@noy-db/hub 0.3.0-pre.8 → 0.3.0-pre.9

package/dist/{subject-index-O75wKshW.d.ts → subject-index-CyOgGMJL.d.ts}

@@ -314,6 +314,24 @@ interface ForgetResult {
     readonly sealedResidue: readonly string[];
     /** The single `op:'forget'` ledger entry appended for this erasure. */
     readonly ledgerEntry: LedgerEntry;
+    /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased
+     *  because their source subject was forgotten. Overlay outputs are intentionally out of
+     *  scope here — an overlay is always sourced from an MV, never directly from a subject
+     *  collection, so the personal-data-bearing MV rows it reads are already erased above. */
+    readonly derivedRecordsErased: number;
+    /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */
+    readonly derivedAggregatesRecomputed: number;
+    /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen
+     *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */
+    readonly derivedResidueFrozen: readonly string[];
+    /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */
+    readonly lookupReferencesCascaded: number;
+    /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */
+    readonly lookupReferencesNullified: number;
+    /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,
+     *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.
+     *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */
+    readonly lookupReferencesResidue: readonly string[];
 }
 
 /**

package/dist/sync/index.d.ts

@@ -1,6 +1,5 @@
-import { cz as SyncStrategy } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { bW as SyncStrategy } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-BM6E4MUT.js";
+} from "../chunk-RMUXPHIH.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-7TAV3BFQ.js";
-import "../chunk-PVC2FBCQ.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-REWTMYSF.js";
-import "../chunk-VFQOE76I.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.d.ts

@@ -1,7 +1,6 @@
-import { jn as TeamStrategy, c$ as NoydbStore, cN as UnlockedKeyring } from '../index-Dn5GzPg_.js';
-export { e9 as BundleRecipient, fH as EnrollAuthenticatorOptions, fI as EnrollAuthenticatorWrappingDEKsOptions, fJ as EnrollAuthenticatorWrappingKEKOptions, gH as ListUsersOptions, hc as NO_TEAM, hu as PaperRecoveryEntry, hG as PresenceHandle, i8 as RecoverPassphraseInput, i9 as RecoverPassphraseResult, ia as RecoverUserOptions, id as RecoveryProof, ir as RotatePassphraseInput, iY as SlotRewrapCeremony, iZ as SlotRewrapContext, j6 as SyncEngine, je as SyncTransaction, jm as TeamNotEnabledError, jA as UpdateAuthenticatorOptions, jR as WrappedDeksBlob, k0 as buildRecipientKeyringFile, k1 as burnPaperRecoveryEntry, lg as changeSecret, lh as createOwnerKeyring, k7 as deriveMagicLinkContentKey, kb as enrollAuthenticator, li as ensureCollectionDEK, kf as evaluateExportCapability, kh as evaluateImportCapability, kk as findAuthenticator, lj as grant, kl as hasExportCapability, km as hasImportCapability, kp as isMagicLinkGrantExpired, ky as listMagicLinkGrants, kz as listUsers, kA as listUsersWithEnvelopes, lk as loadKeyring, kD as loadPaperRecoveryEntries, kG as magicLinkGrantRecordId, kH as mintPaperRecoveryEntry, kJ as mintWrappedDeksBlob, ll as persistKeyring, kO as readMagicLinkGrantRecord, kv as recoverPassphrase, kQ as recoverUser, kU as removeAuthenticator, lm as revoke, k_ as revokeMagicLinkGrant, kw as rotatePassphrase, l0 as savePaperRecoveryEntries, l4 as unwrapDeksFromBlob, l5 as unwrapDeksFromPaperEntry, l7 as unwrapMagicLinkGrant, ln as updateAuthenticator, lo as updateKeyringIdentity, lf as writeMagicLinkGrant } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { jz as TeamStrategy, c_ as NoydbStore, c8 as UnlockedKeyring } from '../index-DzhNI2vE.js';
+export { e8 as BundleRecipient, fO as EnrollAuthenticatorOptions, fP as EnrollAuthenticatorWrappingDEKsOptions, fQ as EnrollAuthenticatorWrappingKEKOptions, gQ as ListUsersOptions, hm as NO_TEAM, hF as PaperRecoveryEntry, hR as PresenceHandle, ik as RecoverPassphraseInput, il as RecoverPassphraseResult, im as RecoverUserOptions, iq as RecoveryProof, iC as RotatePassphraseInput, j8 as SlotRewrapCeremony, j9 as SlotRewrapContext, ji as SyncEngine, jq as SyncTransaction, jy as TeamNotEnabledError, jN as UpdateAuthenticatorOptions, k6 as WrappedDeksBlob, kh as buildRecipientKeyringFile, ki as burnPaperRecoveryEntry, lC as changeSecret, lD as createOwnerKeyring, ko as deriveMagicLinkContentKey, kt as enrollAuthenticator, lE as ensureCollectionDEK, ky as evaluateExportCapability, kA as evaluateImportCapability, kD as findAuthenticator, lF as grant, kE as hasExportCapability, kF as hasImportCapability, kI as isMagicLinkGrantExpired, kS as listMagicLinkGrants, kT as listUsers, kU as listUsersWithEnvelopes, lG as loadKeyring, kX as loadPaperRecoveryEntries, k$ as magicLinkGrantRecordId, l0 as mintPaperRecoveryEntry, l2 as mintWrappedDeksBlob, lH as persistKeyring, l7 as readMagicLinkGrantRecord, kP as recoverPassphrase, l9 as recoverUser, ld as removeAuthenticator, lI as revoke, lj as revokeMagicLinkGrant, kQ as rotatePassphrase, ll as savePaperRecoveryEntries, lp as unwrapDeksFromBlob, lq as unwrapDeksFromPaperEntry, ls as unwrapMagicLinkGrant, lJ as updateAuthenticator, lK as updateKeyringIdentity, lB as writeMagicLinkGrant } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-F3EKFGUS.js";
+} from "../chunk-FC3XK5JT.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-NTPWQH4S.js";
+} from "../chunk-DEYAO3N6.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,14 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-FWART3VA.js";
+} from "../chunk-VJ3NQK4K.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-BM6E4MUT.js";
+} from "../chunk-RMUXPHIH.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-26FSVNBL.js";
+import "../chunk-MK2BSS44.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +57,19 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-TUL5YQWF.js";
-import "../chunk-FZK3JJJK.js";
-import "../chunk-7TAV3BFQ.js";
-import "../chunk-PVC2FBCQ.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-REWTMYSF.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-6CU3FN74.js";
+import "../chunk-E5AHO65E.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
 import {
   TeamNotEnabledError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.d.ts

@@ -1,5 +1,4 @@
-export { lv as NO_TIERS, lw as TiersContext, jr as TiersNotEnabledError, lx as TiersStrategy, ly as assertDeclaredTier, lz as assertTiersEnabled, lA as classifySealedShred, lB as demote, lC as elevate, lD as getAtTier, lE as listAtTier, lF as putAtTier, lG as withTiers } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+export { lR as NO_TIERS, lS as TiersContext, jD as TiersNotEnabledError, lT as TiersStrategy, lU as assertDeclaredTier, lV as assertTiersEnabled, lW as classifySealedShred, lX as demote, lY as elevate, lZ as getAtTier, l_ as listAtTier, l$ as putAtTier, m0 as withTiers } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/tiers/index.js

@@ -9,19 +9,19 @@ import {
   listAtTier,
   putAtTier,
   withTiers
-} from "../chunk-4VDFUBTS.js";
-import "../chunk-26FSVNBL.js";
-import "../chunk-7TAV3BFQ.js";
-import "../chunk-PVC2FBCQ.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-REWTMYSF.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-SSFC3IYA.js";
+import "../chunk-MK2BSS44.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
 import {
   TiersNotEnabledError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.d.ts

@@ -1,5 +1,4 @@
-export { dy as BundleVersionConflictError, f8 as ConflictError, d1 as EncryptedEnvelope, gG as ListPageResult, hd as NetworkError, hj as NoydbBundleStore, c3 as NoydbPodStore, c$ as NoydbStore, dC as PodVersionConflictError, j3 as StoreCapabilities, j4 as StoreCapabilityError, j5 as StoreTime, jv as TxOp, jK as VaultSnapshot } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+export { dx as BundleVersionConflictError, fc as ConflictError, d0 as EncryptedEnvelope, gP as ListPageResult, hn as NetworkError, ht as NoydbBundleStore, bq as NoydbPodStore, c_ as NoydbStore, dB as PodVersionConflictError, jf as StoreCapabilities, jg as StoreCapabilityError, jh as StoreTime, jH as TxOp, jY as VaultSnapshot } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';

package/dist/to/index.js

@@ -5,7 +5,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/{transition-guard-D5RLJv8S.d.ts → transition-guard-BOUkzQU4.d.ts}

@@ -1,4 +1,4 @@
-import { bR as GuardStrategy, bX as GuardStrategyHandle, bS as GuardChange, bT as GuardContext } from './index-Dn5GzPg_.js';
+import { bc as GuardStrategy, bi as GuardStrategyHandle, bd as GuardChange, be as GuardContext } from './index-DzhNI2vE.js';
 
 /**
  * Register a guard for a collection. Guards run on every `put()` /

package/dist/tx/index.d.ts

@@ -1,7 +1,6 @@
-import { js as TransactionInvariant, lq as TxStrategy } from '../index-Dn5GzPg_.js';
-export { lr as AmendmentTxOptions, ju as TxCollection, ec as TxContext, jw as TxVault, k$ as runTransaction } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { jE as TransactionInvariant, lM as TxStrategy } from '../index-DzhNI2vE.js';
+export { lN as AmendmentTxOptions, jG as TxCollection, eb as TxContext, jI as TxVault, lk as runTransaction } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '../index-B9QdHytu.js';
 import '@noy-db/attestation';
 

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-FCOZ7DEC.js";
+} from "../chunk-JC5R7P44.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-KZ4B3PRT.js");
+      const { GuardExecutor } = await import("../executor-OUA2Y6YC.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/ui/index.d.ts

@@ -1 +1,4 @@
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType } from '../describe-C6iHNlqJ.js';
+export { et as CollectionDescription, f5 as CollectionMeta, fB as DescribeOptions, fC as DescribedField, g3 as FieldMeta, iX as SemanticType } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
+import '../index-B9QdHytu.js';
+import '@noy-db/attestation';

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{validators-C3lrVF-c.d.ts → validators-B3SalxlJ.d.ts}

@@ -1,4 +1,4 @@
-import { dW as ClassifiedEntry, dT as ClassifiedFieldSpec, dX as ClassifiedGroup } from './index-Dn5GzPg_.js';
+import { dV as ClassifiedEntry, dS as ClassifiedFieldSpec, dW as ClassifiedGroup } from './index-DzhNI2vE.js';
 
 /**
  * Configuration/write errors for classified fields. @module

package/dist/{vault-diff-_LSIcOMv.d.ts → vault-diff-Dt9NkLzw.d.ts}

@@ -1,4 +1,4 @@
-import { V as Vault, cM as DiffEntry } from './index-Dn5GzPg_.js';
+import { V as Vault, c7 as DiffEntry } from './index-DzhNI2vE.js';
 
 /**
  * Vault-level diff orchestrator.

package/dist/{verify-CAYGXYNO.js → verify-GH6CWVSW.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-5UOPIPZC.js";
+} from "./chunk-XQ7UYPVN.js";
 import {
   dualReadSealedSlot
-} from "./chunk-UWZ7O4NR.js";
+} from "./chunk-6MWUANRF.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -136,4 +136,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-CAYGXYNO.js.map
+//# sourceMappingURL=verify-GH6CWVSW.js.map

package/dist/{walk-SMAE4IEI.js → walk-76UCFXYV.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-TQ3REHVF.js";
 import {
   derivePersistedSchema
-} from "./chunk-55LSDABW.js";
+} from "./chunk-HBTT7YQX.js";
 import {
   loadPersistedSchema
-} from "./chunk-J7OH6R4K.js";
-import "./chunk-7TAV3BFQ.js";
-import "./chunk-PVC2FBCQ.js";
-import "./chunk-5UOPIPZC.js";
-import "./chunk-UWZ7O4NR.js";
-import "./chunk-REWTMYSF.js";
-import "./chunk-VFQOE76I.js";
+} from "./chunk-KXKLKJW4.js";
+import "./chunk-XHD3L3JO.js";
+import "./chunk-Z5YFRMG5.js";
+import "./chunk-XQ7UYPVN.js";
+import "./chunk-6MWUANRF.js";
+import "./chunk-2KOSJTMU.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-5HZULLHE.js";
-import "./chunk-OJ64XMPJ.js";
+import "./chunk-AUR7MRHA.js";
+import "./chunk-UNJU345Q.js";
+import "./chunk-CU62BBRB.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-SMAE4IEI.js.map
+//# sourceMappingURL=walk-76UCFXYV.js.map

package/dist/with/index.d.ts

@@ -1,8 +1,7 @@
 export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { cN as UnlockedKeyring, cO as ExportFormat } from '../index-Dn5GzPg_.js';
-export { cP as BusHandler, cQ as GateDeleteEvent, cR as GateEventMap, cS as GateHandler, cT as GatePoint, cU as GatePutEvent, cV as LifecycleEventMap, cW as LifecyclePoint, cX as ServiceBus, cY as SubsystemBus } from '../index-Dn5GzPg_.js';
-import '../subject-index-O75wKshW.js';
-import '../describe-C6iHNlqJ.js';
+import { c8 as UnlockedKeyring, c9 as ExportFormat } from '../index-DzhNI2vE.js';
+export { ca as BusHandler, cb as GateDeleteEvent, cc as GateEventMap, cd as GateHandler, ce as GatePoint, cf as GatePutEvent, cg as LifecycleEventMap, ch as LifecyclePoint, ci as ServiceBus, cj as SubsystemBus } from '../index-DzhNI2vE.js';
+import '../subject-index-CyOgGMJL.js';
 import '@noy-db/attestation';
 
 /**

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-QABECTNN.js";
-import "../chunk-TUL5YQWF.js";
-import "../chunk-FZK3JJJK.js";
-import "../chunk-7TAV3BFQ.js";
-import "../chunk-PVC2FBCQ.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-REWTMYSF.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-QTXQ6RNZ.js";
+import "../chunk-6CU3FN74.js";
+import "../chunk-E5AHO65E.js";
+import "../chunk-XHD3L3JO.js";
+import "../chunk-Z5YFRMG5.js";
+import "../chunk-XQ7UYPVN.js";
+import "../chunk-6MWUANRF.js";
+import "../chunk-2KOSJTMU.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-AUR7MRHA.js";
+import "../chunk-UNJU345Q.js";
+import "../chunk-CU62BBRB.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/{with-materialized-view-Xv1-9Bh0.d.ts → with-materialized-view-BP33v1Z6.d.ts}

@@ -1,4 +1,4 @@
-import { cn as MaterializedViewStrategy, co as MaterializedViewStrategyHandle } from './index-Dn5GzPg_.js';
+import { bK as MaterializedViewStrategy, bL as MaterializedViewStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a materialized view: a declared query whose result is

package/dist/{with-overlayed-view-CuWhq_-C.d.ts → with-overlayed-view-DntFpOKN.d.ts}

@@ -1,4 +1,4 @@
-import { cp as OverlayedViewStrategy, cy as OverlayedViewStrategyHandle } from './index-Dn5GzPg_.js';
+import { bM as OverlayedViewStrategy, bV as OverlayedViewStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a read-shadow overlay: bind an MV-owned base collection to

package/dist/{with-rollup-K_iwal4b.d.ts → with-rollup-ClCHO6-4.d.ts}

@@ -1,4 +1,4 @@
-import { ca as DerivationStrategy, cj as DerivationStrategyHandle } from './index-Dn5GzPg_.js';
+import { bx as DerivationStrategy, bG as DerivationStrategyHandle } from './index-DzhNI2vE.js';
 
 /**
  * Register a deterministic derivation: one source collection → one or

package/dist/withdraw-accessible-6J2UH3IN.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-GX2BYNCT.js";
+import "./chunk-OQAODTYR.js";
+import "./chunk-Q2KVKTC2.js";
+import "./chunk-KNXN47MO.js";
+import "./chunk-XHD3L3JO.js";
+import "./chunk-Z5YFRMG5.js";
+import "./chunk-XQ7UYPVN.js";
+import "./chunk-6MWUANRF.js";
+import "./chunk-2KOSJTMU.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AUR7MRHA.js";
+import "./chunk-UNJU345Q.js";
+import "./chunk-CU62BBRB.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-6J2UH3IN.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.3.0-pre.8",
+  "version": "0.3.0-pre.9",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -200,14 +200,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.3.0-pre.8"
+    "@noy-db/attestation": "0.3.0-pre.9"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.3.0-pre.8"
+    "@noy-db/on-shamir": "0.3.0-pre.9"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/api-JDWL67WL.js

@@ -1,20 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-GDOOG5YQ.js";
-import "./chunk-FZK3JJJK.js";
-import "./chunk-7TAV3BFQ.js";
-import "./chunk-PVC2FBCQ.js";
-import "./chunk-5UOPIPZC.js";
-import "./chunk-UWZ7O4NR.js";
-import "./chunk-REWTMYSF.js";
-import "./chunk-VFQOE76I.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-5HZULLHE.js";
-import "./chunk-OJ64XMPJ.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-JDWL67WL.js.map

package/dist/chunk-44DV37ZV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `with-shape/classified/strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: 1,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: 1,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;AAuDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/chunk-47C4CI7R.js

@@ -1,108 +0,0 @@
-import {
-  ClassifiedConfigError,
-  ClassifiedNotEnabledError
-} from "./chunk-OJ64XMPJ.js";
-
-// src/with-shape/classified/descriptor.ts
-function isClassifiedFieldSpec(x) {
-  return typeof x === "object" && x !== null && x._noydbClassified === true;
-}
-function isClassifiedGroup(x) {
-  return typeof x === "object" && x !== null && x._noydbClassifiedGroup === true;
-}
-
-// src/with-shape/classified/errors.ts
-var ClassifiedNeverStoredError = class extends Error {
-  constructor(collection, field) {
-    super(`Field "${field}" in collection "${collection}" is classified storage:'never' (e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedNeverStoredError";
-  }
-  collection;
-  field;
-};
-var ClassifiedValidationError = class extends Error {
-  constructor(collection, field, detail) {
-    super(`Classified field "${field}" in collection "${collection}" failed validation: ${detail}`);
-    this.collection = collection;
-    this.field = field;
-    this.name = "ClassifiedValidationError";
-  }
-  collection;
-  field;
-};
-
-// src/with-shape/classified/resolve.ts
-function resolveClassifiedFields(collection, config) {
-  const byField = {};
-  const claim = (field, spec) => {
-    if (byField[field] !== void 0) {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${field}" is claimed twice \u2014 storage forms are mutually exclusive per field (R5): a field is digest-only OR recoverable OR never, exactly one`
-      );
-    }
-    byField[field] = spec;
-  };
-  for (const [key, entry] of Object.entries(config)) {
-    if (isClassifiedGroup(entry)) {
-      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec);
-    } else {
-      claim(key, entry);
-    }
-  }
-  const riderComputed = {};
-  for (const [field, spec] of Object.entries(byField)) {
-    for (const [name, rider] of Object.entries(spec.riders ?? {})) {
-      const companion = `${field}_${name}`;
-      if (byField[companion] !== void 0 || riderComputed[companion] !== void 0) {
-        throw new ClassifiedConfigError(collection, `rider companion "${companion}" collides with a declared field`);
-      }
-      riderComputed[companion] = (record) => record[field] === void 0 ? void 0 : rider(record[field]);
-    }
-  }
-  return { byField, riderComputed };
-}
-
-// src/with-shape/classified/write.ts
-function enforceClassifiedWrite(record, byField, collection) {
-  for (const [field, spec] of Object.entries(byField)) {
-    const value = record[field];
-    if (value === void 0) continue;
-    if (value === null && spec.storage === "digest-only") continue;
-    if (spec.storage === "never") throw new ClassifiedNeverStoredError(collection, field);
-    const problem = spec.validate?.(value) ?? null;
-    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem);
-  }
-}
-
-// src/with-shape/classified/strategy.ts
-var NO_CLASSIFIED = {
-  async reveal() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verify() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async verifyText() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async matchGroup() {
-    throw new ClassifiedNotEnabledError();
-  },
-  async computeTarget() {
-    throw new ClassifiedNotEnabledError();
-  }
-};
-
-export {
-  isClassifiedFieldSpec,
-  isClassifiedGroup,
-  ClassifiedNeverStoredError,
-  ClassifiedValidationError,
-  resolveClassifiedFields,
-  enforceClassifiedWrite,
-  NO_CLASSIFIED
-};
-//# sourceMappingURL=chunk-47C4CI7R.js.map