@noy-db/hub 0.3.0-pre.6 → 0.3.0-pre.8

package/dist/{chunk-RXUFMTD5.js → chunk-IARAK3PK.js}

@@ -2,7 +2,7 @@
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-MIHAL6PP.js");
+      const { extractPartitionCore } = await import("./extract-partition-VSKT35JG.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -11,4 +11,4 @@ function withCargo() {
 export {
   withCargo
 };
-//# sourceMappingURL=chunk-RXUFMTD5.js.map
+//# sourceMappingURL=chunk-IARAK3PK.js.map

package/dist/{chunk-DBBP35OP.js → chunk-J5YUA6JB.js}

@@ -4,7 +4,7 @@ import {
   chainAnchor,
   loadPeriods,
   validatePeriodName
-} from "./chunk-OCVO2V63.js";
+} from "./chunk-37JZR7CY.js";
 
 // src/with-audit/periods/active.ts
 function withPeriods() {
@@ -20,4 +20,4 @@ function withPeriods() {
 export {
   withPeriods
 };
-//# sourceMappingURL=chunk-DBBP35OP.js.map
+//# sourceMappingURL=chunk-J5YUA6JB.js.map

package/dist/{chunk-BYS45GOJ.js → chunk-J7OH6R4K.js}

@@ -1,9 +1,9 @@
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -46,4 +46,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-BYS45GOJ.js.map
+//# sourceMappingURL=chunk-J7OH6R4K.js.map

package/dist/{chunk-YFF2RP3X.js → chunk-L6Q5NA22.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -37,4 +37,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-YFF2RP3X.js.map
+//# sourceMappingURL=chunk-L6Q5NA22.js.map

package/dist/{chunk-ML5UP7YN.js → chunk-M3OYTM5Z.js}

@@ -2,13 +2,13 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-WAW4VFS7.js";
+} from "./chunk-X5QZAJDB.js";
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -82,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-ML5UP7YN.js.map
+//# sourceMappingURL=chunk-M3OYTM5Z.js.map

package/dist/{chunk-UZZFV3O3.js → chunk-NTPWQH4S.js}

@@ -4,7 +4,7 @@ import {
   loadShamirRecoveryEntries,
   unwrapDeksFromPaperEntry,
   unwrapDeksFromShamirEntry
-} from "./chunk-3UUXDQPM.js";
+} from "./chunk-FWART3VA.js";
 import {
   dekKey
 } from "./chunk-26FSVNBL.js";
@@ -12,13 +12,13 @@ import {
   assertStrongPassphrase,
   mintKeyringCanary,
   persistKeyring
-} from "./chunk-WAL4MRBK.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -586,4 +586,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-UZZFV3O3.js.map
+//# sourceMappingURL=chunk-NTPWQH4S.js.map

package/dist/{chunk-VWGCJUTV.js → chunk-P2PEPSPK.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 
 // src/with-party/team/managed-passphrase.ts
 var MemorySealingKeyProvider = class {
@@ -227,4 +227,4 @@ export {
   loadSealedPassphrase,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-VWGCJUTV.js.map
+//# sourceMappingURL=chunk-P2PEPSPK.js.map

package/dist/{chunk-XDWNF4BS.js → chunk-P6TZ3IVN.js}

@@ -1,17 +1,17 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-BYS45GOJ.js";
+} from "./chunk-J7OH6R4K.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-S55MJQUQ.js";
+} from "./chunk-WPNP3NF5.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-C57J6AWN.js";
+} from "./chunk-BJ2XF2RC.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -22,14 +22,14 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-TWJVOYU2.js";
+} from "./chunk-UMH35AQV.js";
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   bufferToBase64,
   decrypt,
@@ -450,4 +450,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-XDWNF4BS.js.map
+//# sourceMappingURL=chunk-P6TZ3IVN.js.map

package/dist/{chunk-WQAT24C2.js → chunk-PMMV5SQC.js}

@@ -1,15 +1,15 @@
 import {
   ensureCollectionDEK
-} from "./chunk-WAL4MRBK.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   envelopePayloadHash
-} from "./chunk-TWJVOYU2.js";
+} from "./chunk-UMH35AQV.js";
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -413,4 +413,4 @@ export {
   isStaticDictDescriptor,
   DictionaryHandle
 };
-//# sourceMappingURL=chunk-WQAT24C2.js.map
+//# sourceMappingURL=chunk-PMMV5SQC.js.map

package/dist/{chunk-PLQCXH75.js → chunk-PPPZIBKY.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -258,4 +258,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-PLQCXH75.js.map
+//# sourceMappingURL=chunk-PPPZIBKY.js.map

package/dist/chunk-PVC2FBCQ.js

@@ -0,0 +1,45 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-REWTMYSF.js";
+
+// src/kernel/enclave/record-keys/tombstone.ts
+function isTombstoneShape(envelope) {
+  return envelope._data === "" && envelope._cek === void 0 && envelope._del !== true;
+}
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return isTombstoneShape(envelope);
+}
+function buildTombstone(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    ...actor ? { _by: actor } : {}
+  };
+}
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
+}
+function buildDeleteMarker(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    _del: true,
+    ...actor ? { _by: actor } : {}
+  };
+}
+
+export {
+  isTombstoneShape,
+  isTombstone,
+  buildTombstone,
+  isDeleteMarker,
+  buildDeleteMarker
+};
+//# sourceMappingURL=chunk-PVC2FBCQ.js.map

package/dist/chunk-PVC2FBCQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/record-keys/tombstone.ts"],"sourcesContent":["/**\n * Tombstone shape + predicate for the per-record-key (CEK) layer.\n *\n * A *tombstone* is the residue a GDPR crypto-shred (`vault.forget()`)\n * leaves on disk: the live envelope rewritten to `{ _noydb, _v, _ts, _by,\n * _iv:'', _data:'' }`, dropping `_iv`/`_data`/`_cek`/`_det`. With the wrapped\n * per-record CEK gone, the body — and every history version under the same\n * CEK — is permanently undecryptable, while the record KEY survives so the\n * version counter and \"record existed and was erased\" persist for the audit\n * ledger.\n *\n * These two helpers are the pure, collection-independent core of that\n * contract: {@link buildTombstone} mints the shape, {@link isTombstone}\n * recognises it on the read path. The orchestration that *writes* a tombstone\n * (`_writeTombstone`) and drives `vault.forget()` lives with the collection /\n * vault; it calls into these.\n */\nimport { NOYDB_FORMAT_VERSION, type EncryptedEnvelope } from '../../types.js'\n\n/**\n * Shape-only tombstone recognition for layers that have no per-collection\n * context (the sync engine, #590): a tombstone carries an empty `_data` and\n * no wrapped CEK. No live envelope can match — record bodies never serialize\n * to the empty string (the `_sync` meta envelope carries non-empty `_data`,\n * and legacy migration envelopes carry non-empty `_iv`/`_data`).\n */\nexport function isTombstoneShape(envelope: EncryptedEnvelope): boolean {\n  return envelope._data === '' && envelope._cek === undefined && envelope._del !== true\n}\n\n/**\n * Is this envelope a crypto-shred tombstone?\n *\n * A tombstone carries no body (`_data` empty) and no wrapped CEK (`_cek`\n * absent) — decrypting it would call `decrypt('', '', dek)` → an AES-GCM\n * throw, so every read choke point must short-circuit to `null` instead.\n *\n * `encrypted` is the collection's encryption flag: on an unencrypted\n * collection there are no envelopes to shred, so nothing is ever a tombstone.\n * (Legacy migration envelopes carry non-empty `_iv`/`_data`, so they are not\n * tombstones and stay readable.)\n */\nexport function isTombstone(envelope: EncryptedEnvelope, encrypted: boolean): boolean {\n  if (!encrypted) return false\n  return isTombstoneShape(envelope)\n}\n\n/**\n * Mint a tombstone envelope from a record's live version + actor.\n *\n * Keeps `_v` (the displaced version) so the counter is monotonic across the\n * shred, stamps a fresh `_ts`, and records `_by` when an actor is supplied.\n * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the\n * erasure.\n */\nexport function buildTombstone(version: number, actor: string): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: '',\n    ...(actor ? { _by: actor } : {}),\n  }\n}\n\n/** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */\nexport function isDeleteMarker(envelope: EncryptedEnvelope): boolean {\n  return envelope._del === true\n}\n\n/**\n * Mint a delete marker from the deleted record's next version + actor (#589).\n * Minted at the NEXT version (`existing._v + 1`) — unlike `buildTombstone`, which\n * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a\n * re-create can still win over it at a higher version.\n */\nexport function buildDeleteMarker(version: number, actor: string): EncryptedEnvelope {\n  return {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: '',\n    _del: true,\n    ...(actor ? { _by: actor } : {}),\n  }\n}\n"],"mappings":";;;;;AA0BO,SAAS,iBAAiB,UAAsC;AACrE,SAAO,SAAS,UAAU,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS;AACnF;AAcO,SAAS,YAAY,UAA6B,WAA6B;AACpF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,iBAAiB,QAAQ;AAClC;AAUO,SAAS,eAAe,SAAiB,OAAkC;AAChF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,GAAI,QAAQ,EAAE,KAAK,MAAM,IAAI,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,eAAe,UAAsC;AACnE,SAAO,SAAS,SAAS;AAC3B;AAQO,SAAS,kBAAkB,SAAiB,OAAkC;AACnF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,GAAI,QAAQ,EAAE,KAAK,MAAM,IAAI,CAAC;AAAA,EAChC;AACF;","names":[]}

package/dist/{chunk-NL4HVTNO.js → chunk-QABECTNN.js}

@@ -1,7 +1,7 @@
 import {
   hasExportCapability,
   hasImportCapability
-} from "./chunk-WAL4MRBK.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   ExportCapabilityError,
   ImportCapabilityError
@@ -252,4 +252,4 @@ export {
   ServiceBus,
   SubsystemBus
 };
-//# sourceMappingURL=chunk-NL4HVTNO.js.map
+//# sourceMappingURL=chunk-QABECTNN.js.map

package/dist/{chunk-IVIGZTFH.js → chunk-QYMMMKOO.js}

@@ -1,14 +1,14 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-RIZQZKU6.js";
+} from "./chunk-3KBK5LU4.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-C2ZKWL37.js";
+} from "./chunk-DCVVCJVB.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   NoydbError
 } from "./chunk-OJ64XMPJ.js";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-IVIGZTFH.js.map
+//# sourceMappingURL=chunk-QYMMMKOO.js.map

package/dist/{chunk-ZRJBLWKQ.js → chunk-R4IVPJHN.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-V76PHWLE.js";
 import {
   openEnvelopeJson
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-ZRJBLWKQ.js.map
+//# sourceMappingURL=chunk-R4IVPJHN.js.map

package/dist/{chunk-LN22XH4B.js → chunk-REWTMYSF.js}

@@ -29,4 +29,4 @@ export {
   SealedHandle,
   createStore
 };
-//# sourceMappingURL=chunk-LN22XH4B.js.map
+//# sourceMappingURL=chunk-REWTMYSF.js.map