@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.9

package/dist/{chunk-K6WHZBCO.js → chunk-KBBWY46Y.js}

@@ -2,7 +2,7 @@
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-RM6EROS5.js");
+      const { extractPartitionCore } = await import("./extract-partition-VBGCBA6Q.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -11,4 +11,4 @@ function withCargo() {
 export {
   withCargo
 };
-//# sourceMappingURL=chunk-K6WHZBCO.js.map
+//# sourceMappingURL=chunk-KBBWY46Y.js.map

package/dist/{chunk-RNYDHIQL.js → chunk-KBF5GSGX.js}

@@ -4,13 +4,13 @@ import {
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-party/session/session.ts
 var subtle = globalThis.crypto.subtle;
@@ -364,4 +364,4 @@ export {
   clearDevUnlock,
   isDevUnlockActive
 };
-//# sourceMappingURL=chunk-RNYDHIQL.js.map
+//# sourceMappingURL=chunk-KBF5GSGX.js.map

package/dist/{chunk-6P5AJ2ZS.js → chunk-KCG3BHFG.js}

@@ -1,22 +1,3 @@
-import {
-  NoydbError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/kernel/money-runtime.ts
-var engine = null;
-function installMoneyEngine(e) {
-  engine ??= e;
-}
-function moneyRuntime() {
-  if (engine === null) {
-    throw new NoydbError(
-      "MONEY_ENGINE_NOT_LINKED",
-      "money fields require descriptors created via money() from @noy-db/hub \u2014 hand-rolled descriptor objects are not supported"
-    );
-  }
-  return engine;
-}
-
 // src/kernel/query/predicate.ts
 function readPath(record, path) {
   if (record === null || record === void 0) return void 0;
@@ -34,7 +15,7 @@ function readPath(record, path) {
 function evaluateFieldClause(record, clause) {
   const actual = readPath(record, clause.field);
   const { op, value } = clause;
-  if (clause.money) return moneyRuntime().evaluateMoneyClause(actual, op, clause.money);
+  if (clause.via) return clause.via.evaluate(actual, op);
   switch (op) {
     case "==":
       return actual === value;
@@ -110,11 +91,9 @@ function hasFnClause(clauses) {
 }
 
 export {
-  installMoneyEngine,
-  moneyRuntime,
   readPath,
   evaluateFieldClause,
   evaluateClause,
   hasFnClause
 };
-//# sourceMappingURL=chunk-6P5AJ2ZS.js.map
+//# sourceMappingURL=chunk-KCG3BHFG.js.map

package/dist/chunk-KCG3BHFG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/predicate.ts"],"sourcesContent":["/**\n * Operator implementations for the query DSL.\n *\n * All predicates run client-side, AFTER decryption — they never see ciphertext.\n * Field clauses over a Via-covered field (e.g. money) carry their own\n * evaluator closure (see {@link FieldClause.via}), so this module has no\n * dependency on any Via feature's implementation — still tree-shakeable.\n */\n\n/** Comparison operators supported by the where() builder. */\nexport type Operator =\n  | '=='\n  | '!='\n  | '<'\n  | '<='\n  | '>'\n  | '>='\n  | 'in'\n  | 'contains'\n  | 'startsWith'\n  | 'between'\n\n/**\n * A single field comparison clause inside a query plan.\n * Plans are JSON-serializable, so this type uses primitives only.\n */\nexport interface FieldClause {\n  readonly type: 'field'\n  readonly field: string\n  readonly op: Operator\n  readonly value: unknown\n  /**\n   * Present when `field` is covered by a Via feature binding (e.g. a\n   * declared money field): the opaque payload built by the binding's\n   * `buildClause` at query BUILD time, plus a closure that evaluates it\n   * per record via the binding's `evaluateClause`. Attached by\n   * `Query.where()` / `ScanBuilder.where()` when `source.via` covers the\n   * field. The closure keeps this module free of any dependency on a\n   * Via feature's implementation — clauses are in-memory only, never\n   * serialized, so carrying a function here is safe.\n   */\n  readonly via?: {\n    readonly brand: string\n    readonly payload: unknown\n    readonly evaluate: (actual: unknown, op: string) => boolean\n  }\n}\n\n/**\n * A user-supplied predicate function escape hatch. Not serializable.\n *\n * The predicate accepts `unknown` at the type level so the surrounding\n * Clause type can stay non-parametric — this keeps Collection<T> covariant\n * in T at the public API surface. Builder methods cast user predicates\n * (typed `(record: T) => boolean`) into this shape on the way in.\n */\nexport interface FilterClause {\n  readonly type: 'filter'\n  readonly fn: (record: unknown) => boolean\n}\n\n/**\n * A declared deterministic predicate reference. The query\n * builder produces this via `.wherePredicate(name, ctx?)` when a\n * Query has been augmented with a predicates map (typically by the\n * materialized-view registry).\n *\n * `predicateHash` is the consumer-supplied stable hash for the\n * function body; `ctxHash` is the canonical-JSON SHA-256 of `ctx`.\n * Both fold into the MV's `queryHash` so a function or ctx change\n * forces refresh on next visit.\n *\n * `fn` is resolved at builder time from the predicates map and\n * embedded directly — so `evaluateClause` can fire it without a\n * runtime lookup.\n */\nexport interface WherePredicateClause {\n  readonly type: 'wherePredicate'\n  readonly name: string\n  readonly ctx: unknown\n  readonly predicateHash: string\n  readonly ctxHash: string\n  readonly fn: (record: unknown, ctx?: unknown) => boolean\n}\n\n/** A logical group of clauses combined by AND or OR. */\nexport interface GroupClause {\n  readonly type: 'group'\n  readonly op: 'and' | 'or'\n  readonly clauses: readonly Clause[]\n}\n\n/**\n * Cartesian-product expansion clause. Appended to `QueryPlan.clauses`\n * by `Query.crossJoin()`. Processed in declaration order by\n * `executeClausePipeline` — NOT by `evaluateClause` (which is a\n * per-record predicate and throws on this type).\n */\nexport interface CrossJoinClause {\n  readonly type: 'crossJoin'\n  /** Target collection name to cross-join against. */\n  readonly target: string\n  /** Alias under which the right-side record is exposed on each result row. */\n  readonly as: string\n  /**\n   * Lateral filter callback. `undefined` → full cartesian product.\n   * Two call shapes:\n   *   - Subset:    `(left) => TTarget[]`            — returns the right rows for this left row\n   *   - Predicate: `(left) => (right) => boolean`   — executor materializes then filters\n   */\n  readonly on?: (left: unknown) => unknown[] | ((right: unknown) => boolean)\n  /** When `on:` was supplied as `{ predicate: name }`, the name is stored here for queryHash. */\n  readonly onPredicateName?: string\n  /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */\n  readonly maxRows?: number\n}\n\nexport type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause\n\n/**\n * Read a possibly nested field path like \"address.city\" from a record.\n * Returns undefined if any segment is missing.\n */\nexport function readPath(record: unknown, path: string): unknown {\n  if (record === null || record === undefined) return undefined\n  if (!path.includes('.')) {\n    return (record as Record<string, unknown>)[path]\n  }\n  const segments = path.split('.')\n  let cursor: unknown = record\n  for (const segment of segments) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * Evaluate a single field clause against a record.\n * Returns false on type mismatches rather than throwing — query results\n * exclude non-matching records by definition.\n */\nexport function evaluateFieldClause(record: unknown, clause: FieldClause): boolean {\n  const actual = readPath(record, clause.field)\n  const { op, value } = clause\n\n  // A Via-covered field (e.g. money) may store a transformed\n  // representation (money: BigInt-exact in scaled-integer space) that the\n  // generic paths below can't compare correctly — the operand was\n  // pre-built at query BUILD time and the binding's own evaluator knows\n  // how to compare it against the raw stored value.\n  if (clause.via) return clause.via.evaluate(actual, op)\n\n  switch (op) {\n    case '==':\n      return actual === value\n    case '!=':\n      return actual !== value\n    case '<':\n      return isComparable(actual, value) && (actual as number) < (value as number)\n    case '<=':\n      return isComparable(actual, value) && (actual as number) <= (value as number)\n    case '>':\n      return isComparable(actual, value) && (actual as number) > (value as number)\n    case '>=':\n      return isComparable(actual, value) && (actual as number) >= (value as number)\n    case 'in':\n      return Array.isArray(value) && value.includes(actual)\n    case 'contains':\n      if (typeof actual === 'string') return typeof value === 'string' && actual.includes(value)\n      if (Array.isArray(actual)) return actual.includes(value)\n      return false\n    case 'startsWith':\n      return typeof actual === 'string' && typeof value === 'string' && actual.startsWith(value)\n    case 'between': {\n      if (!Array.isArray(value) || value.length !== 2) return false\n      const [lo, hi] = value\n      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false\n      return (actual as number) >= (lo as number) && (actual as number) <= (hi as number)\n    }\n    default: {\n      // Exhaustiveness — TS will error if a new operator is added without a case.\n      const _exhaustive: never = op\n      void _exhaustive\n      return false\n    }\n  }\n}\n\n/**\n * Two values are \"comparable\" if they share an order-defined runtime type.\n * Strings compare lexicographically; numbers and Dates numerically; otherwise false.\n */\nfunction isComparable(a: unknown, b: unknown): boolean {\n  if (typeof a === 'number' && typeof b === 'number') return true\n  if (typeof a === 'string' && typeof b === 'string') return true\n  if (a instanceof Date && b instanceof Date) return true\n  return false\n}\n\n/**\n * Evaluate any clause (field / filter / group) against a record.\n * The recursion depth is bounded by the user's query expression — no risk of\n * blowing the stack on a 50K-record collection.\n *\n * `fnRecord`, when provided, is the view handed to USER CALLBACK clauses\n * (`filter` / `wherePredicate`) instead of `record` — the executor passes\n * the money-decoded view there so user code never sees the stored\n * scaled-int form, while field clauses keep evaluating against the raw\n * record (their money operands are pre-quantized to that space).\n */\nexport function evaluateClause(record: unknown, clause: Clause, fnRecord?: unknown): boolean {\n  switch (clause.type) {\n    case 'field':\n      return evaluateFieldClause(record, clause)\n    case 'filter':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record)\n    case 'wherePredicate':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record, clause.ctx)\n    case 'crossJoin':\n      throw new Error(\n        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not ` +\n          `evaluated per-record. This is a query planner routing error — ` +\n          `crossJoin clauses must be extracted from the clause list before calling ` +\n          `evaluateClause or filterRecords.`,\n      )\n    case 'group':\n      if (clause.op === 'and') {\n        for (const child of clause.clauses) {\n          if (!evaluateClause(record, child, fnRecord)) return false\n        }\n        return true\n      } else {\n        for (const child of clause.clauses) {\n          if (evaluateClause(record, child, fnRecord)) return true\n        }\n        return false\n      }\n  }\n}\n\n/**\n * Does the clause list contain any user-callback clause (filter /\n * wherePredicate), at any group nesting depth? Used by executors to\n * decide whether the per-record decoded view needs materializing.\n */\nexport function hasFnClause(clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (c.type === 'filter' || c.type === 'wherePredicate') return true\n    if (c.type === 'group' && hasFnClause(c.clauses)) return true\n  }\n  return false\n}\n"],"mappings":";AA2HO,SAAS,SAAS,QAAiB,MAAuB;AAC/D,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,WAAQ,OAAmC,IAAI;AAAA,EACjD;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAkB;AACtB,aAAW,WAAW,UAAU;AAC9B,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,QAAiB,QAA8B;AACjF,QAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;AAC5C,QAAM,EAAE,IAAI,MAAM,IAAI;AAOtB,MAAI,OAAO,IAAK,QAAO,OAAO,IAAI,SAAS,QAAQ,EAAE;AAErD,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,MAAM;AAAA,IACtD,KAAK;AACH,UAAI,OAAO,WAAW,SAAU,QAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACzF,UAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,SAAS,KAAK;AACvD,aAAO;AAAA,IACT,KAAK;AACH,aAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,WAAW,KAAK;AAAA,IAC3F,KAAK,WAAW;AACd,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,YAAM,CAAC,IAAI,EAAE,IAAI;AACjB,UAAI,CAAC,aAAa,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE,EAAG,QAAO;AACnE,aAAQ,UAAsB,MAAkB,UAAsB;AAAA,IACxE;AAAA,IACA,SAAS;AAEP,YAAM,cAAqB;AAC3B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAMA,SAAS,aAAa,GAAY,GAAqB;AACrD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO;AACnD,SAAO;AACT;AAaO,SAAS,eAAe,QAAiB,QAAgB,UAA6B;AAC3F,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO,oBAAoB,QAAQ,MAAM;AAAA,IAC3C,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,QAAQ,OAAO,GAAG;AAAA,IACzE,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF,KAAK;AACH,UAAI,OAAO,OAAO,OAAO;AACvB,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,CAAC,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACvD;AACA,eAAO;AAAA,MACT,OAAO;AACL,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACtD;AACA,eAAO;AAAA,MACT;AAAA,EACJ;AACF;AAOO,SAAS,YAAY,SAAqC;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAkB,QAAO;AAC/D,QAAI,EAAE,SAAS,WAAW,YAAY,EAAE,OAAO,EAAG,QAAO;AAAA,EAC3D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-T4NQMPBN.js → chunk-KNXN47MO.js}

@@ -1,9 +1,9 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-UNJU345Q.js";
 import {
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-party/directory/public-envelope/schema.ts
 var DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+);base64,/;
@@ -152,4 +152,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-T4NQMPBN.js.map
+//# sourceMappingURL=chunk-KNXN47MO.js.map

package/dist/{chunk-VK6OC22R.js → chunk-KWLD2D75.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-formula/computed/index.ts
 var ComputedFieldError = class extends NoydbError {
@@ -20,7 +20,8 @@ var ComputedFieldError = class extends NoydbError {
 };
 function evalComputedFields(record, computed, id) {
   const out = { ...record };
-  for (const [field, fn] of Object.entries(computed)) {
+  for (const [field, entry] of Object.entries(computed)) {
+    const fn = typeof entry === "function" ? entry : entry.fn;
     try {
       out[field] = fn(out);
     } catch (cause) {
@@ -34,4 +35,4 @@ export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=chunk-VK6OC22R.js.map
+//# sourceMappingURL=chunk-KWLD2D75.js.map

package/dist/chunk-KWLD2D75.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/computed/index.ts"],"sourcesContent":["/**\n * Computed scalar fields — schema-owned derived values evaluated on\n * write and materialized onto the record.\n *\n * A `computed` map declares pure, synchronous functions keyed by field\n * path. {@link evalComputedFields} runs them in declaration order — each\n * function sees the record with all prior computed fields already\n * injected, so a later field can read an earlier one (`total` reads\n * `netAmount`). The result is stored like any field: queryable,\n * indexable, and `aggregate(sum())`-able (exactly, when the field is also\n * a `money()` field).\n *\n * Computed evaluation is the FIRST stage of the write pipeline (before\n * schema validation), so the user need not supply computed fields and the\n * schema validates the computed result. Cross-record / async derivation\n * is out of scope here — see the validation service.\n */\n\nimport { NoydbError } from '../../kernel/errors.js'\n\nexport type ComputedFn<T = Record<string, unknown>> = (record: T) => unknown\n\n/**\n * #638 Task 7 — the extended per-field entry: `deps` (source field names, feeds\n * `ViaGraph` for taint propagation) and `mode` (`'materialized' | 'virtual'`,\n * default `'materialized'`) alongside `fn`. Lets `computed: { field: {...} }`\n * declare the same `{deps, mode}` shape `via(computed(fn, {...}))` composes —\n * absorbs the old `computedDeps` sibling option (#638 Task 2, retired here).\n */\nexport interface ComputedFieldEntry<T = Record<string, unknown>> {\n  readonly fn: ComputedFn<T>\n  readonly deps?: readonly string[]\n  readonly mode?: 'materialized' | 'virtual'\n}\n\n/** The plain `Record<string, ComputedFn>` sugar keeps working unchanged (materialized,\n *  no deps); a field may alternatively carry the extended `ComputedFieldEntry` shape. */\nexport type ComputedFields<T = Record<string, unknown>> = Record<string, ComputedFn<T> | ComputedFieldEntry<T>>\n\n/** Raised when a computed function throws during a write. */\nexport class ComputedFieldError extends NoydbError {\n  constructor(\n    public readonly field: string,\n    public readonly id: string,\n    public readonly cause: unknown,\n  ) {\n    super(\n      'COMPUTED_FIELD',\n      `computed field \"${field}\" threw for record \"${id}\": ` +\n        (cause instanceof Error ? cause.message : String(cause)),\n    )\n    this.name = 'ComputedFieldError'\n  }\n}\n\n/**\n * Evaluate every computed field in declaration order, injecting each\n * result into a shallow clone. A computed field overwrites any\n * user-supplied value of the same name — the field is schema-owned.\n * Returns the new record; the input is not mutated.\n */\nexport function evalComputedFields<T extends Record<string, unknown>>(\n  record: T,\n  computed: ComputedFields,\n  id: string,\n): T {\n  const out: Record<string, unknown> = { ...record }\n  for (const [field, entry] of Object.entries(computed)) {\n    const fn = typeof entry === 'function' ? entry : entry.fn\n    try {\n      out[field] = fn(out)\n    } catch (cause) {\n      throw new ComputedFieldError(field, id, cause)\n    }\n  }\n  return out as T\n}\n"],"mappings":";;;;;AAwCO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YACkB,OACA,IACA,OAChB;AACA;AAAA,MACE;AAAA,MACA,mBAAmB,KAAK,uBAAuB,EAAE,SAC9C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC1D;AARgB;AACA;AACA;AAOhB,SAAK,OAAO;AAAA,EACd;AAAA,EAVkB;AAAA,EACA;AAAA,EACA;AASpB;AAQO,SAAS,mBACd,QACA,UACA,IACG;AACH,QAAM,MAA+B,EAAE,GAAG,OAAO;AACjD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACrD,UAAM,KAAK,OAAO,UAAU,aAAa,QAAQ,MAAM;AACvD,QAAI;AACF,UAAI,KAAK,IAAI,GAAG,GAAG;AAAA,IACrB,SAAS,OAAO;AACd,YAAM,IAAI,mBAAmB,OAAO,IAAI,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-7F2P2NHX.js → chunk-KXKLKJW4.js}

@@ -1,12 +1,12 @@
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -46,4 +46,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-7F2P2NHX.js.map
+//# sourceMappingURL=chunk-KXKLKJW4.js.map

package/dist/{chunk-PAJCRV7O.js → chunk-KYC4LIEU.js}

@@ -2,7 +2,7 @@ import {
   IllegalTransitionError,
   RecordLockedError,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-audit/guards/with-guard.ts
 function withGuard(strategy) {
@@ -120,4 +120,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-PAJCRV7O.js.map
+//# sourceMappingURL=chunk-KYC4LIEU.js.map

package/dist/{chunk-AZPGB4OD.js → chunk-LEOXZY36.js}

@@ -1,19 +1,19 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-V76PHWLE.js";
+} from "./chunk-PEDZFFKW.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   NoydbError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-AZPGB4OD.js.map
+//# sourceMappingURL=chunk-LEOXZY36.js.map

package/dist/{chunk-2L7PPF2C.js → chunk-M5I354EE.js}

@@ -1,32 +1,32 @@
 import {
   resolveManagedSecret
-} from "./chunk-H7WQMGXH.js";
+} from "./chunk-CJEMA2Z6.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-CND5WQLO.js";
+} from "./chunk-Q2KVKTC2.js";
 import {
   createOwnerKeyring
-} from "./chunk-GMZFHDSG.js";
+} from "./chunk-6CU3FN74.js";
 import {
   LedgerStore
-} from "./chunk-62TTFKU4.js";
+} from "./chunk-WNA6T3MA.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   base64ToBuffer,
   wrapKey
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-cargo/adopt-partition.ts
 async function unsealDeks(seal, transferKey) {
@@ -179,7 +179,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-4ZASGII5.js");
+    const { createNoydb } = await import("./noydb-AMEOU456.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -232,4 +232,4 @@ export {
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition
 };
-//# sourceMappingURL=chunk-2L7PPF2C.js.map
+//# sourceMappingURL=chunk-M5I354EE.js.map

package/dist/{chunk-26FSVNBL.js → chunk-MK2BSS44.js}

@@ -1,6 +1,6 @@
 import {
   TierNotGrantedError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-party/team/tiers.ts
 function dekKey(collection, tier) {
@@ -31,4 +31,4 @@ export {
   effectiveClearance,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-26FSVNBL.js.map
+//# sourceMappingURL=chunk-MK2BSS44.js.map

package/dist/{chunk-G5CFMITA.js → chunk-MSVY7ULZ.js}

@@ -1,9 +1,9 @@
 import {
   envelopeBodyForHash
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   sha256Hex
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -67,4 +67,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-G5CFMITA.js.map
+//# sourceMappingURL=chunk-MSVY7ULZ.js.map

package/dist/{chunk-PE25C4QL.js → chunk-NNWK3PSY.js}

@@ -1,21 +1,21 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-DJ4TNF4N.js";
+} from "./chunk-GX2BYNCT.js";
 import {
   resolveManagedSecret
-} from "./chunk-H7WQMGXH.js";
+} from "./chunk-CJEMA2Z6.js";
 import {
   createOwnerKeyring
-} from "./chunk-GMZFHDSG.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-6CU3FN74.js";
 import {
   wrapKey
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   PermissionDeniedError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -132,4 +132,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-PE25C4QL.js.map
+//# sourceMappingURL=chunk-NNWK3PSY.js.map

package/dist/{chunk-JT4A6OAJ.js → chunk-NSZ6J5DF.js}

@@ -1,15 +1,15 @@
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   ConflictError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-audit/attestation/signer.ts
 import { generateDocSigningKeyPair } from "@noy-db/attestation";
@@ -56,4 +56,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-JT4A6OAJ.js.map
+//# sourceMappingURL=chunk-NSZ6J5DF.js.map

package/dist/{chunk-RHB7BOEO.js → chunk-NUEFXLZU.js}

@@ -1,19 +1,19 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-JT4A6OAJ.js";
+} from "./chunk-NSZ6J5DF.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 import {
   AttestationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-audit/attestation/issue.ts
 import {
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-RHB7BOEO.js.map
+//# sourceMappingURL=chunk-NUEFXLZU.js.map

package/dist/{chunk-I6Q7YECW.js → chunk-NYVQCZ54.js}

@@ -1,9 +1,9 @@
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 
 // src/with-shape/blobs/export-blobs.ts
 var ExportBlobsAbortedError = class extends Error {
@@ -258,4 +258,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-I6Q7YECW.js.map
+//# sourceMappingURL=chunk-NYVQCZ54.js.map

package/dist/chunk-NYVQCZ54.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/blobs/export-blobs.ts","../src/with-shape/blobs/blob-compaction.ts"],"sourcesContent":["/**\n * `vault.exportBlobs()` — bulk blob extraction primitive.\n *\n * Async-iterable handle over every blob attached to records in a\n * vault, optionally filtered by collection allowlist and per-record\n * predicate. Emits tuples of `{ blobId, recordRef, bytes, meta }` so\n * the consumer can pipe into any sink (zip stream, S3 multipart, USB\n * copy, cold-storage tape) without pulling the whole export into\n * memory.\n *\n * ## Auth + audit\n *\n * - Capability check runs **once** at handle creation via\n *   `Vault.assertCanExport('plaintext', 'blob')`. An operator whose\n *   keyring lacks that bit fails before a single byte of ciphertext\n *   is decrypted.\n * - Audit entry lands in `_export_audit` at handle creation: the\n *   actor, start timestamp, target collections, predicate presence,\n *   and batch mechanism. **No content hashes** — per the spec\n *   non-correlation invariant.\n *\n * ## Abort + resume\n *\n * - `handle.abort()` flips the internal signal; the next iteration\n *   boundary throws `AbortError`. Consumers already in `for await`\n *   can catch and exit cleanly.\n * - Restart after a partial failure with `{ afterBlobId }` — the\n *   iterator skips tuples up to (and including) that blob id before\n *   yielding again. Combined with a blob-count ceiling it supports\n *   idempotent batch re-runs.\n *\n * @module\n */\n\nimport type { Collection } from '../../kernel/collection.js'\nimport type { SlotInfo } from '../../kernel/types.js'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface ExportBlobsOptions {\n  /**\n   * Collection allowlist. Omit to export blobs from every collection\n   * the caller has read access to.\n   */\n  readonly collections?: readonly string[]\n  /**\n   * Per-record predicate. Called on the decrypted record BEFORE any\n   * blob bytes are read for that record — returning false skips the\n   * record and all its slots without touching their chunks.\n   */\n  readonly where?: (record: unknown, context: { collection: string; id: string }) => boolean\n  /**\n   * Resume after a specific blob id. The iterator skips tuples up to\n   * and including this id, then yields. Format of the id is the same\n   * as `ExportedBlob.blobId` (the HMAC-keyed eTag).\n   */\n  readonly afterBlobId?: string\n  /**\n   * External abort signal. When fired, the next iterator tick throws\n   * `ExportBlobsAbortedError`. Honored alongside `handle.abort()`.\n   */\n  readonly signal?: AbortSignal\n}\n\nexport interface ExportedBlob {\n  /** Opaque blob identifier — HMAC-keyed eTag, stable across vaults. */\n  readonly blobId: string\n  /** Where this blob came from in the vault. */\n  readonly recordRef: {\n    readonly collection: string\n    readonly id: string\n    readonly slot: string\n  }\n  /** Decrypted plaintext bytes. */\n  readonly bytes: Uint8Array\n  /** Best-effort metadata (from the blob slot record). */\n  readonly meta: {\n    readonly size: number\n    /**\n     * User-visible filename stored on the slot. Often equal to the\n     * slot name; differs when the caller supplied an explicit\n     * `filename` to `BlobSet.put()`.\n     */\n    readonly filename: string\n    readonly mimeType?: string\n    readonly createdAt?: string\n  }\n}\n\nexport interface ExportBlobsHandle extends AsyncIterable<ExportedBlob> {\n  /** Abort the export. Safe to call multiple times. */\n  abort(): void\n  /** True once `abort()` has fired or the external signal aborted. */\n  readonly aborted: boolean\n}\n\nexport class ExportBlobsAbortedError extends Error {\n  constructor(reason: string) {\n    super(`exportBlobs aborted: ${reason}`)\n    this.name = 'ExportBlobsAbortedError'\n  }\n}\n\n// ─── Audit ──────────────────────────────────────────────────────────────\n\nexport const EXPORT_AUDIT_COLLECTION = '_export_audit'\n\nexport interface ExportBlobsAuditEntry {\n  readonly id: string\n  readonly mechanism: 'exportBlobs'\n  readonly actor: string\n  readonly startedAt: string\n  readonly collections: readonly string[] | null\n  readonly predicate: boolean\n  readonly afterBlobId: string | null\n}\n\n// ─── Implementation ─────────────────────────────────────────────────────\n\n/**\n * Build the handle. Factored out of `Vault.exportBlobs` so the\n * implementation can be unit-tested without going through the\n * compartment lifecycle.\n */\nexport function createExportBlobsHandle(\n  actor: string,\n  listAccessibleCollections: () => Promise<string[]>,\n  getCollection: <T>(name: string) => Collection<T>,\n  writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>,\n  options: ExportBlobsOptions,\n): ExportBlobsHandle {\n  let aborted = false\n\n  const abort = (): void => {\n    aborted = true\n  }\n\n  if (options.signal) {\n    if (options.signal.aborted) aborted = true\n    options.signal.addEventListener('abort', () => { aborted = true })\n  }\n\n  function assertLive(): void {\n    if (aborted) throw new ExportBlobsAbortedError('aborted by caller')\n  }\n\n  const allowlist = options.collections ? new Set(options.collections) : null\n\n  // Write the audit entry BEFORE the first yield so a blocked\n  // iteration still leaves an audit trail that the export started.\n  let auditPromise: Promise<void> | null = null\n  function writeAuditOnce(): Promise<void> {\n    if (!auditPromise) {\n      auditPromise = writeAudit({\n        id: generateBatchId(),\n        mechanism: 'exportBlobs',\n        actor,\n        startedAt: new Date().toISOString(),\n        collections: options.collections ?? null,\n        predicate: Boolean(options.where),\n        afterBlobId: options.afterBlobId ?? null,\n      })\n    }\n    return auditPromise\n  }\n\n  async function* generate(): AsyncGenerator<ExportedBlob> {\n    await writeAuditOnce()\n    assertLive()\n\n    // Resolve target collections lazily — also keeps the call async.\n    const allCollections = await listAccessibleCollections()\n    const targets = allCollections.filter(name => {\n      if (name.startsWith('_')) return false\n      if (allowlist && !allowlist.has(name)) return false\n      return true\n    })\n\n    let resumeCursorHit = options.afterBlobId === undefined\n\n    for (const collectionName of targets) {\n      if (aborted) return\n\n      const coll = getCollection<Record<string, unknown>>(collectionName)\n      const records = await coll.list().catch(() => [])\n      for (const record of records) {\n        if (aborted) return\n        assertLive()\n\n        const idField = (record as { id?: unknown }).id\n        if (typeof idField !== 'string') continue\n\n        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue\n\n        const blobSet = coll.blob(idField)\n        const slots = await blobSet.list().catch(() => [] as SlotInfo[])\n        for (const slot of slots) {\n          if (aborted) return\n\n          if (!resumeCursorHit) {\n            if (slot.eTag === options.afterBlobId) {\n              resumeCursorHit = true\n            }\n            continue\n          }\n\n          const bytes = await blobSet.get(slot.name)\n          if (!bytes) continue\n\n          const item: ExportedBlob = {\n            blobId: slot.eTag,\n            recordRef: { collection: collectionName, id: idField, slot: slot.name },\n            bytes,\n            meta: {\n              size: slot.size,\n              filename: slot.filename,\n              ...(slot.mimeType !== undefined && { mimeType: slot.mimeType }),\n              ...(slot.uploadedAt !== undefined && { createdAt: slot.uploadedAt }),\n            },\n          }\n          yield item\n        }\n      }\n    }\n  }\n\n  const handle: ExportBlobsHandle = {\n    abort,\n    get aborted() { return aborted },\n    [Symbol.asyncIterator]: () => generate(),\n  }\n  return handle\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction generateBatchId(): string {\n  // 16 bytes of crypto randomness, URL-safe base64, no padding.\n  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  let s = ''\n  for (const b of raw) s += b.toString(16).padStart(2, '0')\n  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`\n}\n","/**\n * Blob retention + compaction.\n *\n * Declarative per-collection / per-slot eviction policy. Two\n * triggers:\n *\n *   - **`retainDays`** — age-based TTL. A slot uploaded more than N\n *     days ago is evicted.\n *   - **`evictWhen(record)`** — predicate over the **decrypted**\n *     record. Lets consumers express \"the image is safe to drop once\n *     the structured invoice has been reviewed and confirmed.\"\n *\n * Either trigger (or both) causes the slot to evict. Eviction removes\n * the slot entry from `_blob_slots_{collection}`, decrements the\n * blob's refCount (so unreferenced chunks can be GC'd by the next\n * sweep), and writes one entry to the `_blob_eviction_audit`\n * collection for tamper-evident record-keeping.\n *\n * The audit entry carries the eTag of the evicted blob (opaque HMAC\n * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,\n * per the SPEC non-correlation invariant. Consumers reconstructing\n * \"what used to be attached\" can look up the audit entry by record\n * id.\n *\n * Compaction is **consumer-scheduled** — noy-db never runs a\n * background daemon. Call `vault.compact()` whenever your workflow\n * allows (cron, manual \"tidy\" button, cold-storage export prep, …).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope, SlotInfo } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { encrypt, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n// ─── Config types ───────────────────────────────────────────────────────\n\nexport interface BlobFieldPolicy<T = unknown> {\n  /**\n   * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's\n   * opaque `ViaDescriptor` (#629 Task 7). Optional (the\n   * `ClassifiedFieldSpec._viaBrand` precedent): `blobFields` policies are\n   * plain object literals with no declaration factory to stamp it, so a\n   * mandatory field would break every existing declaration.\n   */\n  readonly _viaBrand?: 'blob'\n  /**\n   * Age-based TTL in days. A slot whose `uploadedAt` is older than\n   * `now - retainDays × 86400s` evicts on the next `vault.compact()`.\n   * Omit to disable age-based eviction.\n   */\n  readonly retainDays?: number\n  /**\n   * Predicate evaluated against the decrypted record. When it returns\n   * `true`, every matching slot on that record evicts. Omit to\n   * disable predicate-based eviction.\n   */\n  readonly evictWhen?: (record: T) => boolean\n  /**\n   * **Legal hold.** When this predicate returns `true`, the slot is\n   * never evicted — `retainDays`/`evictWhen` are overridden. Use for a\n   * litigation / audit hold on a fiscal document: the blob stays until\n   * the predicate returns `false` (the hold is released). Fail-closed:\n   * if the predicate throws, the slot is treated as held.\n   */\n  readonly legalHold?: (record: T) => boolean\n  /**\n   * **Period-bound retention.** Returns the date (Date / ISO string /\n   * epoch ms) until which the slot must be retained — typically derived\n   * from the record's fiscal period (e.g. period end + 10 years). While\n   * `now < retainUntil`, the slot is never evicted, regardless of\n   * `retainDays`. Return `null`/`undefined` to impose no floor.\n   * Fail-closed: a throwing function holds the slot.\n   */\n  readonly retainUntil?: (record: T) => Date | string | number | null | undefined\n  /**\n   * **External projection.** When `true`, this field's bytes are stored in the\n   * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,\n   * **unencrypted** object — servable directly from S3/CDN and processable by\n   * native tooling — instead of the encrypted-chunk path. The encrypted slot\n   * record remains the catalog (anchoring invariant). Requires an `objectStore`;\n   * **outside the zero-knowledge guarantee** — use only for assets meant to\n   * leave the vault. See the as-aws-s3 design spec.\n   */\n  readonly external?: boolean\n  /**\n   * For an `external` field: make the object world-readable (CDN origin) rather\n   * than presigned-only. Default `false` (presigned). Ignored unless `external`.\n   */\n  readonly public?: boolean\n  /**\n   * For an `external` field: how to stamp a **backlink** (this record's\n   * vault/collection/id/field) onto the object's metadata — the self-describing\n   * \"secondary store\" that powers reconcile / DR / import re-pairing.\n   * - `'opaque-token'` (default): a random id; preserves the opaque-bucket\n   *   property (no names leak); the token is also recorded on the slot.\n   * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;\n   *   falls back to `'opaque-token'` on a plaintext vault).\n   * - `'plain'`: the reference in cleartext metadata — **leaks structure** to\n   *   bucket readers; only for non-sensitive deployments.\n   * - `'none'`: no backlink.\n   */\n  readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none'\n}\n\nexport type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>\n\n// ─── Audit collection ──────────────────────────────────────────────────\n\nexport const BLOB_EVICTION_AUDIT_COLLECTION = '_blob_eviction_audit'\n\nexport interface BlobEvictionEntry {\n  readonly id: string\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly blobHash: string\n  readonly reason: 'ttl' | 'predicate' | 'both'\n  readonly evictedAt: string\n  readonly actor: string\n}\n\n// ─── Compaction result ──────────────────────────────────────────────────\n\nexport interface CompactionResult {\n  /** Number of blob slots evicted across all collections. */\n  readonly evicted: number\n  /** Number of records touched (iterated + policy checked). */\n  readonly records: number\n  /** Number of collections with `blobFields` configured. */\n  readonly collections: number\n  /** Number of audit entries written. Equal to `evicted`. */\n  readonly auditEntries: number\n  /**\n   * Number of slots that would have evicted (TTL/predicate triggered)\n   * but were retained by a `legalHold` or `retainUntil` floor.\n   */\n  readonly held: number\n  /** Per-collection breakdown for diagnostics. */\n  readonly byCollection: Record<string, { records: number; evicted: number }>\n}\n\n// ─── Core ──────────────────────────────────────────────────────────────\n\nexport interface CompactRunOptions {\n  /** Override \"now\" for deterministic testing. */\n  readonly now?: Date\n  /**\n   * Stop after this many evictions. Useful for capped batches / cron\n   * jobs that need to fit in a time window. `undefined` = unbounded.\n   */\n  readonly maxEvictions?: number\n  /**\n   * Dry-run — evaluate policies and return the counts, but do NOT\n   * delete slots or write audit entries. Lets a consumer preview\n   * what would happen.\n   */\n  readonly dryRun?: boolean\n}\n\nexport interface CompactionContext {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly actor: string\n  readonly encrypted: boolean\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n  /**\n   * Resolve a collection's declared `blobFields` config. Returns an\n   * empty map for collections without the config — the walk skips\n   * those.\n   */\n  readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null\n  /** List collection names in the vault. */\n  readonly listCollections: () => Promise<string[]>\n  /** List record ids in a collection. */\n  readonly listRecords: (collection: string) => Promise<string[]>\n  /** Decrypt and return the record. Null when absent. */\n  readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>\n  /** Return the BlobSet-like handle for a record's slots. */\n  readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>\n  /** Delete a slot and decrement its blob's refCount. */\n  readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>\n}\n\nexport async function runCompaction(\n  ctx: CompactionContext,\n  options: CompactRunOptions = {},\n): Promise<CompactionResult> {\n  const now = options.now ?? new Date()\n  const maxEvictions = options.maxEvictions ?? Infinity\n  const dryRun = options.dryRun === true\n\n  const allCollections = await ctx.listCollections()\n  const byCollection: Record<string, { records: number; evicted: number }> = {}\n  let evicted = 0\n  let records = 0\n  let auditEntries = 0\n  let held = 0\n  let collectionsWithPolicy = 0\n\n  outer: for (const collectionName of allCollections) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    if (!config) continue\n    const configuredSlots = Object.keys(config)\n    if (configuredSlots.length === 0) continue\n    collectionsWithPolicy += 1\n    byCollection[collectionName] = { records: 0, evicted: 0 }\n\n    const ids = await ctx.listRecords(collectionName)\n    for (const recordId of ids) {\n      if (evicted >= maxEvictions) break outer\n\n      const record = await ctx.getRecord(collectionName, recordId).catch(() => null)\n      if (record === null) continue\n      records += 1\n      byCollection[collectionName].records += 1\n\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      for (const slot of slots) {\n        if (evicted >= maxEvictions) break outer\n        const policy = config[slot.name]\n        if (!policy) continue\n\n        const reason = evaluatePolicy(policy, record, slot, now)\n        if (!reason) continue\n\n        // Retention floor: a legal hold or period-bound retainUntil\n        // blocks an otherwise-due eviction. Counted, never evicted.\n        if (isHeld(policy, record, now)) {\n          held += 1\n          continue\n        }\n\n        if (!dryRun) {\n          await ctx.deleteSlot(collectionName, recordId, slot.name)\n          await writeAuditEntry(ctx, {\n            id: generateEvictionId(collectionName, recordId, slot.name),\n            collection: collectionName,\n            recordId,\n            slotName: slot.name,\n            blobHash: slot.eTag,\n            reason,\n            evictedAt: now.toISOString(),\n            actor: ctx.actor,\n          })\n          auditEntries += 1\n        }\n        evicted += 1\n        byCollection[collectionName].evicted += 1\n      }\n    }\n  }\n\n  return {\n    evicted,\n    records,\n    collections: collectionsWithPolicy,\n    auditEntries,\n    held,\n    byCollection,\n  }\n}\n\n/**\n * Whether a retention floor (legal hold or period-bound `retainUntil`)\n * currently blocks eviction of this record's slots. Fail-closed: a\n * throwing predicate holds the slot.\n */\nfunction isHeld<T>(policy: BlobFieldPolicy<T>, record: T, now: Date): boolean {\n  if (policy.legalHold) {\n    try {\n      if (policy.legalHold(record)) return true\n    } catch {\n      return true\n    }\n  }\n  if (policy.retainUntil) {\n    try {\n      const until = policy.retainUntil(record)\n      if (until !== null && until !== undefined) {\n        const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(String(until))\n        if (!Number.isFinite(t)) return true   // fail-closed: unparseable retainUntil holds the slot\n        if (t > now.getTime()) return true\n      }\n    } catch {\n      return true\n    }\n  }\n  return false\n}\n\nfunction evaluatePolicy<T>(\n  policy: BlobFieldPolicy<T>,\n  record: T,\n  slot: SlotInfo,\n  now: Date,\n): 'ttl' | 'predicate' | 'both' | null {\n  let ttlTriggered = false\n  let predicateTriggered = false\n\n  if (policy.retainDays !== undefined && policy.retainDays > 0) {\n    const uploadedAt = Date.parse(slot.uploadedAt)\n    if (Number.isFinite(uploadedAt)) {\n      const ageMs = now.getTime() - uploadedAt\n      const limitMs = policy.retainDays * 86_400_000\n      if (ageMs > limitMs) ttlTriggered = true\n    }\n  }\n\n  if (policy.evictWhen) {\n    try {\n      if (policy.evictWhen(record)) predicateTriggered = true\n    } catch {\n      // Predicate error → do NOT evict. Fail closed.\n    }\n  }\n\n  if (ttlTriggered && predicateTriggered) return 'both'\n  if (ttlTriggered) return 'ttl'\n  if (predicateTriggered) return 'predicate'\n  return null\n}\n\nfunction generateEvictionId(collection: string, recordId: string, slotName: string): string {\n  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8))\n  let suffix = ''\n  for (const b of rand) suffix += b.toString(16).padStart(2, '0')\n  return `${collection}__${recordId}__${slotName}__${suffix}`\n}\n\nasync function writeAuditEntry(ctx: CompactionContext, entry: BlobEvictionEntry): Promise<void> {\n  const json = JSON.stringify(entry)\n  let envelope: EncryptedEnvelope\n  if (ctx.encrypted) {\n    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION)\n    const { iv, data } = await encrypt(json, dek)\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: 1,\n      _ts: entry.evictedAt,\n      _iv: iv,\n      _data: data,\n      _by: entry.actor,\n    }\n  } else {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: 1,\n      _ts: entry.evictedAt,\n      _iv: '',\n      _data: json,\n      _by: entry.actor,\n    }\n  }\n  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope)\n}\n"],"mappings":";;;;;;;;AAgGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,wBAAwB,MAAM,EAAE;AACtC,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,0BAA0B;AAmBhC,SAAS,wBACd,OACA,2BACA,eACA,YACA,SACmB;AACnB,MAAI,UAAU;AAEd,QAAM,QAAQ,MAAY;AACxB,cAAU;AAAA,EACZ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,QAAQ,OAAO,QAAS,WAAU;AACtC,YAAQ,OAAO,iBAAiB,SAAS,MAAM;AAAE,gBAAU;AAAA,IAAK,CAAC;AAAA,EACnE;AAEA,WAAS,aAAmB;AAC1B,QAAI,QAAS,OAAM,IAAI,wBAAwB,mBAAmB;AAAA,EACpE;AAEA,QAAM,YAAY,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AAIvE,MAAI,eAAqC;AACzC,WAAS,iBAAgC;AACvC,QAAI,CAAC,cAAc;AACjB,qBAAe,WAAW;AAAA,QACxB,IAAI,gBAAgB;AAAA,QACpB,WAAW;AAAA,QACX;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,QAAQ,KAAK;AAAA,QAChC,aAAa,QAAQ,eAAe;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,WAAyC;AACvD,UAAM,eAAe;AACrB,eAAW;AAGX,UAAM,iBAAiB,MAAM,0BAA0B;AACvD,UAAM,UAAU,eAAe,OAAO,UAAQ;AAC5C,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,UAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAG,QAAO;AAC9C,aAAO;AAAA,IACT,CAAC;AAED,QAAI,kBAAkB,QAAQ,gBAAgB;AAE9C,eAAW,kBAAkB,SAAS;AACpC,UAAI,QAAS;AAEb,YAAM,OAAO,cAAuC,cAAc;AAClE,YAAM,UAAU,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAChD,iBAAW,UAAU,SAAS;AAC5B,YAAI,QAAS;AACb,mBAAW;AAEX,cAAM,UAAW,OAA4B;AAC7C,YAAI,OAAO,YAAY,SAAU;AAEjC,YAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,QAAQ,CAAC,EAAG;AAE1F,cAAM,UAAU,KAAK,KAAK,OAAO;AACjC,cAAM,QAAQ,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAe;AAC/D,mBAAW,QAAQ,OAAO;AACxB,cAAI,QAAS;AAEb,cAAI,CAAC,iBAAiB;AACpB,gBAAI,KAAK,SAAS,QAAQ,aAAa;AACrC,gCAAkB;AAAA,YACpB;AACA;AAAA,UACF;AAEA,gBAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AACzC,cAAI,CAAC,MAAO;AAEZ,gBAAM,OAAqB;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,WAAW,EAAE,YAAY,gBAAgB,IAAI,SAAS,MAAM,KAAK,KAAK;AAAA,YACtE;AAAA,YACA,MAAM;AAAA,cACJ,MAAM,KAAK;AAAA,cACX,UAAU,KAAK;AAAA,cACf,GAAI,KAAK,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS;AAAA,cAC7D,GAAI,KAAK,eAAe,UAAa,EAAE,WAAW,KAAK,WAAW;AAAA,YACpE;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA4B;AAAA,IAChC;AAAA,IACA,IAAI,UAAU;AAAE,aAAO;AAAA,IAAQ;AAAA,IAC/B,CAAC,OAAO,aAAa,GAAG,MAAM,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,kBAA0B;AAEjC,QAAM,MAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI,IAAI;AACR,aAAW,KAAK,IAAK,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3D;;;ACrIO,IAAM,iCAAiC;AA2E9C,eAAsB,cACpB,KACA,UAA6B,CAAC,GACH;AAC3B,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAElC,QAAM,iBAAiB,MAAM,IAAI,gBAAgB;AACjD,QAAM,eAAqE,CAAC;AAC5E,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,OAAO;AACX,MAAI,wBAAwB;AAE5B,QAAO,YAAW,kBAAkB,gBAAgB;AAClD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB,OAAO,KAAK,MAAM;AAC1C,QAAI,gBAAgB,WAAW,EAAG;AAClC,6BAAyB;AACzB,iBAAa,cAAc,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE;AAExD,UAAM,MAAM,MAAM,IAAI,YAAY,cAAc;AAChD,eAAW,YAAY,KAAK;AAC1B,UAAI,WAAW,aAAc,OAAM;AAEnC,YAAM,SAAS,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC7E,UAAI,WAAW,KAAM;AACrB,iBAAW;AACX,mBAAa,cAAc,EAAE,WAAW;AAExC,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,iBAAW,QAAQ,OAAO;AACxB,YAAI,WAAW,aAAc,OAAM;AACnC,cAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,YAAI,CAAC,OAAQ;AAEb,cAAM,SAAS,eAAe,QAAQ,QAAQ,MAAM,GAAG;AACvD,YAAI,CAAC,OAAQ;AAIb,YAAI,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAC/B,kBAAQ;AACR;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI,WAAW,gBAAgB,UAAU,KAAK,IAAI;AACxD,gBAAM,gBAAgB,KAAK;AAAA,YACzB,IAAI,mBAAmB,gBAAgB,UAAU,KAAK,IAAI;AAAA,YAC1D,YAAY;AAAA,YACZ;AAAA,YACA,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,WAAW,IAAI,YAAY;AAAA,YAC3B,OAAO,IAAI;AAAA,UACb,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,mBAAW;AACX,qBAAa,cAAc,EAAE,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOA,SAAS,OAAU,QAA4B,QAAW,KAAoB;AAC5E,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,QAAO;AAAA,IACvC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AACtB,QAAI;AACF,YAAM,QAAQ,OAAO,YAAY,MAAM;AACvC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,cAAM,IAAI,iBAAiB,OAAO,MAAM,QAAQ,IAAI,OAAO,UAAU,WAAW,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC;AAChH,YAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,YAAI,IAAI,IAAI,QAAQ,EAAG,QAAO;AAAA,MAChC;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QACA,MACA,KACqC;AACrC,MAAI,eAAe;AACnB,MAAI,qBAAqB;AAEzB,MAAI,OAAO,eAAe,UAAa,OAAO,aAAa,GAAG;AAC5D,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU;AAC7C,QAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,YAAM,UAAU,OAAO,aAAa;AACpC,UAAI,QAAQ,QAAS,gBAAe;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,sBAAqB;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,gBAAgB,mBAAoB,QAAO;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,mBAAoB,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,UAAkB,UAA0B;AAC1F,QAAM,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChE,MAAI,SAAS;AACb,aAAW,KAAK,KAAM,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC9D,SAAO,GAAG,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,eAAe,gBAAgB,KAAwB,OAAyC;AAC9F,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,IAAI,WAAW;AACjB,UAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,MACP,KAAK,MAAM;AAAA,IACb;AAAA,EACF,OAAO;AACL,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,MACP,KAAK,MAAM;AAAA,IACb;AAAA,EACF;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,gCAAgC,MAAM,IAAI,QAAQ;AACrF;","names":[]}

package/dist/{chunk-DKGZIX6S.js → chunk-OQAODTYR.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-CND5WQLO.js";
+} from "./chunk-Q2KVKTC2.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-DKGZIX6S.js.map
+//# sourceMappingURL=chunk-OQAODTYR.js.map

package/dist/{chunk-HV3VNAYI.js → chunk-OV4CMJGR.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-DJ4TNF4N.js";
+} from "./chunk-GX2BYNCT.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-DKGZIX6S.js";
+} from "./chunk-OQAODTYR.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-UNJU345Q.js";
 import {
   NoydbError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-HV3VNAYI.js.map
+//# sourceMappingURL=chunk-OV4CMJGR.js.map

package/dist/{chunk-V76PHWLE.js → chunk-PEDZFFKW.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-shape/links/names.ts
 var LINK_COLLECTION_PREFIX = "_links_";
@@ -38,4 +38,4 @@ export {
   linkRowKey,
   LinkIntegrityError
 };
-//# sourceMappingURL=chunk-V76PHWLE.js.map
+//# sourceMappingURL=chunk-PEDZFFKW.js.map