@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.9

package/dist/{subject-index-O75wKshW.d.ts → subject-index-CyOgGMJL.d.ts}

@@ -314,6 +314,24 @@ interface ForgetResult {
     readonly sealedResidue: readonly string[];
     /** The single `op:'forget'` ledger entry appended for this erasure. */
     readonly ledgerEntry: LedgerEntry;
+    /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased
+     *  because their source subject was forgotten. Overlay outputs are intentionally out of
+     *  scope here — an overlay is always sourced from an MV, never directly from a subject
+     *  collection, so the personal-data-bearing MV rows it reads are already erased above. */
+    readonly derivedRecordsErased: number;
+    /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */
+    readonly derivedAggregatesRecomputed: number;
+    /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen
+     *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */
+    readonly derivedResidueFrozen: readonly string[];
+    /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */
+    readonly lookupReferencesCascaded: number;
+    /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */
+    readonly lookupReferencesNullified: number;
+    /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,
+     *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.
+     *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */
+    readonly lookupReferencesResidue: readonly string[];
 }
 
 /**

package/dist/sync/index.d.ts

@@ -1,6 +1,5 @@
-import { cr as SyncStrategy } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { bW as SyncStrategy } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-H3MPSYCH.js";
+} from "../chunk-RMUXPHIH.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
-import "../chunk-VFQOE76I.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.d.ts

@@ -1,7 +1,6 @@
-import { jf as TeamStrategy, cT as NoydbStore, cF as UnlockedKeyring } from '../index-BJ3L-XcV.js';
-export { e1 as BundleRecipient, fz as EnrollAuthenticatorOptions, fA as EnrollAuthenticatorWrappingDEKsOptions, fB as EnrollAuthenticatorWrappingKEKOptions, gz as ListUsersOptions, h4 as NO_TEAM, hm as PaperRecoveryEntry, hy as PresenceHandle, i0 as RecoverPassphraseInput, i1 as RecoverPassphraseResult, i2 as RecoverUserOptions, i5 as RecoveryProof, ii as RotatePassphraseInput, iQ as SlotRewrapCeremony, iR as SlotRewrapContext, i_ as SyncEngine, j6 as SyncTransaction, je as TeamNotEnabledError, js as UpdateAuthenticatorOptions, jJ as WrappedDeksBlob, jU as buildRecipientKeyringFile, jV as burnPaperRecoveryEntry, l8 as changeSecret, l9 as createOwnerKeyring, j$ as deriveMagicLinkContentKey, k3 as enrollAuthenticator, la as ensureCollectionDEK, k7 as evaluateExportCapability, k9 as evaluateImportCapability, kc as findAuthenticator, lb as grant, kd as hasExportCapability, ke as hasImportCapability, kh as isMagicLinkGrantExpired, kq as listMagicLinkGrants, kr as listUsers, ks as listUsersWithEnvelopes, lc as loadKeyring, kv as loadPaperRecoveryEntries, ky as magicLinkGrantRecordId, kz as mintPaperRecoveryEntry, kB as mintWrappedDeksBlob, ld as persistKeyring, kG as readMagicLinkGrantRecord, kn as recoverPassphrase, kI as recoverUser, kM as removeAuthenticator, le as revoke, kS as revokeMagicLinkGrant, ko as rotatePassphrase, kU as savePaperRecoveryEntries, kY as unwrapDeksFromBlob, kZ as unwrapDeksFromPaperEntry, k$ as unwrapMagicLinkGrant, lf as updateAuthenticator, lg as updateKeyringIdentity, l7 as writeMagicLinkGrant } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { jz as TeamStrategy, c_ as NoydbStore, c8 as UnlockedKeyring } from '../index-DzhNI2vE.js';
+export { e8 as BundleRecipient, fO as EnrollAuthenticatorOptions, fP as EnrollAuthenticatorWrappingDEKsOptions, fQ as EnrollAuthenticatorWrappingKEKOptions, gQ as ListUsersOptions, hm as NO_TEAM, hF as PaperRecoveryEntry, hR as PresenceHandle, ik as RecoverPassphraseInput, il as RecoverPassphraseResult, im as RecoverUserOptions, iq as RecoveryProof, iC as RotatePassphraseInput, j8 as SlotRewrapCeremony, j9 as SlotRewrapContext, ji as SyncEngine, jq as SyncTransaction, jy as TeamNotEnabledError, jN as UpdateAuthenticatorOptions, k6 as WrappedDeksBlob, kh as buildRecipientKeyringFile, ki as burnPaperRecoveryEntry, lC as changeSecret, lD as createOwnerKeyring, ko as deriveMagicLinkContentKey, kt as enrollAuthenticator, lE as ensureCollectionDEK, ky as evaluateExportCapability, kA as evaluateImportCapability, kD as findAuthenticator, lF as grant, kE as hasExportCapability, kF as hasImportCapability, kI as isMagicLinkGrantExpired, kS as listMagicLinkGrants, kT as listUsers, kU as listUsersWithEnvelopes, lG as loadKeyring, kX as loadPaperRecoveryEntries, k$ as magicLinkGrantRecordId, l0 as mintPaperRecoveryEntry, l2 as mintWrappedDeksBlob, lH as persistKeyring, l7 as readMagicLinkGrantRecord, kP as recoverPassphrase, l9 as recoverUser, ld as removeAuthenticator, lI as revoke, lj as revokeMagicLinkGrant, kQ as rotatePassphrase, ll as savePaperRecoveryEntries, lp as unwrapDeksFromBlob, lq as unwrapDeksFromPaperEntry, ls as unwrapMagicLinkGrant, lJ as updateAuthenticator, lK as updateKeyringIdentity, lB as writeMagicLinkGrant } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-AG2PLGQ2.js";
+} from "../chunk-FC3XK5JT.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-WGH3YV6Y.js";
+} from "../chunk-DEYAO3N6.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,14 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-VUHXLL32.js";
+} from "../chunk-VJ3NQK4K.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-H3MPSYCH.js";
+} from "../chunk-RMUXPHIH.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-26FSVNBL.js";
+import "../chunk-MK2BSS44.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +57,19 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-GMZFHDSG.js";
-import "../chunk-3CHNKEFI.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-6CU3FN74.js";
+import "../chunk-E5AHO65E.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
 import {
   TeamNotEnabledError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.d.ts

@@ -1,5 +1,4 @@
-export { ln as NO_TIERS, lo as TiersContext, jj as TiersNotEnabledError, lp as TiersStrategy, lq as assertDeclaredTier, lr as assertTiersEnabled, ls as classifySealedShred, lt as demote, lu as elevate, lv as getAtTier, lw as listAtTier, lx as putAtTier, ly as withTiers } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+export { lR as NO_TIERS, lS as TiersContext, jD as TiersNotEnabledError, lT as TiersStrategy, lU as assertDeclaredTier, lV as assertTiersEnabled, lW as classifySealedShred, lX as demote, lY as elevate, lZ as getAtTier, l_ as listAtTier, l$ as putAtTier, m0 as withTiers } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -9,19 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-E3LURVGQ.js";
-import "../chunk-26FSVNBL.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-SSFC3IYA.js";
+import "../chunk-MK2BSS44.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
 import {
   TiersNotEnabledError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.d.ts

@@ -1,5 +1,4 @@
-export { dq as BundleVersionConflictError, f0 as ConflictError, cV as EncryptedEnvelope, gy as ListPageResult, h5 as NetworkError, hb as NoydbBundleStore, bX as NoydbPodStore, cT as NoydbStore, du as PodVersionConflictError, iX as StoreCapabilities, iY as StoreCapabilityError, iZ as StoreTime, jn as TxOp, jC as VaultSnapshot } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+export { dx as BundleVersionConflictError, fc as ConflictError, d0 as EncryptedEnvelope, gP as ListPageResult, hn as NetworkError, ht as NoydbBundleStore, bq as NoydbPodStore, c_ as NoydbStore, dB as PodVersionConflictError, jf as StoreCapabilities, jg as StoreCapabilityError, jh as StoreTime, jH as TxOp, jY as VaultSnapshot } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/to/index.js

@@ -5,7 +5,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/{transition-guard-BzsAQEd-.d.ts → transition-guard-BOUkzQU4.d.ts}

@@ -1,4 +1,4 @@
-import { bJ as GuardStrategy, bP as GuardStrategyHandle, bK as GuardChange, bL as GuardContext } from './index-BJ3L-XcV.js';
+import { bc as GuardStrategy, bi as GuardStrategyHandle, bd as GuardChange, be as GuardContext } from './index-DzhNI2vE.js';
 
 /**
  * Register a guard for a collection. Guards run on every `put()` /

package/dist/tx/index.d.ts

@@ -1,7 +1,6 @@
-import { jk as TransactionInvariant, li as TxStrategy } from '../index-BJ3L-XcV.js';
-export { lj as AmendmentTxOptions, jm as TxCollection, e4 as TxContext, jo as TxVault, kT as runTransaction } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { jE as TransactionInvariant, lM as TxStrategy } from '../index-DzhNI2vE.js';
+export { lN as AmendmentTxOptions, jG as TxCollection, eb as TxContext, jI as TxVault, lk as runTransaction } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-FCOZ7DEC.js";
+} from "../chunk-JC5R7P44.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-KZ4B3PRT.js");
+      const { GuardExecutor } = await import("../executor-OUA2Y6YC.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/ui/index.d.ts

@@ -1 +1,4 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-C6iHNlqJ.js';
+export { et as CollectionDescription, f5 as CollectionMeta, fB as DescribeOptions, fC as DescribedField, g3 as FieldMeta, iX as SemanticType } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{validators-DGmYFP51.d.ts → validators-B3SalxlJ.d.ts}

@@ -1,4 +1,4 @@
-import { dO as ClassifiedEntry, dL as ClassifiedFieldSpec, dP as ClassifiedGroup } from './index-BJ3L-XcV.js';
+import { dV as ClassifiedEntry, dS as ClassifiedFieldSpec, dW as ClassifiedGroup } from './index-DzhNI2vE.js';
 
 /**
  * Configuration/write errors for classified fields. @module

package/dist/{vault-diff-DmBBatkx.d.ts → vault-diff-Dt9NkLzw.d.ts}

@@ -1,4 +1,4 @@
-import { V as Vault, cE as DiffEntry } from './index-BJ3L-XcV.js';
+import { V as Vault, c7 as DiffEntry } from './index-DzhNI2vE.js';
 
 /**
  * Vault-level diff orchestrator.

package/dist/{verify-CAYGXYNO.js → verify-GH6CWVSW.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-5UOPIPZC.js";
+} from "./chunk-XQ7UYPVN.js";
 import {
   dualReadSealedSlot
-} from "./chunk-UWZ7O4NR.js";
+} from "./chunk-6MWUANRF.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -136,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-CAYGXYNO.js.map
+//# sourceMappingURL=verify-GH6CWVSW.js.map

package/dist/{walk-3SB25HF2.js → walk-76UCFXYV.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-TQ3REHVF.js";
 import {
   derivePersistedSchema
-} from "./chunk-55LSDABW.js";
+} from "./chunk-HBTT7YQX.js";
 import {
   loadPersistedSchema
-} from "./chunk-7F2P2NHX.js";
-import "./chunk-JIW3Q5JN.js";
-import "./chunk-HGQ6UNHE.js";
-import "./chunk-5UOPIPZC.js";
-import "./chunk-UWZ7O4NR.js";
-import "./chunk-HCK2DFEK.js";
-import "./chunk-VFQOE76I.js";
+} from "./chunk-KXKLKJW4.js";
+import "./chunk-XHD3L3JO.js";
+import "./chunk-Z5YFRMG5.js";
+import "./chunk-XQ7UYPVN.js";
+import "./chunk-6MWUANRF.js";
+import "./chunk-2KOSJTMU.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-5HZULLHE.js";
-import "./chunk-OJ64XMPJ.js";
+import "./chunk-AUR7MRHA.js";
+import "./chunk-UNJU345Q.js";
+import "./chunk-CU62BBRB.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-3SB25HF2.js.map
+//# sourceMappingURL=walk-76UCFXYV.js.map

package/dist/with/index.d.ts

@@ -1,8 +1,7 @@
 export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { cF as UnlockedKeyring, cG as ExportFormat } from '../index-BJ3L-XcV.js';
-export { cH as BusHandler, cI as GateDeleteEvent, cJ as GateEventMap, cK as GateHandler, cL as GatePoint, cM as GatePutEvent, cN as LifecycleEventMap, cO as LifecyclePoint, cP as ServiceBus, cQ as SubsystemBus } from '../index-BJ3L-XcV.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { c8 as UnlockedKeyring, c9 as ExportFormat } from '../index-DzhNI2vE.js';
+export { ca as BusHandler, cb as GateDeleteEvent, cc as GateEventMap, cd as GateHandler, ce as GatePoint, cf as GatePutEvent, cg as LifecycleEventMap, ch as LifecyclePoint, ci as ServiceBus, cj as SubsystemBus } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '@noy-db/attestation';
 
 /**

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-HBVEGUON.js";
-import "../chunk-GMZFHDSG.js";
-import "../chunk-3CHNKEFI.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-QTXQ6RNZ.js";
+import "../chunk-6CU3FN74.js";
+import "../chunk-E5AHO65E.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/{with-materialized-view-DPEVoGoB.d.ts → with-materialized-view-BP33v1Z6.d.ts}

@@ -1,4 +1,4 @@
-import { cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle } from './index-BJ3L-XcV.js';
+import { bK as MaterializedViewStrategy, bL as MaterializedViewStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a materialized view: a declared query whose result is

package/dist/{with-overlayed-view-DGpKFSv1.d.ts → with-overlayed-view-DntFpOKN.d.ts}

@@ -1,4 +1,4 @@
-import { ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle } from './index-BJ3L-XcV.js';
+import { bM as OverlayedViewStrategy, bV as OverlayedViewStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a read-shadow overlay: bind an MV-owned base collection to

package/dist/{with-rollup-B2RwnTq0.d.ts → with-rollup-ClCHO6-4.d.ts}

@@ -1,4 +1,4 @@
-import { c2 as DerivationStrategy, cb as DerivationStrategyHandle } from './index-BJ3L-XcV.js';
+import { bx as DerivationStrategy, bG as DerivationStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a deterministic derivation: one source collection → one or

package/dist/withdraw-accessible-6J2UH3IN.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-GX2BYNCT.js";
+import "./chunk-OQAODTYR.js";
+import "./chunk-Q2KVKTC2.js";
+import "./chunk-KNXN47MO.js";
+import "./chunk-XHD3L3JO.js";
+import "./chunk-Z5YFRMG5.js";
+import "./chunk-XQ7UYPVN.js";
+import "./chunk-6MWUANRF.js";
+import "./chunk-2KOSJTMU.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AUR7MRHA.js";
+import "./chunk-UNJU345Q.js";
+import "./chunk-CU62BBRB.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-6J2UH3IN.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.3.0-pre.7",
+  "version": "0.3.0-pre.9",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -200,14 +200,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.3.0-pre.7"
+    "@noy-db/attestation": "0.3.0-pre.9"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.3.0-pre.7"
+    "@noy-db/on-shamir": "0.3.0-pre.9"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/api-Z66JMGOU.js

@@ -1,20 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-VFG5YXWM.js";
-import "./chunk-3CHNKEFI.js";
-import "./chunk-JIW3Q5JN.js";
-import "./chunk-HGQ6UNHE.js";
-import "./chunk-5UOPIPZC.js";
-import "./chunk-UWZ7O4NR.js";
-import "./chunk-HCK2DFEK.js";
-import "./chunk-VFQOE76I.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-5HZULLHE.js";
-import "./chunk-OJ64XMPJ.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-Z66JMGOU.js.map

package/dist/chunk-47C4CI7R.js

@@ -1,108 +0,0 @@
-import {
-  ClassifiedConfigError,
-  ClassifiedNotEnabledError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-shape/classified/descriptor.ts
-function isClassifiedFieldSpec(x) {
-  return typeof x === "object" && x !== null && x._noydbClassified === true;
-}
-function isClassifiedGroup(x) {
-  return typeof x === "object" && x !== null && x._noydbClassifiedGroup === true;
-}
-
-// src/with-shape/classified/errors.ts
-var ClassifiedNeverStoredError = class extends Error {
-  constructor(collection, field) {
-    super(`Field "${field}" in collection "${collection}" is classified storage:'never' (e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedNeverStoredError";
-  }
-  collection;
-  field;
-};
-var ClassifiedValidationError = class extends Error {
-  constructor(collection, field, detail) {
-    super(`Classified field "${field}" in collection "${collection}" failed validation: ${detail}`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedValidationError";
-  }
-  collection;
-  field;
-};
-
-// src/with-shape/classified/resolve.ts
-function resolveClassifiedFields(collection, config) {
-  const byField = {};
-  const claim = (field, spec) => {
-    if (byField[field] !== void 0) {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${field}" is claimed twice \u2014 storage forms are mutually exclusive per field (R5): a field is digest-only OR recoverable OR never, exactly one`
-      );
-    }
-    byField[field] = spec;
-  };
-  for (const [key, entry] of Object.entries(config)) {
-    if (isClassifiedGroup(entry)) {
-      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec);
-    } else {
-      claim(key, entry);
-    }
-  }
-  const riderComputed = {};
-  for (const [field, spec] of Object.entries(byField)) {
-    for (const [name, rider] of Object.entries(spec.riders ?? {})) {
-      const companion = `${field}_${name}`;
-      if (byField[companion] !== void 0 || riderComputed[companion] !== void 0) {
-        throw new ClassifiedConfigError(collection, `rider companion "${companion}" collides with a declared field`);
-      }
-      riderComputed[companion] = (record) => record[field] === void 0 ? void 0 : rider(record[field]);
-    }
-  }
-  return { byField, riderComputed };
-}
-
-// src/with-shape/classified/write.ts
-function enforceClassifiedWrite(record, byField, collection) {
-  for (const [field, spec] of Object.entries(byField)) {
-    const value = record[field];
-    if (value === void 0) continue;
-    if (value === null && spec.storage === "digest-only") continue;
-    if (spec.storage === "never") throw new ClassifiedNeverStoredError(collection, field);
-    const problem = spec.validate?.(value) ?? null;
-    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem);
-  }
-}
-
-// src/with-shape/classified/strategy.ts
-var NO_CLASSIFIED = {
-  async reveal() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verify() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verifyText() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async matchGroup() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async computeTarget() {
-    throw new ClassifiedNotEnabledError();
-  }
-};
-
-export {
-  isClassifiedFieldSpec,
-  isClassifiedGroup,
-  ClassifiedNeverStoredError,
-  ClassifiedValidationError,
-  resolveClassifiedFields,
-  enforceClassifiedWrite,
-  NO_CLASSIFIED
-};
-//# sourceMappingURL=chunk-47C4CI7R.js.map

package/dist/chunk-47C4CI7R.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/classified/descriptor.ts","../src/with-shape/classified/errors.ts","../src/with-shape/classified/resolve.ts","../src/with-shape/classified/write.ts","../src/with-shape/classified/strategy.ts"],"sourcesContent":["/**\n * Classified fields — behavioral sensitive-field descriptors (stage 1).\n * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md\n * Law: open on write, declarative on read — read-side behavior is this\n * closed vocabulary; there are no read-side callbacks.\n * @module\n */\n\nexport type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only'\n\nexport type ClassifiedList =\n  | { readonly kind: 'omit' }\n  | { readonly kind: 'mask'; readonly pattern: string }\n  | { readonly kind: 'rider'; readonly rider: string }\n\nexport type ClassifiedRider = (value: unknown) => unknown\n\nexport interface ClassifiedFieldSpec {\n  readonly _noydbClassified: true\n  readonly preset: string\n  readonly storage: ClassifiedStorage\n  readonly list: ClassifiedList\n  readonly sensitivity: 'pii' | 'secret'\n  /** Write-time safe projections; companion field name is `<field>_<rider>`. */\n  readonly riders?: Record<string, ClassifiedRider>\n  /** Write-time validator: error message, or null when valid. */\n  readonly validate?: (value: unknown) => string | null\n  /** Digest-only verify policy (stage 2). Mode both sides normalize under. */\n  readonly verifyNormalize?: 'password' | 'secret-answer'\n  /** Decorate ok:true verdicts with mustRotate after this many days (I1). */\n  readonly rotateDays?: number\n  /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */\n  readonly notLastN?: number\n  /** Member of the collection's matchGroup (secretAnswer preset). */\n  readonly verifyGroupMember?: true\n  /**\n   * Opt into a store-visible blind-index (`_bidx`) tag so equal values become\n   * queryable/joinable while staying digest-only. Digest-only knob (R7); gated\n   * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values\n   * produce equal tags — a partition leak a DEK holder can offline-dictionary\n   * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.\n   */\n  readonly equatable?: true\n}\n\nexport interface ClassifiedGroup {\n  readonly _noydbClassifiedGroup: true\n  readonly preset: string\n  /** member record-field name -> spec (differential per-member policy). */\n  readonly members: Record<string, ClassifiedFieldSpec>\n}\n\nexport type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup\n\nexport function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassified?: unknown })._noydbClassified === true\n}\n\nexport function isClassifiedGroup(x: unknown): x is ClassifiedGroup {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassifiedGroup?: unknown })._noydbClassifiedGroup === true\n}\n","/**\n * Configuration/write errors for classified fields. @module\n *\n * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`\n * (stage 2) so `kernel/enclave/classify/*` can throw them without importing\n * with-*. Re-exported here under the same names so existing import paths\n * keep working.\n */\nexport { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js'\n\nexport class ClassifiedNeverStoredError extends Error {\n  constructor(public readonly collection: string, public readonly field: string) {\n    super(`Field \"${field}\" in collection \"${collection}\" is classified storage:'never' `\n      + `(e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`)\n    this.name = 'ClassifiedNeverStoredError'\n  }\n}\n\nexport class ClassifiedValidationError extends Error {\n  constructor(public readonly collection: string, public readonly field: string, detail: string) {\n    super(`Classified field \"${field}\" in collection \"${collection}\" failed validation: ${detail}`)\n    this.name = 'ClassifiedValidationError'\n  }\n}\n","/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */\n\nimport { isClassifiedGroup, type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from './errors.js'\n\nexport type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js'\nexport { ClassifiedConfigError } from './errors.js'\n\nexport interface ResolvedClassified {\n  readonly byField: Record<string, ClassifiedFieldSpec>\n  readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>\n}\n\nexport function resolveClassifiedFields(\n  collection: string,\n  config: Record<string, ClassifiedEntry>,\n): ResolvedClassified {\n  const byField: Record<string, ClassifiedFieldSpec> = {}\n  const claim = (field: string, spec: ClassifiedFieldSpec): void => {\n    if (byField[field] !== undefined) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is claimed twice — storage forms are mutually exclusive per field (R5): ` +\n        `a field is digest-only OR recoverable OR never, exactly one`)\n    }\n    byField[field] = spec\n  }\n  for (const [key, entry] of Object.entries(config)) {\n    if (isClassifiedGroup(entry)) {\n      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec)\n    } else {\n      claim(key, entry)\n    }\n  }\n  const riderComputed: Record<string, (record: Record<string, unknown>) => unknown> = {}\n  for (const [field, spec] of Object.entries(byField)) {\n    for (const [name, rider] of Object.entries(spec.riders ?? {})) {\n      const companion = `${field}_${name}`\n      if (byField[companion] !== undefined || riderComputed[companion] !== undefined) {\n        throw new ClassifiedConfigError(collection, `rider companion \"${companion}\" collides with a declared field`)\n      }\n      riderComputed[companion] = (record) =>\n        record[field] === undefined ? undefined : rider(record[field])\n    }\n  }\n  return { byField, riderComputed }\n}\n","/** Write-path enforcement: storage:'never' rejection + preset validators.\n *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */\n\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNeverStoredError, ClassifiedValidationError } from './errors.js'\n\nexport function enforceClassifiedWrite(\n  record: Record<string, unknown>,\n  byField: Record<string, ClassifiedFieldSpec>,\n  collection: string,\n): void {\n  for (const [field, spec] of Object.entries(byField)) {\n    const value = record[field]\n    if (value === undefined) continue\n    if (value === null && spec.storage === 'digest-only') continue // explicit clear (C6 branch 3)\n    if (spec.storage === 'never') throw new ClassifiedNeverStoredError(collection, field)\n    const problem = spec.validate?.(value) ?? null\n    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem)\n  }\n}\n","/** The ② capability seam for classified read-egress ops (stage 1: reveal; stage 2: verify). @module */\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNotEnabledError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\nexport type { ClassifiedVerdict } from '../../kernel/types.js'\nimport type { ClassifiedVerdict } from '../../kernel/types.js'\n\nexport interface ClassifiedRevealCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  /** True on an encrypted collection — false selects the plaintext-body read. */\n  readonly encrypted: boolean\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedVerifyCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>       // raw envelope, NOT a decrypted view\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly now: () => number                                        // injected (Q7)\n  /** Group members resolved by the collection (matchGroup only). */\n  readonly groupMembers?: ReadonlyArray<{ readonly field: string; readonly spec: ClassifiedFieldSpec }>\n  readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedStrategy {\n  reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>\n  verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>,\n             opts: { readonly min: number }): Promise<{ readonly passed: boolean }>\n  computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>\n}\n\nexport const NO_CLASSIFIED: ClassifiedStrategy = {\n  async reveal() { throw new ClassifiedNotEnabledError() },\n  async verify() { throw new ClassifiedNotEnabledError() },\n  async verifyText() { throw new ClassifiedNotEnabledError() },\n  async matchGroup() { throw new ClassifiedNotEnabledError() },\n  async computeTarget() { throw new ClassifiedNotEnabledError() },\n}\n"],"mappings":";;;;;;AAsDO,SAAS,sBAAsB,GAAsC;AAC1E,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAAqC,qBAAqB;AAClE;AAEO,SAAS,kBAAkB,GAAkC;AAClE,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAA0C,0BAA0B;AAC5E;;;ACpDO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,OAAe;AAC7E,UAAM,UAAU,KAAK,oBAAoB,UAAU,0HAC2C;AAFpE;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAA4B,YAAoC,OAAe,QAAgB;AAC7F,UAAM,qBAAqB,KAAK,oBAAoB,UAAU,wBAAwB,MAAM,EAAE;AADpE;AAAoC;AAE9D,SAAK,OAAO;AAAA,EACd;AAAA,EAH4B;AAAA,EAAoC;AAIlE;;;ACVO,SAAS,wBACd,YACA,QACoB;AACpB,QAAM,UAA+C,CAAC;AACtD,QAAM,QAAQ,CAAC,OAAe,SAAoC;AAChE,QAAI,QAAQ,KAAK,MAAM,QAAW;AAChC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAC8C;AAAA,IACjE;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,kBAAkB,KAAK,GAAG;AAC5B,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9E,OAAO;AACL,YAAM,KAAK,KAAK;AAAA,IAClB;AAAA,EACF;AACA,QAAM,gBAA8E,CAAC;AACrF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;AAC7D,YAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,UAAI,QAAQ,SAAS,MAAM,UAAa,cAAc,SAAS,MAAM,QAAW;AAC9E,cAAM,IAAI,sBAAsB,YAAY,oBAAoB,SAAS,kCAAkC;AAAA,MAC7G;AACA,oBAAc,SAAS,IAAI,CAAC,WAC1B,OAAO,KAAK,MAAM,SAAY,SAAY,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACA,SAAO,EAAE,SAAS,cAAc;AAClC;;;ACvCO,SAAS,uBACd,QACA,SACA,YACM;AACN,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,UAAU,QAAQ,KAAK,YAAY,cAAe;AACtD,QAAI,KAAK,YAAY,QAAS,OAAM,IAAI,2BAA2B,YAAY,KAAK;AACpF,UAAM,UAAU,KAAK,WAAW,KAAK,KAAK;AAC1C,QAAI,YAAY,KAAM,OAAM,IAAI,0BAA0B,YAAY,OAAO,OAAO;AAAA,EACtF;AACF;;;ACsBO,IAAM,gBAAoC;AAAA,EAC/C,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,gBAAgB;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAChE;","names":[]}