokens at rest. Using a\n * separate store would require a new encryption surface, new adapter calls,\n * and a new backup/restore path — all of which already exist for collections.\n *\n * **Why not exposed as a regular collection?**\n * The same reason `_keyring` and `_ledger` aren't: they have invariants that\n * must be enforced (naming scheme, no cross-user leakage, no schema\n * validation, no history/ledger writes for privacy). Routing through a\n * dedicated API enforces those invariants.\n *\n * **Token lifecycle:**\n * - `putCredential(vault, adapterId, token)` — store or overwrite\n * - `getCredential(vault, adapterId)` — load and decrypt\n * - `deleteCredential(vault, adapterId)` — remove\n * - `listCredentials(vault)` — enumerate adapter IDs (not tokens)\n *\n * The `adapterId` is the record ID within the `_sync_credentials` collection.\n * It should be a stable, human-readable identifier for the adapter instance\n * (e.g. `'google-drive'`, `'dropbox'`, `'s3-prod'`).\n *\n * **ACL:** only `owner` and `admin` roles can read/write sync credentials.\n * Operators, viewers, and clients cannot call this API. The check is made\n * against the caller's keyring role at call time.\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson } from '../../kernel/enclave/index.js'\nimport { ensureCollectionDEK } from './keyring.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\n\n/**\n * The reserved collection name. Never collides with user collections.\n * Canonical definition lives in `reserved-secret-collections.ts` (shared with\n * the `vault.collection()` guard and grant DEK-propagation); re-exported here\n * for existing consumers.\n */\nexport { SYNC_CREDENTIALS_COLLECTION } from './reserved-secret-collections.js'\nimport { SYNC_CREDENTIALS_COLLECTION } from './reserved-secret-collections.js'\n\n// ─── Token types ──────────────────────────────────────────────────────\n\n/**\n * An OAuth/auth token stored in `_sync_credentials`.\n *\n * Fields mirror the OAuth2 token response shape. `customData` is an escape\n * hatch for adapter-specific secrets (API keys, connection strings, etc.)\n * that don't fit the OAuth2 shape.\n */\nexport interface SyncCredential {\n  /** Stable identifier for the adapter instance (e.g. 'google-drive'). */\n  readonly adapterId: string\n  /** OAuth token type, usually 'Bearer'. */\n  readonly tokenType: string\n  /** The access token. Expires at `expiresAt` if set. */\n  readonly accessToken: string\n  /** Long-lived refresh token for renewing the access token. */\n  readonly refreshToken?: string\n  /** ISO timestamp when `accessToken` expires. Absent means \"no expiry\". */\n  readonly expiresAt?: string\n  /** Space-separated OAuth scopes. */\n  readonly scopes?: string\n  /** Adapter-specific opaque data (API keys, endpoints, etc.). */\n  readonly customData?: Record<string, string>\n}\n\n// ─── Access check ─────────────────────────────────────────────────────\n\nfunction requireAdminAccess(keyring: UnlockedKeyring): void {\n  // FR-6: custodian is INTENTIONALLY excluded. Sync credentials are the\n  // firm's hosting/infrastructure secrets (OAuth tokens, connection strings) —\n  // not the custodian's operational scope. A custodian operates the DATA but\n  // must never mint or read transport credentials that could be used to\n  // re-home or impersonate the firm's vault. Do NOT add 'custodian' here.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new PermissionDeniedError(\n      `Sync credentials require owner or admin role. Current role: \"${keyring.role}\"`,\n    )\n  }\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/**\n * Store or overwrite a sync credential for the given adapter.\n *\n * The credential is encrypted with the `_sync_credentials` collection DEK\n * (auto-generated on first use). The record ID is the `adapterId`.\n *\n * Requires owner or admin role.\n */\nexport async function putCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  credential: SyncCredential,\n): Promise<void> {\n  requireAdminAccess(keyring)\n\n  const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n  const { iv, data } = await encrypt(JSON.stringify(credential), dek)\n\n  const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId)\n  const version = existing ? existing._v + 1 : 1\n\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: keyring.userId,\n  }\n\n  await adapter.put(\n    vault,\n    SYNC_CREDENTIALS_COLLECTION,\n    credential.adapterId,\n    envelope,\n    existing ? existing._v : undefined,\n  )\n}\n\n/**\n * Load and decrypt a sync credential for the given adapter ID.\n *\n * Returns `null` if no credential exists for this adapter.\n * Requires owner or admin role.\n */\nexport async function getCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<SyncCredential | null> {\n  requireAdminAccess(keyring)\n\n  const getDek = await ensureCollectionDEK(adapter, vault, keyring)\n  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION)\n\n  const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n  if (!envelope) return null\n\n  const plaintext = await openEnvelopeJson(envelope, dek)\n  return JSON.parse(plaintext) as SyncCredential\n}\n\n/**\n * Delete a sync credential by adapter ID.\n *\n * No-op if the credential doesn't exist. Requires owner or admin role.\n */\nexport async function deleteCredential(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<void> {\n  requireAdminAccess(keyring)\n  await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId)\n}\n\n/**\n * List all adapter IDs that have stored credentials.\n *\n * Returns only the IDs, never the credential payloads. Useful for\n * displaying \"connected adapters\" in UI without decrypting tokens.\n * Requires owner or admin role.\n */\nexport async function listCredentials(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n): Promise<string[]> {\n  requireAdminAccess(keyring)\n  return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION)\n}\n\n/**\n * Check whether a credential exists and whether its access token has expired.\n *\n * Returns `{ exists: false }` if no credential is stored, or\n * `{ exists: true, expired: boolean }` based on the `expiresAt` field.\n * Requires owner or admin role.\n */\nexport async function credentialStatus(\n  adapter: NoydbStore,\n  vault: string,\n  keyring: UnlockedKeyring,\n  adapterId: string,\n): Promise<{ exists: false } | { exists: true; expired: boolean }> {\n  const credential = await getCredential(adapter, vault, keyring, adapterId)\n  if (!credential) return { exists: false }\n\n  const expired = credential.expiresAt\n    ? Date.now() > new Date(credential.expiresAt).getTime()\n    : false\n\n  return { exists: true, expired }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;;;ACyDA,SAAS,mBAAmB,SAAgC;AAM1D,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR,gEAAgE,QAAQ,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAYA,eAAsB,cACpB,SACA,OACA,SACA,YACe;AACf,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,UAAU,GAAG,GAAG;AAElE,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,WAAW,SAAS;AAC3F,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAE7C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,WAAW,SAAS,KAAK;AAAA,EAC3B;AACF;AAQA,eAAsB,cACpB,SACA,OACA,SACA,WACgC;AAChC,qBAAmB,OAAO;AAE1B,QAAM,SAAS,MAAM,oBAAoB,SAAS,OAAO,OAAO;AAChE,QAAM,MAAM,MAAM,OAAO,2BAA2B;AAEpD,QAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,6BAA6B,SAAS;AAChF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,SAAO,KAAK,MAAM,SAAS;AAC7B;AAOA,eAAsB,iBACpB,SACA,OACA,SACA,WACe;AACf,qBAAmB,OAAO;AAC1B,QAAM,QAAQ,OAAO,OAAO,6BAA6B,SAAS;AACpE;AASA,eAAsB,gBACpB,SACA,OACA,SACmB;AACnB,qBAAmB,OAAO;AAC1B,SAAO,QAAQ,KAAK,OAAO,2BAA2B;AACxD;AASA,eAAsB,iBACpB,SACA,OACA,SACA,WACiE;AACjE,QAAM,aAAa,MAAM,cAAc,SAAS,OAAO,SAAS,SAAS;AACzE,MAAI,CAAC,WAAY,QAAO,EAAE,QAAQ,MAAM;AAExC,QAAM,UAAU,WAAW,YACvB,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,SAAS,EAAE,QAAQ,IACpD;AAEJ,SAAO,EAAE,QAAQ,MAAM,QAAQ;AACjC;","names":[]}

package/dist/{chunk-6OQ7NKMZ.js → chunk-O2DB4C3M.js}

@@ -1,14 +1,14 @@
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-6OQ7NKMZ.js.map
+//# sourceMappingURL=chunk-O2DB4C3M.js.map

package/dist/{chunk-LHYQE3BP.js → chunk-OFBFAVLI.js}

@@ -1,19 +1,19 @@
 import {
   SyncScheduler
 } from "./chunk-VQNJ7UZL.js";
+import {
+  NOYDB_SYNC_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   bufferToBase64,
   decrypt,
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_SYNC_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   ConflictError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-party/team/presence.ts
 var PresenceHandle = class {
@@ -719,4 +719,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-LHYQE3BP.js.map
+//# sourceMappingURL=chunk-OFBFAVLI.js.map

package/dist/{chunk-IWVWB7BZ.js → chunk-OJU3CPFA.js}

@@ -1,17 +1,17 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-U6OM4E67.js";
+} from "./chunk-TL7QR5T6.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-55HDKLI3.js";
+} from "./chunk-Z5PIUYNB.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-3UDPDRUC.js";
+} from "./chunk-EWR7HL3K.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -22,10 +22,14 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-6EVZXETK.js";
+} from "./chunk-M66NAZA4.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_BACKUP_VERSION,
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   bufferToBase64,
   decrypt,
@@ -35,14 +39,10 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_BACKUP_VERSION,
-  NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   PartitionExtractionError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -450,4 +450,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-IWVWB7BZ.js.map
+//# sourceMappingURL=chunk-OJU3CPFA.js.map

package/dist/{chunk-ZFME46HJ.js → chunk-OPTFANOX.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   encrypt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-TLJOJBZD.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -72,4 +72,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-ZFME46HJ.js.map
+//# sourceMappingURL=chunk-OPTFANOX.js.map

package/dist/chunk-OPTFANOX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `with-shape/classified/strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: 1,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: 1,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;AAuDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}