@noy-db/hub 0.6.0-pre.15 → 0.6.0-pre.16

package/dist/chunk-RRMXMJUP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/active.ts","../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts"],"sourcesContent":["/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n","/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { ConflictError} from '../../kernel/errors.js';\nimport { isConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(name: string, state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name }, { version, iv: '', data: json, by: this.actor })\n    }\n    const { iv, data } = await encrypt(json, await this.dek())\n    return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name }, { version, iv, data, by: this.actor })\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;;;ACWO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACCO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AAClF,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,MAAc,OAAsB,SAA6C;AAC1G,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,oBAAoB,EAAE,YAAY,qBAAqB,IAAI,KAAK,GAAG,EAAE,SAAS,IAAI,IAAI,MAAM,MAAM,IAAI,KAAK,MAAM,CAAC;AAAA,IAC3H;AACA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,CAAC;AACzD,WAAO,oBAAoB,EAAE,YAAY,qBAAqB,IAAI,KAAK,GAAG,EAAE,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,CAAC;AAAA,EACjH;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AACxF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAChF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;","names":[]}

package/dist/{chunk-FBG62BUQ.js → chunk-T6CCRXD3.js}

@@ -5,14 +5,12 @@ import {
   isRewrappedUnder,
   openEnvelopeJson,
   rewrapEnvelope
-} from "./chunk-PWJSO7HH.js";
+} from "./chunk-LTVETWDH.js";
 import {
+  buildRecordEnvelope,
   isTombstone,
   isTombstoneShape
-} from "./chunk-P3AFV6EA.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-6E2JZRBD.js";
 import {
   ReadOnlyAtInstantError
 } from "./chunk-I64WQSN3.js";
@@ -100,14 +98,10 @@ async function tombstoneHistory(adapter, vault, collection, recordId, actor, enc
     const env = await adapter.get(vault, HISTORY_COLLECTION, id);
     if (!env) continue;
     if (isTombstone(env, encrypted)) continue;
-    const tombstone = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: env._v,
-      _ts: now,
-      _iv: "",
-      _data: "",
-      ...actor ? { _by: actor } : {}
-    };
+    const tombstone = buildRecordEnvelope(
+      { collection: HISTORY_COLLECTION, id },
+      { version: env._v, ts: now, iv: "", data: "", ...actor ? { by: actor } : {} }
+    );
     await adapter.put(vault, HISTORY_COLLECTION, id, tombstone);
     count++;
   }
@@ -330,4 +324,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-FBG62BUQ.js.map
+//# sourceMappingURL=chunk-T6CCRXD3.js.map

package/dist/chunk-T6CCRXD3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/history.ts","../src/with-commit/history/time-machine.ts"],"sourcesContent":["import { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js'\nimport { isTombstone, isTombstoneShape, rewrapEnvelope, isRewrappedUnder, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * History storage convention:\n * Collection: `_history`\n * ID format: `{collection}:{recordId}:{paddedVersion}`\n * Version is zero-padded to 10 digits for lexicographic sorting.\n */\n\nconst HISTORY_COLLECTION = '_history'\nconst VERSION_PAD = 10\n\nfunction historyId(collection: string, recordId: string, version: number): string {\n  return `${collection}:${recordId}:${String(version).padStart(VERSION_PAD, '0')}`\n}\n\n// Unused today, kept for future history-id parsing utilities.\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nfunction parseHistoryId(id: string): { collection: string; recordId: string; version: number } | null {\n  const lastColon = id.lastIndexOf(':')\n  if (lastColon < 0) return null\n  const versionStr = id.slice(lastColon + 1)\n  const rest = id.slice(0, lastColon)\n  const firstColon = rest.indexOf(':')\n  if (firstColon < 0) return null\n  return {\n    collection: rest.slice(0, firstColon),\n    recordId: rest.slice(firstColon + 1),\n    version: parseInt(versionStr, 10),\n  }\n}\n\nfunction matchesPrefix(id: string, collection: string, recordId?: string): boolean {\n  if (recordId) {\n    return id.startsWith(`${collection}:${recordId}:`)\n  }\n  return id.startsWith(`${collection}:`)\n}\n\n/** Save a history entry (a complete encrypted envelope snapshot). */\nexport async function saveHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  envelope: EncryptedEnvelope,\n): Promise<void> {\n  const id = historyId(collection, recordId, envelope._v)\n  await adapter.put(vault, HISTORY_COLLECTION, id, envelope)\n}\n\n/** Get history entries for a record, sorted newest-first. */\nexport async function getHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  options?: HistoryOptions,\n): Promise<EncryptedEnvelope[]> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => matchesPrefix(id, collection, recordId))\n    .sort()\n    .reverse() // newest first\n\n  const entries: EncryptedEnvelope[] = []\n\n  for (const id of matchingIds) {\n    const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!envelope) continue\n\n    // Apply time filters\n    if (options?.from && envelope._ts < options.from) continue\n    if (options?.to && envelope._ts > options.to) continue\n\n    entries.push(envelope)\n\n    if (options?.limit && entries.length >= options.limit) break\n  }\n\n  return entries\n}\n\n/** Get a specific version's envelope from history. */\nexport async function getVersionEnvelope(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  version: number,\n): Promise<EncryptedEnvelope | null> {\n  const id = historyId(collection, recordId, version)\n  return adapter.get(vault, HISTORY_COLLECTION, id)\n}\n\n/** Prune history entries. Returns the number of entries deleted. */\nexport async function pruneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string | undefined,\n  options: PruneOptions,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => recordId ? matchesPrefix(id, collection, recordId) : matchesPrefix(id, collection))\n    .sort()\n\n  let toDelete: string[] = []\n\n  if (options.keepVersions !== undefined) {\n    // Keep only the N most recent, delete the rest\n    const keep = options.keepVersions\n    if (matchingIds.length > keep) {\n      toDelete = matchingIds.slice(0, matchingIds.length - keep)\n    }\n  }\n\n  if (options.beforeDate) {\n    // Delete entries older than the specified date\n    for (const id of matchingIds) {\n      if (toDelete.includes(id)) continue\n      const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n      if (envelope && envelope._ts < options.beforeDate) {\n        toDelete.push(id)\n      }\n    }\n  }\n\n  // Deduplicate\n  const uniqueDeletes = [...new Set(toDelete)]\n\n  for (const id of uniqueDeletes) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return uniqueDeletes.length\n}\n\n/** Clear all history for a vault, optionally scoped to a collection or record. */\nexport async function clearHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection?: string,\n  recordId?: string,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  let toDelete: string[]\n\n  if (collection && recordId) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection, recordId))\n  } else if (collection) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection))\n  } else {\n    toDelete = allIds\n  }\n\n  for (const id of toDelete) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return toDelete.length\n}\n\n/**\n * Crypto-shred every `_history` version of a record. Each non-tombstone\n * history envelope is OVERWRITTEN in place with a tombstone\n * `{ _noydb, _v, _ts: now, _by: actor, _iv: '', _data: '' }` — dropping\n * `_iv`/`_data`/`_cek`/`_det`, so the prior ciphertext (and the wrapped CEK\n * that could decrypt it) is gone everywhere this store reaches. The version\n * counter (`_v`) is preserved so the audit trail still shows \"N versions\n * existed and were erased.\"\n *\n * Overwrite — NOT delete — so the history key itself survives as proof the\n * version existed. Already-tombstoned versions (re-run / idempotent forget)\n * are left untouched and not counted.\n *\n * Returns the number of history versions newly tombstoned.\n */\nexport async function tombstoneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  actor: string,\n  encrypted: boolean,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  const now = new Date().toISOString()\n  let count = 0\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (no body and no wrapped CEK)? Skip — idempotent.\n    if (isTombstone(env, encrypted)) continue\n    const tombstone: EncryptedEnvelope = buildRecordEnvelope(\n      { collection: HISTORY_COLLECTION, id },\n      { version: env._v, ts: now, iv: '', data: '', ...(actor ? { by: actor } : {}) },\n    )\n    await adapter.put(vault, HISTORY_COLLECTION, id, tombstone)\n    count++\n  }\n  return count\n}\n\n/**\n * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`.\n * Mirrors what `rewrapBodyToDek` already does for a record's LIVE body on a\n * tier move (elevate/demote/putAtTier) — each `_history` envelope also\n * carries its own `_cek`, wrapped under the collection's tier-0 DEK at write\n * time (`record-codec.ts`), so a tier move that rewraps only the live\n * envelope leaves prior versions decryptable at rest under the tier the\n * record left. This is defense-in-depth *beneath* the read-gate\n * (`history()`/`getVersion()` already return empty for an elevated record;\n * this protects the ciphertext even if that gate is bypassed).\n *\n * Rewraps content in place — unlike `tombstoneHistory`, it does NOT blank\n * `_iv`/`_data`/`_cek` — so a subsequent `demote()` restores tier-0\n * readability. Tombstone-shaped entries (a forgotten/shredded version —\n * blanked `_data`, no `_cek`) are skipped: there is no key material left to\n * rewrap.\n *\n * **Legacy fallback.** A snapshot written before this fix stays wrapped\n * under the tier-0 DEK even after its live record has since moved tiers, so\n * a rewrap attempted with a tier-N `fromDek` fails to unwrap/decrypt. When\n * the caller supplies `tier0Dek`, a failed rewrap is retried once with\n * `tier0Dek` as `fromDek` (the only other key a pre-fix snapshot can be\n * wrapped under — history is written only by tier-0 `put()`). The output is\n * always wrapped under `toDek` regardless of which `fromDek` succeeded. A\n * rewrap that fails under BOTH keys re-throws — that is real corruption, not\n * a tier mismatch, and must not be swallowed.\n *\n * **Crash-atomicity / idempotency (#712 whole-branch-fix-3).** This loop has\n * no transaction around it: a crash after some entries have been rewritten\n * under `toDek` but before the loop finishes leaves the record's history\n * split across two keys. A retry of the SAME call must not re-fail on the\n * entries that already made it — so each entry is probed with\n * `isRewrappedUnder(env, toDek)` FIRST; a match means it's already at the\n * target key and is skipped (put nothing). This makes same-target retries\n * and demote-after-crash fully self-healing. It does NOT close every crash\n * window: a crash that lands SOME entries under `toDek` while the record's\n * NEXT move target differs from this call's `toDek` (an intermediate-tier\n * crash — e.g. elevate 0→1 crashes mid-loop, then the record is moved 1→2)\n * still finds those entries unreadable under either `fromDek` or the\n * tier-0 fallback, since `toDek` is a third key the next call never probes\n * for. That residual window is an accepted, fail-closed limitation (see\n * `.changeset/history-at-rest.md` and the design doc) — availability is\n * lost, never confidentiality.\n */\nexport async function rewrapHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n  tier0Dek?: EnclaveKey,\n): Promise<void> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (forgotten/shredded version)? Nothing to rewrap.\n    if (isTombstoneShape(env)) continue\n    // #712/whole-branch-fix-3: toDek-first idempotency skip — already at the\n    // target key (a same-target retry, or demote-after-crash landing back on\n    // a key it already reached)? Nothing to do; put nothing.\n    if (await isRewrappedUnder(env, toDek)) continue\n\n    let next: EncryptedEnvelope\n    try {\n      next = await rewrapEnvelope(env, fromDek, toDek)\n    } catch (err) {\n      if (!tier0Dek) throw err\n      // Legacy fallback: retry once under the tier-0 DEK. A failure here is\n      // real corruption, not a tier mismatch — let it propagate.\n      next = await rewrapEnvelope(env, tier0Dek, toDek)\n    }\n\n    await adapter.put(vault, HISTORY_COLLECTION, id, next)\n  }\n}\n","/**\n * Time-machine queries — point-in-time reads reconstructed from the\n * existing history + ledger infrastructure.\n *\n * ## Usage\n *\n * ```ts\n * const vault = await db.openVault('acme', { secret })\n * const q1End = vault.at('2026-03-31T23:59:59Z')\n * const invoice = await q1End.collection<Invoice>('invoices').get('inv-001')\n * // → the record as it stood at the close of Q1 2026\n * ```\n *\n * ## How it works\n *\n * Every write path already fans out into two persistence lanes:\n *\n * 1. `saveHistory(...)` persists a **full encrypted envelope snapshot**\n *    per version under the `_history` collection (one envelope per\n *    version, keyed by `{collection}:{id}:{paddedVersion}`). Each\n *    envelope carries its own `_ts` (the write timestamp).\n * 2. `ledger.append(...)` appends a hash-chained audit entry that\n *    records the `op` (put / delete), `version`, and `ts`.\n *\n * Reconstruction at a target timestamp T is therefore:\n *\n * - Find the newest history envelope for `(collection, id)` whose\n *   `_ts ≤ T` — that's the state the record was in at T.\n * - Check the ledger for any `op: 'delete'` entry for the same\n *   `(collection, id)` with `entry.ts` in `(latestEnvelope._ts, T]` —\n *   if present, the record was deleted before T, so return `null`.\n * - Decrypt the surviving envelope with the current collection DEK\n *   (DEKs are per-collection but stable across versions — the same\n *   key encrypts v1 and v15 of a record).\n *\n * No delta replay. The existing `history.ts` module already stores\n * complete snapshots; we just pick the right one.\n *\n * ## Read-only contract\n *\n * Every write method on `CollectionInstant` throws\n * {@link ReadOnlyAtInstantError}. A historical view is a *read*\n * surface — mutating the past would require either a branch/shadow\n * mechanism (tracked under shadow vaults) or a rewrite of\n * history, which breaks the ledger's tamper-evidence guarantee.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport type { LedgerStore } from './ledger/store.js'\nimport { getHistory } from './history.js'\nimport { openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { ReadOnlyAtInstantError } from '../../kernel/errors.js'\nimport { liveRecordIsElevated } from '../../kernel/tier-visibility.js'\n\n/**\n * Narrow view of a {@link Vault}'s internals that\n * {@link VaultInstant} needs. Passed in by `Vault.at()` rather than\n * constructed here so all crypto + adapter access stays inside the\n * Vault class.\n *\n * Not exported from the public barrel — consumers should get a\n * `VaultInstant` via `vault.at(ts)`, never by constructing one\n * directly.\n */\nexport interface VaultEngine {\n  readonly adapter: NoydbStore\n  /** Vault name (the compartment). */\n  readonly name: string\n  /**\n   * `true` when the vault was opened with a secret (the normal\n   * case). `false` in plaintext-mode vaults (`encrypt: false`) — in\n   * that case `envelope._data` is raw JSON and we skip the DEK lookup.\n   */\n  readonly encrypted: boolean\n  /**\n   * Resolves the DEK used to decrypt a given collection's envelopes.\n   * Not called when `encrypted` is false.\n   */\n  getDEK(collection: string): Promise<EnclaveKey>\n  /**\n   * Lazily-initialised ledger. We consult it to detect deletes that\n   * happened between the latest history snapshot and the target\n   * timestamp. `null` when history is disabled for this vault — in\n   * that case time-machine reads fall back to history-only\n   * reconstruction (which may miss deletes).\n   */\n  getLedger(): LedgerStore | null\n}\n\n/**\n * A vault at a fixed instant. Produced by `vault.at(timestamp)`.\n * Carries no session state of its own — every read is a fresh\n * lookup through the vault's adapter.\n *\n * Cheap to construct; safe to throw away. Create one per query.\n */\nexport class VaultInstant {\n  constructor(\n    private readonly engine: VaultEngine,\n    /** Fully-resolved target timestamp (ISO-8601 UTC). */\n    public readonly timestamp: string,\n  ) {}\n\n  /** Get a point-in-time view of a collection. */\n  collection<T = unknown>(name: string): CollectionInstant<T> {\n    return new CollectionInstant<T>(this.engine, this.timestamp, name)\n  }\n}\n\n/**\n * A read-only collection view anchored to a past instant.\n *\n * Every write method throws {@link ReadOnlyAtInstantError} — see the\n * module docstring for why. The read surface is intentionally smaller\n * than the live {@link Collection}: `get` and `list` cover the\n * \"what did the books look like on date X\" use case without pulling\n * in the full query DSL / joins / aggregates at this stage. Follow-up\n * work tracked under.\n */\nexport class CollectionInstant<T = unknown> {\n  constructor(\n    private readonly engine: VaultEngine,\n    private readonly targetTs: string,\n    public readonly name: string,\n  ) {}\n\n  /**\n   * Return the record as it existed at the target timestamp, or\n   * `null` if the record had not been created yet or had already been\n   * deleted by then.\n   *\n   * Gated on the LIVE record's current tier — #730, mirroring the #712\n   * read-gate `history()`/`getVersion()` already apply: an elevated record\n   * is invisible through the whole time-machine surface, not just a\n   * decrypt failure. See {@link resolveVisibleEnvelope}.\n   *\n   * Decrypts through {@link openEnvelopeJson}, the `_cek`-aware envelope\n   * body opener — a snapshot from a `perRecordKeys` collection is encrypted\n   * under its own per-record CEK (wrapped in `_cek`), not the collection\n   * DEK directly.\n   */\n  async get(id: string): Promise<T | null> {\n    const envelope = await this.resolveVisibleEnvelope(id)\n    if (!envelope) return null\n    const plaintext = this.engine.encrypted\n      ? await openEnvelopeJson(envelope, await this.engine.getDEK(this.name))\n      : envelope._data\n    return JSON.parse(plaintext) as T\n  }\n\n  /**\n   * IDs of records that existed (had at least one `put` and were not\n   * subsequently deleted) at the target timestamp.\n   *\n   * Implemented as a linear scan over history + ledger. Performance\n   * is bounded by total history size (not live-vault size), so the\n   * memory-first vault-scale cap (1K–50K records × average history\n   * depth) still applies.\n   */\n  async list(): Promise<string[]> {\n    const historyIds = await collectHistoryIds(this.engine.adapter, this.engine.name, this.name)\n    const liveIds = await this.engine.adapter.list(this.engine.name, this.name)\n    const candidateIds = new Set<string>([...historyIds, ...liveIds])\n    const alive: string[] = []\n    for (const id of candidateIds) {\n      const env = await this.resolveVisibleEnvelope(id)\n      if (env) alive.push(id)\n    }\n    return alive.sort()\n  }\n\n  // ── write guards ───────────────────────────────────────────────────\n\n  async put(_id: string, _record: T): Promise<never> {\n    throw new ReadOnlyAtInstantError('put', this.targetTs)\n  }\n  async delete(_id: string): Promise<never> {\n    throw new ReadOnlyAtInstantError('delete', this.targetTs)\n  }\n  async update(_id: string, _patch: Partial<T>): Promise<never> {\n    throw new ReadOnlyAtInstantError('update', this.targetTs)\n  }\n\n  // ── internals ─────────────────────────────────────────────────────\n\n  /**\n   * {@link resolveEnvelope}, additionally gated on the record's LIVE\n   * (current, not historical) tier — #730. Mirrors the #712 read-gate\n   * `history()`/`getVersion()` apply: history snapshots keep their\n   * tier-0-wrapped CEKs and carry no `_tier` of their own, so an elevated\n   * record's prior versions would otherwise stay tier-0-decryptable here.\n   * `null` for a resolved envelope carrying its own `_tier > 0` (a\n   * tier-aware snapshot reached some other way) or whose LIVE record is\n   * currently elevated — both `get()` and `list()` route through this so\n   * the invisibility law holds on the whole time-machine read surface, not\n   * just a decrypt failure.\n   */\n  private async resolveVisibleEnvelope(id: string): Promise<EncryptedEnvelope | null> {\n    const envelope = await this.resolveEnvelope(id)\n    if (!envelope || (envelope._tier ?? 0) > 0) return null\n    if (await liveRecordIsElevated(this.engine.adapter, this.engine.name, this.name, id)) return null\n    return envelope\n  }\n\n  /**\n   * Return the envelope that represents the record's state at\n   * `targetTs`, accounting for deletes. `null` if the record didn't\n   * exist at that instant.\n   *\n   * ## Why we use the ledger as the authoritative timeline\n   *\n   * The per-version history snapshots saved by `saveHistory()` do\n   * carry a `_ts` field, but that timestamp is the moment the\n   * snapshot was *captured* (i.e. the instant right before the\n   * subsequent overwrite), not the original write time. The ledger,\n   * by contrast, records `ts` at the moment of each `put` / `delete`\n   * — it's the only source that tracks the real timeline. So:\n   *\n   *   1. Walk the ledger; find the latest entry for `(collection, id)`\n   *      with `ts ≤ targetTs`.\n   *   2. If that entry is a `delete`, the record was gone at the\n   *      target instant — return null.\n   *   3. Otherwise it's a `put` with a specific `version`. Load the\n   *      envelope for that version from history, falling back to the\n   *      live collection for the most recent version.\n   *\n   * ## Fallback when the ledger is disabled\n   *\n   * If the vault has history disabled, `getLedger()` returns null and\n   * we fall back to comparing envelope `_ts` fields. This is\n   * approximate and gets the *last write* right but may confuse the\n   * intermediate versions; adopters needing accurate time-machine\n   * reads should leave history enabled.\n   */\n  private async resolveEnvelope(id: string): Promise<EncryptedEnvelope | null> {\n    const ledger = this.engine.getLedger()\n    if (ledger) {\n      return this.resolveViaLedger(id, ledger)\n    }\n    return this.resolveViaEnvelopeTs(id)\n  }\n\n  private async resolveViaLedger(id: string, ledger: LedgerStore): Promise<EncryptedEnvelope | null> {\n    const entries = await ledger.entries()\n    // Entries are already ordered by index which is the mutation order.\n    let latest: { op: 'put' | 'delete'; version: number } | null = null\n    for (const e of entries) {\n      if (e.collection !== this.name || e.id !== id) continue\n      if (e.ts > this.targetTs) break   // entries are time-ordered by index\n      // `amendment` + `lifecycle` entries are audit-only summaries — they\n      // carry no (collection, id) tuple of their own and would never match\n      // the filter above. The narrow here is a type guard, not a runtime\n      // skip.\n      // `forget` is a subject-erasure summary with empty (collection, id) —\n      // never matches the filter above; the narrow is a type guard.\n      if (e.op === 'amendment' || e.op === 'lifecycle' || e.op === 'forget') continue\n      // `migration` is a record rewrite (cutover) — resolve it like a put.\n      latest = { op: e.op === 'migration' ? 'put' : e.op, version: e.version }\n    }\n    if (!latest) return null\n    if (latest.op === 'delete') return null\n    return this.loadVersion(id, latest.version)\n  }\n\n  private async resolveViaEnvelopeTs(id: string): Promise<EncryptedEnvelope | null> {\n    const history = await getHistory(\n      this.engine.adapter, this.engine.name, this.name, id,\n    )\n    const live = await this.engine.adapter.get(this.engine.name, this.name, id)\n    const byVersion = new Map<number, EncryptedEnvelope>()\n    for (const e of history) byVersion.set(e._v, e)\n    if (live) byVersion.set(live._v, live)\n    const sorted = [...byVersion.values()].sort((a, b) =>\n      a._ts < b._ts ? 1 : a._ts > b._ts ? -1 : 0,\n    )\n    return sorted.find((e) => e._ts <= this.targetTs) ?? null\n  }\n\n  /**\n   * Fetch the envelope for a specific version. The live record (most\n   * recent put) lives in the main collection; prior versions live in\n   * `_history`. We check live first because the common case after a\n   * delete is that we're trying to load the last-live version from\n   * history, and skipping live for the current-version case avoids a\n   * redundant lookup.\n   */\n  private async loadVersion(id: string, version: number): Promise<EncryptedEnvelope | null> {\n    const live = await this.engine.adapter.get(this.engine.name, this.name, id)\n    if (live && live._v === version) return live\n\n    // Direct lookup by (collection, id, version) — avoids scanning all history.\n    const historyId = `${this.name}:${id}:${String(version).padStart(10, '0')}`\n    return await this.engine.adapter.get(this.engine.name, '_history', historyId)\n  }\n}\n\n/**\n * Scan the `_history` collection once and collect every distinct\n * `recordId` for the given collection. History keys follow the\n * shape `<collection>:<recordId>:<paddedVersion>`; we split on the\n * last two colons (delimiter-safe because `paddedVersion` is\n * exactly 10 digits).\n */\nasync function collectHistoryIds(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n): Promise<string[]> {\n  const all = await adapter.list(vault, '_history')\n  const prefix = `${collection}:`\n  const seen = new Set<string>()\n  for (const key of all) {\n    if (!key.startsWith(prefix)) continue\n    const lastColon = key.lastIndexOf(':')\n    if (lastColon <= prefix.length) continue\n    const middle = key.slice(prefix.length, lastColon)\n    seen.add(middle)\n  }\n  return [...seen]\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWA,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AAEpB,SAAS,UAAU,YAAoB,UAAkB,SAAyB;AAChF,SAAO,GAAG,UAAU,IAAI,QAAQ,IAAI,OAAO,OAAO,EAAE,SAAS,aAAa,GAAG,CAAC;AAChF;AAkBA,SAAS,cAAc,IAAY,YAAoB,UAA4B;AACjF,MAAI,UAAU;AACZ,WAAO,GAAG,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG;AAAA,EACnD;AACA,SAAO,GAAG,WAAW,GAAG,UAAU,GAAG;AACvC;AAGA,eAAsB,YACpB,SACA,OACA,YACA,UACA,UACe;AACf,QAAM,KAAK,UAAU,YAAY,UAAU,SAAS,EAAE;AACtD,QAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,QAAQ;AAC3D;AAGA,eAAsB,WACpB,SACA,OACA,YACA,UACA,SAC8B;AAC9B,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC,EACpD,KAAK,EACL,QAAQ;AAEX,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,aAAa;AAC5B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,QAAI,CAAC,SAAU;AAGf,QAAI,SAAS,QAAQ,SAAS,MAAM,QAAQ,KAAM;AAClD,QAAI,SAAS,MAAM,SAAS,MAAM,QAAQ,GAAI;AAE9C,YAAQ,KAAK,QAAQ;AAErB,QAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,MAAO;AAAA,EACzD;AAEA,SAAO;AACT;AAGA,eAAsB,mBACpB,SACA,OACA,YACA,UACA,SACmC;AACnC,QAAM,KAAK,UAAU,YAAY,UAAU,OAAO;AAClD,SAAO,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAClD;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACA,SACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,WAAW,cAAc,IAAI,YAAY,QAAQ,IAAI,cAAc,IAAI,UAAU,CAAC,EAC/F,KAAK;AAER,MAAI,WAAqB,CAAC;AAE1B,MAAI,QAAQ,iBAAiB,QAAW;AAEtC,UAAM,OAAO,QAAQ;AACrB,QAAI,YAAY,SAAS,MAAM;AAC7B,iBAAW,YAAY,MAAM,GAAG,YAAY,SAAS,IAAI;AAAA,IAC3D;AAAA,EACF;AAEA,MAAI,QAAQ,YAAY;AAEtB,eAAW,MAAM,aAAa;AAC5B,UAAI,SAAS,SAAS,EAAE,EAAG;AAC3B,YAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,UAAI,YAAY,SAAS,MAAM,QAAQ,YAAY;AACjD,iBAAS,KAAK,EAAE;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAE3C,aAAW,MAAM,eAAe;AAC9B,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,cAAc;AACvB;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,MAAI;AAEJ,MAAI,cAAc,UAAU;AAC1B,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAAA,EACxE,WAAW,YAAY;AACrB,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,UAAU,CAAC;AAAA,EAC9D,OAAO;AACL,eAAW;AAAA,EACb;AAEA,aAAW,MAAM,UAAU;AACzB,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,SAAS;AAClB;AAiBA,eAAsB,iBACpB,SACA,OACA,YACA,UACA,OACA,WACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,MAAI,QAAQ;AACZ,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,YAAY,KAAK,SAAS,EAAG;AACjC,UAAM,YAA+B;AAAA,MACnC,EAAE,YAAY,oBAAoB,GAAG;AAAA,MACrC,EAAE,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC,EAAG;AAAA,IAChF;AACA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,SAAS;AAC1D;AAAA,EACF;AACA,SAAO;AACT;AA8CA,eAAsB,cACpB,SACA,OACA,YACA,UACA,SACA,OACA,UACe;AACf,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,iBAAiB,GAAG,EAAG;AAI3B,QAAI,MAAM,iBAAiB,KAAK,KAAK,EAAG;AAExC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,eAAe,KAAK,SAAS,KAAK;AAAA,IACjD,SAAS,KAAK;AACZ,UAAI,CAAC,SAAU,OAAM;AAGrB,aAAO,MAAM,eAAe,KAAK,UAAU,KAAK;AAAA,IAClD;AAEA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,IAAI;AAAA,EACvD;AACF;;;AC9LO,IAAM,eAAN,MAAmB;AAAA,EACxB,YACmB,QAED,WAChB;AAHiB;AAED;AAAA,EACf;AAAA,EAHgB;AAAA,EAED;AAAA;AAAA,EAIlB,WAAwB,MAAoC;AAC1D,WAAO,IAAI,kBAAqB,KAAK,QAAQ,KAAK,WAAW,IAAI;AAAA,EACnE;AACF;AAYO,IAAM,oBAAN,MAAqC;AAAA,EAC1C,YACmB,QACA,UACD,MAChB;AAHiB;AACA;AACD;AAAA,EACf;AAAA,EAHgB;AAAA,EACA;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlB,MAAM,IAAI,IAA+B;AACvC,UAAM,WAAW,MAAM,KAAK,uBAAuB,EAAE;AACrD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,YAAY,KAAK,OAAO,YAC1B,MAAM,iBAAiB,UAAU,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,IACpE,SAAS;AACb,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAA0B;AAC9B,UAAM,aAAa,MAAM,kBAAkB,KAAK,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,IAAI;AAC3F,UAAM,UAAU,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK,OAAO,MAAM,KAAK,IAAI;AAC1E,UAAM,eAAe,oBAAI,IAAY,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC;AAChE,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,cAAc;AAC7B,YAAM,MAAM,MAAM,KAAK,uBAAuB,EAAE;AAChD,UAAI,IAAK,OAAM,KAAK,EAAE;AAAA,IACxB;AACA,WAAO,MAAM,KAAK;AAAA,EACpB;AAAA;AAAA,EAIA,MAAM,IAAI,KAAa,SAA4B;AACjD,UAAM,IAAI,uBAAuB,OAAO,KAAK,QAAQ;AAAA,EACvD;AAAA,EACA,MAAM,OAAO,KAA6B;AACxC,UAAM,IAAI,uBAAuB,UAAU,KAAK,QAAQ;AAAA,EAC1D;AAAA,EACA,MAAM,OAAO,KAAa,QAAoC;AAC5D,UAAM,IAAI,uBAAuB,UAAU,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAc,uBAAuB,IAA+C;AAClF,UAAM,WAAW,MAAM,KAAK,gBAAgB,EAAE;AAC9C,QAAI,CAAC,aAAa,SAAS,SAAS,KAAK,EAAG,QAAO;AACnD,QAAI,MAAM,qBAAqB,KAAK,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE,EAAG,QAAO;AAC7F,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgCA,MAAc,gBAAgB,IAA+C;AAC3E,UAAM,SAAS,KAAK,OAAO,UAAU;AACrC,QAAI,QAAQ;AACV,aAAO,KAAK,iBAAiB,IAAI,MAAM;AAAA,IACzC;AACA,WAAO,KAAK,qBAAqB,EAAE;AAAA,EACrC;AAAA,EAEA,MAAc,iBAAiB,IAAY,QAAwD;AACjG,UAAM,UAAU,MAAM,OAAO,QAAQ;AAErC,QAAI,SAA2D;AAC/D,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,eAAe,KAAK,QAAQ,EAAE,OAAO,GAAI;AAC/C,UAAI,EAAE,KAAK,KAAK,SAAU;AAO1B,UAAI,EAAE,OAAO,eAAe,EAAE,OAAO,eAAe,EAAE,OAAO,SAAU;AAEvE,eAAS,EAAE,IAAI,EAAE,OAAO,cAAc,QAAQ,EAAE,IAAI,SAAS,EAAE,QAAQ;AAAA,IACzE;AACA,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,WAAO,KAAK,YAAY,IAAI,OAAO,OAAO;AAAA,EAC5C;AAAA,EAEA,MAAc,qBAAqB,IAA+C;AAChF,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK,OAAO;AAAA,MAAS,KAAK,OAAO;AAAA,MAAM,KAAK;AAAA,MAAM;AAAA,IACpD;AACA,UAAM,OAAO,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE;AAC1E,UAAM,YAAY,oBAAI,IAA+B;AACrD,eAAW,KAAK,QAAS,WAAU,IAAI,EAAE,IAAI,CAAC;AAC9C,QAAI,KAAM,WAAU,IAAI,KAAK,IAAI,IAAI;AACrC,UAAM,SAAS,CAAC,GAAG,UAAU,OAAO,CAAC,EAAE;AAAA,MAAK,CAAC,GAAG,MAC9C,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK;AAAA,IAC3C;AACA,WAAO,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,KAAK;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,YAAY,IAAY,SAAoD;AACxF,UAAM,OAAO,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE;AAC1E,QAAI,QAAQ,KAAK,OAAO,QAAS,QAAO;AAGxC,UAAMA,aAAY,GAAG,KAAK,IAAI,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;AACzE,WAAO,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,YAAYA,UAAS;AAAA,EAC9E;AACF;AASA,eAAe,kBACb,SACA,OACA,YACmB;AACnB,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,QAAM,SAAS,GAAG,UAAU;AAC5B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,OAAO,KAAK;AACrB,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAC7B,UAAM,YAAY,IAAI,YAAY,GAAG;AACrC,QAAI,aAAa,OAAO,OAAQ;AAChC,UAAM,SAAS,IAAI,MAAM,OAAO,QAAQ,SAAS;AACjD,SAAK,IAAI,MAAM;AAAA,EACjB;AACA,SAAO,CAAC,GAAG,IAAI;AACjB;","names":["historyId"]}

package/dist/{chunk-T7XUDZ7N.js → chunk-THUITYH7.js}

@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-5ROD2DCQ.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-6HG5FP3I.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -1058,4 +1058,4 @@ export {
   readPodRedirect,
   readPod
 };
-//# sourceMappingURL=chunk-T7XUDZ7N.js.map
+//# sourceMappingURL=chunk-THUITYH7.js.map

package/dist/{chunk-TEJILTMY.js → chunk-TTAND7MR.js}

@@ -4,10 +4,10 @@ import {
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-62KVBIBU.js";
+} from "./chunk-53PWELSC.js";
 import {
   isDeleteMarker
-} from "./chunk-P3AFV6EA.js";
+} from "./chunk-6E2JZRBD.js";
 import {
   PeriodClosedError,
   ValidationError
@@ -124,7 +124,7 @@ function validatePeriodName(name, existing, partition) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-HLINHILR.js");
+  const { envelopePayloadHash } = await import("./ledger-6IHXJHDD.js");
   await ledger.append({
     op: "put",
     collection,
@@ -198,4 +198,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-TEJILTMY.js.map
+//# sourceMappingURL=chunk-TTAND7MR.js.map

package/dist/{chunk-HAN2PHLM.js → chunk-TWPTRJEU.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-T7XUDZ7N.js";
+} from "./chunk-THUITYH7.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-HAN2PHLM.js.map
+//# sourceMappingURL=chunk-TWPTRJEU.js.map

package/dist/{chunk-WVCOS4XA.js → chunk-TY6N3PAC.js}

@@ -1,7 +1,7 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-HAN2PHLM.js";
+} from "./chunk-TWPTRJEU.js";
 import {
   sha256Hex
 } from "./chunk-QTDAPDDV.js";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-WVCOS4XA.js.map
+//# sourceMappingURL=chunk-TY6N3PAC.js.map

package/dist/{chunk-5LKPMDBC.js → chunk-UVFO25FJ.js}

@@ -5,11 +5,11 @@ import {
 import {
   applyRewrappedBody,
   rewrapBodyToDek
-} from "./chunk-PWJSO7HH.js";
+} from "./chunk-LTVETWDH.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-P3AFV6EA.js";
+} from "./chunk-6E2JZRBD.js";
 import {
   decrypt,
   encrypt,
@@ -378,4 +378,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-5LKPMDBC.js.map
+//# sourceMappingURL=chunk-UVFO25FJ.js.map

package/dist/{chunk-KIZOCPHS.js → chunk-VUUUIKRG.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   openEnvelopeJson
-} from "./chunk-PWJSO7HH.js";
+} from "./chunk-LTVETWDH.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
@@ -75,4 +75,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-KIZOCPHS.js.map
+//# sourceMappingURL=chunk-VUUUIKRG.js.map

package/dist/{chunk-U26JILS3.js → chunk-WMZQCXZ5.js}

@@ -7,15 +7,15 @@ import {
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-FINIMZ55.js";
+} from "./chunk-A3WHDOWI.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-62KVBIBU.js";
+} from "./chunk-53PWELSC.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-PWJSO7HH.js";
+} from "./chunk-LTVETWDH.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-SFY6NT7D.js";
@@ -88,4 +88,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-U26JILS3.js.map
+//# sourceMappingURL=chunk-WMZQCXZ5.js.map

package/dist/{chunk-RLK57SMS.js → chunk-YX6J3Z3Z.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-PE6R44GS.js";
+} from "./chunk-IQGIPRSE.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-RLK57SMS.js.map
+//# sourceMappingURL=chunk-YX6J3Z3Z.js.map

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-CJ4KXDD4.js";
+} from "../chunk-CZV57HHC.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,

package/dist/{classified-marker-BCYBGITH.js → classified-marker-L7LXKS6Q.js}

@@ -13,11 +13,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-OMH3WVVL.js");
+  const { persistClassifiedMarker } = await import("./register-XHOOX37G.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-EWT5HIX5.js");
+  const { loadPersistedSchema } = await import("./storage-N3IMFNGS.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -25,4 +25,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-BCYBGITH.js.map
+//# sourceMappingURL=classified-marker-L7LXKS6Q.js.map

package/dist/{collection-facade-YCJHWX64.js → collection-facade-KN3UFKZ4.js}

@@ -10,17 +10,17 @@ import {
   similarTo,
   syncTierSearch,
   warmIndex
-} from "./chunk-X24QHSG5.js";
-import "./chunk-KNAZGJFG.js";
+} from "./chunk-343FH4S5.js";
+import "./chunk-4JDTLWUZ.js";
 import "./chunk-AURFOK3D.js";
-import "./chunk-PJ5TGJ7U.js";
-import "./chunk-PE6R44GS.js";
-import "./chunk-SZZEDEIU.js";
+import "./chunk-FZ2SSI5R.js";
+import "./chunk-IQGIPRSE.js";
+import "./chunk-7LLKPODL.js";
 import "./chunk-RVTOCAHQ.js";
 import "./chunk-AMKCY454.js";
-import "./chunk-62KVBIBU.js";
-import "./chunk-PWJSO7HH.js";
-import "./chunk-P3AFV6EA.js";
+import "./chunk-53PWELSC.js";
+import "./chunk-LTVETWDH.js";
+import "./chunk-6E2JZRBD.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -42,4 +42,4 @@ export {
   syncTierSearch,
   warmIndex
 };
-//# sourceMappingURL=collection-facade-YCJHWX64.js.map
+//# sourceMappingURL=collection-facade-KN3UFKZ4.js.map

package/dist/consent/index.js

@@ -2,13 +2,13 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-KIZOCPHS.js";
+} from "../chunk-VUUUIKRG.js";
 import {
   NO_CONSENT
 } from "../chunk-PEOZ34EM.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-PWJSO7HH.js";
-import "../chunk-P3AFV6EA.js";
+import "../chunk-LTVETWDH.js";
+import "../chunk-6E2JZRBD.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";

package/dist/custody/index.js

@@ -2,11 +2,11 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-LAVPHX2V.js";
-import "../chunk-RERAMZK5.js";
-import "../chunk-PNEV2TBR.js";
-import "../chunk-PWJSO7HH.js";
-import "../chunk-P3AFV6EA.js";
+} from "../chunk-IGE6XWKK.js";
+import "../chunk-LJDW6LQJ.js";
+import "../chunk-PZLIA5R3.js";
+import "../chunk-LTVETWDH.js";
+import "../chunk-6E2JZRBD.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";

package/dist/{dead-filter-5ROD2DCQ.js → dead-filter-6HG5FP3I.js}

@@ -5,7 +5,7 @@ import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-EWT5HIX5.js");
+  const { loadPersistedSchema } = await import("./storage-N3IMFNGS.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +25,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-5ROD2DCQ.js.map
+//# sourceMappingURL=dead-filter-6HG5FP3I.js.map

package/dist/{delegation-IULC56LW.js → delegation-7EGBYBRN.js}

@@ -6,8 +6,8 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   openEnvelopeJson
-} from "./chunk-PWJSO7HH.js";
-import "./chunk-P3AFV6EA.js";
+} from "./chunk-LTVETWDH.js";
+import "./chunk-6E2JZRBD.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -104,4 +104,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-IULC56LW.js.map
+//# sourceMappingURL=delegation-7EGBYBRN.js.map

package/dist/derivations/index.js

@@ -9,8 +9,8 @@ import {
   DerivationExecutor
 } from "../chunk-YDJXGYYA.js";
 import "../chunk-YH65A6WM.js";
-import "../chunk-PWJSO7HH.js";
-import "../chunk-P3AFV6EA.js";
+import "../chunk-LTVETWDH.js";
+import "../chunk-6E2JZRBD.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";

package/dist/{derive-AP2NXZDC.js → derive-XKAYJ2OA.js}

@@ -4,8 +4,8 @@ import {
   isZodSchema
 } from "./chunk-HNOBRU24.js";
 import "./chunk-Y2NBBT6K.js";
-import "./chunk-PWJSO7HH.js";
-import "./chunk-P3AFV6EA.js";
+import "./chunk-LTVETWDH.js";
+import "./chunk-6E2JZRBD.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -19,4 +19,4 @@ export {
   isZod4Schema,
   isZodSchema
 };
-//# sourceMappingURL=derive-AP2NXZDC.js.map
+//# sourceMappingURL=derive-XKAYJ2OA.js.map

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-GWJNBTZA.js";
+} from "../chunk-4XEUSZWN.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,9 +16,9 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-PNEV2TBR.js";
-import "../chunk-PWJSO7HH.js";
-import "../chunk-P3AFV6EA.js";
+} from "../chunk-PZLIA5R3.js";
+import "../chunk-LTVETWDH.js";
+import "../chunk-6E2JZRBD.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";

package/dist/{dispatch-Z6C35BGM.js → dispatch-56T7VPGE.js}

@@ -15,7 +15,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-GD32BQQK.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-LFHRV6JH.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -24,7 +24,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-WSC6Z7SB.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-26ZJLNLG.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -44,7 +44,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-GD32BQQK.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-LFHRV6JH.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -57,7 +57,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-WSC6Z7SB.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-26ZJLNLG.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -69,4 +69,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-Z6C35BGM.js.map
+//# sourceMappingURL=dispatch-56T7VPGE.js.map

package/dist/{dispatch-4KKOMKWJ.js → dispatch-BM5GNCE2.js}

@@ -4,14 +4,14 @@ import {
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-5CK7VSSK.js";
+} from "./chunk-OPGKH5RD.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-PE6R44GS.js";
-import "./chunk-SZZEDEIU.js";
+import "./chunk-IQGIPRSE.js";
+import "./chunk-7LLKPODL.js";
 import "./chunk-RVTOCAHQ.js";
-import "./chunk-62KVBIBU.js";
-import "./chunk-PWJSO7HH.js";
-import "./chunk-P3AFV6EA.js";
+import "./chunk-53PWELSC.js";
+import "./chunk-LTVETWDH.js";
+import "./chunk-6E2JZRBD.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -28,7 +28,7 @@ async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = f
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-6QGMG5MA.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-MT2OBMZB.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -134,7 +134,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
         const outputCollection = derivationSource.getCollection(outSpec.collection);
         const txCtx = derivationSource.getActiveTxContext();
         if (out.kind === "array") {
-          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-6QGMG5MA.js");
+          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-MT2OBMZB.js");
           const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
           const prevKeys = new Set(prior?.keys ?? []);
           const newKeysList = out.entries.map((e) => e.key);
@@ -191,4 +191,4 @@ export {
   dispatchArrayDerivationsOnDelete,
   dispatchDerivations
 };
-//# sourceMappingURL=dispatch-4KKOMKWJ.js.map
+//# sourceMappingURL=dispatch-BM5GNCE2.js.map

package/dist/{enclave-KJID436X.js → enclave-KDLGVX5Z.js}

@@ -23,14 +23,15 @@ import {
   sealRecordToHost,
   verifyBrokerProof,
   writeEnvelopeBody
-} from "./chunk-PWJSO7HH.js";
+} from "./chunk-LTVETWDH.js";
 import {
   buildDeleteMarker,
+  buildRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-P3AFV6EA.js";
+} from "./chunk-6E2JZRBD.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
@@ -87,6 +88,7 @@ export {
   bufferToBase64,
   buildDeleteMarker,
   buildRecordAad,
+  buildRecordEnvelope,
   buildTombstone,
   computeBidxTarget,
   computeBrokerProof,
@@ -146,4 +148,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-KJID436X.js.map
+//# sourceMappingURL=enclave-KDLGVX5Z.js.map