@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.19

package/dist/forget/index.js

@@ -1,16 +1,16 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-D6E5N2O3.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-TENLCGYD.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
-import "../chunk-I64WQSN3.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/forget/active.ts

package/dist/guards/index.js

@@ -2,13 +2,13 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-QWNYUTI2.js";
+} from "../chunk-5EJQNA26.js";
 import {
   GuardExecutor
-} from "../chunk-RWPNRCK2.js";
+} from "../chunk-RORE2GX2.js";
 import {
   GuardRegistry
-} from "../chunk-VTTRWLOR.js";
+} from "../chunk-BP4I7IBK.js";
 import {
   ReadOnlyVaultFacade
 } from "../chunk-JK733I5V.js";
@@ -18,7 +18,7 @@ import {
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AmendmentForbiddenError,

package/dist/history/index.js

@@ -1,31 +1,31 @@
 import {
   CollectionInstant,
-  VaultInstant,
+  VaultInstant
+} from "../chunk-SA77BQ7F.js";
+import {
+  diff,
+  formatDiff
+} from "../chunk-SVLR4POP.js";
+import {
+  NO_HISTORY,
   clearHistory,
   getHistory,
   getVersionEnvelope,
+  historyIdentity,
   pruneHistory,
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-AKFNLRA2.js";
-import {
-  diff,
-  formatDiff
-} from "../chunk-SVLR4POP.js";
-import {
-  NO_HISTORY
-} from "../chunk-AFHQATY4.js";
+} from "../chunk-YOT7D63X.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-IEA3TZJE.js";
+} from "../chunk-MNUTPZRQ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "../chunk-I7FD46FF.js";
-import "../chunk-AMKCY454.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -33,22 +33,24 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-N4GAJSRQ.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-RNSC2ARR.js";
+import "../chunk-47ZFULEZ.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
-import "../chunk-I64WQSN3.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/history/active.ts
 function withHistory() {
   return {
     saveHistory,
+    historyIdentity,
     getHistoryEntries: getHistory,
     getVersionEnvelope,
     pruneHistory,
@@ -89,6 +91,7 @@ export {
   getHistory,
   getVersionEnvelope,
   hashEntry,
+  historyIdentity,
   paddedIndex,
   parseIndex,
   pruneHistory,

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-IRHOQFA7.js";
+} from "../chunk-7RCZ436O.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-FZ2SSI5R.js";
+} from "../chunk-PG6PFMDC.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-OXRPH6AR.js";
+} from "../chunk-GYUCRDAU.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-7LLKPODL.js";
-import "../chunk-RVTOCAHQ.js";
-import "../chunk-N4GAJSRQ.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-437FDIHO.js";
+import "../chunk-KDX6VEYV.js";
+import "../chunk-RNSC2ARR.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -47,7 +47,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/i18n/densify.ts

package/dist/index.d.ts

@@ -306,6 +306,22 @@ export type { SessionToken, CreateSessionResult, CreateSessionOptions, } from '.
 export { enableDevUnlock, loadDevUnlock, clearDevUnlock, isDevUnlockActive, } from './with-party/session/dev-unlock.js';
 export type { DevUnlockOptions } from './with-party/session/dev-unlock.js';
 export { isDiscriminant } from './kernel/util/discriminant.js';
+/**
+ * Record-identity AAD (#1041) — **public because a raw DEK is no longer enough
+ * to read a record.**
+ *
+ * Every record body is sealed with additional authenticated data derived from
+ * `{collection, id, _tier, _by}`, so a holder of a delegated DEK — a magic-link
+ * grantee, an `at-*` host, external tooling reading a backup — must be able to
+ * reproduce it. Without this export a delegated key opens nothing, which would
+ * silently break delegation rather than merely inconvenience it.
+ *
+ * `recordAadFor(address, envelope)` is the reader's form: it takes the address
+ * the envelope was fetched from and reads `_tier`/`_by` off the envelope
+ * itself, so callers thread two fields rather than four.
+ */
+export { recordAadFor } from './kernel/enclave/index.js';
+export type { RecordIdentity, RecordRef } from './kernel/enclave/index.js';
 export { bufferToBase64, base64ToBuffer, encryptBytes, decryptBytes } from './kernel/enclave/index.js';
 export { encryptDeterministic, decryptDeterministic } from './kernel/enclave/index.js';
 export { EnclaveNotSupportedError } from './kernel/errors.js';