@noy-db/hub 0.6.0-pre.1 → 0.6.0-pre.3

package/dist/{chunk-MXZ5TSTR.js → chunk-AHCSWNVL.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-3CLZY46Y.js";
+} from "./chunk-7V2OGKES.js";
 import {
   deriveSchemaManifest
-} from "./chunk-HS7HNYBD.js";
+} from "./chunk-2DHSSLOD.js";
 import {
   loadFence
-} from "./chunk-MVOWXQHN.js";
+} from "./chunk-6BU3L4UE.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-EK7DT5BT.js";
+} from "./chunk-4VUPLMZ6.js";
 import {
   loadKeyring
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-RW3XKAF3.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -290,4 +290,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-MXZ5TSTR.js.map
+//# sourceMappingURL=chunk-AHCSWNVL.js.map

package/dist/{chunk-V5C5NNBR.js → chunk-CDB2HVQW.js}

@@ -1,12 +1,12 @@
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -46,4 +46,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-V5C5NNBR.js.map
+//# sourceMappingURL=chunk-CDB2HVQW.js.map

package/dist/{chunk-3HYWYLXL.js → chunk-CEJWMBXO.js}

@@ -177,4 +177,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-3HYWYLXL.js.map
+//# sourceMappingURL=chunk-CEJWMBXO.js.map

package/dist/chunk-CEJWMBXO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/with-materialized-view.ts"],"sourcesContent":["import { MaterializedViewConfigError, ValidationError } from '../../kernel/errors.js'\nimport type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js'\n\n/**\n * Register a materialized view: a declared query whose result is\n * persisted as a queryable collection and kept fresh as sources\n * change. Writes go through the standard `Collection.put` pipeline;\n * refresh-driven deletes route through `Collection._internalDelete` so\n * user `onDelete` guards on the output collection aren't tripped by\n * housekeeping.\n *\n * Three registration modes:\n *   - **single-source** — declare `query: (db) => Query<TRow>`; the\n *     dependency analyzer derives source collections from the plan.\n *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`\n *     plus optional `groupBy` + `aggregate`; the executor reads each\n *     arm, maps to the unified row shape, concatenates, then groups\n *     and aggregates.\n *   - **projection** (#810) — declare `projection: { source, joins,\n *     map }`; one output row per primary record, enriched with\n *     forward FK legs and reverse \"collect\" legs before `map` runs.\n *\n * The three modes are mutually exclusive — exactly one of `query` /\n * `unionSources` / `projection` must be set at registration time.\n *\n * See design-history/2026-05-20-dim14-mv-v2-design.md (single-source v2),\n * design-history/2026-05-21-dim14-mv-multikey-and-union.md (UNION),\n * and design-history/2026-07-25-join-projection-mv-design.md (projection).\n */\nexport function withMaterializedView<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n): MaterializedViewStrategy {\n  if (!spec.name || spec.name.length === 0) {\n    throw new ValidationError('withMaterializedView: name is required')\n  }\n  // Mutual exclusion: exactly one of the three forms must be declared.\n  const declaredForms = [spec.query, spec.unionSources, spec.projection]\n    .filter((f) => f !== undefined).length\n  if (declaredForms > 1) {\n    throw new MaterializedViewConfigError(\n      'query, unionSources, and projection are mutually exclusive — pick one',\n    )\n  }\n  if (declaredForms === 0) {\n    throw new MaterializedViewConfigError(\n      'strategy must declare exactly one of query, unionSources, or projection',\n    )\n  }\n  if (spec.query !== undefined && typeof spec.query !== 'function') {\n    throw new ValidationError('withMaterializedView: query must be a function returning a Query<T>')\n  }\n  // UNION-form invariants.\n  if (spec.unionSources) {\n    // A single arm is a deliberate shape: map→group→aggregate over\n    // ONE collection with a COMPUTED bucket key (e.g. month sliced from a\n    // date field) — something the query form's stored-field groupBy cannot\n    // express. The executor and dependency analyzer are arm-count-agnostic.\n    if (spec.unionSources.length < 1) {\n      throw new MaterializedViewConfigError(\n        'unionSources requires at least 1 source collection',\n      )\n    }\n    const seen = new Set<string>()\n    for (const s of spec.unionSources) {\n      if (typeof s?.collection !== 'string' || s.collection.length === 0) {\n        throw new MaterializedViewConfigError(\n          'each unionSources entry must declare a non-empty `collection` string',\n        )\n      }\n      if (typeof s.map !== 'function') {\n        throw new MaterializedViewConfigError(\n          `unionSources entry for \"${s.collection}\" is missing a \\`map\\` function`,\n        )\n      }\n      if (seen.has(s.collection)) {\n        throw new MaterializedViewConfigError(\n          `unionSources must reference distinct collections (duplicate: \"${s.collection}\")`,\n        )\n      }\n      seen.add(s.collection)\n    }\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": UNION strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`,\n      )\n    }\n    // `moneyFields` only has meaning when there's an aggregate to\n    // money-rewrite — it keys reducer outputs, so declaring it without\n    // `aggregate` is a no-op config mistake.\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    // Per-arm joins resolve right-side collections that the union\n    // dependency set (built from arm `collection`s alone) does NOT\n    // include. The consumer must list those right-side collections in\n    // `sources` so writes to them trigger MV refresh.\n    if (spec.unionSources.some(s => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": a unionSources arm declares join(s) but `\n        + `no \\`sources\\` are listed — declare sources: [...] with the right-side `\n        + `(join-target) collection names so writes to them trigger MV refresh`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on UNION strategies — `\n        + `UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Use the query() form, or open an issue if per-arm predicates are needed`,\n      )\n    }\n  }\n  // Projection-form invariants (#810). Shape checks only — the\n  // semantic ref() check on collect legs (the `on` field must carry a\n  // ref() targeting the projection source) runs at first\n  // materialization, parity with join-time ref errors.\n  if (spec.projection) {\n    const projection = spec.projection\n    if (typeof projection.source !== 'string' || projection.source.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.source must be a non-empty collection name`,\n      )\n    }\n    if (typeof projection.map !== 'function') {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection is missing a \\`map\\` function`,\n      )\n    }\n    if (!Array.isArray(projection.joins) || projection.joins.length < 1) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.joins must declare at least 1 leg — `\n        + `a leg-less single-source MV is the query() form's job`,\n      )\n    }\n    const seenAs = new Set<string>()\n    for (const leg of projection.joins) {\n      const l = leg as { field?: unknown; collect?: unknown; on?: unknown; as?: unknown }\n      const isForward = l.field !== undefined\n      const isCollect = l.collect !== undefined\n      if (isForward && isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a projection leg cannot declare both \\`field\\` `\n          + `(forward) and \\`collect\\` (reverse) — split it into two legs`,\n        )\n      }\n      if (!isForward && !isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare either \\`field\\` `\n          + `(forward FK) or \\`collect\\` (reverse one-to-many)`,\n        )\n      }\n      if (isForward && (typeof l.field !== 'string' || l.field.length === 0)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a forward projection leg must declare a non-empty \\`field\\``,\n        )\n      }\n      if (isCollect) {\n        if (typeof l.collect !== 'string' || l.collect.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": a collect projection leg must declare a non-empty \\`collect\\` collection name`,\n          )\n        }\n        if (typeof l.on !== 'string' || l.on.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": collect leg for \"${l.collect}\" must declare a non-empty \\`on\\` FK field`,\n          )\n        }\n      }\n      if (typeof l.as !== 'string' || l.as.length === 0) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare a non-empty \\`as\\` alias`,\n        )\n      }\n      if (seenAs.has(l.as)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": projection legs must attach under distinct \\`as\\` aliases (duplicate: \"${l.as}\")`,\n        )\n      }\n      seenAs.add(l.as)\n    }\n    // Post-map grouping invariants — same rules as UNION (the mapped\n    // stream feeds the same shared groupAndReduce tail).\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a row-per-primary-record MV`,\n      )\n    }\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on projection strategies — `\n        + `projection mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Filter inside projection.map (return null to omit) instead`,\n      )\n    }\n  }\n  // i18nLocale + i18nFields drive compute-time i18n resolution of group-key\n  // i18nText fields before bucketing — UNION mode (resolved on the unified rows)\n  // AND query mode (resolved in GroupedReduction.run before groupAndReduce).\n  // i18nLocale without i18nFields cannot resolve anything, so reject it early.\n  if (spec.i18nLocale !== undefined && spec.i18nFields === undefined) {\n    throw new MaterializedViewConfigError(\n      `withMaterializedView \"${spec.name}\": i18nLocale requires i18nFields — `\n      + `declare the i18nText descriptors of the group-key fields so they can be `\n      + `resolved at the mv layer before bucketing.`,\n    )\n  }\n  if (typeof spec.rowKey !== 'function') {\n    throw new ValidationError('withMaterializedView: rowKey is required (no default; see spec § Type surface)')\n  }\n  if (spec.refresh !== 'eager' && spec.refresh !== 'lazy' && spec.refresh !== 'manual') {\n    throw new ValidationError(\n      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got \"${String(spec.refresh)}\"`,\n    )\n  }\n  return {\n    __noydb_strategy: 'materialized-view',\n    spec,\n  }\n}\n"],"mappings":";;;;;;AA6BO,SAAS,qBACd,MAC0B;AAC1B,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AAEA,QAAM,gBAAgB,CAAC,KAAK,OAAO,KAAK,cAAc,KAAK,UAAU,EAClE,OAAO,CAAC,MAAM,MAAM,MAAS,EAAE;AAClC,MAAI,gBAAgB,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,UAAU,UAAa,OAAO,KAAK,UAAU,YAAY;AAChE,UAAM,IAAI,gBAAgB,qEAAqE;AAAA,EACjG;AAEA,MAAI,KAAK,cAAc;AAKrB,QAAI,KAAK,aAAa,SAAS,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,OAAO,GAAG,eAAe,YAAY,EAAE,WAAW,WAAW,GAAG;AAClE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,EAAE,UAAU;AAAA,QACzC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,EAAE,UAAU,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,iEAAiE,EAAE,UAAU;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,IAAI,EAAE,UAAU;AAAA,IACvB;AACA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AAIA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAKA,QAAI,KAAK,aAAa,KAAK,OAAK,EAAE,QAAQ,EAAE,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI;AAC5G,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,YAAY;AACnB,UAAM,aAAa,KAAK;AACxB,QAAI,OAAO,WAAW,WAAW,YAAY,WAAW,OAAO,WAAW,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAQ,YAAY;AACxC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,KAAK,WAAW,MAAM,SAAS,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,WAAW,OAAO;AAClC,YAAM,IAAI;AACV,YAAM,YAAY,EAAE,UAAU;AAC9B,YAAM,YAAY,EAAE,YAAY;AAChC,UAAI,aAAa,WAAW;AAC1B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,cAAc,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IAAI;AACtE,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,WAAW;AACb,YAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,WAAW,GAAG;AAC3D,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UACpC;AAAA,QACF;AACA,YAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI,uBAAuB,EAAE,OAAO;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,OAAO,IAAI,EAAE,EAAE,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI,6EAA6E,EAAE,EAAE;AAAA,QACrH;AAAA,MACF;AACA,aAAO,IAAI,EAAE,EAAE;AAAA,IACjB;AAGA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,IAAI;AAAA,IAGpC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,WAAW,YAAY;AACrC,UAAM,IAAI,gBAAgB,mFAAgF;AAAA,EAC5G;AACA,MAAI,KAAK,YAAY,WAAW,KAAK,YAAY,UAAU,KAAK,YAAY,UAAU;AACpF,UAAM,IAAI;AAAA,MACR,2EAA2E,OAAO,KAAK,OAAO,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-2KIV7BEK.js → chunk-FDX7OWWI.js}

@@ -33,4 +33,4 @@ function withOverlayedView(spec) {
 export {
   withOverlayedView
 };
-//# sourceMappingURL=chunk-2KIV7BEK.js.map
+//# sourceMappingURL=chunk-FDX7OWWI.js.map

package/dist/chunk-FDX7OWWI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/overlay-views/with-overlayed-view.ts"],"sourcesContent":["import { ValidationError } from '../../kernel/errors.js'\nimport type { OverlayedViewSpec, OverlayedViewStrategy } from './types.js'\n\n/**\n * Register a read-shadow overlay: bind an MV-owned base collection to\n * a user-writable overlay so consumers can express operator-editable\n * lifecycles as one declarative block.\n *\n * See design-history/2026-05-20-dim14-mv-v2-design.md.\n */\nexport function withOverlayedView(\n  spec: OverlayedViewSpec,\n): OverlayedViewStrategy {\n  if (!spec.name || spec.name.length === 0) {\n    throw new ValidationError('withOverlayedView: name is required')\n  }\n  if (!spec.base || spec.base.length === 0) {\n    throw new ValidationError('withOverlayedView: base is required')\n  }\n  if (!spec.overlay || spec.overlay.length === 0) {\n    throw new ValidationError('withOverlayedView: overlay is required')\n  }\n  if (spec.base === spec.overlay) {\n    throw new ValidationError('withOverlayedView: base and overlay must be different collections')\n  }\n  if (spec.base === spec.name || spec.overlay === spec.name) {\n    throw new ValidationError(\n      'withOverlayedView: virtual name must differ from both base and overlay collection names',\n    )\n  }\n  if (!spec.shadowField || spec.shadowField.length === 0) {\n    throw new ValidationError('withOverlayedView: shadowField is required')\n  }\n  return {\n    __noydb_strategy: 'overlayed-view',\n    spec,\n  }\n}\n"],"mappings":";;;;;AAUO,SAAS,kBACd,MACuB;AACvB,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,qCAAqC;AAAA,EACjE;AACA,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,qCAAqC;AAAA,EACjE;AACA,MAAI,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,GAAG;AAC9C,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AACA,MAAI,KAAK,SAAS,KAAK,SAAS;AAC9B,UAAM,IAAI,gBAAgB,mEAAmE;AAAA,EAC/F;AACA,MAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,YAAY,KAAK,MAAM;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,KAAK,eAAe,KAAK,YAAY,WAAW,GAAG;AACtD,UAAM,IAAI,gBAAgB,4CAA4C;AAAA,EACxE;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-4MQDV3HZ.js → chunk-FFDNKRCY.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-EK7DT5BT.js";
+} from "./chunk-4VUPLMZ6.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-4MQDV3HZ.js.map
+//# sourceMappingURL=chunk-FFDNKRCY.js.map

package/dist/{chunk-PP5CO2PR.js → chunk-FMQJZH4R.js}

@@ -201,7 +201,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-AG4SCHUQ.js");
+      const { revealSealedField } = await import("./reveal-BW36KCOQ.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -244,4 +244,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-PP5CO2PR.js.map
+//# sourceMappingURL=chunk-FMQJZH4R.js.map

package/dist/{chunk-JSRU5W2M.js → chunk-FZ6NYJ7L.js}

@@ -1,13 +1,13 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-4MQDV3HZ.js";
+} from "./chunk-FFDNKRCY.js";
 import {
   sha256Hex
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   ReadOnlyError
 } from "./chunk-HNGSV2YC.js";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-JSRU5W2M.js.map
+//# sourceMappingURL=chunk-FZ6NYJ7L.js.map

package/dist/{chunk-ZGGVOADG.js → chunk-G6S5VVHP.js}

@@ -5,7 +5,7 @@ import {
   buildStringFieldEntries,
   extractSnippet,
   searchScan
-} from "./chunk-XBLKM73C.js";
+} from "./chunk-3JVXVJ7L.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
@@ -394,4 +394,4 @@ export {
   rebuildEmbeddings,
   syncTierSearch
 };
-//# sourceMappingURL=chunk-ZGGVOADG.js.map
+//# sourceMappingURL=chunk-G6S5VVHP.js.map

package/dist/{chunk-OMSAULZM.js → chunk-HY6Y2P4Y.js}

@@ -1,29 +1,29 @@
 import {
   walkClosure
-} from "./chunk-BPTZ4K5L.js";
+} from "./chunk-4GZ6XOVW.js";
 import {
   resolveManagedSecret
-} from "./chunk-MC2LFTQM.js";
+} from "./chunk-XWX7GL56.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-EK7DT5BT.js";
+} from "./chunk-4VUPLMZ6.js";
 import {
   createOwnerKeyring
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-RW3XKAF3.js";
 import {
   diff
 } from "./chunk-SVLR4POP.js";
 import {
   LedgerStore
-} from "./chunk-ZK4CO2KZ.js";
+} from "./chunk-Q6TEJXBX.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   base64ToBuffer,
   wrapKey
@@ -193,7 +193,7 @@ function shortJSON(value) {
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-TWXPHVU7.js");
+      const { extractPartitionCore } = await import("./extract-partition-IO7FDZ2P.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -399,7 +399,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-6W2XGQCS.js");
+    const { createNoydb } = await import("./noydb-QGPKEDXK.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -455,4 +455,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-OMSAULZM.js.map
+//# sourceMappingURL=chunk-HY6Y2P4Y.js.map

package/dist/{chunk-46V67XP5.js → chunk-IQRP74OO.js}

@@ -8,7 +8,7 @@ import {
   rotateKeys,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-RW3XKAF3.js";
 import {
   NoAccessError,
   NoydbError,
@@ -114,4 +114,4 @@ export {
   MemoryDeviceSealProvider,
   withTeam
 };
-//# sourceMappingURL=chunk-46V67XP5.js.map
+//# sourceMappingURL=chunk-IQRP74OO.js.map

package/dist/chunk-IQRP74OO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/echo-ceremony.ts","../src/with-party/team/device-seal.ts","../src/with-party/team/active.ts"],"sourcesContent":["/**\n * `beginEchoUnlock` — the interactive ceremony API (spec\n * design-history/2026-08-02-echo-secret-design.md, #940, Task 6).\n *\n * Split out of `echo-secret.ts` (which owns only the block builders +\n * verifiers) because this module orchestrates BOTH `echo-secret.ts`\n * (`verifyPrompt`/`resolveEchoReveal`/`verifyTypedEcho`) AND `keyring.ts`\n * (`loadKeyring`) — and `keyring.ts` itself imports `buildEchoBlock` from\n * `echo-secret.ts`. Keeping the ceremony here instead of inside\n * `echo-secret.ts` yields a clean DAG (`echo-ceremony.ts` → {`echo-secret.ts`,\n * `keyring.ts`}; `keyring.ts` → `echo-secret.ts`) instead of a two-file\n * cycle, and restores `echo-secret.ts`'s documented charter (builders +\n * verifiers only).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DeviceSealProvider } from './device-seal.js'\nimport { WrongPromptError, WrongEchoError, ValidationError, NoAccessError } from '../../kernel/errors.js'\nimport { verifyPrompt, resolveEchoReveal, verifyTypedEcho } from './echo-secret.js'\nimport { loadKeyring, readKeyringFile, assertKeyringNotExpired, type UnlockedKeyring } from './keyring.js'\n\n/** Options for {@link beginEchoUnlock}. */\nexport interface BeginEchoUnlockOptions {\n  readonly userId: string\n  readonly prompt: string\n  readonly deviceSeal?: DeviceSealProvider\n}\n\n/**\n * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —\n * `complete()` may be called more than once (e.g. retry after a wrong key).\n */\nexport interface EchoCeremony {\n  /**\n   * Echo to display for owner recognition; null ⇒ degraded: ask the owner to\n   * TYPE it.\n   *\n   * Conforming-player contract (spec\n   * design-history/2026-08-02-echo-secret-design.md, \"Ceremony\"):\n   * when the owner does NOT recognize the revealed echo, the player MUST show\n   * a hard phishing warning — do not continue, open the official app, rotate\n   * the secret immediately — MUST NOT offer any skip or\n   * \"verification unavailable\" fallback, and MUST simply abandon the ceremony\n   * by never calling {@link EchoCeremony.complete}. The kernel cannot enforce\n   * this terminal state; it is the player's obligation.\n   */\n  readonly reveal: string | null\n  readonly maskHint: string | undefined\n  /** Complete the ceremony. `echo` is REQUIRED when `reveal` is null. */\n  complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring>\n}\n\n/**\n * Begin the interactive anti-phishing unlock ceremony (spec decision 4):\n * prompt → echo reveal → key. Fetches and parses the `_keyring/{userId}`\n * row (same store path as `loadKeyring`), verifies the prompt, and resolves\n * the echo for display (or degrades to the typed-echo path when the reveal\n * cannot be resolved — sealed reveal under a foreign device).\n *\n * Conforming-player contract (spec\n * design-history/2026-08-02-echo-secret-design.md): an owner who does\n * not recognize `ceremony.reveal` is looking at a phish. The player MUST then\n * show a hard warning (stop, open the official app, rotate the secret now),\n * MUST NOT offer a skip / \"verification unavailable\" fallback or any\n * single-field secret entry, and MUST abandon the ceremony without calling\n * `complete()`.\n *\n * @throws NoAccessError when no keyring exists for `userId` (mirrors\n * `loadKeyring`'s missing-row error).\n * @throws KeyringExpiredError when the slot is past its `expires_at` —\n * checked before the prompt is verified, so an expired slot never reveals.\n * @throws ValidationError when the keyring is not an echo keyring.\n * @throws WrongPromptError when the prompt fails its verifier.\n */\nexport async function beginEchoUnlock(\n  store: NoydbStore,\n  vault: string,\n  opts: BeginEchoUnlockOptions,\n): Promise<EchoCeremony> {\n  const { userId, prompt, deviceSeal } = opts\n\n  // Same store path + missing-row error as loadKeyring, now shared via\n  // `readKeyringFile` (#951).\n  const found = await readKeyringFile(store, vault, userId)\n  if (!found) {\n    throw new NoAccessError(`No keyring found for user \"${userId}\" in vault \"${vault}\"`)\n  }\n  const { file: keyringFile } = found\n\n  // Same expiry gate as loadKeyring, applied BEFORE the prompt is verified so\n  // an expired slot never reveals its echo (and leaks no timing on the\n  // prompt). Now shared via `assertKeyringNotExpired` (#951).\n  assertKeyringNotExpired(keyringFile)\n\n  const block = keyringFile.echo\n  if (block === undefined) {\n    throw new ValidationError('not an echo keyring')\n  }\n\n  if (!(await verifyPrompt(block, prompt))) {\n    throw new WrongPromptError()\n  }\n\n  const reveal = await resolveEchoReveal(block, prompt, deviceSeal)\n\n  return {\n    reveal,\n    maskHint: block.mask_hint,\n    async complete(input: { readonly echo?: string; readonly key: string }): Promise<UnlockedKeyring> {\n      let echo: string\n      if (reveal !== null) {\n        // A supplied input.echo must agree with the revealed echo — defensive:\n        // a player that collects a typed echo despite a reveal must not\n        // silently unlock with a mismatched pair.\n        if (input.echo !== undefined && input.echo !== reveal) {\n          throw new WrongEchoError()\n        }\n        echo = reveal\n      } else {\n        if (input.echo === undefined) {\n          throw new ValidationError('beginEchoUnlock: echo is required to complete a degraded (typed-echo) ceremony.')\n        }\n        if (!(await verifyTypedEcho(block, input.echo))) {\n          throw new WrongEchoError()\n        }\n        echo = input.echo\n      }\n      return loadKeyring(store, vault, { userId, secret: { prompt, echo, key: input.key } })\n    },\n  }\n}\n","import { NoydbError } from '../../kernel/errors.js'\nimport type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js'\n\n/**\n * Device-local sealer for the echo reveal-blob (spec decision 5).\n * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals\n * the WHOLE secret): this seals only the echo part, and only so an\n * enrolled device can display it during the unlock ceremony. The\n * sealed bytes may sit in the (untrusted) keyring file — attacker-B\n * resistance comes from `unseal` requiring this device's key store.\n *\n * The interface itself is declared on the `/with` port\n * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)\n * so the kernel spine can reference it without a static spine→service\n * import; re-exported here as the canonical consumer-facing home.\n */\nexport type { DeviceSealProvider }\n\n/** In-memory test provider — AES-GCM under a per-instance random key. */\nexport class MemoryDeviceSealProvider implements DeviceSealProvider {\n  readonly id: string\n  private readonly keyPromise: Promise<CryptoKey>\n  constructor(opts: { id: string }) {\n    this.id = opts.id\n    this.keyPromise = globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n      'encrypt',\n      'decrypt',\n    ])\n  }\n  async seal(plain: Uint8Array): Promise<Uint8Array> {\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12))\n    const ct = new Uint8Array(\n      await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await this.keyPromise, plain as BufferSource),\n    )\n    const out = new Uint8Array(12 + ct.length)\n    out.set(iv, 0)\n    out.set(ct, 12)\n    return out\n  }\n  async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n    try {\n      return new Uint8Array(\n        await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: sealed.slice(0, 12) },\n          await this.keyPromise,\n          sealed.slice(12) as BufferSource,\n        ),\n      )\n    } catch {\n      throw new NoydbError('DEVICE_SEAL_UNSEAL_FAILED', 'Device seal: unseal failed (tamper or wrong device).')\n    }\n  }\n}\n","/**\n * Enable the multi-user team capability (#267 Track A tail).\n *\n * Pass to `createNoydb({ teamStrategy: withTeam() })` to make `db.grant` /\n * `db.revoke` / `db.rotate` live. The keyring grant/revoke/rotate engines\n * are statically imported HERE — this module is reachable only through the\n * `@noy-db/hub/team` subpath (and the root barrel's tree-shakeable\n * re-export), so a single-user floor bundle never carries them. The facade\n * (`TeamFacade.runGrant` / `runRevoke` / `runRotate`) owns the policy-gate +\n * keyring plumbing and receives the engine as an argument.\n */\nimport type { TeamStrategy } from './strategy.js'\nimport { grant as grantEngine, revoke as revokeEngine, rotateKeys as rotateEngine } from './keyring.js'\n\nexport function withTeam(): TeamStrategy {\n  return {\n    async grant(team, vault, options, factors) {\n      return team.runGrant(grantEngine, vault, options, factors)\n    },\n    async revoke(team, vault, options, factors) {\n      return team.runRevoke(revokeEngine, vault, options, factors)\n    },\n    async rotate(team, vault, collections) {\n      return team.runRotate(rotateEngine, vault, collections)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,eAAsB,gBACpB,OACA,OACA,MACuB;AACvB,QAAM,EAAE,QAAQ,QAAQ,WAAW,IAAI;AAIvC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,OAAO,MAAM;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,8BAA8B,MAAM,eAAe,KAAK,GAAG;AAAA,EACrF;AACA,QAAM,EAAE,MAAM,YAAY,IAAI;AAK9B,0BAAwB,WAAW;AAEnC,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,gBAAgB,qBAAqB;AAAA,EACjD;AAEA,MAAI,CAAE,MAAM,aAAa,OAAO,MAAM,GAAI;AACxC,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,MAAM,SAAS,OAAmF;AAChG,UAAI;AACJ,UAAI,WAAW,MAAM;AAInB,YAAI,MAAM,SAAS,UAAa,MAAM,SAAS,QAAQ;AACrD,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,OAAO;AACL,YAAI,MAAM,SAAS,QAAW;AAC5B,gBAAM,IAAI,gBAAgB,iFAAiF;AAAA,QAC7G;AACA,YAAI,CAAE,MAAM,gBAAgB,OAAO,MAAM,IAAI,GAAI;AAC/C,gBAAM,IAAI,eAAe;AAAA,QAC3B;AACA,eAAO,MAAM;AAAA,MACf;AACA,aAAO,YAAY,OAAO,OAAO,EAAE,QAAQ,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACF;;;ACjHO,IAAM,2BAAN,MAA6D;AAAA,EACzD;AAAA,EACQ;AAAA,EACjB,YAAY,MAAsB;AAChC,SAAK,KAAK,KAAK;AACf,SAAK,aAAa,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,MAC9F;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,KAAK,OAAwC;AACjD,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,WAAW,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,YAAY,KAAqB;AAAA,IAC9G;AACA,UAAM,MAAM,IAAI,WAAW,KAAK,GAAG,MAAM;AACzC,QAAI,IAAI,IAAI,CAAC;AACb,QAAI,IAAI,IAAI,EAAE;AACd,WAAO;AAAA,EACT;AAAA,EACA,MAAM,OAAO,QAAyC;AACpD,QAAI;AACF,aAAO,IAAI;AAAA,QACT,MAAM,WAAW,OAAO,OAAO;AAAA,UAC7B,EAAE,MAAM,WAAW,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,UAC3C,MAAM,KAAK;AAAA,UACX,OAAO,MAAM,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,WAAW,6BAA6B,sDAAsD;AAAA,IAC1G;AAAA,EACF;AACF;;;ACtCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL,MAAM,MAAM,MAAM,OAAO,SAAS,SAAS;AACzC,aAAO,KAAK,SAAS,OAAa,OAAO,SAAS,OAAO;AAAA,IAC3D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,SAAS,SAAS;AAC1C,aAAO,KAAK,UAAU,QAAc,OAAO,SAAS,OAAO;AAAA,IAC7D;AAAA,IACA,MAAM,OAAO,MAAM,OAAO,aAAa;AACrC,aAAO,KAAK,UAAU,YAAc,OAAO,WAAW;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-TFZ7LLOQ.js → chunk-J7FM3RAU.js}

@@ -10,11 +10,11 @@ import {
 } from "./chunk-JXIDGFKS.js";
 import {
   envelopeBodySize
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-NQRJ5AJO.js";
+} from "./chunk-7H73RIE3.js";
 import {
   decrypt,
   derivePresenceKey,
@@ -22,7 +22,7 @@ import {
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   ValidationError,
   isConflictError
@@ -1160,4 +1160,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-TFZ7LLOQ.js.map
+//# sourceMappingURL=chunk-J7FM3RAU.js.map

package/dist/{chunk-ZWMO5GL5.js → chunk-JJNOLSG5.js}

@@ -1,12 +1,12 @@
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   ConflictError
 } from "./chunk-HNGSV2YC.js";
@@ -56,4 +56,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-ZWMO5GL5.js.map
+//# sourceMappingURL=chunk-JJNOLSG5.js.map

package/dist/{chunk-KZ3KMDN3.js → chunk-LWSJG3LI.js}

@@ -120,4 +120,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-KZ3KMDN3.js.map
+//# sourceMappingURL=chunk-LWSJG3LI.js.map

package/dist/chunk-LWSJG3LI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/guards/with-guard.ts","../src/with-audit/guards/immutable-guard.ts","../src/with-audit/guards/transition-guard.ts"],"sourcesContent":["import { ValidationError } from '../../kernel/errors.js'\nimport type { GuardSpec, GuardStrategy } from './types.js'\n\n/**\n * Register a guard for a collection. Guards run on every `put()` /\n * `delete()` for the named collection (after permissions, before\n * encryption) and may:\n *\n *   - `check` — block writes by throwing (typically `RecordLockedError`)\n *   - `frozenFields` — freeze specific fields once a condition is true\n *   - `amendment` — declare an authorized-override path with invariant\n *\n * Pass the returned handle to `createNoydb({ strategies: [...] })`.\n *\n * @see design-history/2026-05-18-guards-design.md\n */\nexport function withGuard<T extends Record<string, unknown>>(\n  strategy: GuardSpec<T>,\n): GuardStrategy<T> {\n  if (!strategy.collection || strategy.collection.length === 0) {\n    throw new ValidationError('withGuard: collection name is required')\n  }\n  return {\n    __noydb_strategy: 'guard',\n    spec: strategy,\n  }\n}\n","/**\n * `immutableGuard` — declarative WORM / append-only sugar over the guard\n * service.\n *\n * Issued fiscal documents (invoices, DDTs) must be immutable after issue.\n * That is expressible today with a hand-rolled `withGuard` (block on\n * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is\n * repetitive and easy to get subtly wrong. `immutableGuard` generates\n * exactly that guard from a declarative config, reusing the guard\n * machinery wholesale — `check`/`onDelete` rejection, the ledgered\n * `amendment` override, and composition with `periods`/`history`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   immutableGuard({\n *     collection: 'invoices',\n *     after: (r) => r.status === 'issued',   // immutable once issued\n *   }),\n * ] })\n * ```\n *\n * A record is mutable until `after(record)` holds; from then on, updates\n * and deletes throw `RecordLockedError` unless performed inside an\n * `amendment` transaction by an authorized role (the override is\n * ledgered by the guard amendment mechanism). `appendOnly: true` is\n * shorthand for `after: () => true` — immutable from creation.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { RecordLockedError, ValidationError } from '../../kernel/errors.js'\n\nexport interface ImmutableGuardConfig<T extends Record<string, unknown>> {\n  /** The collection to make WORM. */\n  collection: string\n  /**\n   * A record becomes immutable once this predicate holds. Evaluated on\n   * the *existing* (already-persisted) record, so the write that first\n   * makes it true is still allowed; subsequent writes are blocked.\n   * Mutually exclusive with `appendOnly`.\n   */\n  after?: (record: T) => boolean\n  /** Shorthand for `after: () => true` — immutable from creation. */\n  appendOnly?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly: it receives every {before, after} pair touching this\n   * collection in the amendment plus the guard context; throwing reverts\n   * the whole amendment and surfaces as `InvariantError`.\n   *\n   * Use this to keep a constraint inviolable EVEN under amendment — e.g.\n   * forbid deleting an issued document by re-throwing on any\n   * `before !== null && after === null` change, or assert a cross-record\n   * sum is preserved. When omitted the amendment is unconditionally\n   * allowed (the amendment itself is the sanctioned, ledgered override) —\n   * this is the backward-compatible default.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\n/**\n * Build an immutability guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function immutableGuard<T extends Record<string, unknown>>(\n  config: ImmutableGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, after, appendOnly, amendmentRoles, amendmentInvariant } = config\n  if (appendOnly && after !== undefined) {\n    throw new ValidationError('immutableGuard: `after` and `appendOnly` are mutually exclusive')\n  }\n  if (!appendOnly && after === undefined) {\n    throw new ValidationError('immutableGuard: provide `after` or `appendOnly: true`')\n  }\n\n  const isImmutable: (record: T) => boolean = appendOnly ? () => true : after!\n  const reason = appendOnly ? 'append-only collection' : 'record is immutable after issue'\n\n  const spec: GuardSpec<T> = {\n    collection,\n    // Block updates to an already-immutable record. Inserts (existing\n    // null) and the transition write that first makes the record\n    // immutable are allowed — `after` reads the prior state.\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      if (ctx.existing !== null && isImmutable(ctx.existing)) {\n        throw new RecordLockedError(collection, recordId(incoming as Record<string, unknown>), reason)\n      }\n    },\n    // Block deletes of an immutable record.\n    onDelete: (existing: T) => {\n      if (isImmutable(existing)) {\n        throw new RecordLockedError(collection, recordId(existing as Record<string, unknown>), reason)\n      }\n    },\n    // The authorized override: inside an amendment transaction the\n    // check/onDelete are skipped and the change is ledgered. By default\n    // there is no extra invariant — the amendment itself is the\n    // sanctioned exception. Callers may supply `amendmentInvariant` to\n    // keep a constraint inviolable even under amendment (e.g. forbid\n    // deletes, or preserve a cross-record sum); a throw reverts the\n    // amendment and surfaces as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n","/**\n * `transitionGuard` — declarative state-machine sugar over the guard\n * service.\n *\n * Any record with a lifecycle field (invoice `status`, order state,\n * ticket workflow, subscription phase) needs transition validation: a\n * write may only move the field along a declared arc. That is expressible\n * with a hand-rolled `withGuard({ check })`, but every consumer\n * re-implements the same graph lookup + error. `transitionGuard`\n * generates exactly that guard from a state graph, reusing the guard\n * machinery wholesale — `check` rejection, the ledgered `amendment`\n * override, and composition with `periods`/`history`.\n *\n * It generalizes {@link immutableGuard}: WORM is the special case \"every\n * state has no outgoing arcs\", i.e. `transitions` mapping each state to `[]`.\n *\n * ```ts\n * createNoydb({ guardStrategies: [\n *   transitionGuard<Sale>({\n *     collection: 'sales', field: 'status',\n *     transitions: {                          // absence of an arc = forbidden\n *       draft: ['to_verify', 'cancelled'],\n *       to_verify: ['proforma', 'draft', 'cancelled'],\n *       proforma: ['invoiced', 'cancelled'],\n *       invoiced: ['paid'], paid: [], cancelled: [],\n *     },\n *     initial: ['draft', 'to_verify'],        // allowed status on insert\n *   }),\n * ] })\n * ```\n *\n * Semantics:\n * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in\n *   `initial`. When `initial` is omitted, any value is allowed on insert.\n * - **Update**: the arc `(existing[field] → incoming[field])` must be\n *   listed in `transitions[from]`, else `IllegalTransitionError`. A\n *   same-value write (`from === to`) is allowed when `allowIdempotent`\n *   (default `true`) — so writes that touch other fields without moving\n *   state pass.\n * - **Override**: inside an `amendment` transaction by an authorized role\n *   the check is skipped and the change is ledgered (mirrors every guard).\n *\n * The status graph is caller-supplied data — no UI, no domain logic.\n */\n\nimport { withGuard } from './with-guard.js'\nimport type { GuardSpec, GuardStrategy, GuardContext, GuardChange } from './types.js'\nimport { IllegalTransitionError, ValidationError } from '../../kernel/errors.js'\n\nexport interface TransitionGuardConfig<T extends Record<string, unknown>> {\n  /** The collection whose state field is governed. */\n  collection: string\n  /** The state field on the record (e.g. `'status'`). */\n  field: keyof T & string\n  /**\n   * The transition graph: each state maps to the states it may move to.\n   * A state absent from the map (or mapped to `[]`) is terminal — no\n   * outgoing arc, so any non-idempotent write from it is rejected.\n   */\n  transitions: Readonly<Record<string, readonly string[]>>\n  /**\n   * States allowed as the initial value on insert (`existing === null`).\n   * Omit to allow any value on insert.\n   */\n  initial?: readonly string[]\n  /**\n   * Allow a same-value write (`from === to`) on update. Default `true` —\n   * lets a put that changes other fields, but not the state, through.\n   */\n  allowIdempotent?: boolean\n  /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */\n  amendmentRoles?: ReadonlyArray<'admin' | 'owner'>\n  /**\n   * Optional set-level invariant run over the amendment change-set after\n   * the writes execute. Signature matches `GuardSpec.amendment.invariant`\n   * exactly. When omitted the amendment is unconditionally allowed (the\n   * amendment itself is the sanctioned, ledgered override) — the\n   * backward-compatible default. Mirrors {@link immutableGuard}.\n   */\n  amendmentInvariant?: (\n    changes: ReadonlyArray<GuardChange<T>>,\n    ctx: GuardContext<T>,\n  ) => Promise<void> | void\n}\n\nfunction recordId(record: Record<string, unknown> | null): string {\n  const id = record?.id\n  return typeof id === 'string' ? id : ''\n}\n\nfunction stateOf(record: Record<string, unknown>, field: string): string {\n  const v = record[field]\n  return typeof v === 'string' ? v : String(v)\n}\n\n/**\n * Build a state-machine transition guard. Pass the returned handle to\n * `createNoydb({ guardStrategies: [...] })`.\n */\nexport function transitionGuard<T extends Record<string, unknown>>(\n  config: TransitionGuardConfig<T>,\n): GuardStrategy<T> {\n  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config\n  const allowIdempotent = config.allowIdempotent ?? true\n\n  if (!field) {\n    throw new ValidationError('transitionGuard: `field` is required')\n  }\n  if (transitions === undefined || typeof transitions !== 'object') {\n    throw new ValidationError('transitionGuard: `transitions` must be a state→states map')\n  }\n\n  const spec: GuardSpec<T> = {\n    collection,\n    check: (incoming: T, ctx: GuardContext<T>) => {\n      const rec = incoming as Record<string, unknown>\n      const to = stateOf(rec, field)\n\n      // Insert — gate on the allowed initial set (any value if unset).\n      if (ctx.existing === null) {\n        if (initial !== undefined && !initial.includes(to)) {\n          throw new IllegalTransitionError(collection, recordId(rec), '(none)', to)\n        }\n        return\n      }\n\n      // Update — the arc (from → to) must be a declared edge.\n      const from = stateOf(ctx.existing as Record<string, unknown>, field)\n      if (from === to) {\n        if (allowIdempotent) return\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n      const allowed = transitions[from] ?? []\n      if (!allowed.includes(to)) {\n        throw new IllegalTransitionError(collection, recordId(rec), from, to)\n      }\n    },\n    // The authorized override: inside an amendment transaction the check\n    // is skipped and the change is ledgered. By default no extra invariant\n    // — the amendment itself is the sanctioned exception. Callers may\n    // supply `amendmentInvariant` to keep a constraint inviolable even\n    // under amendment; a throw reverts the amendment as `InvariantError`.\n    amendment: {\n      roles: amendmentRoles ?? ['admin', 'owner'],\n      invariant: amendmentInvariant ?? (() => {\n        /* allow — the amendment is the override, and is ledgered */\n      }),\n    },\n  }\n\n  return withGuard<T>(spec)\n}\n"],"mappings":";;;;;;;AAgBO,SAAS,UACd,UACkB;AAClB,MAAI,CAAC,SAAS,cAAc,SAAS,WAAW,WAAW,GAAG;AAC5D,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,MAAM;AAAA,EACR;AACF;;;ACwCA,SAAS,SAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAMO,SAAS,eACd,QACkB;AAClB,QAAM,EAAE,YAAY,OAAO,YAAY,gBAAgB,mBAAmB,IAAI;AAC9E,MAAI,cAAc,UAAU,QAAW;AACrC,UAAM,IAAI,gBAAgB,iEAAiE;AAAA,EAC7F;AACA,MAAI,CAAC,cAAc,UAAU,QAAW;AACtC,UAAM,IAAI,gBAAgB,uDAAuD;AAAA,EACnF;AAEA,QAAM,cAAsC,aAAa,MAAM,OAAO;AACtE,QAAM,SAAS,aAAa,2BAA2B;AAEvD,QAAM,OAAqB;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,OAAO,CAAC,UAAa,QAAyB;AAC5C,UAAI,IAAI,aAAa,QAAQ,YAAY,IAAI,QAAQ,GAAG;AACtD,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA,IAEA,UAAU,CAAC,aAAgB;AACzB,UAAI,YAAY,QAAQ,GAAG;AACzB,cAAM,IAAI,kBAAkB,YAAY,SAAS,QAAmC,GAAG,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;;;ACpCA,SAASA,UAAS,QAAgD;AAChE,QAAM,KAAK,QAAQ;AACnB,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEA,SAAS,QAAQ,QAAiC,OAAuB;AACvE,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AAC7C;AAMO,SAAS,gBACd,QACkB;AAClB,QAAM,EAAE,YAAY,OAAO,aAAa,SAAS,gBAAgB,mBAAmB,IAAI;AACxF,QAAM,kBAAkB,OAAO,mBAAmB;AAElD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EAClE;AACA,MAAI,gBAAgB,UAAa,OAAO,gBAAgB,UAAU;AAChE,UAAM,IAAI,gBAAgB,gEAA2D;AAAA,EACvF;AAEA,QAAM,OAAqB;AAAA,IACzB;AAAA,IACA,OAAO,CAAC,UAAa,QAAyB;AAC5C,YAAM,MAAM;AACZ,YAAM,KAAK,QAAQ,KAAK,KAAK;AAG7B,UAAI,IAAI,aAAa,MAAM;AACzB,YAAI,YAAY,UAAa,CAAC,QAAQ,SAAS,EAAE,GAAG;AAClD,gBAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,UAAU,EAAE;AAAA,QAC1E;AACA;AAAA,MACF;AAGA,YAAM,OAAO,QAAQ,IAAI,UAAqC,KAAK;AACnE,UAAI,SAAS,IAAI;AACf,YAAI,gBAAiB;AACrB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AACA,YAAM,UAAU,YAAY,IAAI,KAAK,CAAC;AACtC,UAAI,CAAC,QAAQ,SAAS,EAAE,GAAG;AACzB,cAAM,IAAI,uBAAuB,YAAYA,UAAS,GAAG,GAAG,MAAM,EAAE;AAAA,MACtE;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,WAAW;AAAA,MACT,OAAO,kBAAkB,CAAC,SAAS,OAAO;AAAA,MAC1C,WAAW,uBAAuB,MAAM;AAAA,MAExC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAa,IAAI;AAC1B;","names":["recordId"]}

package/dist/{chunk-LTU4FLHG.js → chunk-MYG6WIRJ.js}

@@ -4,10 +4,10 @@ import {
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-24UICKTB.js";
+} from "./chunk-6SAFL5YE.js";
 import {
   isDeleteMarker
-} from "./chunk-NQRJ5AJO.js";
+} from "./chunk-7H73RIE3.js";
 import {
   PeriodClosedError,
   ValidationError
@@ -61,7 +61,7 @@ function validatePeriodName(name, existing) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-DONWFC5M.js");
+  const { envelopePayloadHash } = await import("./ledger-AETNF4OM.js");
   await ledger.append({
     op: "put",
     collection,
@@ -128,4 +128,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-LTU4FLHG.js.map
+//# sourceMappingURL=chunk-MYG6WIRJ.js.map

package/dist/{chunk-SRGJET2F.js → chunk-NJDQ4YSV.js}

@@ -1,6 +1,6 @@
 import {
   ViaGraph
-} from "./chunk-T4GPR2IR.js";
+} from "./chunk-7TSYBD3E.js";
 import {
   sha256Hex
 } from "./chunk-VCETL77O.js";
@@ -172,4 +172,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-SRGJET2F.js.map
+//# sourceMappingURL=chunk-NJDQ4YSV.js.map

package/dist/{chunk-DPJTDNUF.js → chunk-O42AUQCP.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-NVU7ZMPN.js";
+} from "./chunk-3IXIU6FP.js";
 import {
   assertStrongEchoSecret,
   assertStrongSecret,
@@ -9,13 +9,13 @@ import {
   mintKeyringCanary,
   persistKeyring,
   readKeyringFile
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-RW3XKAF3.js";
 import {
   dekKey
 } from "./chunk-AHLJSVRL.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -30,7 +30,7 @@ import {
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   DelegationTargetMissingError,
   InvalidKeyError,
@@ -936,4 +936,4 @@ export {
   removeAuthenticator,
   findAuthenticator
 };
-//# sourceMappingURL=chunk-DPJTDNUF.js.map
+//# sourceMappingURL=chunk-O42AUQCP.js.map

package/dist/{chunk-F3GVO44K.js → chunk-PDLLCOGD.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-HNHCQ556.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   NoydbError
 } from "./chunk-HNGSV2YC.js";
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-F3GVO44K.js.map
+//# sourceMappingURL=chunk-PDLLCOGD.js.map

package/dist/{chunk-VBY6ZLJT.js → chunk-PL2GHSCM.js}

@@ -9,7 +9,7 @@ import {
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -24,7 +24,7 @@ import {
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -3070,4 +3070,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-VBY6ZLJT.js.map
+//# sourceMappingURL=chunk-PL2GHSCM.js.map

package/dist/{chunk-DCMQR46R.js → chunk-PNKHAKQ7.js}

@@ -1,7 +1,7 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-ZWMO5GL5.js";
+} from "./chunk-JJNOLSG5.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -10,7 +10,7 @@ import {
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   AttestationError
 } from "./chunk-HNGSV2YC.js";
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-DCMQR46R.js.map
+//# sourceMappingURL=chunk-PNKHAKQ7.js.map

package/dist/{chunk-3IIPWA75.js → chunk-Q2VEFHDQ.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-CCZJJ4I2.js";
 import {
   putDerivedOutput
-} from "./chunk-ZXJXDHNK.js";
+} from "./chunk-5ZKS6ZE2.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
 } from "./chunk-E6427JU2.js";
@@ -282,4 +282,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-3IIPWA75.js.map
+//# sourceMappingURL=chunk-Q2VEFHDQ.js.map

package/dist/{chunk-ZK4CO2KZ.js → chunk-Q6TEJXBX.js}

@@ -7,16 +7,16 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-24UICKTB.js";
+} from "./chunk-6SAFL5YE.js";
 import {
   openEnvelopeJson
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   LedgerContentionError,
   isConflictError
@@ -717,4 +717,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-ZK4CO2KZ.js.map
+//# sourceMappingURL=chunk-Q6TEJXBX.js.map

package/dist/{chunk-GS5RT2KK.js → chunk-QULVCV3M.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-UHXCLPGC.js";
 import {
   SealedHandle
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
@@ -262,4 +262,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-GS5RT2KK.js.map
+//# sourceMappingURL=chunk-QULVCV3M.js.map